php-ebpf/main.cpp

#include <iostream>
#include <phpcpp.h>
#include <fstream>
#include "bcc_common.h"
#include "bpf_module.h"
#include "libbpf.h"
#include "BPF.h"
#include <csignal>
#include <atomic>
#include <sstream>
#include <utility>
#include <vector>
#include "table.cpp"

constexpr const char *TRACE_PIPE_PATH = "/sys/kernel/debug/tracing/trace_pipe";

// Php::out << "Value of fn: " << fnn << std::endl;

const std::vector<std::string> syscall_prefixes = {
		"sys_",
		"__x64_sys_",
		"__x32_compat_sys_",
		"__ia32_compat_sys_",
		"__arm64_sys_",
		"__s390x_sys_",
		"__s390_sys_",
		"__riscv_sys_"
};

class EbpfExtension : public Php::Base {
private:
	ebpf::BPF bpf;
	void *mod;
	Php::Object _perf_event;
	PerfEventArrayTable *_class_perf_event;

	static std::string add_prefix(const std::string &prefix, const std::string &name) {
		if (name.rfind(prefix, 0) != 0) {
			return prefix + name;
		}
		return name;
	}

	std::string fix_syscall_fnname(const std::string &name) {
		for (const auto &prefix: syscall_prefixes) {
			if (name.rfind(prefix, 0) == 0) {
				return bpf.get_syscall_fnname(name.substr(prefix.length()));
			}
		}
		return name;
	}

	void _trace_autoload() {
		size_t num_funcs = bpf.get_num_functions();
		for (size_t i = 0; i < num_funcs; i++) {
			const char *func_name = bpf.get_function_name(i);
			std::string fn_name(func_name);
			if (fn_name.rfind("kprobe__", 0) == 0) {
				std::string kernel_func = fix_syscall_fnname(fn_name.substr(8));
				bpf.attach_kprobe(kernel_func, fn_name);
			} else if (fn_name.rfind("kretprobe__", 0) == 0) {
				std::string kernel_func = fix_syscall_fnname(fn_name.substr(11));
				bpf.attach_kprobe(kernel_func, fn_name, 0, BPF_PROBE_RETURN);
			} else if (fn_name.rfind("tracepoint__", 0) == 0) {
				std::string tp_name = fn_name.substr(12);
				std::replace(tp_name.begin(), tp_name.end(), '_', ':');
				bpf.attach_tracepoint(tp_name, fn_name);
			} else if (fn_name.rfind("raw_tracepoint__", 0) == 0) {
				std::string tp_name = fn_name.substr(16);
				bpf.attach_raw_tracepoint(tp_name, fn_name);
			} else if (fn_name.rfind("kfunc__", 0) == 0) {
				fn_name = add_prefix("kfunc__", fn_name);
				attach_kfunc(fn_name);
			} else if (fn_name.rfind("kretfunc__", 0) == 0) {
				fn_name = add_prefix("kretfunc__", fn_name);
				attach_kfunc(fn_name);
			} else if (fn_name.rfind("lsm__", 0) == 0) {
				fn_name = add_prefix("lsm__", fn_name);
				attach_lsm(fn_name);
			}
		}
	}

public:
	EbpfExtension() = default;

	virtual ~EbpfExtension() = default;

	Php::Value __get(const Php::Value &name) {
		int from_attr = 1;
		auto res = get_table_cls(name, from_attr);  // 这里传递 std::vector<Php::Value>
		if (!res.isObject()) {
			return Php::Base::__get(name);
		} else {
			return res;
		}

//		printf("111111111\n");
//		if (name == "events") return _perf_event;
//
//		auto a = new PerfEventArrayTable;
//		a->getMessage();
//
	}

	void php_test(Php::Parameters &params) {
		int ty = bpf_table_type(this->mod, "counters");
		Php::out << "counters type]" << ty << std::endl;
		int ty2 = bpf_table_type(this->mod, "events");
		Php::out << "events type]" << ty2 << std::endl;
//		bpf.get_map_in_map_table<int>("").get_fd();
//		auto aaa = bpf.table<>()("counters");
//		aaa.get_value(0, reinterpret_cast<std::string &>(val));
//
//		auto control_table_hdl = bpf.get_array_table<uint64_t>("counters");
//		auto res1 = control_table_hdl.get_value(1, val);
//		Php::out<< "ok]" <<res1.ok() <<std::endl;
//		Php::out<< "msg]" << res1.msg() <<std::endl;
//		Php::out <<"val]" << val <<std::endl;
	}

