eBPF 零侵入可观测性开发实战

sudo bpftrace -e '
kprobe:tcp_v4_connect {
    @start[tid] = nsecs;
}

kretprobe:tcp_v4_connect /@start[tid]/ {
    @us[comm] = hist((nsecs - @start[tid]) / 1000);
    delete(@start[tid]);
}
'

#!/usr/bin/env bpftrace
# 文件名：syscall_count.bt
# 用途：统计每个进程的系统调用次数，每 5 秒输出一次 top 20
# 运行：sudo bpftrace syscall_count.bt

BEGIN
{
    printf("Tracing syscalls... Ctrl-C to stop.\n");
    printf("Output every 5 seconds, top 20 by count.\n\n");
}

// 用 tracepoint 而不是 kprobe：tracepoint 是稳定 ABI，跨内核版本兼容
// tracepoint:syscalls:sys_enter_* 会匹配所有 syscall 入口
tracepoint:syscalls:sys_enter_*
{
    // comm 是当前进程名（16 字节截断），pid 是进程 ID
    // 用 comm 作为 key 更直观，想细粒度就换成 pid
    @count[comm] = count();
}

// interval:s:5 每 5 秒触发一次
interval:s:5
{
    printf("\n=== top 20 syscall callers (at %s) ===\n", nsecs);
    // print() 默认按值排序，limit 20 取前 20
    print(@count, 20);

    // 清空重新计数，避免数据累积看不出来变化
    // 如果想看累计值就注释掉这行
    clear(@count);
}

END
{
    printf("\nExiting. Final stats:\n");
    print(@count, 20);
    clear(@count);
}

=== top 20 syscall callers (at 1697234532) ===
@count[kubelet]: 18432
@count[etcd]: 9234
@count[apiserver]: 8102
@count[node-exporter]: 3321
@count[containerd]: 2104
@count[prometheus]: 1823
@count[kube-proxy]: 994
...

#!/usr/bin/env python3
# 文件名：trace_openat.py
# 用途：跟踪所有 openat 系统调用，输出 PID/进程名/文件名/调用次数
# 运行：sudo python3 trace_openat.py
# 依赖：apt install bpfcc-tools python3-bpfcc linux-headers-$(uname -r)

from bcc import BPF
from collections import defaultdict
import time

# BPF C 程序
# 这里用 tracepoint 而不是 kprobe，因为 tracepoint 直接暴露了参数结构体
# sys_enter_openat 的参数格式在 /sys/kernel/debug/tracing/events/syscalls/sys_enter_openat/format
bpf_text = """
#include <uapi/linux/ptrace.h>
#include <linux/sched.h>

// 为什么用 HASH 而不是 ARRAY：
// key 是 pid，但 pid 取值范围 0~4M+，用 ARRAY 太浪费内存
// HASH 按需分配，更省
struct val_t {
    u64 count;
    char comm[16];
};

BPF_HASH(openat_count, u32, struct val_t);

// tracepoint:syscalls:sys_enter_openat
// args->dfd: 目录 fd（AT_FDCWD=-100 表示当前目录）
// args->filename: 用户态指针，指向要打开的文件路径
// args->flags:   打开标志（O_RDONLY 等）
TRACEPOINT_PROBE(syscalls, sys_enter_openat)
{
    u32 pid = bpf_get_current_pid_tgid() >> 32;
    struct val_t val = {0};

    // 先查现有记录
    struct val_t *existing = openat_count.lookup(&pid);
    if (existing) {
        existing->count++;
    } else {
        // 新 PID，初始化
        val.count = 1;
        bpf_get_current_comm(&val.comm, sizeof(val.comm));
        openat_count.update(&pid, &val);
    }

    return 0;
}
"""

# 单独的程序：把每个 PID 最近一次打开的文件名也存下来
# 这样能在用户态输出"PID xxx 打开了 yyy"
bpf_text_filename = """
#include <uapi/linux/ptrace.h>

BPF_HASH(last_file, u32, char[256]);

TRACEPOINT_PROBE(syscalls, sys_enter_openat)
{
    u32 pid = bpf_get_current_pid_tgid() >> 32;
    char filename[256] = {0};

