eBPF libbpf 库解析

struct {
	__uint(type, BPF_MAP_TYPE_ARRAY);
	__type(key, u32);
	__type(value, u32);
	__uint(max_entries, 5);
} config_args SEC(".maps");

// vmlinux-4.19.91-007.h

typedef signed char __s8;
typedef unsigned char __u8;
typedef short int __s16;
typedef short unsigned int __u16;
typedef int __s32;
typedef unsigned int __u32;
typedef long long int __s64;
typedef long long unsigned int __u64;

typedef __s8 s8;
typedef __u8 u8;
typedef __s16 s16;
typedef __u16 u16;
typedef __s32 s32;
typedef __u32 u32;
typedef __s64 s64;
typedef __u64 u64;

enum {
	false = 0,
	true = 1,
};

typedef _Bool bool;

// 4.16 前内核, 自定义函数需要使用 __always_inline
static __always_inline void my_function(void *ctx, int val)

// 4.16 及以后内核,可以 eBPF 函数间可以直接调用
static __noinline int get_opcode(struct bpf_raw_tracepoint_args *ctx) {
// 或者:
static __attribute((noinline)) int get_opcode(struct bpf_raw_tracepoint_args *ctx) {
	return ctx->args[1];
}

SEC("raw_tp")
int hello(struct bpf_raw_tracepoint_args *ctx) {
	int opcode = get_opcode(ctx);
	bpf_printk("Syscall: %d", opcode);
	return 0;
}

// <bpf/bpf_helpers.h>

/* Avoid 'linux/stddef.h' definition of '__always_inline'. */
#undef __always_inline
#define __always_inline inline __attribute__((always_inline))

#ifndef __noinline
#define __noinline __attribute__((noinline))
#endif
#ifndef __weak
#define __weak __attribute__((weak))
#endif

/*
 * Use __hidden attribute to mark a non-static BPF subprogram effectively
 * static for BPF verifier's verification algorithm purposes, allowing more
 * extensive and permissive BPF verification process, taking into account
 * subprogram's caller context.
 */
#define __hidden __attribute__((visibility("hidden")))

// https://github.com/libbpf/libbpf/blob/a6d7530cb7dff87ac1e64a540e63b67ddde2e0f9/src/libbpf.c#L35
struct bpf_sec_def {
	char *sec;
	enum bpf_prog_type prog_type;
	enum bpf_attach_type expected_attach_type;
	long cookie;
	int handler_id;

	libbpf_prog_setup_fn_t prog_setup_fn;
	libbpf_prog_prepare_load_fn_t prog_prepare_load_fn;
	libbpf_prog_attach_fn_t prog_attach_fn;
};

// https://github.com/libbpf/libbpf/blob/a6d7530cb7dff87ac1e64a540e63b67ddde2e0f9/src/libbpf.c#L8472
static const struct bpf_sec_def section_defs[] = {
	// 不需要 attach，所以不需要指定 handler_id
	SEC_DEF("socket",		SOCKET_FILTER, 0, SEC_NONE),
	SEC_DEF("sk_reuseport/migrate",	SK_REUSEPORT, BPF_SK_REUSEPORT_SELECT_OR_MIGRATE, SEC_ATTACHABLE),
	SEC_DEF("sk_reuseport",		SK_REUSEPORT, BPF_SK_REUSEPORT_SELECT, SEC_ATTACHABLE)

    // 下面需要 auto attach 到 kprobe 或 uprobe
	SEC_DEF("kprobe+",		KPROBE,	0, SEC_NONE, attach_kprobe),
	SEC_DEF("uprobe+",		KPROBE,	0, SEC_NONE, attach_uprobe),
	SEC_DEF("uprobe.s+",		KPROBE,	0, SEC_SLEEPABLE, attach_uprobe),
	SEC_DEF("kretprobe+",		KPROBE, 0, SEC_NONE, attach_kprobe),
	SEC_DEF("uretprobe+",		KPROBE, 0, SEC_NONE, attach_uprobe),
	SEC_DEF("uretprobe.s+",		KPROBE, 0, SEC_SLEEPABLE, attach_uprobe),
	SEC_DEF("kprobe.multi+",	KPROBE,	BPF_TRACE_KPROBE_MULTI, SEC_NONE, attach_kprobe_multi),
	SEC_DEF("kretprobe.multi+",	KPROBE,	BPF_TRACE_KPROBE_MULTI, SEC_NONE, attach_kprobe_multi),
	SEC_DEF("ksyscall+",		KPROBE,	0, SEC_NONE, attach_ksyscall),
	SEC_DEF("kretsyscall+",		KPROBE, 0, SEC_NONE, attach_ksyscall),
	SEC_DEF("usdt+",		KPROBE,	0, SEC_NONE, attach_usdt),

	// 网络:
	SEC_DEF("tc",			SCHED_CLS, 0, SEC_NONE), // 不需要 attach
	SEC_DEF("classifier",		SCHED_CLS, 0, SEC_NONE),
	SEC_DEF("action",		SCHED_ACT, 0, SEC_NONE),

    // 下面需要 auto attach 到 tracepoint
	SEC_DEF("tracepoint+",		TRACEPOINT, 0, SEC_NONE, attach_tp), // 需要 attach
	SEC_DEF("tp+",			TRACEPOINT, 0, SEC_NONE, attach_tp),
	SEC_DEF("raw_tracepoint+",	RAW_TRACEPOINT, 0, SEC_NONE, attach_raw_tp),
	SEC_DEF("raw_tp+",		RAW_TRACEPOINT, 0, SEC_NONE, attach_raw_tp),
	SEC_DEF("raw_tracepoint.w+",	RAW_TRACEPOINT_WRITABLE, 0, SEC_NONE, attach_raw_tp),
	SEC_DEF("raw_tp.w+",		RAW_TRACEPOINT_WRITABLE, 0, SEC_NONE, attach_raw_tp),

    // 下面需要 auto attach 到 tracing 而非 tracepoint，都是依赖于 BTF 信息的，使用 bpf link 来 attach
	// Program Type 都是 TRACING，但是 Attach Type 各不相同。
	SEC_DEF("tp_btf+",		TRACING, BPF_TRACE_RAW_TP, SEC_ATTACH_BTF, attach_trace),
	SEC_DEF("fentry+",		TRACING, BPF_TRACE_FENTRY, SEC_ATTACH_BTF, attach_trace),
	SEC_DEF("fmod_ret+",		TRACING, BPF_MODIFY_RETURN, SEC_ATTACH_BTF, attach_trace),
	SEC_DEF("fexit+",		TRACING, BPF_TRACE_FEXIT, SEC_ATTACH_BTF, attach_trace),
	SEC_DEF("fentry.s+",		TRACING, BPF_TRACE_FENTRY, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
	SEC_DEF("fmod_ret.s+",		TRACING, BPF_MODIFY_RETURN, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
	SEC_DEF("fexit.s+",		TRACING, BPF_TRACE_FEXIT, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
	SEC_DEF("freplace+",		EXT, 0, SEC_ATTACH_BTF, attach_trace),

    // 下面需要 auto attach 到 lsm，也依赖 BTF，有对应的 Attach Type。
	SEC_DEF("lsm+",			LSM, BPF_LSM_MAC, SEC_ATTACH_BTF, attach_lsm),
	SEC_DEF("lsm.s+",		LSM, BPF_LSM_MAC, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_lsm),
	SEC_DEF("lsm_cgroup+",		LSM, BPF_LSM_CGROUP, SEC_ATTACH_BTF),
	SEC_DEF("iter+",		TRACING, BPF_TRACE_ITER, SEC_ATTACH_BTF, attach_iter),
	SEC_DEF("iter.s+",		TRACING, BPF_TRACE_ITER, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_iter),

