1
// bpf() 系统调用的核心逻辑（简化）
2
SYSCALL_DEFINE5(bpf, int, cmd, union bpf_attr *, attr, unsigned int, size)
3
{
4
    switch (cmd) {
5
    case BPF_PROG_LOAD:
6
        // 1. 验证 eBPF 字节码
7
        err = bpf_prog_load(attr, &prog);
8
        // 2. JIT 编译
9
        bpf_prog_select_runtime(prog, &err);
10
        // 3. 返回程序 fd
11
        return prog->fd;
12
    case BPF_MAP_CREATE:
13
        return bpf_map_create(attr);
14
    case BPF_PROG_ATTACH:
15
        return bpf_prog_attach(attr);
16
    // ... 更多命令
17
    }
18
}

1
// 内核态 eBPF 程序中操作 Map
2
struct bpf_map_def SEC("maps") my_map = {
3
    .type = BPF_MAP_TYPE_HASH,
4
    .key_size = sizeof(u32),
5
    .value_size = sizeof(u64),
6
    .max_entries = 1024,
7
};
8

9
SEC("kprobe/do_unlinkat")
10
int bpf_prog(void *ctx)
11
{
12
    u32 key = 1;
13
    u64 value = 42;
14

15
    // 查找
16
    u64 *val = bpf_map_lookup_elem(&my_map, &key);
17
    if (val) {
18
        // 更新
19
        __sync_fetch_and_add(val, 1);
20
    } else {
21
        // 插入
22
        bpf_map_update_elem(&my_map, &key, &value, BPF_ANY);
23
    }
24

25
    // 删除
26
    bpf_map_delete_elem(&my_map, &key);
27

28
    return 0;
29
}

1
// 用户态操作 Map（通过 bpf() 系统调用）
2
int map_fd = bpf_map_get_fd_by_id(map_id);
3

4
// 查找
5
__u64 value;
6
__u32 key = 1;
7
bpf_map_lookup_elem(map_fd, &key, &value);
8

9
// 更新
10
value = 100;
11
bpf_map_update_elem(map_fd, &key, &value, BPF_ANY);
12

13
// 遍历
14
while (bpf_map_get_next_key(map_fd, &key, &next_key) == 0) {
15
    bpf_map_lookup_elem(map_fd, &next_key, &value);
16
    printf("key=%u value=%lu\n", next_key, value);
17
    key = next_key;
18
}

1
# 一行命令追踪 execve 系统调用
2
sudo bpftrace -e 'tracepoint:syscalls:sys_enter_execve { printf("%s called execve\n", comm); }'
3

4
# 输出示例：
5
# bash called execve
6
# ls called execve
7
# ps called execve

1
#include <linux/bpf.h>
2
#include <bpf/bpf_helpers.h>
3

4
/* 定义 Map：传递事件数据到用户态 */
5
struct event {
6
    u32 pid;
7
    char comm[16];
8
};
9

10
struct {
11
    __uint(type, BPF_MAP_TYPE_RINGBUF);
12
    __uint(max_entries, 256 * 1024);  /* 256 KB */
13
} events SEC(".maps");
14

15
SEC("tracepoint/syscalls/sys_enter_execve")
16
int hello_execve(struct trace_event_raw_sys_enter *ctx)
17
{
18
    struct event *e;
19

20
    /* 从 Ring Buffer 预留空间 */
21
    e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
22
    if (!e)
23
        return 0;
24

25
    /* 填充事件数据 */
26
    e->pid = bpf_get_current_pid_tgid() >> 32;
27
    bpf_get_current_comm(&e->comm, sizeof(e->comm));
28

29
    /* 提交事件 */
30
    bpf_ringbuf_submit(e, 0);
31

32
    return 0;
33
}
34

35
char LICENSE[] SEC("license") = "GPL";

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <signal.h>
4
#include <unistd.h>
5
#include <bpf/libbpf.h>
6
#include <bpf/bpf.h>
7
#include "hello.skel.h"  /* libbpf 骨架自动生成 */
8