	void __construct(Php::Parameters &params) {
		std::string bpf_code = params[0].stringValue();
		auto init_res = bpf.init(bpf_code);
		if (!init_res.ok()) {
			throw Php::Exception("init error: " + init_res.msg());
		}
		this->mod = (void *) bpf.get_mod();
		_trace_autoload();
	}

	ebpf::StatusTuple attach_kfunc(const std::string &kfn) {
		int probe_fd;
		auto fn = bpf.load_func(kfn, BPF_PROG_TYPE_TRACING, probe_fd);

		int res_fd = bpf_attach_kfunc(probe_fd);
		if (res_fd < 0) {
			TRY2(bpf.unload_func(kfn));
			return ebpf::StatusTuple(-1, "Unable to attach kfunc using %s",
			                         kfn.c_str());
		}
		return ebpf::StatusTuple::OK();
	}

	ebpf::StatusTuple attach_lsm(const std::string &lsm) {
		int probe_fd;
		auto fn = bpf.load_func(lsm, BPF_PROG_TYPE_LSM, probe_fd);

		int res_fd = bpf_attach_lsm(probe_fd);
		if (res_fd < 0) {
			TRY2(bpf.unload_func(lsm));
			return ebpf::StatusTuple(-1, "Unable to attach lsm using %s",
			                         lsm.c_str());
		}
		return ebpf::StatusTuple::OK();
	}

	void php_attach_kprobe(Php::Parameters &params) {
		std::string kernel_func = params[0].stringValue();
		std::string probe_func = params[1].stringValue();
		auto attach_res = bpf.attach_kprobe(kernel_func, probe_func);
		if (!attach_res.ok()) {
			throw Php::Exception("attach error: " + attach_res.msg());
		}
	}

	void php_attach_tracepoint(Php::Parameters &params) {
		std::string tp_func = params[0].stringValue();
		std::string probe_func = params[1].stringValue();
		auto attach_res = bpf.attach_tracepoint(tp_func, probe_func);
		if (!attach_res.ok()) {
			throw Php::Exception("attach error: " + attach_res.msg());
		}
	}

	void php_attach_raw_tracepoint(Php::Parameters &params) {
		std::string tp_func = params[0].stringValue();
		std::string probe_func = params[1].stringValue();
		auto attach_res = bpf.attach_raw_tracepoint(tp_func, probe_func);
		if (!attach_res.ok()) {
			throw Php::Exception("attach error: " + attach_res.msg());
		}
	}

	void php_attach_kfunc(Php::Parameters &params) {
		std::string kfunc = params[0].stringValue();
		auto attach_res = attach_kfunc(kfunc);
		if (!attach_res.ok()) {
			throw Php::Exception("attach error: " + attach_res.msg());
		}
	}

	void php_attach_lsm(Php::Parameters &params) {
		std::string kfunc = params[0].stringValue();
		auto attach_res = attach_lsm(kfunc);
		if (!attach_res.ok()) {
			throw Php::Exception("attach error: " + attach_res.msg());
		}
	}

	void php_attach_uprobe(Php::Parameters &params) {
		std::string binary_path = params[0].stringValue();
		std::string symbol = params[1].stringValue();
		std::string probe_func = params[2].stringValue();

		int64_t symbol_addr = 0, symbol_offset = 0, pid_param;
		uint32_t ref_ctr_offset = 0;
		pid_t pid = -1;

		if (params.size() > 3) {
			Php::Value options = params[3];
			symbol_addr = options.get("symbol_addr").numericValue();
			symbol_offset = options.get("symbol_offset").numericValue();
			ref_ctr_offset = options.get("ref_ctr_offset").numericValue();
			pid_param = options.get("pid").numericValue();
			if (pid_param > 0) {
				pid = static_cast<pid_t>(pid_param);
			}
		}

		auto attach_res = bpf.attach_uprobe(binary_path, symbol, probe_func, symbol_addr, BPF_PROBE_ENTRY, pid,
		                                    symbol_offset, ref_ctr_offset);
		if (!attach_res.ok()) {
			throw Php::Exception("attach error: " + attach_res.msg());
		}
	}

	void php_detach_kprobe(Php::Parameters &params) {
		std::string fn = params[0].stringValue();
		auto detach_res = bpf.detach_kprobe(fn);
		if (!detach_res.ok()) {
			throw Php::Exception("detach_kprobe error: " + detach_res.msg());
		}
	}

	void php_detach_uprobe(Php::Parameters &params) {
		std::string binary_path = params[0].stringValue();
		std::string symbol = params[1].stringValue();

		int64_t symbol_addr = 0, symbol_offset = 0, pid_param;
		pid_t pid = -1;

		if (params.size() > 2) {
			Php::Value options = params[2];
			symbol_addr = options.get("symbol_addr").numericValue();
			symbol_offset = options.get("symbol_offset").numericValue();
			pid_param = options.get("pid").numericValue();
			if (pid_param > 0) {
				pid = static_cast<pid_t>(pid_param);
			}
		}

		auto detach_res = bpf.detach_uprobe(binary_path, symbol, symbol_addr, BPF_PROBE_ENTRY, pid, symbol_offset);
		if (!detach_res.ok()) {
			throw Php::Exception("detach_kprobe error: " + detach_res.msg());
		}
	}

