1
# BCC Python 示例：追踪 openat 系统调用
2
from bcc import BPF
3

4
bpf_text = """
5
#include <uapi/linux/ptrace.h>
6
struct data_t { u32 pid; char comm[16]; char filename[256]; };
7
BPF_PERF_OUTPUT(events);
8

9
TRACEPOINT_PROBE(syscalls, sys_enter_openat) {
10
    struct data_t data = {};
11
    data.pid = bpf_get_current_pid_tgid() >> 32;
12
    bpf_get_current_comm(&data.comm, sizeof(data.comm));
13
    bpf_probe_read_user_str(&data.filename, sizeof(data.filename), args->filename);
14
    events.perf_submit(args, &data, sizeof(data));
15
}
16
"""
17

18
b = BPF(text=bpf_text)
19

20
def print_event(cpu, data, size):
21
    event = b["events"].event(data)
22
    print(f"PID={event.pid} COMM={event.comm} FILE={event.filename}")
23

24
b["events"].open_perf_buffer(print_event)
25
while True:
26
    b.perf_buffer_poll()

1
# 1. 编写 eBPF 程序
2
cat > hello.bpf.c << 'EOF'
3
#include "vmlinux.h"
4
#include <bpf/bpf_helpers.h>
5

6
struct { __uint(type, BPF_MAP_TYPE_RINGBUF); __uint(max_entries, 256*1024); } events SEC(".maps");
7

8
SEC("tracepoint/syscalls/sys_enter_execve")
9
int hello(void *ctx) {
10
    bpf_trace_printk("Hello from eBPF!", 18);
11
    return 0;
12
}
13

14
char LICENSE[] SEC("license") = "GPL";
15
EOF
16

17
# 2. 编译
18
clang -g -O2 -target bpf -D__TARGET_ARCH_x86 -c hello.bpf.c -o hello.bpf.o
19

20
# 3. 生成骨架
21
bpftool gen skeleton hello.bpf.o > hello.skel.h
22

23
# 4. 编写用户态程序（包含 hello.skel.h）
24
# 5. 编译用户态程序
25
gcc -o hello hello.c -lbpf -lelf -lz
26

27
# 6. 运行
28
sudo ./hello

1
// 骨架提供的核心 API
2
struct hello_bpf *hello_bpf__open(void);          // 打开
3
struct hello_bpf *hello_bpf__open_and_load(void);  // 打开+加载
4
int hello_bpf__load(struct hello_bpf *skel);       // 加载
5
int hello_bpf__attach(struct hello_bpf *skel);     // 附加
6
void hello_bpf__destroy(struct hello_bpf *skel);   // 销毁
7

8
// 访问 Map 和程序
9
int fd = bpf_map__fd(skel->maps.my_map);
10
int prog_fd = bpf_program__fd(skel->progs.my_prog);

1
# 生成 Go 代码
2
go generate ./...
3

4
# bpf2go 会生成以下文件：
5
# hello_bpfel.go    — Go 类型定义和加载函数
6
# hello_bpfel.o     — 编译后的 eBPF 字节码

1
// eBPF 程序（Rust）
2
#![no_std]
3
#![no_main]
4

5
use aya_bpf::{
6
    bindings::xdp_action,
7
    macros::xdp,
8
    programs::XdpContext,
9
};
10
use aya_log_ebpf::info;
11

12
#[xdp(name="hello_xdp")]
13
pub fn hello_xdp(ctx: XdpContext) -> u32 {
14
    info!(&ctx, "received a packet");
15
    xdp_action::XDP_PASS
16
}
17

18
#[panic_handler]
19
fn panic(_info: &core::panic::PanicInfo) -> ! {
20
    unsafe { core::hint::unreachable_unchecked() }
21
}

1
// 用户态程序（Rust）
2
use aya::{Bpf, programs::Xdp, BpfLoader};
3
use std::net::Interface;
4

5
fn main() -> Result<(), anyhow::Error> {
6
    // 加载 eBPF 程序
7
    let mut bpf = BpfLoader::new().load_file("hello.o")?;
8

9
    // 获取 XDP 程序
10
    let program: &mut Xdp = bpf.program_mut("hello_xdp")?.try_into()?;
11
    program.load()?;
12

13
    // 附加到网卡
14
    let iface = Interface::from_str("eth0")?;
15
    program.attach(&iface, XdpFlags::default())?;
16

17
    println!("XDP program attached to eth0");
18

19
    // 事件循环
20
    loop {
21
        std::thread::sleep(std::time::Duration::from_secs(1));
22
    }
23
}

1
# 一行命令追踪
2
sudo bpftrace -e 'tracepoint:syscalls:sys_enter_openat { printf("%s → %s\n", comm, str(args->filename)); }'
3

4
# 脚本文件
5
cat > trace_open.bt << 'EOF'
6
#!/usr/bin/env bpftrace
7

8
tracepoint:syscalls:sys_enter_openat
9
/comm == "myapp"/
10
{
11
    printf("PID=%d FILE=%s\n", pid, str(args->filename));
12
}
13

14
tracepoint:syscalls:sys_exit_openat
15
/comm == "myapp" && args->ret < 0/
16
{
17
    printf("FAILED: PID=%d RET=%d\n", pid, args->ret);
18
}
19
EOF
20

21
sudo bpftrace trace_open.bt

1
# 使用 libbpf-bootstrap 快速开始
2
git clone https://github.com/libbpf/libbpf-bootstrap.git
3
cd libbpf-bootstrap/c
4

5
# 编译
6
make
7

8
# 运行
9
sudo ./minimal
10
sudo ./bootstrap

1
# 使用 ebpf-go-bootstrap 快速开始
2
git clone https://github.com/cilium/ebpf-go-bootstrap.git
3
cd ebpf-go-bootstrap
4

5
# 编译
6
go generate ./...
7
go build -o app
8

9
# 运行
10
sudo ./app

1
# 安装 Aya 工具
2
cargo install aya-tool
3

4
# 创建新项目
5
cargo generate --name my-ebpf https://github.com/aya-rs/aya-template
6

7
cd my-ebpf
8
cargo build --release
9
sudo ./target/release/my-ebpf

1
# 生成骨架头文件
2
bpftool gen skeleton example.bpf.o > example.skel.h
3

4
# 在 C 代码中使用
5
# #include "example.skel.h"
6
# struct example_bpf *obj = example_bpf__open();
7
# example_bpf__load(obj);
8
# example_bpf__attach(obj);

1
#!/usr/bin/env python3
2
from bcc import BPF
3

4
prog = """
5
#include <uapi/linux/ptrace.h>
6
int trace_open(struct pt_regs *ctx, const char __user *filename) {
7
    bpf_trace_printk("open: %s\\n", filename);
8
    return 0;
9
}
10
"""
11
b = BPF(text=prog)
12
b.attach_kprobe(event="do_sys_openat2", fn_name="trace_open")
13
b.trace_print()