	SEC_DEF("syscall",		SYSCALL, 0, SEC_SLEEPABLE),

    // 网络：下面这些都是网络相关的，不需要 auto attach
	SEC_DEF("xdp.frags/devmap",	XDP, BPF_XDP_DEVMAP, SEC_XDP_FRAGS),
	SEC_DEF("xdp/devmap",		XDP, BPF_XDP_DEVMAP, SEC_ATTACHABLE),
	SEC_DEF("xdp.frags/cpumap",	XDP, BPF_XDP_CPUMAP, SEC_XDP_FRAGS),
	SEC_DEF("xdp/cpumap",		XDP, BPF_XDP_CPUMAP, SEC_ATTACHABLE),
	SEC_DEF("xdp.frags",		XDP, BPF_XDP, SEC_XDP_FRAGS),
	SEC_DEF("xdp",			XDP, BPF_XDP, SEC_ATTACHABLE_OPT),

    // 用户空间进程序在 attach 前,需要使用 perf_event_open 的 att 来指定采样频率和周期.
    // https://github.com/libbpf/libbpf-bootstrap/blob/master/examples/c/profile.c#L194
	SEC_DEF("perf_event",		PERF_EVENT, 0, SEC_NONE),

	// 网络：轻量级隧道
	SEC_DEF("lwt_in",		LWT_IN, 0, SEC_NONE),
	SEC_DEF("lwt_out",		LWT_OUT, 0, SEC_NONE),
	SEC_DEF("lwt_xmit",		LWT_XMIT, 0, SEC_NONE),
	SEC_DEF("lwt_seg6local",	LWT_SEG6LOCAL, 0, SEC_NONE),

	SEC_DEF("sockops",		SOCK_OPS, BPF_CGROUP_SOCK_OPS, SEC_ATTACHABLE_OPT),
	SEC_DEF("sk_skb/stream_parser",	SK_SKB, BPF_SK_SKB_STREAM_PARSER, SEC_ATTACHABLE_OPT),
	SEC_DEF("sk_skb/stream_verdict",SK_SKB, BPF_SK_SKB_STREAM_VERDICT, SEC_ATTACHABLE_OPT),
	SEC_DEF("sk_skb",		SK_SKB, 0, SEC_NONE),
	SEC_DEF("sk_msg",		SK_MSG, BPF_SK_MSG_VERDICT, SEC_ATTACHABLE_OPT),
	SEC_DEF("lirc_mode2",		LIRC_MODE2, BPF_LIRC_MODE2, SEC_ATTACHABLE_OPT),
	SEC_DEF("flow_dissector",	FLOW_DISSECTOR, BPF_FLOW_DISSECTOR, SEC_ATTACHABLE_OPT),
	SEC_DEF("cgroup_skb/ingress",	CGROUP_SKB, BPF_CGROUP_INET_INGRESS, SEC_ATTACHABLE_OPT),
	SEC_DEF("cgroup_skb/egress",	CGROUP_SKB, BPF_CGROUP_INET_EGRESS, SEC_ATTACHABLE_OPT),
	SEC_DEF("cgroup/skb",		CGROUP_SKB, 0, SEC_NONE),
	SEC_DEF("cgroup/sock_create",	CGROUP_SOCK, BPF_CGROUP_INET_SOCK_CREATE, SEC_ATTACHABLE),
	SEC_DEF("cgroup/sock_release",	CGROUP_SOCK, BPF_CGROUP_INET_SOCK_RELEASE, SEC_ATTACHABLE),
	SEC_DEF("cgroup/sock",		CGROUP_SOCK, BPF_CGROUP_INET_SOCK_CREATE, SEC_ATTACHABLE_OPT),
	SEC_DEF("cgroup/post_bind4",	CGROUP_SOCK, BPF_CGROUP_INET4_POST_BIND, SEC_ATTACHABLE),
	SEC_DEF("cgroup/post_bind6",	CGROUP_SOCK, BPF_CGROUP_INET6_POST_BIND, SEC_ATTACHABLE),
	SEC_DEF("cgroup/bind4",		CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_BIND, SEC_ATTACHABLE),
	SEC_DEF("cgroup/bind6",		CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_BIND, SEC_ATTACHABLE),
	SEC_DEF("cgroup/connect4",	CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_CONNECT, SEC_ATTACHABLE),
	SEC_DEF("cgroup/connect6",	CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_CONNECT, SEC_ATTACHABLE),
	SEC_DEF("cgroup/sendmsg4",	CGROUP_SOCK_ADDR, BPF_CGROUP_UDP4_SENDMSG, SEC_ATTACHABLE),
	SEC_DEF("cgroup/sendmsg6",	CGROUP_SOCK_ADDR, BPF_CGROUP_UDP6_SENDMSG, SEC_ATTACHABLE),
	SEC_DEF("cgroup/recvmsg4",	CGROUP_SOCK_ADDR, BPF_CGROUP_UDP4_RECVMSG, SEC_ATTACHABLE),
	SEC_DEF("cgroup/recvmsg6",	CGROUP_SOCK_ADDR, BPF_CGROUP_UDP6_RECVMSG, SEC_ATTACHABLE),
	SEC_DEF("cgroup/getpeername4",	CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_GETPEERNAME, SEC_ATTACHABLE),
	SEC_DEF("cgroup/getpeername6",	CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_GETPEERNAME, SEC_ATTACHABLE),
	SEC_DEF("cgroup/getsockname4",	CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_GETSOCKNAME, SEC_ATTACHABLE),
	SEC_DEF("cgroup/getsockname6",	CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_GETSOCKNAME, SEC_ATTACHABLE),
	SEC_DEF("cgroup/sysctl",	CGROUP_SYSCTL, BPF_CGROUP_SYSCTL, SEC_ATTACHABLE),
	SEC_DEF("cgroup/getsockopt",	CGROUP_SOCKOPT, BPF_CGROUP_GETSOCKOPT, SEC_ATTACHABLE),
	SEC_DEF("cgroup/setsockopt",	CGROUP_SOCKOPT, BPF_CGROUP_SETSOCKOPT, SEC_ATTACHABLE),
	SEC_DEF("cgroup/dev",		CGROUP_DEVICE, BPF_CGROUP_DEVICE, SEC_ATTACHABLE_OPT),

	SEC_DEF("struct_ops+",		STRUCT_OPS, 0, SEC_NONE),
	SEC_DEF("sk_lookup",		SK_LOOKUP, BPF_SK_LOOKUP, SEC_ATTACHABLE),
};

struct bpf_raw_tracepoint_args {
    __u64 args[0];  // 变长数组
};

SEC("raw_tracepoint/sys_enter")
int raw_tracepoint__sys_enter(struct bpf_raw_tracepoint_args *ctx)
{
	 // 根据 TRACE_EVENT_FN(sys_enter 中的 TP_PROTO(struct pt_regs *regs, long id) 来确定
	// ctx->args 数组的内容。
	// ctx->args[0] --》 保存系统调用函数参数的 struct pt_regs *regs；
	// ctx->args[1] --》 保存 syscall id

    unsigned long syscall_id = ctx->args[1]; // 直接读取变长数组成员的值。

    if(syscall_id != 268)    // 过滤系统调用 id，只处理 fchmodat 系统调用
        return 0;

    struct pt_regs *regs;
    regs = (struct pt_regs *) ctx->args[0]; // 获得 struct pt_regs * // 直接读取变长数组成员的值。

    char pathname[256];
    u32 mode;

