Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Trying to modify a kernel variable by eBPF, is it possible? #5150

Open
FauraSol opened this issue Nov 20, 2024 · 0 comments
Open

Trying to modify a kernel variable by eBPF, is it possible? #5150

FauraSol opened this issue Nov 20, 2024 · 0 comments

Comments

@FauraSol
Copy link

FauraSol commented Nov 20, 2024

I am trying to modify a kernel variable during runtime in kernel version 5.14. Is this feasible? Are there any specific methods such as using kfuncs or modifying syscalls that I could use to achieve this? Could you also provide some detailed examples or relevant links?

I try to use kfuncs, and checked BPF.support_kfunc() is True. When including #include <bpf/bpf_helpers.h>, I receive an error indicating that the file cannot be found. After including it using the absolute path, I get the error: fatal error: 'bpf_helper_defs.h' file not found (the bpf/bpf_helpers.h includes this file via a relative path). After copying bpf_helper_defs.h to the corresponding directory, I encounter a conflict with the definition in /virtual/include/bcc/helpers.h.

And I am trying to implement my own kfunc in the Linux 5.14 kernel. I have added a function and its corresponding prototype in helpers.c, but I am unable to recognize this symbol in the BCC test.py script.

BPF_CALL_1(bpf_update_variable, u32 *, new_value){
	if(new_value)
		my_dummy = * new_value;
	return 0;
}

const struct bpf_func_proto bpf_update_variable_proto = {
	.func		= bpf_update_variable, 
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_INT,
};

I am new to BCC and I'm appreciated for your assistance!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant