Thiết kế website giá rẻ

Question

I am looking into kfunc mechanism and wrote a simple kernel module that exposes a kfunc which i try to call from ebpf code:

kernel module code:

__bpf_kfunc_start_defs();
__bpf_kfunc void bpf_mykfunc(void)
{
    printk(KERN_INFO "Hello from bpf_mykfunc kfuncn");
}
__bpf_kfunc_end_defs();

BTF_SET8_START(bpf_kfunc_example_ids_set)
BTF_ID_FLAGS(func, bpf_mykfunc, 0)
BTF_SET8_END(bpf_kfunc_example_ids_set)

static const struct btf_kfunc_id_set bpf_kfunc_example_set = {
    .owner = THIS_MODULE,
    .set = &bpf_kfunc_example_ids_set,
};

static int __init hello_init(void)
{
    int ret;

    printk(KERN_INFO "Hello, world!n");
    ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_TRACING /*BPF_PROG_TYPE_KPROBE*/, &bpf_kfunc_example_set);
    if (ret) {
        pr_err("bpf_kfunc_example: Failed to register BTF kfunc ID setn");
        return ret;
    }
    printk(KERN_INFO "bpf_kfunc_example: Module loaded successfullyn");
    return 0;
}

static void __exit hello_exit(void)
{
    printk(KERN_INFO "Goodbye, world!n");
}

module_init(hello_init);
module_exit(hello_exit);

ebpf code:

SEC("tracepoint/syscalls/sys_enter_execve")
int trace_exec(struct trace_event_raw_sys_enter *ctx)
{
    char comm[256];
    __u32 zero = 0;

    // Retrieve current process name
    if (bpf_get_current_comm(comm, sizeof(comm)) < 0)
        return 0;

    // Lookup the target command from the map
    const char *target = bpf_map_lookup_elem(&target_exec, &zero);
    if (!target)
        return 0;

    // Compare the process name with the target name
    #pragma unroll
    for (int i = 0; i < 256; i++) {
        if (comm[i] != target[i])
            return 0;
        if (comm[i] == '')
            break;
    }

    // Call a custom kernel function (if defined in your program)
    bpf_mykfunc();

    return 0;
}

The verifier for somereason does not like it:

libbpf: prog 'trace_exec': BPF program load failed: -EACCES
libbpf: prog 'trace_exec': -- BEGIN PROG LOAD LOG --
0: R1=ctx() R10=fp0
; int trace_exec(struct trace_event_raw_sys_enter *ctx)
0: (b7) r6 = 0                        ; R6_w=0
; __u32 zero = 0;
1: (63) *(u32 *)(r10 -260) = r6       ; R6_w=0 R10=fp0 fp-264=0000????
2: (bf) r1 = r10                      ; R1_w=fp0 R10=fp0
; 
3: (07) r1 += -256                    ; R1_w=fp-256
; if (bpf_get_current_comm(comm, sizeof(comm)) < 0)
4: (b7) r2 = 256                      ; R2_w=256
5: (85) call bpf_get_current_comm#16          ; R0_w=scalar() fp-8=mmmmmmmm fp-16=mmmmmmmm fp-24=mmmmmmmm fp-32=mmmmmmmm fp-40=mmmmmmmm fp-48=mmmmmmmm fp-56=mmmmmmmm fp-64=mmmmmmmm fp-72=mmmmmmmm fp-80=mmmmmmmm fp-88=mmmmmmmm fp-96=mmmmmmmm fp-104=mmmmmmmm fp-112=mmmmmmmm fp-120=mmmmmmmm fp-128=mmmmmmmm fp-136=mmmmmmmm fp-144=mmmmmmmm fp-152=mmmmmmmm fp-160=mmmmmmmm fp-168=mmmmmmmm fp-176=mmmmmmmm fp-184=mmmmmmmm fp-192=mmmmmmmm fp-200=mmmmmmmm fp-208=mmmmmmmm fp-216=mmmmmmmm fp-224=mmmmmmmm fp-232=mmmmmmmm fp-240=mmmmmmmm fp-248=mmmmmmmm fp-256=mmmmmmmm
; if (bpf_get_current_comm(comm, sizeof(comm)) < 0)
6: (6d) if r6 s> r0 goto pc+12        ; R0_w=scalar(smin=0,umax=0x7fffffffffffffff,var_off=(0x0; 0x7fffffffffffffff)) R6_w=0
7: (bf) r2 = r10                      ; R2_w=fp0 R10=fp0
; 
8: (07) r2 += -260                    ; R2_w=fp-260
; const char *target = bpf_map_lookup_elem(&target_exec, &zero);
9: (18) r1 = 0xffff9da60a801400       ; R1_w=map_ptr(map=target_exec,ks=4,vs=256)
11: (85) call bpf_map_lookup_elem#1   ; R0=map_value_or_null(id=1,map=target_exec,ks=4,vs=256)
; if (!target)
12: (15) if r0 == 0x0 goto pc+6       ; R0=map_value(map=target_exec,ks=4,vs=256)
; if (comm[i] != target[i])
13: (71) r2 = *(u8 *)(r0 +0)          ; R0=map_value(map=target_exec,ks=4,vs=256) R2_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
; if (comm[i] != target[i])
14: (71) r1 = *(u8 *)(r10 -256)       ; R1_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) R10=fp0 fp-256=mmmmmmmm
; if (comm[i] != target[i])
15: (1d) if r1 == r2 goto pc+1 17: R0=map_value(map=target_exec,ks=4,vs=256) R1_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) R2_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) R6=0 R10=fp0 fp-8=mmmmmmmm fp-16=mmmmmmmm fp-24=mmmmmmmm fp-32=mmmmmmmm fp-40=mmmmmmmm fp-48=mmmmmmmm fp-56=mmmmmmmm fp-64=mmmmmmmm fp-72=mmmmmmmm fp-80=mmmmmmmm fp-88=mmmmmmmm fp-96=mmmmmmmm fp-104=mmmmmmmm fp-112=mmmmmmmm fp-120=mmmmmmmm fp-128=mmmmmmmm fp-136=mmmmmmmm fp-144=mmmmmmmm fp-152=mmmmmmmm fp-160=mmmmmmmm fp-168=mmmmmmmm fp-176=mmmmmmmm fp-184=mmmmmmmm fp-192=mmmmmmmm fp-200=mmmmmmmm fp-208=mmmmmmmm fp-216=mmmmmmmm fp-224=mmmmmmmm fp-232=mmmmmmmm fp-240=mmmmmmmm fp-248=mmmmmmmm fp-256=mmmmmmmm fp-264=mmmm????
; if (comm[i] == '')
17: (55) if r1 != 0x0 goto pc+3       ; R1_w=0
; bpf_mykfunc();
18: (85) call bpf_mykfunc#139349
calling kernel function bpf_mykfunc is not allowed
processed 20 insns (limit 1000000) max_states_per_insn 0 total_states 2 peak_states 2 mark_read 1
-- END PROG LOAD LOG --
libbpf: prog 'trace_exec': failed to load: -EACCES
libbpf: failed to load object 'ebpf'
libbpf: failed to load BPF skeleton 'ebpf': -EACCES
Failed to load and verify BPF programs: -13

What I am missing?

Thiết kế website giá rẻ

Danh mục

Getting -EACCES when callig kfunc from ebpf code