1
#include <linux/bpf.h>
2
#include <bpf/bpf_helpers.h>
3
#include <bpf/bpf_tracing.h>
4

5
struct event {
6
    u32 pid;
7
    int ret;
8
    char comm[16];
9
};
10

11
struct {
12
    __uint(type, BPF_MAP_TYPE_RINGBUF);
13
    __uint(max_entries, 256 * 1024);
14
} events SEC(".maps");
15

16
// kprobe：在函数入口追踪
17
SEC("kprobe/do_sys_openat2")
18
int BPF_KPROBE(trace_open_entry, int dfd, const char *filename, int flags)
19
{
20
    u32 pid = bpf_get_current_pid_tgid() >> 32;
21

22
    // 过滤：只追踪 PID 为 1234 的进程
23
    if (pid != 1234)
24
        return 0;
25

26
    struct event *e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
27
    if (!e)
28
        return 0;
29

30
    e->pid = pid;
31
    bpf_get_current_comm(&e->comm, sizeof(e->comm));
32
    bpf_probe_read_kernel_str(&e->filename, sizeof(e->filename), filename);
33

34
    bpf_ringbuf_submit(e, 0);
35
    return 0;
36
}
37

38
// kretprobe：在函数返回追踪
39
SEC("kretprobe/do_sys_openat2")
40
int BPF_KRETPROBE(trace_open_return, int ret)
41
{
42
    u32 pid = bpf_get_current_pid_tgid() >> 32;
43
    if (pid != 1234)
44
        return 0;
45

46
    // ret 是函数返回值
47
    // 正数 = fd，负数 = 错误码
48
    if (ret < 0) {
49
        // 记录打开失败
50
    }
51
    return 0;
52
}
53

54
char LICENSE[] SEC("license") = "GPL";

1
#include <linux/bpf.h>
2
#include <bpf/bpf_helpers.h>
3

4
struct event {
5
    u32 pid;
6
    int dfd;
7
    int flags;
8
    char comm[16];
9
    char filename[256];
10
};
11

12
struct {
13
    __uint(type, BPF_MAP_TYPE_RINGBUF);
14
    __uint(max_entries, 256 * 1024);
15
} events SEC(".maps");
16

17
SEC("tracepoint/syscalls/sys_enter_openat")
18
int trace_openat(struct trace_event_raw_sys_enter *ctx)
19
{
20
    struct event *e;
21

22
    e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
23
    if (!e)
24
        return 0;
25

26
    e->pid = bpf_get_current_pid_tgid() >> 32;
27
    e->dfd = ctx->args[0];           // dfd 参数
28
    e->flags = ctx->args[2];         // flags 参数
29
    bpf_get_current_comm(&e->comm, sizeof(e->comm));
30

31
    // 读取 filename 参数（用户态指针）
32
    const char *filename = (const char *)ctx->args[1];
33
    bpf_probe_read_user_str(&e->filename, sizeof(e->filename), filename);
34

35
    bpf_ringbuf_submit(e, 0);
36
    return 0;
37
}
38

39
char LICENSE[] SEC("license") = "GPL";

1
# 列出所有可用的 tracepoint
2
sudo bpftool perf list
3

4
# 或者查看 tracepoint 文件系统
5
ls /sys/kernel/debug/tracing/events/
6
# bpf/  block/  cgroup/  cpuhp/  exceptions/  ext4/  filemap/
7
# f2fs/  fs_dax/  ftrace/  huge_memory/  i2c/  initcall/
8
# iomap/  irq/  irq_vectors/  jbd2/  kmem/  libata/
9
# mce/  mdio/  migrate/  mmap/  module/  napi/
10
# net/  numa/  oom/  pagemap/  power/  printk/
11
# ras/  raw_syscalls/  rcu/  regmap/  regulator/  rpm/
12
# rseq/  rtc/  sched/  scsi/  signal/  skb/
13
# smbus/  sock/  spi/  sunrpc/  swiotlb/  syscalls/
14
# task/  tcp/  thermal/  timer/  tlb/  udp/  vmscan/
15
# vsyscall/  workqueue/  writeback/  xdp/  xfs/
16

17
# 查看特定 tracepoint 的格式
18
sudo cat /sys/kernel/debug/tracing/events/syscalls/sys_enter_openat/format

1
#include <linux/bpf.h>
2
#include <bpf/bpf_helpers.h>
3
#include <bpf/bpf_tracing.h>
4

5
struct event {
6
    u32 pid;
7
    u64 duration_ns;
8
    char comm[16];
9
};
10

11
struct {
12
    __uint(type, BPF_MAP_TYPE_RINGBUF);
13
    __uint(max_entries, 256 * 1024);
14
} events SEC(".maps");
15

16
// 记录函数进入时间
17
struct {
18
    __uint(type, BPF_MAP_TYPE_HASH);
19
    __uint(max_entries, 10240);
20
    __type(key, u32);      // TID
21
    __type(value, u64);    // 入口时间戳
22
} start_times SEC(".maps");
23

24
// uprobe：在函数入口记录时间
25
SEC("uprobe")
26
int BPF_UPROBE(trace_func_entry)
27
{
28
    u64 pid_tgid = bpf_get_current_pid_tgid();
29
    u32 tid = (u32)pid_tgid;
30
    u64 ts = bpf_ktime_get_ns();
31

32
    bpf_map_update_elem(&start_times, &tid, &ts, BPF_ANY);
33
    return 0;
34
}
35

