PT_REGS_PARM2_CORE with PT_REGS_PARM2

[Kevin-sa]

Hi, I have been learning eBPF recently. However, I came across a problem that I cannot solve.

I was trying to gather system calls using "raw_tracepoint/sys_enter. i use PT_REGS_PARM2_CORE and PT_REGS_PARM2 get fchmodat params.

//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc $BPF_CLANG -cflags $BPF_CFLAGS -target amd64 bpf raw_sys_enter.c -- -I../headers

ebpf with PT_REGS_PARM2_CORE

//go:build ignore

#include "common.h"
#include "bpf_endian.h"
#include "bpf_tracing.h"

char __license[] SEC("license") = "Dual MIT/GPL";


struct bpf_raw_tracepoint_args {
	__u64 args[0];
};

#define TASK_COMM_LEN 16
#define TARGET_NAME "cron"
typedef unsigned long size_t;


SEC("raw_tracepoint/sys_enter")
int raw_tracepoint__sys_enter(struct bpf_raw_tracepoint_args *ctx)
{
    unsigned long syscall_id = ctx->args[1];
    if(syscall_id != 268)
        return 0;

    struct pt_regs *regs;
    regs = (struct pt_regs *) ctx->args[0];

    char pathname[256];
    u32 mode;

    char *pathname_ptr = (char *) PT_REGS_PARM2_CORE(regs);
    bpf_core_read_user_str(&pathname, sizeof(pathname), pathname_ptr);
    if (!pathname)
        return 0;
    bpf_printk("pathname:%s", pathname);
    return 0;
}

When I go generate, I get following error:

../headers/bpf_tracing.h:131:50: note: expanded from macro 'PT_REGS_PARM2_CORE'
#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), rsi)

ebpf with PT_REGS_PARM2

//go:build ignore

#include "common.h"
#include "bpf_endian.h"
#include "bpf_tracing.h"

char __license[] SEC("license") = "Dual MIT/GPL";


struct bpf_raw_tracepoint_args {
	__u64 args[0];
};

#define TASK_COMM_LEN 16
#define TARGET_NAME "cron"
typedef unsigned long size_t;


SEC("raw_tracepoint/sys_enter")
int raw_tracepoint__sys_enter(struct bpf_raw_tracepoint_args *ctx)
{
    unsigned long syscall_id = ctx->args[1];
    if(syscall_id != 268)
        return 0;

    struct pt_regs *regs;
    regs = (struct pt_regs *) ctx->args[0];

    char pathname[256];
    u32 mode;

    char *pathname_ptr = (char *) PT_REGS_PARM2(regs);
    bpf_probe_read(&pathname, sizeof(pathname), pathname_ptr);
    if (!pathname)
        return 0;
    bpf_printk("pathname:%s", pathname);
    return 0;
}

When I execute my code after go build, I get following error

2023/11/22 06:48:05 loading objects: field RawTracepointSysEnter: program raw_tracepoint__sys_enter: load program: permission denied: 3: (79) r3 = *(u64 *)(r1 +104): R1 invalid mem access 'inv' (9 line(s) omitted)

I have been googling and searching the web for a long time, however was not able to find solutions for this.
It would be very helpful for me if anybody might take a time off to save me...

Also, my kernel version is Linux 5.15.0-88-generic and arch is x86_64 for your information.

Thanks!

[lmb]

Can you include the full error message generated by bpf2go? You've only copied the last part.

[Kevin-sa]

thank you for your reply，i copied the full message generated by bpf2go and golang code

golang code

package main

import (
	"log"
	"time"

	"github.com/cilium/ebpf/link"
	"github.com/cilium/ebpf/rlimit"
)

//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc $BPF_CLANG -cflags $BPF_CFLAGS --target=amd64 bpf raw_sys_enter.c -- -I../headers

const mapKey uint32 = 0

func main() {
	if err := rlimit.RemoveMemlock(); err != nil {
		log.Fatal(err)
	}

	// Load pre-compiled programs and maps into the kernel.
	objs := bpfObjects{}
	if err := loadBpfObjects(&objs, nil); err != nil {
		log.Fatalf("loading objects: %v", err)
	}
	defer objs.Close()

	log.Println(objs.RawTracepointSysEnter.Type())
	// tp, err := link.AttachRawTracepoint("syscalls", "sys_enter", objs.RawTracepointSysExit, nil)
	tp, err := link.AttachRawTracepoint(link.RawTracepointOptions{
		Name:    "sys_enter",
		Program: objs.RawTracepointSysEnter,
	})
	if err != nil {
		log.Fatalf("opening tracepoint: %s", err)
	}
	defer tp.Close()

	ticker := time.NewTicker(1 * time.Second)
	defer ticker.Stop()

	log.Println("Waiting for events..")

	for range ticker.C {
	}

}

full message generated by bpf2go

root@kevin-virtual-machine ~/g/s/g/K/e/sys_enter# go generate
/root/go/src/github.com/Kevin-sa/ebpf-fuzz/sys_enter/raw_sys_enter.c:33:35: warning: implicit declaration of function 'BPF_CORE_READ' is invalid in C99 [-Wimplicit-function-declaration]
    char *pathname_ptr = (char *) PT_REGS_PARM2_CORE(regs);
                                  ^
../headers/bpf_tracing.h:131:31: note: expanded from macro 'PT_REGS_PARM2_CORE'
#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), rsi)
                              ^
/root/go/src/github.com/Kevin-sa/ebpf-fuzz/sys_enter/raw_sys_enter.c:33:35: error: use of undeclared identifier 'rsi'
../headers/bpf_tracing.h:131:50: note: expanded from macro 'PT_REGS_PARM2_CORE'
#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ((x), rsi)
                                                 ^
/root/go/src/github.com/Kevin-sa/ebpf-fuzz/sys_enter/raw_sys_enter.c:34:5: warning: implicit declaration of function 'bpf_core_read_user_str' is invalid in C99 [-Wimplicit-function-declaration]
    bpf_core_read_user_str(&pathname, sizeof(pathname), pathname_ptr);
    ^
/root/go/src/github.com/Kevin-sa/ebpf-fuzz/sys_enter/raw_sys_enter.c:35:10: warning: address of array 'pathname' will always evaluate to 'true' [-Wpointer-bool-conversion]
    if (!pathname)
        ~^~~~~~~~
3 warnings and 1 error generated.
Error: can't execute clang: exit status 1
exit status 1
main.go:11: running "go": exit status 1

[lmb]

Your best bet is fixing the issues outlined in the error messages: make sure BPF_CORE_READ is defined, add a declaration for bpf_core_read_user_str and fix the NULL check on pathname.

Since this is not an issue with the library your best bet is the ebpf slack or stack overflow, sorry!