	[[noreturn]] static void php_trace_print() {
		std::ifstream pipe(TRACE_PIPE_PATH);
		std::string line;
		if (!pipe.is_open()) {
			throw Php::Exception("Failed to open trace_pipe");
		}

		std::cout << "Press Ctrl+C to stop..." << std::endl;
		while (true) {
			if (std::getline(pipe, line)) {
				std::cout << line << std::endl;
			}
		}
	}

	static Php::Value php_trace_fields(Php::Parameters &params) {
		std::ifstream traceFile(TRACE_PIPE_PATH);

		if (!traceFile.is_open()) {
			throw Php::Exception("Failed to open trace_pipe");
		}

		std::string line;
		while (std::getline(traceFile, line)) {
			if (line.empty()) {
				continue;
			}

			if (line.rfind("CPU:", 0) == 0) {
				continue;
			}

			std::string task = line.substr(0, 16);
			task.erase(0, task.find_first_not_of(" "));

			std::istringstream iss(line.substr(17));
			std::string pid, cpu, flags, ts, msg;
			char delim;

			if (!(iss >> pid >> delim >> cpu >> delim >> flags >> ts)) {
				continue;
			}

			size_t sym_end = iss.str().find(": ", iss.tellg());
			if (sym_end != std::string::npos) {
				msg = iss.str().substr(sym_end + 2);
			}

			Php::Array result;
			result[0] = task;
			result[1] = std::stoi(pid);
			result[2] = std::stoi(cpu.substr(1, cpu.size() - 2)); // 去掉方括号
			result[3] = flags;
			result[4] = std::stod(ts);
			result[5] = msg;
			return result;
		}
		return Php::Value();
	}

	Php::Value php_perf_event(Php::Parameters &params) {
		std::string event_name = params[0].stringValue();  // Get event_name from the parameters
		this->_class_perf_event = new PerfEventArrayTable(&this->bpf, event_name);
		return Php::Object("PerfEventArrayTable", this->_class_perf_event);
	}

	Php::Value get_table_cls(const char *table_name, int from_attr) {
		int ttype = bpf_table_type(this->mod, table_name);
		switch (ttype) {
			case BPF_MAP_TYPE_HASH:
				return Php::Object("HashTable", new HashTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_ARRAY:
				return Php::Object("ArrayTable", new ArrayTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_PROG_ARRAY:
				return Php::Object("ProgArrayTable", new ProgArrayTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_PERF_EVENT_ARRAY:
				this->_class_perf_event = new PerfEventArrayTable(&this->bpf, table_name);
				return Php::Object("PerfEventArrayTable", this->_class_perf_event);
			case BPF_MAP_TYPE_PERCPU_HASH:
				return Php::Object("PerCpuHashTable", new PerCpuHashTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_PERCPU_ARRAY:
				return Php::Object("PerCpuArrayTable", new PerCpuArrayTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_LPM_TRIE:
				return Php::Object("LpmTrieTable", new LpmTrieTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_STACK_TRACE:
				return Php::Object("StackTraceTable", new StackTraceTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_LRU_HASH:
				return Php::Object("LruHashTable", new LruHashTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_LRU_PERCPU_HASH:
				return Php::Object("LruPerCpuHashTable", new LruPerCpuHashTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_CGROUP_ARRAY:
				return Php::Object("CgroupArrayTable", new CgroupArrayTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_DEVMAP:
				return Php::Object("DevMapTable", new DevMapTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_CPUMAP:
				return Php::Object("CpuMapTable", new CpuMapTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_XSKMAP:
				return Php::Object("XskMapTable", new XskMapTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_ARRAY_OF_MAPS:
				return Php::Object("MapInMapArrayTable", new MapInMapArrayTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_HASH_OF_MAPS:
				return Php::Object("MapInMapHashTable", new MapInMapHashTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_QUEUE:
			case BPF_MAP_TYPE_STACK:
				return Php::Object("QueueStackTable", new QueueStackTable(&this->bpf, table_name));
			case BPF_MAP_TYPE_RINGBUF:
				return Php::Object("RingBufTable", new RingBufTable(&this->bpf, table_name));
			default:
				if (from_attr) {
					return ttype;
				}
				throw Php::Exception("Unknown table type " + std::to_string(ttype));
		}
	}