    // args->filename 是用户态指针，用 bpf_probe_read_user 读取
    // 注意：直接解引用用户态指针会触发 verifier 报错
    bpf_probe_read_user_str(&filename, sizeof(filename), (void *)args->filename);

    last_file.update(&pid, &filename);
    return 0;
}
"""

print("Loading BPF program...")
b = BPF(text=bpf_text)
b2 = BPF(text=bpf_text_filename)

# BCC 的 TRACEPOINT_PROBE 会自动 attach，不用手动 attach_kprobe
print("Tracing openat... Ctrl-C to stop.")
print(f"{'PID':>8}  {'COMM':<16}  {'COUNT':>8}  LAST_FILE")
print("-" * 80)

try:
    while True:
        time.sleep(2)
        # 读 count map
        count_map = b["openat_count"]
        file_map = b2["last_file"]

        # 收集结果
        rows = []
        for k, v in count_map.items():
            pid = k.value
            comm = v.comm.decode('utf-8', errors='replace').rstrip('\x00')
            count = v.count
            last = ""
            try:
                last = file_map[k].value.decode('utf-8', errors='replace').rstrip('\x00')
            except KeyError:
                pass
            rows.append((pid, comm, count, last))

        # 按 count 降序
        rows.sort(key=lambda x: x[2], reverse=True)

        print(f"\n=== top 15 openat callers (at {time.strftime('%H:%M:%S')}) ===")
        for pid, comm, count, last in rows[:15]:
            print(f"{pid:>8}  {comm:<16}  {count:>8}  {last}")

except KeyboardInterrupt:
    print("\nExiting.")

=== top 15 openat callers (at 14:23:11) ===
    1234  kubelet             8421  /var/lib/kubelet/config.yaml
    5678  etcd               5234  /var/lib/etcd/member/wal/0.wal
    9012  apiserver          3321  /etc/kubernetes/pki/apiserver.crt
    3456  containerd         2104  /run/containerd/containerd.sock
   ...

# hubble-values.yaml - Helm 配置
# 安装命令：
#   helm upgrade cilium cilium/cilium --namespace kube-system \
#     -f hubble-values.yaml
hubble:
  enabled: true
  # 监听 Unix socket，安全（不暴露端口）
  socketPath: /var/run/cilium/hubble.sock
  # metrics 服务，给 Prometheus 抓
  metrics:
    enabled:
      - flow
      - port-distribution
      - dns
      - http
      - tcp
    # 采集维度：按 namespace/pod/source/destination 聚合
    contextOptions:
      - source
      - destination
      - namespace
    # 采样率：50:1，生产推荐配置，全采样 CPU 开销大
    sampling: 50
  relay:
    enabled: true
    # relay 是 Hubble 的 gRPC 代理，多节点聚合用
    listenAddress: ":4245"
  ui:
    enabled: true
    # Hubble UI 提供 service map 可视化
    service:
      type: ClusterIP

# Cilium 本身的配置
kubeProxyReplacement: partial
hostServices:
  enabled: true
# 关键：开启 L7 协议解析（默认只看 L3/L4）
# 注意：开了 L7 会增加少量 CPU 开销（每个连接 ~3%）
l7Proxy: true

# 确认 hubble relay 起来了
kubectl -n kube-system get pods -l k8s-app=hubble-relay

# 端口转发到本地
cilium hubble port-forward &
# 默认监听 localhost:4245

# 看实时流量
hubble observe --namespace prod --protocol http

# 看被网络策略 drop 的流量（排障神器）
hubble observe --verdict DROPPED

# 看某个 Pod 的所有流量
hubble observe --from-pod prod/payment-xxx --type flow

# 看某个 Pod 的 HTTP 请求详情（L7）
hubble observe --from-pod prod/checkout-xxx --protocol http -o json

Jul 14 10:23:45.123  default/checkout-abc (ID:12345) -> default/payment-def (ID:67890)
  HTTP POST /api/v1/charge HTTP/1.1 200 OK latency=82ms
Jul 14 10:23:45.456  default/payment-def (ID:67890) -> default/db-postgres (ID:11111)
  TCP SYN (flags=SYN,ACK) latency=1.2ms
Jul 14 10:23:46.789  default/payment-def (ID:67890) <- default/checkout-abc (ID:12345)
  HTTP POST /api/v1/charge (verdict=DROPPED) latency=2ms
  DropReason: Policy denied (egress rule not found)

