ebpf环境搭建及tracepoint内核调试sys_enter_write

前言：解决某个进程强制kill的问题，这边记录下搭建ebpf环境搭建及tracepoint内核调试sys_enter_write

参考文章：https://www.cnxct.com/an-applied-introduction-to-ebpf-with-go/

搭建eunomia-bpf编译工具链

编译器工具链ecc

编译器工具链ecc，用于将eBPF内核代码编译为config文件或WASM模块

ecli

搭建ecli工具，用于运行eBPF程序

配置编译运行环境

sudo apt install clang llvm

运行hello world

简单的 eBPF 程序开始，它会在内核中打印一条消息

/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
#define BPF_NO_GLOBAL_DATA
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>

typedef unsigned int u32;
typedef int pid_t;
const pid_t pid_filter = 0;

char LICENSE[] SEC("license") = "Dual BSD/GPL";

SEC("tp/syscalls/sys_enter_write")
int handle_tp(void *ctx)
{
 pid_t pid = bpf_get_current_pid_tgid() >> 32;
 if (pid_filter && pid != pid_filter)
  return 0;
 bpf_printk("BPF triggered sys_enter_write from PID %d.\n", pid);
 return 0;
}