Attaching eBPF to KPROBE?

Question

I wrote a simple program to attach to execve system call with a kprobe, but I am unable to see the relevant output.

Here is my one.c (BPF program):

#include <errno.h>
#include <bpf/bpf.h>
#include <stdio.h>
#include <string.h>

#include "bpf_load.h"
#include "bpf_util.h"
#include "libbpf.h"

#define SEC(NAME) __attribute__((section(NAME), used))

SEC("kprobe/execve")
int bpf_prog1(struct pt_regs *ctx)
{
        char m[]="hello world";
        bpf_trace_printk(m,sizeof(m));
        
        return 0;
}

char _license[] SEC("license") = "GPL";

bpf_load.c (user space loader):

#include "bpf_load.h"
#include <stdio.h>

#include <linux/bpf.h>
#include <sys/resource.h>

int main(int argc, char **argv) {
    if (load_bpf_file("one.o")) {
        printf("%s", bpf_log_buf);
        return 1;
    }
    return 0;
}

And the Makefile:

CLANG = clang

EXECABLE = monitor-exec

BPFCODE = one

BPFTOOLS = /kernel-src/samples/bpf
BPFLOADER = $(BPFTOOLS)/bpf_load.c

INCLUDE += -I/kernel-src/samples/bpf
INCLUDE += -I/kernel-src/tools/lib

CCINCLUDE += -I/kernel-src/tools/testing/selftests/bpf
CCINCLUDE += -I/kernel-src/tools/lib/bpf
CCINCLUDE += ${INCLUDE}

LOADINCLUDE += -I/kernel-src/tools/include
LOADINCLUDE += -I/kernel-src/tools/perf
LOADINCLUDE += ${INCLUDE}
LIBRARY_PATH = -L/usr/local/lib64
BPFSO = -lbpf

.PHONY: clean bpfload build

clean:
    rm -f *.o *.so $(EXECABLE)

build: ${BPFCODE.c} ${BPFLOADER}
    $(CLANG) -O2 -DHAVE_ATTR_TEST=0 -target bpf -c $(BPFCODE:=.c) $(CCINCLUDE) -o ${BPFCODE:=.o}

bpfload: build
    clang -o $(EXECABLE) -DHAVE_ATTR_TEST=0  -lelf $(LOADINCLUDE) $(LIBRARY_PATH) $(BPFSO) \
        $(BPFLOADER) loader.c

$(EXECABLE): bpfload

.DEFAULT_GOAL := $(EXECABLE)

As of now I don't get any errors from the Makefile.

I am getting the following output when I execute ./monitor-exec

invalid relo for insn[6].code 0x85
bpf_load_program() err=22
last insn is not an exit or jmp
processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
last insn is not an exit or jmp
processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

I am unable to understand what I am doing wrong. I am just attaching a kprobe and that should print hello world when that system call occurs.

Where does your program pick the definition for bpf_trace_printk() from? It looks like it does not know where to find it when libbpf attempts to perform relocation on your object file. — Qeole
So what should i do? i am new to it..so as of my understanding bpf_trace_printk() definition is not in my program , am i correct? — avsr
I'm not sure because it could be in one of the files you include. But you can try adding it manually, in your BPF program file: static int (*bpf_trace_printk)(const char *fmt, int fmt_size, ...) = (void *) BPF_FUNC_trace_printk; (this will declare the function based on the BPF_FUNC_trace_printk enum member defined in linux/bpf.h, included from bpf/bpf.h I think). — Qeole
okay it worked thanks....and i had one more problem failed to create kprobe 'execve' error 'No such file or directory' , , how to know the all systemcalls types that suppourt after kprobe/ or anyother like uprobe,tracepoint... — avsr
Nearly all kernel functions can be traced (provided they were not inlined at compilation). You might want to check what symbols are available with something like sudo cat /proc/kallsyms|grep execve. Although for system calls we usually recommend using tracepoints rather than kprobes, because they are more stable (between kernel versions). In your case, there's a tracepoint called sys_enter_execve that you could use. — Qeole

Qeole Qeole · Accepted Answer · 2020-07-16T13:39:45

In your eBPF program:

#include <errno.h>
#include <bpf/bpf.h>
#include <stdio.h>
#include <string.h>

#include "bpf_load.h"
#include "bpf_util.h"
#include "libbpf.h"

#define SEC(NAME) __attribute__((section(NAME), used))

SEC("kprobe/execve")
int bpf_prog1(struct pt_regs *ctx)
{
        char m[]="hello world";
        bpf_trace_printk(m,sizeof(m));
        
        return 0;
}

You use bpf_trace_printk() correctly (although you might want to add a \n at the end of your message or your output will be messy), but it turns out none of the files you include contains the definition for this helper.

bpf_trace_printk() is compiled as part of the kernel and won't ever be compiled into your BPF object file. When trying to load your program, the function load_bpf_file() does a relocation step where it places the number associated to bpf_trace_prink() (in user API) in the relevant instruction of the eBPF bytecode.

But it needs to find this number somewhere. It is defined in header linux/bpf.h (pulled from several of your includes) as FN(trace_printk) (some macro magic going on), resulting de facto in a #define BPF_FUNC_trace_prink 6. But you need to tell your loading function that it corresponds to the bpf_trace_prink() you're calling!

Two solutions:

Manually declare it:

static int (*bpf_trace_printk)(const char *fmt, int fmt_size, ...) =
        (void *) BPF_FUNC_trace_printk;

Or add a header that contains it, e.g. tools/lib/bpf/bpf_helpers.h in kernel repo. In your case:
```
#include <bpf/bpf_helpers.h>
```
(Note that this header is generated when compiling libbpf, it is not present in the repository by default.)

Attaching eBPF to KPROBE?

1 Answers