9
static volatile bool exiting = false;
10

11
static void sig_handler(int sig) { exiting = true; }
12

13
/* Ring Buffer 事件回调 */
14
static int handle_event(void *ctx, void *data, size_t len)
15
{
16
    struct event {
17
        unsigned int pid;
18
        char comm[16];
19
    } *e = data;
20

21
    printf("%-8u %-16s\n", e->pid, e->comm);
22
    return 0;
23
}
24

25
int main(int argc, char **argv)
26
{
27
    struct hello_bpf *skel;
28
    struct ring_buffer *rb;
29
    int err;
30

31
    signal(SIGINT, sig_handler);
32
    signal(SIGTERM, sig_handler);
33

34
    /* 1. 打开并加载 eBPF 程序 */
35
    skel = hello_bpf__open_and_load();
36
    if (!skel) {
37
        fprintf(stderr, "Failed to open and load BPF skeleton\n");
38
        return 1;
39
    }
40

41
    /* 2. 附加到 tracepoint */
42
    err = hello_bpf__attach(skel);
43
    if (err) {
44
        fprintf(stderr, "Failed to attach BPF program\n");
45
        goto cleanup;
46
    }
47

48
    /* 3. 设置 Ring Buffer 轮询 */
49
    rb = ring_buffer__new(bpf_map__fd(skel->maps.events),
50
                          handle_event, NULL, NULL);
51
    if (!rb) {
52
        fprintf(stderr, "Failed to create ring buffer\n");
53
        goto cleanup;
54
    }
55

56
    printf("%-8s %-16s\n", "PID", "COMM");
57

58
    /* 4. 事件循环 */
59
    while (!exiting) {
60
        err = ring_buffer__poll(rb, 100);
61
        if (err < 0 && err != -EINTR) {
62
            fprintf(stderr, "Error polling ring buffer: %d\n", err);
63
            break;
64
        }
65
    }
66

67
    ring_buffer__free(rb);
68

69
cleanup:
70
    hello_bpf__destroy(skel);
71
    return err != 0;
72
}

1
# 生成骨架头文件
2
bpftool gen skeleton hello.bpf.o > hello.skel.h
3

4
# 编译用户态程序
5
gcc -o hello hello.c -lbpf -lelf -lz
6

7
# 运行
8
sudo ./hello
9
# PID      COMM
10
# 28451    bash
11
# 28452    ls
12
# 28453    ps

1
# 列出所有已加载的 eBPF 程序
2
sudo bpftool prog list
3

4
# 查看特定程序的详细信息
5
sudo bpftool prog show id 123
6

7
# 查看程序的 xlated 字节码（JIT 前）
8
sudo bpftool prog dump xlated id 123
9

10
# 查看程序的 JIT 机器码
11
sudo bpftool prog dump jited id 123
12

13
# 列出所有 Map
14
sudo bpftool map list
15

16
# 查看 Map 内容
17
sudo bpftool map dump id 456

1
# 追踪所有 openat 系统调用
2
sudo bpftrace -e 'tracepoint:syscalls:sys_enter_openat {
3
    printf("%s → %s\n", comm, str(args->filename));
4
}'
5

6
# 统计每个进程的系统调用次数
7
sudo bpftrace -e 'tracepoint:raw_syscalls:sys_enter {
8
    @syscalls[comm] = count();
9
}'
10

11
# 追踪进程创建
12
sudo bpftrace -e 'tracepoint:sched:sched_process_exec {
13
    printf("exec: %s → %s\n", comm, str(args->filename));
14
}'

1
# 检查内核对 eBPF 的支持情况
2
sudo bpftool feature probe
3

4
# 检查特定程序类型是否支持
5
sudo bpftool feature probe | grep "program_type"
6

7
# 检查 Map 类型支持
8
sudo bpftool feature probe | grep "map_type"
9

10
# 检查 Helper 函数支持
11
sudo bpftool feature probe | grep "helper"