[ checkout ] ──HTTP──> [ payment ] ──TCP──> [ db-postgres ]
     │                    │
     └──HTTP──> [ cart ]   └─X─(denied)─> [ redis-cache ]

# 统计每个容器的系统调用次数
sudo /usr/share/bcc/tools/syscount -c -P

# 跟踪特定进程的慢函数调用
sudo /usr/share/bcc/tools/funcslower do_sys_open -p $(pgrep -n myapp)

#!/usr/bin/env python3
# 文件名：container_syscall.py
# 用途：按容器名聚合 syscall 调用次数，定位"哪个容器在折腾内核"
# 运行：sudo python3 container_syscall.py

from bcc import BPF
import os
import argparse
import time
import struct

# BPF 程序：抓 syscall 入口，按 cgroup id 聚合
bpf_text = r"""
#include <uapi/linux/ptrace.h>
#include <linux/sched.h>

// key: cgroup id (32bit) + syscall id
// value: 计数
struct key_t {
    u32 cgid;
    int syscall_id;
};

BPF_HASH(syscall_count, struct key_t, u64);

// 用 raw_tracepoint 而不是 tracepoint，性能更好（少一次参数拷贝）
RAW_TRACEPOINT_PROBE(sys_enter)
{
    // raw tracepoint 的 ctx 是一个 args 数组
    // args[0] 是 struct pt_regs *
    // args[1] 是 long syscall_id
    struct key_t key = {0};
    u32 cgid = bpf_get_current_cgroup_id();  // 拿 cgroup id
    int syscall_id = (int)ctx->args[1];

    key.cgid = cgid;
    key.syscall_id = syscall_id;

    u64 zero = 0;
    u64 *val = syscall_count.lookup_or_try_init(&key, &zero);
    if (val) {
        (*val)++;
    }
    return 0;
}
"""

def cgid_to_container(cgid, cgroup_root="/sys/fs/cgroup"):
    """通过遍历 cgroupfs 把 cgid 反查为 container path。
    
    cgroup v2 里每个 cgroup 在 cgroupfs 里有一个目录，目录的 inode 号就是 cgid。
    这个函数缓存一份映射，避免每次都遍历。
    """
    # 简化版：遍历 /sys/fs/cgroup/kubepods 的子目录，匹配 inode
    # 生产代码应该缓存 + 增量更新
    for root, dirs, files in os.walk(cgroup_root):
        try:
            ino = os.stat(root).st_ino
            if ino == cgid:
                return root
        except OSError:
            continue
    return None

def parse_container_id(path):
    """从 cgroup path 提取 container id（kubepods 的格式）。"""
    if not path:
        return "<unknown>"
    # 形如 /sys/fs/cgroup/kubepods/pod-xxx/<container-id>
    parts = path.split("/")
    if "kubepods" in parts:
        idx = parts.index("kubepods")
        if len(parts) > idx + 2:
            return parts[-1][:12]  # 截短，跟 docker ps 显示一致
    return path

# syscall 名字表（部分常见的，完整表见 /usr/include/x86_64-linux-gnu/asm/unistd_64.h）
SYSCALL_NAMES = {
    0: "read", 1: "write", 2: "open", 3: "close", 4: "stat",
    5: "fstat", 9: "mmap", 10: "mprotect", 11: "munmap", 12: "brk",
    21: "access", 32: "dup", 35: "nanosleep", 39: "getpid", 41: "socket",
    42: "connect", 43: "accept", 44: "sendto", 45: "recvfrom",
    49: "bind", 50: "listen", 56: "clone", 57: "fork", 59: "execve",
    62: "kill", 72: "fcntl", 79: "getcwd", 80: "chdir", 82: "rename",
    83: "mkdir", 84: "rmdir", 85: "creat", 87: "unlink",
    89: "readlink", 102: "getuid", 158: "arch_prctl",
    202: "futex", 217: "getdents64", 228: "clock_gettime",
    232: "epoll_wait", 233: "epoll_ctl", 257: "openat",
    262: "newfstatat", 287: "epoll_pwait", 288: "accept4",
    291: "epoll_create1", 292: "dup3", 293: "pipe2",
    302: "prlimit64", 318: "getrandom", 332: "statx",
}

print("Loading BPF program (this takes ~5s)...")
b = BPF(text=bpf_text)

print("Tracing syscalls per container... Ctrl-C to stop.")
print(f"{'CONTAINER':<16} {'SYSCALL':<14} {'COUNT':>10}")
print("-" * 50)

