eBPF专题一 | 手把手教你用eBPF诊断MySQL(含源码)

准备一台 Linux 机器，安装好 Python 和内核开发包。（注：内核开发包版本必须和内核版本一致）安装带有符号表的MySQL

//从MySQL源码中分析函数选用了mysql-server层的连接校验处理函数check_connectionstatic int check_connection(THD *thd){  ...}

#!/usr/bin/python//这个对象可以将我们的观测代码嵌入到观测点中执行from bcc import BPF

bpf_text="""#include <uapi/linux/ptrace.h>#include <linux/sched.h>
//定义结构体 data_t 保存我们每次观测到的结果struct data_t {    u32 pid;    u32 tgid;    u64 ts;    char info[40];};
//PF_PERF_OUTPUT 定义了一个叫 events 的表，观测代码可以将观测数据写入到 events 表中BPF_PERF_OUTPUT(events);
//该自定义函数用来和MySQL观察的内核函数进行绑定关联int do_check_connection(struct pt_regs *ctx) {    //获取了 MySQL 进程对应的结构体 task_struct，然后从获取了其中的 线程pid 和 用户空间进程tgid    struct task_struct *t = (struct task_struct *)bpf_get_current_task();        //初始化data用来保存观测结果    struct data_t data = {};        // create a new connection    char a[] = "hello world,create a new connection";    bpf_probe_read_kernel_str(&data.info,sizeof(data.info),a);        // process id    bpf_probe_read(&data.pid,sizeof(data.pid),&t->pid);        // thread id    bpf_probe_read(&data.tgid,sizeof(data.pid),&t->tgid);        // bpf_ktime_get_ns returns u64 number of nanoseconds. Starts at system boot time but stops during suspend.    data.ts = bpf_ktime_get_ns();        //将观测的数据提交到表中    events.perf_submit(ctx, &data, sizeof(data));
    return 0;}"""

# initialize BPF//自定义的ebpf程序b = BPF(text=bpf_text)//将ebpf观察代码中的自定义函数和MySQL的内核函数进行绑定（name为mysqld进程路径，sym为编译后的探测函数名，fn_name为绑定的ebpf自定义函数）b.attach_uprobe(name="/home/mysqld", sym="_ZL16check_connectionP3THD",fn_name='do_check_connection')

# output trace result.print("Starting to Trace MySQL server do_check_connection function")print("------------------------------------------------------------")
//定义打印的回调函数def print_event(cpu, data, size):    event = b["events"].event(data)    decoded_string = event.info.decode('utf-8')    print("%-35s, process id %-6s, thread id %-6s, sytem uptime(s) %-14s" % (decoded_string,event.tgid, event.pid,event.ts/1000000000))
//open_perf_buffer 将打印的回调函数注册到 events 表中b["events"].open_perf_buffer(print_event)while 1:    try:        b.perf_buffer_poll()    except KeyboardInterrupt:        exit()

class THD: public MDL_context_owner,           public Query_area,           public Open_tables_state {    public:    MDL_context mdl_context;    enum enum_mark_columns mark_used_columns;    unlong wat_privilege;    LEX *lex;    bool gtid_executed_warning_issued;    ...    private:    ...    LEX_CSTRING m_catalog; }