    // 读取第二个系统调用函数参数的值
    // PT_REGS_PARM[1-5], 也即从 1 开始计数。
    char *pathname_ptr = (char *) PT_REGS_PARM2_CORE(regs);
    bpf_core_read_user_str(&pathname, sizeof(pathname), pathname_ptr);

    // 读取第三个系统调用函数参数的值
    mode = (u32) PT_REGS_PARM3_CORE(regs);

    char fmt[] = "fchmodat %s %d\n";
    bpf_trace_printk(fmt, sizeof(fmt), &pathname, mode);
    return 0;
}

// task 是内核数据结构
struct task_struct *task = (struct task_struct *)bpf_get_current_task();
// 从内核地址读取数据，也需要使用 bpf_probe_read, 这里的 BPF_CORE_READ 是它的链式封装。
pid_t ppid = (pid_t)BPF_CORE_READ(task, real_parent, tgid);


//vmlinux.h 提供的 tracepoint ctx struct 大部分 field 都是 array 类型。内核在调用 handler 之前，已经对
//tracepoint ctx struct 中的各 filed 赋值，所以如果是 array 类型 field，则各字段可以直接读取，例如下面的
// ctx->args[0] 和 ctx->args[1]。
struct trace_event_raw_sys_enter {
	struct trace_entry ent;
	long int id;
	long unsigned int args[6];
	char __data[0];
};

SEC("tracepoint/syscalls/sys_enter_execve")
int tracepoint__syscalls__sys_enter_execve(struct trace_event_raw_sys_enter *ctx)
{
	//  execve 系统调用参数格式：
	// int execve(const char *filename, char *const argv[], char *const envp[]);

	// ctx->args 是 long unsigned int args[6]; 类型，故可以直接读取成员值。
	ret = bpf_probe_read(event->filename, TASK_FILENAME_LEN,
			     (const char *)ctx->args[0]);

	// 下面的 ctx->args[1] 指向命令行参数指针数组，数组以 NULL 结尾。
	// 所以，需要先用 bpf_probe_read 读取命令行参数指针，存入 argp，
	// 然后再使用 bpf_probe_read 从 argp 读取参数字符串。

	const char **args = (const char **)(ctx->args[1]);
#pragma unroll
	for (int i = 1; i < 10; i++) {
		const char *argp = NULL;
		// 1. 读取 args[i] 字符串地址，存入 argp。
		ret = bpf_probe_read(&argp, sizeof(argp), &args[i]);

		// 向 event->args 数组写入前，需要做边界检查，否则 eBPF verifier 失败。
		if (event->args_size > LAST_ARG) {
			goto output;
		}

		// 2. 从 argp 读取字符串。
		ret = bpf_probe_read(&event->args[event->args_size],
				     ARGSIZE - 2, argp);
		event->args_size += ARGSIZE - 2;

		// 在 read 的数据块末尾添加两个特殊的字符串标记 '!!', 用于后续用户空间切割。
		//
		// 边界检查的 index 必须是变量，不能是表达式（如 event->args_size + 1），如果需要表达式，则需
                // 要先对 index 值计算，然后再用它做检查和设置。
		//
		// 1. 先计算要写的数组 index；
		event->args_size += 1;
		// 2. 写之前对 index 进行边界检查；
		if (event->args_size > FULL_MAX_ARGS_ARR) {
			goto output;
		}
		// 3. 实际写数组。
		event->args[event->args_size] = '!';
// 。。。
	}

// fs/exec.c
SYSCALL_DEFINE3(execve,
		const char __user *, filename,
		const char __user *const __user *, argv,
		const char __user *const __user *, envp)
{
	return do_execve(getname(filename), argv, envp);
}

// fs/exec.c
int do_execve(struct filename *filename,
	const char __user *const __user *__argv,
	const char __user *const __user *__envp)
{
	struct user_arg_ptr argv = { .ptr.native = __argv };
	struct user_arg_ptr envp = { .ptr.native = __envp };
	return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
}

# zgrep bpf_probe /proc/kallsyms
ffffffff811bb360 T bpf_probe_read
ffffffff811bb3a0 T bpf_probe_write_user
ffffffff811bb3f0 T bpf_probe_read_str
ffffffff811bc600 T bpf_probe_register
ffffffff811bc630 T bpf_probe_unregister
ffffffff81e457c0 r bpf_probe_read_str_proto
ffffffff81e45980 r bpf_probe_write_user_proto
ffffffff81e459c0 r bpf_probe_read_proto

root@lima-ebpf-dev:/hello-ebpf/process# zgrep bpf_probe /proc/kallsyms
ffffffff9f42abd0 T bpf_probe_read_user
ffffffff9f42ac20 T bpf_probe_read_user_str
ffffffff9f42ac70 T bpf_probe_read_kernel
ffffffff9f42acc0 T bpf_probe_read_kernel_str
ffffffff9f42ad10 T bpf_probe_write_user
ffffffff9f42bbd0 T bpf_probe_read_compat_str
ffffffff9f42bc70 T bpf_probe_read_compat
ffffffff9f42d900 T bpf_probe_register
ffffffff9f42d950 T bpf_probe_unregister
ffffffffa0434040 d bpf_probe_write_user_proto
ffffffffa04340a0 d bpf_probe_read_compat_str_proto
ffffffffa0434100 d bpf_probe_read_compat_proto
ffffffffa0434160 D bpf_probe_read_kernel_str_proto
ffffffffa04341c0 D bpf_probe_read_kernel_proto
ffffffffa0434220 D bpf_probe_read_user_str_proto
ffffffffa0434280 D bpf_probe_read_user_proto

// https://github.com/libbpf/libbpf/blob/a6d7530cb7dff87ac1e64a540e63b67ddde2e0f9/src/bpf_core_read.h#L230

/*
 * bpf_core_read() abstracts away bpf_probe_read_kernel() call and captures offset relocation for source
 * address using __builtin_preserve_access_index() built-in, provided by Clang.
 *
 * __builtin_preserve_access_index() takes as an argument an expression of taking an address of a field within
 * struct/union. It makes compiler emit a relocation, which records BTF type ID describing root struct/union
 * and an accessor string which describes exact embedded field that was used to take an address. See detailed
 * description of this relocation format and semantics in comments to struct bpf_field_reloc in
 * libbpf_internal.h.
 *
 * This relocation allows libbpf to adjust BPF instruction to use correct actual field offset, based on target
 * kernel BTF type that matches original (local) BTF, used to record relocation.
 */
#define bpf_core_read(dst, sz, src)					    \
	bpf_probe_read_kernel(dst, sz, (const void *)__builtin_preserve_access_index(src))

/* NOTE: see comments for BPF_CORE_READ_USER() about the proper types use. */
#define bpf_core_read_user(dst, sz, src)				    \
	bpf_probe_read_user(dst, sz, (const void *)__builtin_preserve_access_index(src))
/*
 * bpf_core_read_str() is a thin wrapper around bpf_probe_read_str()
 * additionally emitting BPF CO-RE field relocation for specified source
 * argument.
 */
#define bpf_core_read_str(dst, sz, src)					    \
	bpf_probe_read_kernel_str(dst, sz, (const void *)__builtin_preserve_access_index(src))

/* NOTE: see comments for BPF_CORE_READ_USER() about the proper types use. */
#define bpf_core_read_user_str(dst, sz, src)				    \
	bpf_probe_read_user_str(dst, sz, (const void *)__builtin_preserve_access_index(src))

struct task_struct *task = (void *)bpf_get_current_task();
struct task_struct *parent_task;
int err;

err = bpf_core_read(&parent_task, sizeof(void *), &task->parent);
if (err) {
    /* handle error */
}

/* parent_task contains the value of task->parent pointer */


struct my_kernel_type {
    const char *name;
    char type[32];
};

struct my_kernel_type *t = ...;
const char *p;
char str[32];