# cgid -> container name 缓存
cgid_cache = {}

try:
    while True:
        time.sleep(5)
        # 清屏（可选）
        print("\n" + "=" * 50)

        # 收集结果
        rows = []
        for k, v in b["syscall_count"].items():
            cgid = k.cgid
            sid = k.syscall_id
            cnt = v.value

            # 缓存 cgid -> container name
            if cgid not in cgid_cache:
                path = cgid_to_container(cgid)
                cgid_cache[cgid] = parse_container_id(path) if path else f"cgid:{cgid}"

            container = cgid_cache[cgid]
            sname = SYSCALL_NAMES.get(sid, f"sys_{sid}")
            rows.append((container, sname, cnt))

        # 按容器分组，每组内按 count 降序
        rows.sort(key=lambda x: (x[0], -x[2]))

        for container, sname, cnt in rows[:30]:
            print(f"{container:<16} {sname:<14} {cnt:>10}")

        # 清空计数，看增量
        b["syscall_count"].clear()

except KeyboardInterrupt:
    print("\nExiting.")

// tcp_connect_latency.bpf.c
#include <linux/bpf.h>
#include <linux/tcp.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>

// key: PID（其实是 tgid）
// value: 连接开始时间戳
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __type(key, u32);
    __type(value, u64);
    __uint(max_entries, 65536);
} connect_start SEC(".maps");

// key: pod 名字（前 16 字节，用 comm）+ 远端 IP
// value: 按延迟区间分桶的计数
struct latency_key {
    char comm[16];
    u32 raddr;
};

struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __type(key, struct latency_key);
    __type(value, u64);
    __uint(max_entries, 10240);
} latency_count SEC(".maps");

SEC("kprobe/tcp_v4_connect")
int BPF_KPROBE(trace_connect_v4, struct sock *sk)
{
    u32 pid = bpf_get_current_pid_tgid() >> 32;
    u64 ts = bpf_ktime_get_ns();
    bpf_map_update_elem(&connect_start, &pid, &ts, BPF_ANY);
    return 0;
}

SEC("kretprobe/tcp_v4_connect")
int BPF_KRETPROBE(trace_connect_v4_ret, int ret)
{
    u32 pid = bpf_get_current_pid_tgid() >> 32;
    u64 *start = bpf_map_lookup_elem(&connect_start, &pid);
    if (!start) return 0;  // 没记录开始时间，跳过

    u64 now = bpf_ktime_get_ns();
    u64 delta_us = (now - *start) / 1000;

    struct latency_key key = {0};
    bpf_get_current_comm(&key.comm, sizeof(key.comm));

    u64 zero = 0;
    u64 *val = latency_count.lookup_or_try_init(&key, &zero);
    if (val) {
        // 按延迟区间分桶：>1ms, >10ms, >100ms, >1s
        // 高 32 位存 bucket id，低 32 位存计数（简化版，生产建议用独立 map per bucket）
        if (delta_us > 1000000)      *val = (1ULL << 32) | (*val & 0xFFFFFFFF);
        else if (delta_us > 100000)  *val = (2ULL << 32) | (*val & 0xFFFFFFFF);
        else if (delta_us > 10000)   *val = (3ULL << 32) | (*val & 0xFFFFFFFF);
        else if (delta_us > 1000)    *val = (4ULL << 32) | (*val & 0xFFFFFFFF);
        else                         *val = (5ULL << 32) | (*val & 0xFFFFFFFF);
        *val += 1;
    }

    bpf_map_delete_elem(&connect_start, &pid);
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

#!/usr/bin/env python3
# 文件名：tcp_latency_exporter.py
# 用途：读取 BPF map，导出 TCP 连接延迟分布为 Prometheus 指标
# 运行：sudo python3 tcp_latency_exporter.py

from bcc import BPF
from prometheus_client import Counter, start_http_server
import time

# Prometheus 指标定义
# 标签：pod（进程名）、latency_bucket（延迟区间）
TCP_CONNECT_TOTAL = Counter(
    "tcp_connect_total",
    "Total TCP connect attempts",
    ["pod", "latency_bucket"]
)

LATENCY_BUCKETS = {
    1: "gt_1s",
    2: "100ms_to_1s",
    3: "10ms_to_100ms",
    4: "1ms_to_10ms",
    5: "le_1ms",
}

print("Loading BPF program...")
b = BPF(src_file="tcp_connect_latency.bpf.c")
b.attach_kprobe(event="tcp_v4_connect", fn_name="trace_connect_v4")
b.attach_kretprobe(event="tcp_v4_connect", fn_name="trace_connect_v4_ret")

# 启动 Prometheus exporter
start_http_server(9090)
print("Prometheus exporter on http://localhost:9090/metrics")

last_values = {}  # (pod, bucket) -> last count，用于算增量

while True:
    time.sleep(10)
    for k, v in b["latency_count"].items():
        pod = k.comm.decode('utf-8', errors='replace').rstrip('\x00')
        # v.value 的高 32 位是 bucket id，低 32 位是计数（简化版）
        bucket_id = v.value >> 32
        count = v.value & 0xFFFFFFFF
        bucket_name = LATENCY_BUCKETS.get(bucket_id, "unknown")

        key = (pod, bucket_name)
        prev = last_values.get(key, 0)
        delta = count - prev
        if delta > 0:
            TCP_CONNECT_TOTAL.labels(pod=pod, latency_bucket=bucket_name).inc(delta)
            last_values[key] = count

#!/usr/bin/env python3
# 文件名：anomaly_detector.py
# 用途：消费 TCP 延迟指标，做基线学习 + 异常检测，触发后调 LLM 分析
# 运行：python3 anomaly_detector.py

import requests
import time
import statistics
from collections import deque
from datetime import datetime

# Prometheus 查询地址
PROM_URL = "http://localhost:9090/api/v1/query"

# 简单的基线学习：维护最近 N 个数据点，算 mean + std
BASELINE_WINDOW = 60  # 60 个点 = 10 分钟（每 10s 采一次）
baselines = {}  # pod -> deque of (timestamp, p99_latency_ms)

def query_prometheus(query):
    """查 Prometheus，返回 metric 列表。"""
    resp = requests.get(PROM_URL, params={"query": query}, timeout=5)
    resp.raise_for_status()
    data = resp.json()
    if data["status"] != "success":
        return []
    return data["data"]["result"]

def detect_anomaly(pod, current_value, baseline):
    """3-sigma 异常检测。
    
    简单但有效：当前值偏离均值超过 3σ 算异常。
    生产环境建议用 EWMA 或 isolation forest。
    """
    if len(baseline) < 30:
        return False  # 数据不够，不算异常
    values = [v for _, v in baseline]
    mean = statistics.mean(values)
    stdev = statistics.stdev(values)
    if stdev == 0:
        return False
    z_score = (current_value - mean) / stdev
    return abs(z_score) > 3

def trigger_aiops_analysis(pod, latency_ms, baseline_mean):
    """触发 AIOps 分析：拉 eBPF 上下文 + 调 LLM。"""
    print(f"\n[ALERT] {datetime.now()} Anomaly detected!")
    print(f"  Pod: {pod}")
    print(f"  Current P99: {latency_ms:.1f}ms (baseline: {baseline_mean:.1f}ms)")

    # 1. 通知 eBPF Agent 切换到全采样（伪代码，实际是调 Agent 的 gRPC）
    print("  -> Notifying eBPF Agent to switch to full-sampling mode...")

    # 2. 拉 eBPF 上下文（这里简化为打印，实际是从 Agent 拉数据）
    context = {
        "pod": pod,
        "p99_latency_ms": latency_ms,
        "baseline_mean_ms": baseline_mean,
        "timestamp": datetime.now().isoformat(),
        # 实际还会拉：
        # - 该 Pod 最近 5 分钟的 syscall top 10
        # - 该 Pod 的 TCP 重传统计
        # - 该 Pod 所在节点的 CPU/内存压力
        # - 下游依赖服务的延迟
    }