36
// uretprobe：在函数返回计算耗时
37
SEC("uretprobe")
38
int BPF_URETPROBE(trace_func_return)
39
{
40
    u64 pid_tgid = bpf_get_current_pid_tgid();
41
    u32 tid = (u32)pid_tgid;
42
    u64 *start_ts;
43

44
    start_ts = bpf_map_lookup_elem(&start_times, &tid);
45
    if (!start_ts)
46
        return 0;
47

48
    u64 duration = bpf_ktime_get_ns() - *start_ts;
49
    bpf_map_delete_elem(&start_times, &tid);
50

51
    struct event *e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
52
    if (!e)
53
        return 0;
54

55
    e->pid = pid_tgid >> 32;
56
    e->duration_ns = duration;
57
    bpf_get_current_comm(&e->comm, sizeof(e->comm));
58

59
    bpf_ringbuf_submit(e, 0);
60
    return 0;
61
}
62

63
char LICENSE[] SEC("license") = "GPL";

1
# 使用 bpftool 挂载 uprobe
2
# 格式：binary:offset 或 binary:function_name
3

4
# 方式一：通过函数名（需要符号表）
5
sudo bpftool prog load uprobe.bpf.o /sys/fs/bpf/uprobe \
6
    type uprobe binary /usr/bin/myapp func my_function
7

8
# 方式二：通过偏移量
9
sudo bpftool prog load uprobe.bpf.o /sys/fs/bpf/uprobe \
10
    type uprobe binary /usr/bin/myapp offset 0x5d6
11

12
# 使用 bpftrace 挂载 uprobe（更简单）
13
sudo bpftrace -e 'uprobe:/usr/bin/myapp:my_function {
14
    printf("called by %s\n", comm);
15
}'

1
// 在 C 程序中定义 USDT 探针
2
#include <sys/sdt.h>  // SystemTap DTrace 头文件
3

4
void handle_request(struct request *req)
5
{
6
    // 标记函数入口
7
    DTRACE_PROBE2(myapp, request_start, req->id, req->type);
8

9
    // 处理请求
10
    process_request(req);
11

12
    // 标记函数完成
13
    DTRACE_PROBE2(myapp, request_done, req->id, req->status);
14
}

1
#include <linux/bpf.h>
2
#include <bpf/bpf_helpers.h>
3

4
struct event {
5
    u32 pid;
6
    u64 request_id;
7
    int request_type;
8
};
9

10
struct {
11
    __uint(type, BPF_MAP_TYPE_RINGBUF);
12
    __uint(max_entries, 256 * 1024);
13
} events SEC(".maps");
14

15
SEC("usdt/myapp/request_start")
16
int trace_request_start(struct pt_regs *ctx)
17
{
18
    struct event *e;
19

20
    e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
21
    if (!e)
22
        return 0;
23

24
    e->pid = bpf_get_current_pid_tgid() >> 32;
25
    // USDT 参数通过 bpf_usdt_read_arg 读取
26
    bpf_usdt_read_arg(1, ctx, &e->request_id);   // 第1个参数
27
    bpf_usdt_read_arg(2, ctx, &e->request_type);  // 第2个参数
28

29
    bpf_ringbuf_submit(e, 0);
30
    return 0;
31
}
32

33
char LICENSE[] SEC("license") = "GPL";

1
# 使用 bpftrace 列出二进制中的 USDT 探针
2
sudo bpftrace -l 'usdt:/usr/bin/myapp:*'
3

4
# 使用 readelf 查看 .note.stapsdt 段
5
readelf -n /usr/bin/myapp | grep stapsdt
6

7
# 使用 tplist（BCC 工具）
8
tplist -l /usr/bin/myapp

1
# 追踪 do_sys_openat2 的调用（kprobe）
2
sudo bpftrace -e 'kprobe:do_sys_openat2 {
3
    printf("PID=%d COMM=%s\n", pid, comm);
4
}'
5

6
# 追踪 do_sys_openat2 的返回值（kretprobe）
7
sudo bpftrace -e 'kretprobe:do_sys_openat2 {
8
    printf("ret=%d\n", retval);
9
}'
10

11
# 追踪系统调用（tracepoint）
12
sudo bpftrace -e 'tracepoint:syscalls:sys_enter_openat {
13
    printf("%s: %s\n", comm, str(args->filename));
14
}'

1
# 追踪 bash 的 readline 函数
2
sudo bpftrace -e 'uprobe:/bin/bash:readline {
3
    printf("%s typed: %s\n", comm, str(retval));
4
}'
5

6
# 追踪 malloc 调用
7
sudo bpftrace -e 'uprobe:/lib/x86_64-linux-gnu/libc.so.6:malloc {
8
    printf("malloc(%d) by %s\n", arg0, comm);
9
}'

1
// 在用户态程序中挂载 kprobe
2
#include <bpf/libbpf.h>
3

4
int main()
5
{
6
    struct myprog_bpf *skel;
7

8
    skel = myprog_bpf__open_and_load();
9
    if (!skel)
10
        return 1;
11

12
    // 附加 kprobe
13
    skel->links.trace_open_entry =
14
        bpf_program__attach_kprobe(skel->progs.trace_open_entry,
15
                                    false,  // kprobe (not kretprobe)
16
                                    "do_sys_openat2");
17
    if (!skel->links.trace_open_entry) {
18
        fprintf(stderr, "Failed to attach kprobe\n");
19
        return 1;
20
    }
21

22
    // 事件循环...
23
    while (1) {
24
        ring_buffer__poll(rb, 100);
25
    }
26

27
    myprog_bpf__destroy(skel);
28
    return 0;
29
}