	Php::Value php_table(Php::Parameters &params) {
		std::string table_name = params[0].stringValue();  // Get event_name from the parameters
		int from_fn = 0;
		return get_table_cls(table_name.c_str(), from_fn);

//		this->_class_perf_event = new PerfEventArrayTable(&this->bpf, table_name);
//		return Php::Object("PerfEventArrayTable", this->_class_perf_event);
	}

	void php_perf_buffer_poll(Php::Parameters &params) {

		if (!this->_class_perf_event) {
			throw Php::Exception("perf event is null.");
		}
		int timeout_ms = -1;
		int res = this->_class_perf_event->perf_buffer_poll(timeout_ms);
		if (res < 0) {
			throw Php::Exception("perf buffer poll error.");
		}
	}

	Php::Value php_get_syscall_fnname(Php::Parameters &params) {
		std::string name = params[0].stringValue();
		return bpf.get_syscall_fnname(name);
	}

};

std::string sanitize_str(std::string str, bool (*validator)(char),
                         char replacement = '_') {
	for (size_t i = 0; i < str.length(); i++)
		if (!validator(str[i]))
			str[i] = replacement;
	return str;
}

std::string attach_type_prefix(bpf_probe_attach_type type) {
	switch (type) {
		case BPF_PROBE_ENTRY:
			return "p";
		case BPF_PROBE_RETURN:
			return "r";
	}
	return "ERROR";
}

static bool kprobe_event_validator(char c) {
	return (c != '+') && (c != '.');
}

std::string get_kprobe_event(const std::string &kernel_func,
                             bpf_probe_attach_type type) {
	std::string res = attach_type_prefix(type) + "_";
	res += sanitize_str(kernel_func, &kprobe_event_validator);
	return res;
}

extern "C" {
PHPCPP_EXPORT void *get_module() {
	static Php::Extension extension("ebpf", "1.0.0");
	Php::Class<EbpfExtension> ebpf_class("Ebpf");
	ebpf_class.method<&EbpfExtension::php_trace_print>("trace_print");
	ebpf_class.method<&EbpfExtension::php_trace_fields>("trace_fields");
	ebpf_class.method<&EbpfExtension::__construct>("__construct", {
			Php::ByVal("bpf_code", Php::Type::String)
	});
	ebpf_class.method<&EbpfExtension::php_attach_kprobe>("attach_kprobe", {
			Php::ByVal("kernel_func", Php::Type::String),
			Php::ByVal("probe_func", Php::Type::String)
	});
	ebpf_class.method<&EbpfExtension::php_attach_tracepoint>("attach_tracepoint", {
			Php::ByVal("tp", Php::Type::String),
			Php::ByVal("probe_func", Php::Type::String)
	});
	ebpf_class.method<&EbpfExtension::php_attach_raw_tracepoint>("attach_raw_tracepoint", {
			Php::ByVal("tp", Php::Type::String),
			Php::ByVal("probe_func", Php::Type::String)
	});
	ebpf_class.method<&EbpfExtension::php_attach_kfunc>("attach_kfunc", {
			Php::ByVal("kfn", Php::Type::String),
	});
	ebpf_class.method<&EbpfExtension::php_attach_lsm>("attach_lsm", {
			Php::ByVal("lsm", Php::Type::String),
	});
	ebpf_class.method<&EbpfExtension::php_attach_uprobe>("attach_uprobe", {
			Php::ByVal("binary_path", Php::Type::String),
			Php::ByVal("symbol", Php::Type::String),
			Php::ByVal("probe_func", Php::Type::String),
			Php::ByVal("options", Php::Type::Array, false),
	});

//	ebpf_class.method<&EbpfExtension::php_open_perf_buffer>("open_perf_buffer", {
//			Php::ByVal("callback", Php::Type::Callable),
//	});

	ebpf_class.method<&EbpfExtension::php_perf_event>("perf_event", {
			Php::ByVal("ev_name", Php::Type::String),
	});

	ebpf_class.method<&EbpfExtension::php_table>("table", {
			Php::ByVal("tb_name", Php::Type::String),
	});

	ebpf_class.method<&EbpfExtension::php_perf_buffer_poll>("perf_buffer_poll", {});

	ebpf_class.method<&EbpfExtension::php_get_syscall_fnname>("get_syscall_fnname", {
			Php::ByVal("name", Php::Type::String),
	});
	/*detach*/
	ebpf_class.method<&EbpfExtension::php_detach_kprobe>("detach_kprobe", {
			Php::ByVal("kernel_func", Php::Type::String),
	});

	ebpf_class.method<&EbpfExtension::php_detach_uprobe>("detach_uprobe", {
			Php::ByVal("binary_path", Php::Type::String),
			Php::ByVal("symbol", Php::Type::String),
			Php::ByVal("options", Php::Type::Array, false),
	});
	ebpf_class.method<&EbpfExtension::php_test>("test", {});
	extension.add(std::move(ebpf_class));

