Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Trying to modify a kernel variable by eBPF, is it possible? #5150

Open
FauraSol opened this issue Nov 20, 2024 · 0 comments
Open

Trying to modify a kernel variable by eBPF, is it possible? #5150

FauraSol opened this issue Nov 20, 2024 · 0 comments

Comments

@FauraSol
Copy link

FauraSol commented Nov 20, 2024

I am trying to modify a kernel variable during runtime in kernel version 5.14. Is this feasible? Are there any specific methods such as using kfuncs or modifying syscalls that I could use to achieve this? Could you also provide some detailed examples or relevant links?

I try to use kfuncs, and checked BPF.support_kfunc() is True. When including #include <bpf/bpf_helpers.h>, I receive an error indicating that the file cannot be found. After including it using the absolute path, I get the error: fatal error: 'bpf_helper_defs.h' file not found (the bpf/bpf_helpers.h includes this file via a relative path). After copying bpf_helper_defs.h to the corresponding directory, I encounter a conflict with the definition in /virtual/include/bcc/helpers.h.

And I am trying to implement my own kfunc in the Linux 5.14 kernel. I have added a function and its corresponding prototype in helpers.c, but I am unable to recognize this symbol in the BCC test.py script.

BPF_CALL_1(bpf_update_variable, u32 *, new_value){
	if(new_value)
		my_dummy = * new_value;
	return 0;
}

const struct bpf_func_proto bpf_update_variable_proto = {
	.func		= bpf_update_variable, 
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_INT,
};

I am new to BCC and I'm appreciated for your assistance!

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant