最新消息:雨落星辰是一个专注网站SEO优化、网站SEO诊断、搜索引擎研究、网络营销推广、网站策划运营及站长类的自媒体原创博客

Trying to modify a kernel variable by eBPF, is it possible? - Stack Overflow

programmeradmin11浏览0评论

I am trying to modify a kernel variable during runtime in kernel version 5.14. Is this feasible? Are there any specific methods such as using kfuncs or modifying syscalls that I could use to achieve this? Could you also provide some detailed examples or relevant links?

I try to use kfuncs, and checked BPF.support_kfunc() is True. When including #include <bpf/bpf_helpers.h>, I receive an error indicating that the file cannot be found. After including it using the absolute path, I get the error: fatal error: 'bpf_helper_defs.h' file not found (the bpf/bpf_helpers.h includes this file via a relative path). After copying bpf_helper_defs.h to the corresponding directory, I encounter a conflict with the definition in /virtual/include/bcc/helpers.h.

And I am trying to implement my own kfunc in the Linux 5.14 kernel. I have added a function and its corresponding prototype in helpers.c, but I am unable to recognize this symbol in the BCC test.py script.

BPF_CALL_1(bpf_update_variable, u32 *, new_value){
    if(new_value)
        my_dummy = * new_value;
    return 0;
}

const struct bpf_func_proto bpf_update_variable_proto = {
    .func       = bpf_update_variable, 
    .gpl_only   = false,
    .ret_type   = RET_INTEGER,
    .arg1_type  = ARG_PTR_TO_INT,
};
发布评论

评论列表(0)

  1. 暂无评论