	/*HashTable*/
	Php::Class<HashTable> ebpf_hashtable_cls("HashTable");
	/*ArrayTable*/
	Php::Class<ArrayTable> ebpf_array_table_cls("ArrayTable");
	ebpf_array_table_cls.method<&ArrayTable::Value>("value", {
			Php::ByVal("i", Php::Type::Numeric),
	});
	/*ProgArrayTable*/
	Php::Class<ProgArrayTable> ebpf_prog_array_table_cls("ProgArrayTable");
	/*PerfEventArrayTable*/
	Php::Class<PerfEventArrayTable> ebpf_perf_event_class("PerfEventArrayTable");
	ebpf_perf_event_class.method<&PerfEventArrayTable::php_open_perf_buffer>("open_perf_buffer", {
			Php::ByVal("callback", Php::Type::Callable),
	});
	/*PerCpuHashTable*/
	Php::Class<PerCpuHashTable> ebpf_percpuhash_table_cls("PerCpuHashTable");
	/*PerCpuArrayTable*/
	Php::Class<PerCpuArrayTable> ebpf_percpuarray_table_cls("PerCpuArrayTable");
	/*LpmTrieTable*/
	Php::Class<LpmTrieTable> ebpf_lpmtrie_table_cls("LpmTrieTable");
	/*StackTraceTable*/
	Php::Class<StackTraceTable> ebpf_stack_trace_table_cls("StackTraceTable");
	/*LruHashTable*/
	Php::Class<LruHashTable> ebpf_lruhash_table_cls("LruHashTable");
	/*LruPerCpuHashTable*/
	Php::Class<LruPerCpuHashTable> ebpf_lruper_cpuhash_table_cls("LruPerCpuHashTable");
	/*CgroupArrayTable*/
	Php::Class<CgroupArrayTable> ebpf_cgroup_array_table_cls("CgroupArrayTable");
	/*DevMapTable*/
	Php::Class<DevMapTable> ebpf_devmap_table_cls("DevMapTable");
	/*CpuMapTable*/
	Php::Class<CpuMapTable> ebpf_cpumap_table_cls("CpuMapTable");
	/*XskMapTable*/
	Php::Class<XskMapTable> ebpf_xskmap_table_cls("XskMapTable");
	/*MapInMapArrayTable*/
	Php::Class<MapInMapArrayTable> ebpf_map_in_map_array_table_cls("MapInMapArrayTable");
	/*MapInMapHashTable*/
	Php::Class<MapInMapHashTable> ebpf_map_in_maphash_table_cls("MapInMapHashTable");
	/*QueueStackTable*/
	Php::Class<QueueStackTable> ebpf_queue_stack_table_cls("QueueStackTable");
	/*RingBufTable*/
	Php::Class<RingBufTable> ebpf_ringbuf_table_cls("RingBufTable");

	extension.add(std::move(ebpf_hashtable_cls));
	extension.add(std::move(ebpf_array_table_cls));
	extension.add(std::move(ebpf_prog_array_table_cls));
	extension.add(std::move(ebpf_perf_event_class));
	extension.add(std::move(ebpf_percpuhash_table_cls));
	extension.add(std::move(ebpf_percpuarray_table_cls));
	extension.add(std::move(ebpf_lpmtrie_table_cls));
	extension.add(std::move(ebpf_stack_trace_table_cls));
	extension.add(std::move(ebpf_lruhash_table_cls));
	extension.add(std::move(ebpf_lruper_cpuhash_table_cls));
	extension.add(std::move(ebpf_cgroup_array_table_cls));
	extension.add(std::move(ebpf_devmap_table_cls));
	extension.add(std::move(ebpf_cpumap_table_cls));
	extension.add(std::move(ebpf_xskmap_table_cls));
	extension.add(std::move(ebpf_map_in_map_array_table_cls));
	extension.add(std::move(ebpf_map_in_maphash_table_cls));
	extension.add(std::move(ebpf_queue_stack_table_cls));
	extension.add(std::move(ebpf_ringbuf_table_cls));
	return extension;
}
}