// 对于 struct 中的指针 field，需要先 read 到本地指针，然后再使用本地指针 read 实际内容。
/* get string pointer, CO-RE-relocatable */
bpf_core_read(&p, sizeof(p), &t->name);
/* read the string, non-CO-RE-relocatable, pointer is valid regardless */
bpf_probe_read_kernel_str(str, sizeof(str), p);

// 对于 struct 中数组 field，由于是
/* read string as CO-RE-relocatable */
bpf_core_read_str(str, sizeof(str), &t->type);

// https://github.com/libbpf/libbpf/blob/a6d7530cb7dff87ac1e64a540e63b67ddde2e0f9/src/bpf_core_read.h#L346
     70:#define BPF_CORE_READ_BITFIELD_PROBED(s, field) ({			      \
     88:#define BPF_CORE_READ_BITFIELD(s, field) ({				      \

    442:#define BPF_CORE_READ(src, a, ...) ({					    \
    350:#define BPF_CORE_READ_INTO(dst, src, a, ...) ({				    \
    386:#define BPF_CORE_READ_STR_INTO(dst, src, a, ...) ({			    \

    458:#define BPF_CORE_READ_USER(src, a, ...) ({				    \
    360:#define BPF_CORE_READ_USER_INTO(dst, src, a, ...) ({			    \
    396:#define BPF_CORE_READ_USER_STR_INTO(dst, src, a, ...) ({		    \

    465:#define BPF_PROBE_READ(src, a, ...) ({					    \
    366:#define BPF_PROBE_READ_INTO(dst, src, a, ...) ({			    \
    402:#define BPF_PROBE_READ_STR_INTO(dst, src, a, ...) ({			    \

    376:#define BPF_PROBE_READ_USER_INTO(dst, src, a, ...) ({			    \
    413:#define BPF_PROBE_READ_USER_STR_INTO(dst, src, a, ...) ({		    \
    477:#define BPF_PROBE_READ_USER(src, a, ...) ({				    \

// arch/x86/include/asm/ptrace.h

struct pt_regs {
/*
 * C ABI says these regs are callee-preserved. They aren't saved on kernel entry
 * unless syscall needs a complete, fully filled "struct pt_regs".
 */
	unsigned long r15;
	unsigned long r14;
	unsigned long r13;
	unsigned long r12;
	unsigned long bp;
	unsigned long bx;
/* These regs are callee-clobbered. Always saved on kernel entry. */
	unsigned long r11;
	unsigned long r10;
	unsigned long r9;
	unsigned long r8;
	unsigned long ax;
	unsigned long cx;
	unsigned long dx;
	unsigned long si;
	unsigned long di;
/*
 * On syscall entry, this is syscall#. On CPU exception, this is error code.
 * On hw interrupt, it's IRQ number:
 */
	unsigned long orig_ax;
/* Return frame for iretq */
	unsigned long ip;
	unsigned long cs;
	unsigned long flags;
	unsigned long sp;
	unsigned long ss;
/* top of stack page */
};

// libbpf/src/bpf_tracing.h, 对应 C 中的 <bpf/bpf_tracing.h> 头文件

// x86 和 x86_64 都对应 bpf_target_x86
/* Fall back to what the compiler says */
#if defined(__x86_64__)
	#define bpf_target_x86
	#define bpf_target_defined



#if defined(bpf_target_x86)

#if defined(__KERNEL__) || defined(__VMLINUX_H__) // 内核代码部分

#define __PT_PARM1_REG di
#define __PT_PARM2_REG si
#define __PT_PARM3_REG dx
#define __PT_PARM4_REG cx
#define __PT_PARM5_REG r8
#define __PT_RET_REG sp
#define __PT_FP_REG bp
#define __PT_RC_REG ax
#define __PT_SP_REG sp
#define __PT_IP_REG ip
/* syscall uses r10 for PARM4 */
#define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)
#define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)

#else // 用户空间部分

#ifdef __i386__  // x86

#define __PT_PARM1_REG eax
#define __PT_PARM2_REG edx
#define __PT_PARM3_REG ecx
/* i386 kernel is built with -mregparm=3 */
#define __PT_PARM4_REG __unsupported__
#define __PT_PARM5_REG __unsupported__
#define __PT_RET_REG esp
#define __PT_FP_REG ebp
#define __PT_RC_REG eax
#define __PT_SP_REG esp
#define __PT_IP_REG eip

#else /* __i386__ */   // x86_64 的如下：

#define __PT_PARM1_REG rdi
#define __PT_PARM2_REG rsi
#define __PT_PARM3_REG rdx
#define __PT_PARM4_REG rcx
#define __PT_PARM5_REG r8
#define __PT_RET_REG rsp
#define __PT_FP_REG rbp
#define __PT_RC_REG rax
#define __PT_SP_REG rsp
#define __PT_IP_REG rip
/* syscall uses r10 for PARM4 */
#define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)
#define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)

#endif /* __i386__ */

#endif /* __KERNEL__ || __VMLINUX_H__ */

// libbpf/src/bpf_tracing.h, 对应 C 中的 <bpf/bpf_tracing.h> 头文件

#if defined(bpf_target_defined)

struct pt_regs;  // 参考前面内核中的定义，如 arch/x86/include/asm/ptrace.h

/* allow some architecutres to override `struct pt_regs` */
#ifndef __PT_REGS_CAST
#define __PT_REGS_CAST(x) (x)
#endif

# 读取寄存器值，结果为参数指针
#define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)
#define PT_REGS_PARM2(x) (__PT_REGS_CAST(x)->__PT_PARM2_REG)
#define PT_REGS_PARM3(x) (__PT_REGS_CAST(x)->__PT_PARM3_REG)
#define PT_REGS_PARM4(x) (__PT_REGS_CAST(x)->__PT_PARM4_REG)
#define PT_REGS_PARM5(x) (__PT_REGS_CAST(x)->__PT_PARM5_REG)
#define PT_REGS_RET(x) (__PT_REGS_CAST(x)->__PT_RET_REG)
#define PT_REGS_FP(x) (__PT_REGS_CAST(x)->__PT_FP_REG)
#define PT_REGS_RC(x) (__PT_REGS_CAST(x)->__PT_RC_REG)
#define PT_REGS_SP(x) (__PT_REGS_CAST(x)->__PT_SP_REG)
#define PT_REGS_IP(x) (__PT_REGS_CAST(x)->__PT_IP_REG)

# 读取寄存器内参数指针指向的实际值。
#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_REG)
#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM2_REG)
#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_REG)
#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_REG)
#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_REG)
#define PT_REGS_RET_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RET_REG)
#define PT_REGS_FP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_FP_REG)
#define PT_REGS_RC_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RC_REG)
#define PT_REGS_SP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_SP_REG)
#define PT_REGS_IP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_IP_REG)


# 以下是系统调用的参数对应的函数宏。
#ifndef PT_REGS_PARM1_SYSCALL
#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1(x)
#endif
#define PT_REGS_PARM2_SYSCALL(x) PT_REGS_PARM2(x)
#define PT_REGS_PARM3_SYSCALL(x) PT_REGS_PARM3(x)
#ifndef PT_REGS_PARM4_SYSCALL
#define PT_REGS_PARM4_SYSCALL(x) PT_REGS_PARM4(x)
#endif
#define PT_REGS_PARM5_SYSCALL(x) PT_REGS_PARM5(x)