    # 3. 调 LLM 分析（这里只打印 prompt，实际是调 OpenAI/Claude API）
    prompt = f"""你是一个 AIOps 分析助手。检测到以下异常：

{context}

基于这些 eBPF 采集的数据，请给出：
1. 最可能的根因（不超过 3 个假设，按可能性排序）
2. 每个假设的验证方法
3. 推荐的处置操作
"""
    print("  -> LLM Prompt:")
    print(prompt)
    # 实际调用：
    # resp = requests.post("https://api.openai.com/v1/chat/completions", ...)
    # 分析结果发到告警群

print("Starting AIOps anomaly detector...")
print(f"Sampling every 10s, baseline window: {BASELINE_WINDOW} samples")

while True:
    time.sleep(10)

    # 查询每个 pod 的 P99 延迟（过去 1 分钟）
    query = 'histogram_quantile(0.99, sum(rate(tcp_connect_total[1m])) by (le, pod))'
    results = query_prometheus(query)

    for r in results:
        pod = r["metric"].get("pod", "unknown")
        try:
            p99 = float(r["value"][1])
        except (ValueError, IndexError):
            continue

        # 更新基线
        if pod not in baselines:
            baselines[pod] = deque(maxlen=BASELINE_WINDOW)
        baselines[pod].append((time.time(), p99))

        # 异常检测
        baseline_values = [v for _, v in baselines[pod]]
        baseline_mean = statistics.mean(baseline_values) if baseline_values else 0

        if detect_anomaly(pod, p99, baselines[pod]):
            trigger_aiops_analysis(pod, p99, baseline_mean)
            # 触发后清空基线，避免连续告警
            baselines[pod].clear()

# 看内核版本
uname -r

# 看 BTF 是否启用（CO-RE 必备）
ls -la /sys/kernel/btf/vmlinux

# 看支持哪些 program type
bpftool feature probe

# 看支持哪些 map type
bpftool feature probe | grep map_type

# 方式一：root 用户（最简单，最不安全）
sudo bpftrace ...

# 方式二：CAP_BPF + CAP_PERFMON（5.8+ 推荐）
sudo setcap cap_bpf,cap_perfmon,cap_sys_admin+ep /usr/bin/bpftrace

# 方式三：user namespace + unshare（K8s 推荐）
# 在 Pod securityContext 里加 capabilities

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: ebpf-agent
spec:
  template:
    spec:
      hostNetwork: true          # 要访问内核网络栈
      hostPID: false             # 不要 host PID，按需开
      serviceAccount: ebpf-agent
      containers:
        - name: agent
          image: ebpf-agent:latest
          securityContext:
            # 关键：必须特权或者具体 capabilities
            privileged: true  # 简单粗暴，但很多公司禁止
            # 或者用具体 capabilities（更安全）：
            # capabilities:
            #   add:
            #     - BPF
            #     - PERFMON
            #     - SYS_ADMIN    # 部分场景需要
            #     - NET_ADMIN    # 网络观测需要
            #     - SYS_RESOURCE # RLIMIT_MEMLOCK
          resources:
            limits:
              cpu: 500m
              memory: 512Mi
            requests:
              cpu: 100m
              memory: 128Mi
          volumeMounts:
            - name: cgroup
              mountPath: /sys/fs/cgroup
              readOnly: true
            - name: tracing
              mountPath: /sys/kernel/debug
              readOnly: true
            - name: bpf
              mountPath: /sys/fs/bpf
      volumes:
        - name: cgroup
          hostPath:
            path: /sys/fs/cgroup
        - name: tracing
          hostPath:
            path: /sys/kernel/debug
        - name: bpf
          hostPath:
            path: /sys/fs/bpf

# 临时调大
ulimit -l 8192  # 8MB，默认才 64KB

# 永久生效（/etc/security/limits.conf）
* soft memlock 8192
* hard memlock 8192

# 或者 systemd unit 里加
[Service]
LimitMEMLOCK=infinity

# 方法一：看文件
ls -la /sys/kernel/btf/vmlinux
# 存在即启用

# 方法二：看配置
zcat /proc/config.gz | grep CONFIG_DEBUG_INFO_BTF
# CONFIG_DEBUG_INFO_BTF=y

// 兼容不同内核版本的字段访问
struct task_struct *task = (void *)bpf_get_current_task();

// 5.x 才有字段，老内核没有
if (bpf_core_field_exists(task->mm->arg_start)) {
    // 安全访问
} else {
    // 走 fallback 逻辑
}