Quantcast
Channel: Active questions tagged linux-kernel - Stack Overflow
Viewing all articles
Browse latest Browse all 12294

BPF custom kfunc : calling kernel function %s is not allowed

$
0
0

I am writing some codes for my thesis using ebpf and I need to create a custom kfunc to call within my bpf program. To do so I started by following the example here https://eunomia.dev/tutorials/43-kfuncs/#file-kfuncc as well as the one in the kernel documentation https://docs.kernel.org/6.8/bpf/kfuncs.html. The code of the lkm implementing the kfunc is the following:

#include <linux/module.h>#include <linux/printk.h>#include <linux/string.h> #include <linux/btf.h>MODULE_LICENSE("GPL");__bpf_kfunc_start_defs();__bpf_kfunc int bpf_strstr(char *s1, __u32 s1__sz, char *s2, __u32 s2__sz){    if (s2__sz == 0)         return 0;    if (s1__sz == 0 || s1__sz < s2__sz)         return -1;    for (int i = 0; i <= s1__sz - s2__sz; i++)    {        int j = 0;        while (j < s2__sz && s1[i + j] == s2[j])            j++;        if (j == s2__sz)            return i;    }    return -1;}__bpf_kfunc_end_defs();/*// kernel version > 6.8BTF_KFUNCS_START(bpf_strstr_id_set)BTF_ID_FLAGS(func, bpf_strstr) BTF_KFUNCS_END(bpf_strstr_id_set) */// kernel version <= 6.8BTF_SET8_START(bpf_strstr_id_set)BTF_ID_FLAGS(func, bpf_strstr, 0)BTF_SET8_END(bpf_strstr_id_set)static const struct btf_kfunc_id_set bpf_strstr_kfunc_set = {        .owner = THIS_MODULE,        .set   = &bpf_strstr_id_set,};static int __init myinit(void){    /* Register the BTF */    int ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_TRACING, &bpf_strstr_kfunc_set);    if(ret)    {        printk("Failed to load bpf_strstr kfunc : %d\n", ret);        return ret;    }    printk("bpf_strstr kfunc loaded\n");    return 0;}//late_initcall(myinit);static void __exit myexit(void){    printk("bpf_strstr function unloaded\n");}module_init(myinit)module_exit(myexit)

While in the ebpf program I trace the file opening and I insert a simple example like the following:

// extern declaration extern int bpf_strstr(char *s1, __u32 s1__sz, char *s2, __u32 s2__sz) __ksym;SEC("tracepoint/syscalls/sys_enter_open")int tracepoint__open(struct trace_event_raw_sys_enter *ctx){    // do stuff like getting cmd, file opening and pid    const char s1[] = "Hello World";    const char s2[] = "World";    int ret2 = bpf_strstr(s1, sizeof(s1)-1, s2, sizeof(s2)-1);    if(ret2 != 0)    {        bpf_printk("[INFO] : strstr failed : %d\n", ret2);    }    else    {        bpf_printk("[INFO] : strstr success : %d\n", ret2);    }    return 0;}

Compilation goes fine but whenever I try to run the code the verifier fails saying that calling the kernel function %s is not allowed. It does the same even with the following example https://github.com/eunomia-bpf/bpf-developer-tutorial/tree/main/src/43-kfuncs (by cloning the entire repo and use all their libraries).dmesg do not show any error while loading the module.I am using ubuntu 24.04.1 LTS, kernel 6.8.0-48-generic.

So even trying different sources I always get the same error.From the verifier source code (https://elixir.bootlin.com/linux/v6.8/source/kernel/bpf/verifier.c#L11928) it seems that it is failing to fetch the kfunc meta :

// verifier source code slice of 'static int check_kfunc_call'err = fetch_kfunc_meta(env, insn, &meta, &func_name);if (err == -EACCES && func_name)    verbose(env, "calling kernel function %s is not allowed\n", func_name);

more precisely it is failing to retrieve the kfunc flags:

kfunc_flags = btf_kfunc_id_set_contains(desc_btf, func_id, env->prog);if (!kfunc_flags) {    return -EACCES;}

but I cannot understand why since the registration seems successful.I don't think there is a compilation / library problem since I tried the eunomia example linked above where they provide their own libraries and Makefile.Maybe some kernel configuration options?


Viewing all articles
Browse latest Browse all 12294

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>