尝试使用 char 数组字段无效字段错误创建地图

Question

我想知道如何使用 char 数组值创建 ebpf 映射

我这样试过

struct {
    __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
    __uint(key_size, sizeof(int));
    __uint(value_size, sizeof(char)*10);
    __uint(max_entries, 2);
} my_map SEC(".maps");

这是 ebpf 程序的完整代码

#include <linux/version.h>
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <linux/string.h>

struct {
    __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
    __uint(key_size, sizeof(int));
    __uint(value_size, sizeof(char)*10);
    __uint(max_entries, 2);
} my_map SEC(".maps");

SEC("kprobe/__x64_sys_write")
int bpf_prog1(struct pt_regs *ctx)
{
    struct S {
        int pid;
        char cookie[10];
    } data;

    data.pid = bpf_get_current_pid_tgid();
//      data.cookie = 0x123;
    memcpy(data.cookie,"msg fwd",sizeof("msg fwd"));

    bpf_perf_event_output(ctx, &my_map, 0, &data, sizeof(data));

    return 0;


}

char _license[] SEC("license") = "GPL";
int _version SEC("version") = 99;

这是我分配给 perf_buffer_opts

的用户函数

static void print_bpf_output(void *ctx, int cpu, void *data, __u32 size)
{
    struct {
        int pid;
        char cookie[10];
    } *e = data;

这是完整的代码。所以任何人都可以告诉我做错了什么为什么说无效参数

libbpf: map 'my_map': failed to create: Invalid argument(-22)
libbpf: failed to load object './trace_output_kern.o'
ERROR: loading BPF object file failed
root@

完整的用户空间代码

// SPDX-License-Identifier: GPL-2.0-only
#include <stdio.h>
#include <fcntl.h>
#include <poll.h>
#include <time.h>
#include <signal.h>
#include <bpf/libbpf.h>


//create .o file root@this:/home/ubuntu/Desktop/ebpf/kern# clang -I /lib/modules/5.14.1/build -I /usr/include/bpf/ -O2 -Wall -c trace_output_user.c

static __u64 time_get_ns(void)
{
    struct timespec ts;

    clock_gettime(CLOCK_MONOTONIC, &ts);
    return ts.tv_sec * 1000000000ull + ts.tv_nsec;
}

static __u64 start_time;
static __u64 cnt;

#define MAX_CNT 100000ll

static void print_bpf_output(void *ctx, int cpu, void *data, __u32 size)
{
    struct {
        int pid;
        char cookie[10];
    } *e = data;

    if (e->cookie != 0x12345678) {
        printf("BUG pid %llx cookie %s sized %d\n",
               e->pid, e->cookie, size);
        return;
    }

    cnt++;

    if (cnt == MAX_CNT) {
        printf("recv %lld events per sec\n",
               MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
        return;
    }
}

int main(int argc, char **argv)
{
    struct perf_buffer_opts pb_opts = {};
    struct bpf_link *link = NULL;
    struct bpf_program *prog;
    struct perf_buffer *pb;
    struct bpf_object *obj;
    int map_fd, ret = 0;
    char filename[256];
    FILE *f;

    //snprintf(filename, sizeof(filename), "..o", argv[0]);
    obj = bpf_object__open_file("./trace_output_kern.o", NULL);
    if (libbpf_get_error(obj)) {
        fprintf(stderr, "ERROR: opening BPF object file failed\n");
        return 0;
    }

    /* load BPF program */
    if (bpf_object__load(obj)) {
        fprintf(stderr, "ERROR: loading BPF object file failed\n");
        goto cleanup;
    }

    map_fd = bpf_object__find_map_fd_by_name(obj, "my_map");
    if (map_fd < 0) {
        fprintf(stderr, "ERROR: finding a map in obj file failed\n");
        goto cleanup;
    }

    prog = bpf_object__find_program_by_name(obj, "bpf_prog1");
    if (libbpf_get_error(prog)) {
        fprintf(stderr, "ERROR: finding a prog in obj file failed\n");
        goto cleanup;
    }

    link = bpf_program__attach(prog);
    if (libbpf_get_error(link)) {
        fprintf(stderr, "ERROR: bpf_program__attach failed\n");
        link = NULL;
        goto cleanup;
    }

    pb_opts.sample_cb = print_bpf_output;
    pb = perf_buffer__new(map_fd, 8, &pb_opts);
    ret = libbpf_get_error(pb);
    if (ret) {
        printf("failed to setup perf_buffer: %d\n", ret);
        return 1;
    }

    f = popen("taskset 1 dd if=/dev/zero of=/dev/null", "r");
    (void) f;

    start_time = time_get_ns();
    while ((ret = perf_buffer__poll(pb, 1000)) >= 0 && cnt < MAX_CNT) {
    }
    kill(0, SIGINT);

cleanup:
    bpf_link__destroy(link);
    bpf_object__close(obj);
    return ret;
}

Answer 1

键和值应该是__u32:

struct {
    __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
    __uint(key_size, sizeof(__u32));
    __uint(value_size, sizeof(__u32));
} my_map SEC(".maps");

然后您可以像往常一样将事件推送到该地图：

bpf_perf_event_output(ctx, &my_map, 0, &data, sizeof(data));

bpf_perf_event_output 助手将事件的大小作为参数，因此它不需要是地图中的静态参数。

尝试使用 char 数组字段无效字段错误创建地图

Trying to create map with char array field invalid field error

c

linux

ebpf

bpf