Problem with BPF_CORE_READ macro function

* Problem with BPF_CORE_READ macro function
@ 2020-12-03 12:19 David Marcinkovic
  2020-12-03 20:35 ` Andrii Nakryiko
  0 siblings, 1 reply; 5+ messages in thread
From: David Marcinkovic @ 2020-12-03 12:19 UTC (permalink / raw)
  To: bpf; +Cc: Juraj Vijtiuk, Luka Perkov, Andrii Nakryiko

Hello everyone,

I am trying to run a simple BPF program that hooks onto
`mac80211/drv_sta_state` tracepoint. When I run the program on the arm
32 bit architecture,
the verifier rejects to load the program and outputs the following error
message:

Unrecognized arg#0 type PTR
; int tp__mac80211_drv_sta_state(struct trace_event_raw_drv_sta_state* ctx)
0: (bf) r3 = r1
1: (85) call unknown#195896080
invalid func unknown#195896080

This error does not seem to occur on the amd64 architecture. I am
using clang version 10 for both, compiling on amd64 and
cross-compiling for arm32.

I have prepared a simple program that hooks onto the
`mac80211/drv_sta_state` tracepoint.
In this example, `BPF_CORE_READ` macro function seems to cause the
verifier to reject to load the program.
I've been using this macro in various different programs and it didn't
cause any problems.
Also, I've been using packed structs and bit fields in other programs
and they also didn't cause any problems.

I tried to use BPF_CORE_READ_BITFIELD as stated in this patch [0] and
got a similar error.

Any input is much appreciated,

Best regards,
David Marčinković

[0] https://lore.kernel.org/bpf/20201007202946.3684483-1-andrii@kernel.org/T/#ma08db511daa0b5978f16df9f98f4ef644b83fc96

mac80211.c
-------------------

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>

#include <bpf/libbpf.h>
#include <bpf/bpf.h>
#include "mac80211.skel.h"

void read_trace_pipe(void)
{
int trace_fd;

trace_fd = open("/sys/kernel/debug/tracing/trace_pipe", O_RDONLY, 0);
if (trace_fd < 0)
return;

while (1) {
static char buf[4096];
ssize_t sz;

sz = read(trace_fd, buf, sizeof(buf) - 1);
if (sz > 0) {
buf[sz] = 0;
puts(buf);
}
}
}

int main(int argc, char **argv)
{
struct mac80211_bpf *obj;
int err = 0;

obj = mac80211_bpf__open();
if (!obj) {
fprintf(stderr, "failed to open and/or load BPF object\n");
return 1;
}

err = mac80211_bpf__load(obj);
if (err) {
fprintf(stderr, "failed to load BPF object %d\n", err);
goto cleanup;
}

err = mac80211_bpf__attach(obj);
if (err) {
fprintf(stderr, "failed to attach BPF programs\n");
goto cleanup;
}

read_trace_pipe();

cleanup:
mac80211_bpf__destroy(obj);
return err != 0;
}

mac80211.bpf.c
-------------------

#include "vmlinux.h"

#include <bpf/bpf_core_read.h>
#include <bpf/bpf_helpers.h>

SEC("tracepoint/mac80211/drv_sta_state")
int tp__mac80211_drv_sta_state(struct trace_event_raw_drv_sta_state* ctx)
{
        u32 old_state = BPF_CORE_READ(ctx, old_state);

        bpf_printk("Old state is %d\n", old_state);

        return 0;
}

char LICENSE[] SEC("license") = "GPL";

^ permalink raw reply	[flat|nested] 5+ messages in thread