#ifndef PT_REGS_PARM1_CORE_SYSCALL
#define PT_REGS_PARM1_CORE_SYSCALL(x) PT_REGS_PARM1_CORE(x)
#endif
#define PT_REGS_PARM2_CORE_SYSCALL(x) PT_REGS_PARM2_CORE(x)
#define PT_REGS_PARM3_CORE_SYSCALL(x) PT_REGS_PARM3_CORE(x)
#ifndef PT_REGS_PARM4_CORE_SYSCALL
#define PT_REGS_PARM4_CORE_SYSCALL(x) PT_REGS_PARM4_CORE(x)
#endif
#define PT_REGS_PARM5_CORE_SYSCALL(x) PT_REGS_PARM5_CORE(x)

//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc $BPF_CLANG -cflags "-O2 -g" --target=$GOARCH bpf nettuple.bpf.c -- -I ./ -I../headers -g

// arch/x86/include/asm/syscall_wrapper.h

// __64_sys_*(const struct pt_regs *regs) -> __se_sys_*(type1 name1，type2 name2) -> __do_sys_*(type1 name1，type2 name2)

/*
 * Instead of the generic __SYSCALL_DEFINEx() definition, this macro takes
 * struct pt_regs *regs as the only argument of the syscall stub named
 * __x64_sys_*(). It decodes just the registers it needs and passes them on to
 * the __se_sys_*() wrapper performing sign extension and then to the
 * __do_sys_*() function doing the actual job. These wrappers and functions
 * are inlined (at least in very most cases), meaning that the assembly looks
 * as follows (slightly re-ordered for better readability):
 *
 * <__x64_sys_recv>:		<-- syscall with 4 parameters
 *	callq	<__fentry__>
 *
 *	mov	0x70(%rdi),%rdi	<-- decode regs->di
 *	mov	0x68(%rdi),%rsi	<-- decode regs->si
 *	mov	0x60(%rdi),%rdx	<-- decode regs->dx
 *	mov	0x38(%rdi),%rcx	<-- decode regs->r10
 *
 *	xor	%r9d,%r9d	<-- clear %r9
 *	xor	%r8d,%r8d	<-- clear %r8
 *
 *	callq	__sys_recvfrom	<-- do the actual work in __sys_recvfrom()
 *				    which takes 6 arguments
 *
 *	cltq			<-- extend return value to 64-bit
 *	retq			<-- return
 *
 * This approach avoids leaking random user-provided register content down
 * the call chain.
 *
 * If IA32_EMULATION is enabled, this macro generates an additional wrapper
 * named __ia32_sys_*() which decodes the struct pt_regs *regs according
 * to the i386 calling convention (bx, cx, dx, si, di, bp).
 */
#define __SYSCALL_DEFINEx(x, name, ...)					\
	asmlinkage long __x64_sys##name(const struct pt_regs *regs);	\
	ALLOW_ERROR_INJECTION(__x64_sys##name, ERRNO);			\
	static long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__));	\
	static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__));\
	asmlinkage long __x64_sys##name(const struct pt_regs *regs)	\
	{								\
		return __se_sys##name(SC_X86_64_REGS_TO_ARGS(x,__VA_ARGS__));\
	}								\
	__IA32_SYS_STUBx(x, name, __VA_ARGS__)				\
	static long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__))	\
	{								\
		long ret = __do_sys##name(__MAP(x,__SC_CAST,__VA_ARGS__));\
		__MAP(x,__SC_TEST,__VA_ARGS__);				\
		__PROTECT(x, ret,__MAP(x,__SC_ARGS,__VA_ARGS__));	\
		return ret;						\
	}								\
	static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__))
// __do_sys##name 只有一个函数头，函数体是后面使用类似于 SYSCALL_DEFINE5 实际定义的系统调用函数 body。


// include/linux/syscalls.h
#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
/*
 * It may be useful for an architecture to override the definitions of the
 * SYSCALL_DEFINE0() and __SYSCALL_DEFINEx() macros, in particular to use a
 * different calling convention for syscalls. To allow for that, the prototypes
 * for the sys_*() functions below will *not* be included if
 * CONFIG_ARCH_HAS_SYSCALL_WRAPPER is enabled.
 */
#include <asm/syscall_wrapper.h>
#endif /* CONFIG_ARCH_HAS_SYSCALL_WRAPPER */

...

#define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__)
#define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__)
#define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__)
#define SYSCALL_DEFINE4(name, ...) SYSCALL_DEFINEx(4, _##name, __VA_ARGS__)
#define SYSCALL_DEFINE5(name, ...) SYSCALL_DEFINEx(5, _##name, __VA_ARGS__)
#define SYSCALL_DEFINE6(name, ...) SYSCALL_DEFINEx(6, _##name, __VA_ARGS__)

#define SYSCALL_DEFINE_MAXARGS	6

#define SYSCALL_DEFINEx(x, sname, ...)				\
	SYSCALL_METADATA(sname, x, __VA_ARGS__)			\
	__SYSCALL_DEFINEx(x, sname, __VA_ARGS__)

// fs/exec.c
// 使用上面 __SYSCALL_DEFINEx 定义的 wrapper 实现：
SYSCALL_DEFINE5(execveat,
		int, fd, const char __user *, filename,
		const char __user *const __user *, argv,
		const char __user *const __user *, envp,
		int, flags)
{
	int lookup_flags = (flags & AT_EMPTY_PATH) ? LOOKUP_EMPTY : 0;

	return do_execveat(fd,
			   getname_flags(filename, lookup_flags, NULL),
			   argv, envp, flags);
}

int do_execveat(int fd, struct filename *filename,
		const char __user *const __user *__argv,
		const char __user *const __user *__envp,
		int flags)
{
	struct user_arg_ptr argv = { .ptr.native = __argv };
	struct user_arg_ptr envp = { .ptr.native = __envp };

	return do_execveat_common(fd, filename, argv, envp, flags);
}

static int do_execveat_common(int fd, struct filename *filename,
			      struct user_arg_ptr argv,
			      struct user_arg_ptr envp,
			      int flags)
{
	return __do_execve_file(fd, filename, argv, envp, flags, NULL);
}

static int __do_execve_file(int fd, struct filename *filename,
			    struct user_arg_ptr argv,
			    struct user_arg_ptr envp,
			    int flags, struct file *file)
{
	char *pathbuf = NULL;
	struct linux_binprm *bprm;
	struct files_struct *displaced;
	int retval;

	if (IS_ERR(filename))
		return PTR_ERR(filename);
...
}

// 下面这三个函数都是 SYSCALL_DEFINE5 内部生产的
asmlinkage long __x64_sys_execveat(const struct pt_regs *regs) // 暴露
//- >
static long __se_sys_execveat(int fd, struct filename *filename,
		const char __user *const __user *__argv,
		const char __user *const __user *__envp,
		int flags)
// ->
static inline long __do_sys_execveat(int fd, struct filename *filename,
		const char __user *const __user *__argv,
		const char __user *const __user *__envp,
		int flags)

// 下面这些函数是 SYSCALL_DEFINE5 内部调用的
// ->
int do_execveat(int fd, struct filename *filename,            // 暴露
		const char __user *const __user *__argv,
		const char __user *const __user *__envp,
		int flags)
// ->
static int do_execveat_common(int fd, struct filename *filename,
			      struct user_arg_ptr argv,
			      struct user_arg_ptr envp,
			      int flags)
// ->
static int __do_execve_file(int fd, struct filename *filename,
			    struct user_arg_ptr argv,
			    struct user_arg_ptr envp,
			    int flags, struct file *file)

// arch/x86/entry/syscalls/syscall_64.tbl
#
# 64-bit system call numbers and entry vectors
#
# The format is:
# <number> <abi> <name> <entry point>
#
# The __x64_sys_*() stubs are created on-the-fly for sys_*() system calls
#
# The abi is "common", "64" or "x32" for this file.
#
0	common	read			__x64_sys_read
1	common	write			__x64_sys_write
...
322	64	execveat		__x64_sys_execveat/ptregs
545	x32	execveat		__x32_compat_sys_execveat/ptregs

