「Let's Go eBPF」来，一起“偷窥”下进程在干什么？

int fd, key, value;
fd = bpf_create_map(BPF_MAP_TYPE_HASH, sizeof(key), sizeof(value), 100)

struct bpf_map_def SEC("maps") map_name = {
    .type = BPF_MAP_TYPE_HASH,
    .key_size = sizeof(int),
    .value_size = sizeof(int),
    .max_entries = 100,
};

/**
 * @brief **bpf_object__find_map_by_name()** returns BPF map of
 * the given name, if it exists within the passed BPF object
 * @param obj BPF object
 * @param name name of the BPF map
 * @return BPF map instance, if such map exists within the BPF object;
 * or NULL otherwise.
 */
LIBBPF_API struct bpf_map *
bpf_object__find_map_by_name(const struct bpf_object *obj, const char *name);

/**
 * @brief **bpf_map__fd()** gets the file descriptor of the passed
 * BPF map
 * @param map the BPF map instance
 * @return the file descriptor; or -EINVAL in case of an error
 */
LIBBPF_API int bpf_map__fd(const struct bpf_map *map);

#define BPF_MAP(_name, _type, _key_type, _value_type, _max_entries) \
struct bpf_map_def SEC("maps") _name = { \
  .type = _type, \
  .key_size = sizeof(_key_type), \
  .value_size = sizeof(_value_type), \
  .max_entries = _max_entries, \
};

#define BPF_HASH(_name, _key_type, _value_type) \
BPF_MAP(_name, BPF_MAP_TYPE_HASH, _key_type, _value_type, 10240)

#define BPF_PERF_OUTPUT(_name) \
BPF_MAP(_name, BPF_MAP_TYPE_PERF_EVENT_ARRAY, int, u32, 1024)

BPF_PERF_OUTPUT(execve_out)
BPF_PERF_OUTPUT(execveat_out)
BPF_HASH(config_map, u32, u32)

#define DATA_ARG 0
#define DATA_ENV 1
#define DATA_RET 2

typedef struct event_data {
    u64 ts;

    u32 type;
    u32 pid;
    u32 tid;
    u32 uid;

    s64 ret;

    char comm[TASK_COMM_LEN];
    char payload[MAX_STRING_SIZE];
} event_data_t;

#define CONFIG_MAX_ARG 0
#define CONFIG_MAX_ENV 1

static __always_inline int get_config(u32 key) {
    u32 *config = bpf_map_lookup_elem(&config_map, &key);
    if (config == NULL)
        return 0;

    return *config;
}

SEC("tracepoint/syscalls/sys_enter_execve")
int tracepoint__sys_enter_execve(struct sys_enter_execve_args *ctx) {
    // ... 
}

struct syscalls_enter_open_args {
    unsigned long long unused;
    long syscall_nr;
    long filename_ptr;
    long flags;
    long mode;
};

struct sys_enter_execve_args {
    unsigned long long unused;
    long syscall_nr;
    long filename;  // const char *
    long argv;  // const char *const *
    long envp;  // const char *const *
};

struct sys_enter_execveat_args {
    unsigned long long unused;
    long syscall_nr;
    long fd;
    long filename;
    long argv;
    long envp;
};

struct sys_exit_args {
    unsigned long long unused;
    long syscall_nr;
    long ret;
};

static __always_inline void init_context(event_data_t *data) {
    data->ts = bpf_ktime_get_ns();
    u64 id = bpf_get_current_pid_tgid();
    data->tid = id;
    data->pid = id >> 32;
    data->uid = bpf_get_current_uid_gid();
    bpf_get_current_comm(&data->comm, sizeof(data->comm));
}

SEC("tracepoint/syscalls/sys_enter_execve")
int tracepoint__sys_enter_execve(struct sys_enter_execve_args *ctx) {
    event_data_t data = {};
    data.type = DATA_ARG;
    init_context(&data);
    const char *filename = ctx->filename;
    if (!filename) {
        return -1;
    }

    int size = bpf_probe_read_str(&data.payload, MAX_STRING_SIZE, filename);
    if (size > 0) {
        bpf_perf_event_output(ctx, &execve_out, BPF_F_CURRENT_CPU, &data, sizeof(data) - sizeof(data.payload) + size);
    } else {
        return -1;
    }

    const char *const * argv = ctx->argv;
    u32 max_arg = get_config(CONFIG_MAX_ARG);

    #pragma unroll
    for (int i = 1; i < max_arg && i < MAX_LOOP; i++) {
        const char *argp = NULL;
        bpf_probe_read(&argp, sizeof(argp), &argv[i]);
        if (!argp) {
            break;
        }
        int size = bpf_probe_read_str(&data.payload, MAX_STRING_SIZE, argp);
        if (size > 0) {
            bpf_perf_event_output(ctx, &execve_out, BPF_F_CURRENT_CPU, &data, sizeof(data) - sizeof(data.payload) + size);
        } else {
            break;
        }
    }
    
    // ...
    return 0;
}

/**
 * @brief **perf_buffer__new()** creates BPF perfbuf manager for a specified
 * BPF_PERF_EVENT_ARRAY map
 * @param map_fd FD of BPF_PERF_EVENT_ARRAY BPF map that will be used by BPF
 * code to send data over to user-space
 * @param page_cnt number of memory pages allocated for each per-CPU buffer
 * @param sample_cb function called on each received data record
 * @param lost_cb function called when record loss has occurred
 * @param ctx user-provided extra context passed into *sample_cb* and *lost_cb*
 * @return a new instance of struct perf_buffer on success, NULL on error with
 * *errno* containing an error code
 */
LIBBPF_API struct perf_buffer *
perf_buffer__new(int map_fd, size_t page_cnt,
	perf_buffer_sample_fn sample_cb, perf_buffer_lost_fn lost_cb, void *ctx,
	const struct perf_buffer_opts *opts);