ebpf 读 ppid 错误

共计 1523 个字符，预计需要花费 4 分钟才能阅读完成。

 ⚡  Thu 15 Jun - 15:48  /usr/share/bcc/tools 
 root@ebpf  uname -a
Linux ebpf 5.15.0-73-generic #80-Ubuntu SMP Mon May 15 15:18:26 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

报错信息

 ✘ ⚡  Thu 15 Jun - 15:39  ~/go/src/tp-test 
 root@ebpf  docker run -it -v$PWD/ebpf/execve:/src/ ghcr.io/eunomia-bpf/ecc-`uname -m`:latest && ecli ./ebpf/execve/package.json
ls: cannot access '/src/*.h': No such file or directory
INFO [ecc_rs::bpf_compiler] Compiling bpf object...
INFO [ecc_rs::bpf_compiler] Generating package json..
INFO [ecc_rs::bpf_compiler] Packing ebpf object and config into /src/package.json...
INFO [faerie::elf] strtab: 0x597e symtab 0x59b8 relocs 0x5a00 sh_offset 0x5a00
libbpf: prog 'tracepoint__syscalls__sys_enter_execve': BPF program load failed: Permission denied
libbpf: prog 'tracepoint__syscalls__sys_enter_execve': -- BEGIN PROG LOAD LOG --
arg#0 reference type('UNKNOWN ') size cannot be determined: -22
; struct task_struct *task = (struct task_struct *)bpf_get_current_task();
0: (85) call bpf_get_current_task#35
; u64 ppid = task->real_parent->tgid;
1: (79) r1 = *(u64 *)(r0 +2400)
R0 invalid mem access 'inv'
processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
-- END PROG LOAD LOG --
libbpf: prog 'tracepoint__syscalls__sys_enter_execve': failed to load: -13
libbpf: failed to load object 'execv_bpf<ʉ�'
Error: Bpf("Failed to start polling: Bpf(\"Failed to load and attach: Failed to load bpf object\"), receiving on a closed channel")

错误代码

struct task_struct *task = (typeof(task))bpf_get_current_task();

u64 ppid = task->real_parent->tgid;

正确代码

struct task_struct *task = (struct task_struct *)bpf_get_current_task();
	u64 ppid =  (u64)BPF_CORE_READ(task, real_parent, tgid);