[[email protected] /root]
#bpftrace -l "*execveat*" |grep -E 'kprobe|trace'
tracepoint:syscalls:sys_enter_execveat
tracepoint:syscalls:sys_exit_execveat
kprobe:__ia32_compat_sys_execveat
kprobe:__ia32_sys_execveat
kprobe:__x64_sys_execveat
kprobe:do_execveat

# bpftrace -l "kprobe:do*" |grep 'execve'
kprobe:do_execve_file
kprobe:do_execve
kprobe:do_execveat

// handler 函数必须以 syscall__ 开头，后面的名称可以随意自定义（不要求一定 syscall name 相同）。
int syscall__recvfrom_entry(struct pt_regs* ctx)
{
    u64 tgid = bpf_get_current_pid_tgid();
    u32 pid = tgid >> 32;
    FILTER_PID
    void* buf = (void*) PT_REGS_PARM2(ctx);
    bpf_trace_printk("buffer addr %llx", buf);
    recv_map.update(&tgid, &buf);
    return 0;
}
...
// 必须使用 bpf.get_syscall_fnname("recvfrom") 来获取 ARCH 相关的 syscall name。
attach_res = bpf.attach_kprobe(bpf.get_syscall_fnname("recvfrom"), "recvfrom_entry");
if(!attach_res.ok()) {
        LOG_ERROR("attach_kprobe recvfrom_entry failed, error: %s", attach_res.msg().c_str());
        return;
}

// 使用 kprobe 插桩系统调用函数时，函数名称是 ARCH 相关的，不具有通用性。
SEC("kprobe/sys_execve") // 未开启 CONFIG_ARCH_HAS_SYSCALL_WRAPPER
SEC("kprobe/__ia32_sys_execve") // 开启 CONFIG_ARCH_HAS_SYSCALL_WRAPPER
SEC("kprobe/__arm64_sys_execve")
SEC("kprobe/__x64_sys_execve")

// 使用 ksyscall 前缀，可以指定 ARCH 无关的系统调用名称。
SEC("ksyscall/execve")
// 使用 BPF_KPROBE_SYSCALL 函数宏，收益：
// 1. 可以直接按照 syscall 参数列表来指定各参数类型和名称；
// 2. BPF_KPROBE_SYSCALL 内部自动兼容 CONFIG_ARCH_HAS_SYSCALL_WRAPPER 开启与否；
//    + 未开起：直接从 struct pt_regs *ctx 中读取各系统调用参数；
//    + 开启：先使用 (struct pt_regs *)PT_REGS_PARM1(ctx) 来获取 regs，然后再使用
//    PT_REGS_PARM*_CORE_SYSCALL(ctx) 从 regs 中读取各系统调用参数。
int BPF_KPROBE_SYSCALL(hello, const char *pathname)
{
   struct data_t data = {};
   struct user_msg_t *p;

   data.pid = bpf_get_current_pid_tgid() >> 32;
   data.uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;

   bpf_get_current_comm(&data.command, sizeof(data.command));
   bpf_probe_read_user_str(&data.path, sizeof(data.path), pathname);

   p = bpf_map_lookup_elem(&my_config, &data.uid);
   if (p != 0) {
      bpf_probe_read_kernel_str(&data.message, sizeof(data.message), p->message);
   } else {
      bpf_probe_read_kernel_str(&data.message, sizeof(data.message), message);
   }

   // 还可以继续使用 ctx，类型为原始的 struct pt_regs *.
   bpf_perf_event_output(ctx, &output, BPF_F_CURRENT_CPU, &data, sizeof(data));
   return 0;
}

// libbpf ksyscall 是在使用 libbpf 来做 attach 时自动处理的。（所以 cilium 不支持）
// https://github.com/libbpf/libbpf/blob/1728e3e4bef0e138ea95ffe62163eb9a6ac6fa32/src/libbpf.c#L10379
struct bpf_link *bpf_program__attach_ksyscall(const struct bpf_program *prog,
					      const char *syscall_name,
					      const struct bpf_ksyscall_opts *opts)
{
	LIBBPF_OPTS(bpf_kprobe_opts, kprobe_opts);
	char func_name[128];

	if (!OPTS_VALID(opts, bpf_ksyscall_opts))
		return libbpf_err_ptr(-EINVAL);

	// 内核支持 FEAT_SYSCALL_WRAPPER 的情况下，自动给 syscall_name 添加 ARCH 前缀，如 __x64, __arm64
	// 从而
	if (kernel_supports(prog->obj, FEAT_SYSCALL_WRAPPER)) {
		/* arch_specific_syscall_pfx() should never return NULL here
		 * because it is guarded by kernel_supports(). However, since
		 * compiler does not know that we have an explicit conditional
		 * as well.
		 */
		snprintf(func_name, sizeof(func_name), "__%s_sys_%s",
			 arch_specific_syscall_pfx() ? : "", syscall_name);
	} else {
		snprintf(func_name, sizeof(func_name), "__se_sys_%s", syscall_name);
	}

	kprobe_opts.retprobe = OPTS_GET(opts, retprobe, false);
	kprobe_opts.bpf_cookie = OPTS_GET(opts, bpf_cookie, 0);

	return bpf_program__attach_kprobe_opts(prog, func_name, &kprobe_opts);
}

// cilium/ebpg 使用 BPF_PROG，参数列表中直接指定内核函数的参数列表。

// https://github.com/cilium/ebpf/blob/02200f5764662c8fd3779172de216e5b93b3fefc/examples/fentry/fentry.c#L77
SEC("fentry/tcp_connect")
int BPF_PROG(tcp_connect, struct sock *sk) {
	if (sk->__sk_common.skc_family != AF_INET) {
		return 0;
	}

	struct event *tcp_info;
	tcp_info = bpf_ringbuf_reserve(&events, sizeof(struct event), 0);
	if (!tcp_info) {
		return 0;
	}

	tcp_info->saddr = sk->__sk_common.skc_rcv_saddr; // 对于 fentry，可以直接解引用指针。
	tcp_info->daddr = sk->__sk_common.skc_daddr;
	tcp_info->dport = sk->__sk_common.skc_dport;
	tcp_info->sport = bpf_htons(sk->__sk_common.skc_num);

	bpf_get_current_comm(&tcp_info->comm, TASK_COMM_LEN);

	bpf_ringbuf_submit(tcp_info, 0);

	return 0;
}

// https://github.com/cilium/ebpf/issues/1016#issuecomment-1523843050
SEC("kprobe/sys_read") // 对于 cilium/ebpf 而言，系统调用函数必须以 kprobe/sys_ 开头，
int syscall__probe_entry_read(struct pt_regs *ctx)
{
    u64 id = bpf_get_current_pid_tgid();
    u32 pid = id >> 32;
    if (pid != A_PID)
        return 0;

    //
    struct pt_regs *__ctx = (struct pt_regs *)PT_REGS_PARM1_CORE(ctx);
    if (!__ctx)
    {
        bpf_printk("[sys_read_entry]:failed to load original ctx");
        return 0;
    }

    bpf_printk("[sys_read_entry]:called for [PID:%lu]\n", pid);

    // Stash arguments
    struct data_args_t read_args = {};

    read_args.fd = (int)PT_REGS_PARM1_CORE(__ctx);
    char *read_buf = (char *)PT_REGS_PARM2_CORE(__ctx);

    if (!read_buf)
    {
        bpf_printk("[sys_read_entry]:read buf is null");
        return 0;
    }

    read_args.buf = read_buf;
    bpf_map_update_elem(&active_read_args_map, &id, &read_args, BPF_ANY);
    return 0;
}


// https://github.com/time-river/Linux-eBPF-Learning/commits/63e6cebb9fb25f0aff94486bef888b766b21fe30/2-openat/openat3_kern.c
SEC("kprobe/sys_openat")
int hello(struct pt_regs *ctx) {
	char fmt[] = "@dirfd='%d' @pathname='%s'";
	struct pt_regs *real_regs = (struct pt_regs *)PT_REGS_PARM1(ctx);
	int dirfd = PT_REGS_PARM1_CORE(real_regs);
	char *pathname = (char *)PT_REGS_PARM2_CORE(real_regs);

	bpf_trace_printk(fmt, sizeof(fmt), dirfd, pathname);

	return 0;
}

// https://blog.cloudflare.com/zh-cn/live-patch-security-vulnerabilities-with-ebpf-lsm-zh-cn/
SEC("lsm/cred_prepare")
int BPF_PROG(handle_cred_prepare, struct cred *new, const struct cred *old,
             gfp_t gfp, int ret)
{
    struct pt_regs *regs;
    struct task_struct *task;
    kernel_cap_t caps;
    int syscall;
    unsigned long flags;

    // If previous hooks already denied, go ahead and deny this one
    if (ret) {
        return ret;
    }

    task = bpf_get_current_task_btf();
    regs = (struct pt_regs *) bpf_task_pt_regs(task); // 也是非直接 struct pt_regs *
    // In x86_64 orig_ax has the syscall interrupt stored here
    syscall = regs->orig_ax;
    caps = task->cred->cap_effective;

    // Only process UNSHARE syscall, ignore all others
    if (syscall != UNSHARE_SYSCALL) {
        return 0;
    }

    // PT_REGS_PARM1_CORE pulls the first parameter passed into the unshare syscall
    flags = PT_REGS_PARM1_CORE(regs); // 所以需要使用 PT_REGS_PARM1_CORE 来从 regs 中获取第一参数值。

    // Ignore any unshare that does not have CLONE_NEWUSER
    if (!(flags & CLONE_NEWUSER)) {
        return 0;
    }

    // Allow tasks with CAP_SYS_ADMIN to unshare (already root)
    if (caps.cap[CAP_TO_INDEX(CAP_SYS_ADMIN)] & CAP_TO_MASK(CAP_SYS_ADMIN)) {
        return 0;
    }

    return -EPERM;
}

// libpf/src/bpf_tracing.h

/*
 * When invoked from a syscall handler kprobe, returns a pointer to a
 * struct pt_regs containing syscall arguments and suitable for passing to
 * PT_REGS_PARMn_SYSCALL() and PT_REGS_PARMn_CORE_SYSCALL().
 */
#ifndef PT_REGS_SYSCALL_REGS
/* By default, assume that the arch selects ARCH_HAS_SYSCALL_WRAPPER. */
#define PT_REGS_SYSCALL_REGS(ctx) ((struct pt_regs *)PT_REGS_PARM1(ctx))
#endif

// https://www.joyk.com/dig/detail/1653814776687666

/* TP_PROTO(struct pt_regs *regs, long id) 定义了可以通过 bpf_raw_tracepoint_args 的 args 拿到的信息。 id 是系统 */
/* 调用的 id， regs 中包含了对应的系统调用的参数。 可以通过 id 过滤只处理 fchmodat 的系统调用事件（通过命令 */
/* ausyscall fchmodat 找到对应的系统调用 id）， */

TRACE_EVENT_FN(sys_enter,
    TP_PROTO(struct pt_regs *regs, long id),
    TP_ARGS(regs, id),
    TP_STRUCT__entry(
        __field(    long,           id              )
        __array(    unsigned long,  args,   6       )
    ),
    TP_fast_assign(
        __entry->id = id;
        syscall_get_arguments(current, regs, __entry->args);
    ),
    TP_printk("NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)",
          __entry->id,
          __entry->args[0], __entry->args[1], __entry->args[2],
          __entry->args[3], __entry->args[4], __entry->args[5]),
    syscall_regfunc, syscall_unregfunc
);

struct bpf_raw_tracepoint_args {
    __u64 args[0];
};

/* fchmodat 这个系统调用的函数定义如下: */
/* : int fchmodat(int dirfd, const char *pathname, mode_t mode, int flags); */

/* 因为 regs 是 pt_regs 类型，所以我们可以通过 PT_REGS_PARM1_CORE(regs) 获取第一个参数的值， */
/* PT_REGS_PARM2_CORE(regs) 获取第二个参数的值， PT_REGS_PARM3_CORE(regs) 获取第三个参数的值，以此类推， 可以通过 */
/* PT_REGS_PARM4_CORE 和 PT_REGS_PARM5_CORE 分别获取 regs 中第四个和第五个参数的值。 */

SEC("raw_tracepoint/sys_enter")
int raw_tracepoint__sys_enter(struct bpf_raw_tracepoint_args *ctx)
{
    unsigned long syscall_id = ctx->args[1];
    if(syscall_id != 268)    // 过滤系统调用 id，只处理 fchmodat 系统调用
        return 0;

    struct pt_regs * regs = (struct pt_regs *) ctx->args[0];

    char pathname[256];
    u32 mode;

    // 读取第二个参数的值
    char *pathname_ptr = (char *) PT_REGS_PARM2_CORE(regs);
    bpf_core_read_user_str(&pathname, sizeof(pathname), pathname_ptr);

    // 读取第三个参数的值
    mode = (u32) PT_REGS_PARM3_CORE(regs);

    char fmt[] = "fchmodat %s %d\n";
    bpf_trace_printk(fmt, sizeof(fmt), &pathname, mode);
    return 0;
}

// initial tail call entry from sys_enter.
// purpose is to save the syscall info of relevant syscalls through the task_info map.
// can move to one of:
// 1. sys_enter_submit, general event submit logic from sys_enter
// 2. directly to syscall tail hanler in sys_enter_tails
SEC("raw_tracepoint/sys_enter_init")
int sys_enter_init(struct bpf_raw_tracepoint_args *ctx)
{
    struct task_struct *task = (struct task_struct *) bpf_get_current_task();

    u64 pid_tgid = bpf_get_current_pid_tgid();
    u32 tid = pid_tgid;
    task_info_t *task_info = bpf_map_lookup_elem(&task_info_map, &tid);
    if (unlikely(task_info == NULL)) {
        u32 pid = pid_tgid >> 32;
        task_info = init_task_info(tid, pid, NULL);
        if (unlikely(task_info == NULL)) {
            return 0;
        }
    }

    syscall_data_t *sys = &(task_info->syscall_data);
    sys->id = ctx->args[1];

    if (get_kconfig(ARCH_HAS_SYSCALL_WRAPPER)) {
        struct pt_regs *regs = (struct pt_regs *) ctx->args[0];

        if (is_x86_compat(task)) {
#if defined(bpf_target_x86)
            sys->args.args[0] = BPF_CORE_READ(regs, bx); // regs 是非直接指针，所以需要 CORE READ；
            sys->args.args[1] = BPF_CORE_READ(regs, cx);
            sys->args.args[2] = BPF_CORE_READ(regs, dx);
            sys->args.args[3] = BPF_CORE_READ(regs, si);
            sys->args.args[4] = BPF_CORE_READ(regs, di);
            sys->args.args[5] = BPF_CORE_READ(regs, bp);
#endif // bpf_target_x86
        } else {
            sys->args.args[0] = PT_REGS_PARM1_CORE_SYSCALL(regs);
            sys->args.args[1] = PT_REGS_PARM2_CORE_SYSCALL(regs);
            sys->args.args[2] = PT_REGS_PARM3_CORE_SYSCALL(regs);
            sys->args.args[3] = PT_REGS_PARM4_CORE_SYSCALL(regs);
            sys->args.args[4] = PT_REGS_PARM5_CORE_SYSCALL(regs);
            sys->args.args[5] = PT_REGS_PARM6_CORE_SYSCALL(regs);
        }
    } else {
        bpf_probe_read(sys->args.args, sizeof(6 * sizeof(u64)), (void *) ctx->args);
    }

    if (is_compat(task)) {
        // Translate 32bit syscalls to 64bit syscalls, so we can send to the correct handler
        u32 *id_64 = bpf_map_lookup_elem(&sys_32_to_64_map, &sys->id);
        if (id_64 == 0)
            return 0;

        sys->id = *id_64;
    }

    // exit, exit_group and rt_sigreturn syscalls don't return
    if (sys->id != SYSCALL_EXIT && sys->id != SYSCALL_EXIT_GROUP &&
        sys->id != SYSCALL_RT_SIGRETURN) {
        sys->ts = bpf_ktime_get_ns();
        task_info->syscall_traced = true;
    }

    // if id is irrelevant continue to next tail call
    bpf_tail_call(ctx, &sys_enter_submit_tail, sys->id);

    // call syscall handler, if exists
    bpf_tail_call(ctx, &sys_enter_tails, sys->id);
    return 0;
}

// https://github.com/libbpf/libbpf/blob/1728e3e4bef0e138ea95ffe62163eb9a6ac6fa32/src/bpf_tracing.h#L666

/*
 * BPF_PROG is a convenience wrapper for generic tp_btf/fentry/fexit and
 * similar kinds of BPF programs, that accept input arguments as a single
 * pointer to untyped u64 array, where each u64 can actually be a typed
 * pointer or integer of different size. Instead of requring user to write
 * manual casts and work with array elements by index, BPF_PROG macro
 * allows user to declare a list of named and typed input arguments in the
 * same syntax as for normal C function. All the casting is hidden and
 * performed transparently, while user code can just assume working with
 * function arguments of specified type and name.
 *
 * Original raw context argument is preserved as well as 'ctx' argument.
 * This is useful when using BPF helpers that expect original context
 * as one of the parameters (e.g., for bpf_perf_event_output()).
 */
#define BPF_PROG(name, args...)						    \
name(unsigned long long *ctx);						    \
static __always_inline typeof(name(0))					    \
____##name(unsigned long long *ctx, ##args);				    \
typeof(name(0)) name(unsigned long long *ctx)				    \
{									    \
	_Pragma("GCC diagnostic push")					    \
	_Pragma("GCC diagnostic ignored \"-Wint-conversion\"")		    \
	return ____##name(___bpf_ctx_cast(args));			    \
	_Pragma("GCC diagnostic pop")					    \
}									    \
static __always_inline typeof(name(0))					    \
____##name(unsigned long long *ctx, ##args)

/*
 * BPF_KPROBE serves the same purpose for kprobes as BPF_PROG for
 * tp_btf/fentry/fexit BPF programs. It hides the underlying platform-specific
 * low-level way of getting kprobe input arguments from struct pt_regs, and
 * provides a familiar typed and named function arguments syntax and
 * semantics of accessing kprobe input paremeters.
 *
 * Original struct pt_regs* context is preserved as 'ctx' argument. This might
 * be necessary when using BPF helpers like bpf_perf_event_output().
 */
#define BPF_KPROBE(name, args...)					    \
name(struct pt_regs *ctx);						    \
static __always_inline typeof(name(0))					    \
____##name(struct pt_regs *ctx, ##args);				    \
typeof(name(0)) name(struct pt_regs *ctx)				    \
{									    \
	_Pragma("GCC diagnostic push")					    \
	_Pragma("GCC diagnostic ignored \"-Wint-conversion\"")		    \
	return ____##name(___bpf_kprobe_args(args));			    \
	_Pragma("GCC diagnostic pop")					    \
}									    \
static __always_inline typeof(name(0))					    \
____##name(struct pt_regs *ctx, ##args)


/*
 * BPF_KRETPROBE is similar to BPF_KPROBE, except, it only provides optional
 * return value (in addition to `struct pt_regs *ctx`), but no input
 * arguments, because they will be clobbered by the time probed function
 * returns.
 */
#define BPF_KRETPROBE(name, args...)					    \
name(struct pt_regs *ctx);						    \
static __always_inline typeof(name(0))					    \
____##name(struct pt_regs *ctx, ##args);				    \
typeof(name(0)) name(struct pt_regs *ctx)				    \
{									    \
	_Pragma("GCC diagnostic push")					    \
	_Pragma("GCC diagnostic ignored \"-Wint-conversion\"")		    \
	return ____##name(___bpf_kretprobe_args(args));			    \
	_Pragma("GCC diagnostic pop")					    \
}									    \
static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args)


/*
 * BPF_KSYSCALL is a variant of BPF_KPROBE, which is intended for
 * tracing syscall functions, like __x64_sys_close. It hides the underlying
 * platform-specific low-level way of getting syscall input arguments from
 * struct pt_regs, and provides a familiar typed and named function arguments
 * syntax and semantics of accessing syscall input parameters.
 *
 * Original struct pt_regs * context is preserved as 'ctx' argument. This might
 * be necessary when using BPF helpers like bpf_perf_event_output().
 *
 * At the moment BPF_KSYSCALL does not transparently handle all the calling
 * convention quirks for the following syscalls:
 *
 * - mmap(): __ARCH_WANT_SYS_OLD_MMAP.
 * - clone(): CONFIG_CLONE_BACKWARDS, CONFIG_CLONE_BACKWARDS2 and
 *            CONFIG_CLONE_BACKWARDS3.
 * - socket-related syscalls: __ARCH_WANT_SYS_SOCKETCALL.
 * - compat syscalls.
 *
 * This may or may not change in the future. User needs to take extra measures
 * to handle such quirks explicitly, if necessary.
 *
 * This macro relies on BPF CO-RE support and virtual __kconfig externs.
 */
#define BPF_KSYSCALL(name, args...)					    \
name(struct pt_regs *ctx);						    \
extern _Bool LINUX_HAS_SYSCALL_WRAPPER __kconfig;			    \
static __always_inline typeof(name(0))					    \
____##name(struct pt_regs *ctx, ##args);				    \
typeof(name(0)) name(struct pt_regs *ctx)				    \
{									    \
	struct pt_regs *regs = LINUX_HAS_SYSCALL_WRAPPER		    \
			       ? (struct pt_regs *)PT_REGS_PARM1(ctx)	    \
			       : ctx;					    \
	_Pragma("GCC diagnostic push")					    \
	_Pragma("GCC diagnostic ignored \"-Wint-conversion\"")		    \
	if (LINUX_HAS_SYSCALL_WRAPPER)					    \
		return ____##name(___bpf_syswrap_args(args));		    \
	else								    \
		return ____##name(___bpf_syscall_args(args));		    \
	_Pragma("GCC diagnostic pop")					    \
}									    \
static __always_inline typeof(name(0))					    \
____##name(struct pt_regs *ctx, ##args)

#define BPF_KPROBE_SYSCALL BPF_KSYSCALL

/* BPF_UPROBE and BPF_URETPROBE are identical to BPF_KPROBE and BPF_KRETPROBE,
 * but are named way less confusingly for SEC("uprobe") and SEC("uretprobe")
 * use cases.
 */
#define BPF_UPROBE(name, args...)  BPF_KPROBE(name, ##args)
#define BPF_URETPROBE(name, args...)  BPF_KRETPROBE(name, ##args)