minimal example can't run about libbpf-bootstrap HOT 9 CLOSED

@mrpre you can prevent bpf_printk() from using global variables by defining BPF_NO_GLOBAL_DATA before including bpf_helpers.h header.

BCC implementation uses suboptimal implementation that requires on the stack variables and their implementation (which libbpf will do if BPF_NO_GLOBAL_DATA is defined)

from libbpf-bootstrap.

How about we add minimal_legacy example which will define BPF_NO_GLOBAL_DATA (to avoid global variables for bpf_printk()) and do the map as you shown above?

from libbpf-bootstrap.

Your kernel is too old for this example.

To get it work, you need to remove my_pid (you can use a map instead) and bpf_printk.

from libbpf-bootstrap.

@chenhengqi
It seems that bpf_printk with constant string works well under BCC.
So how BCC process the constant string used by bpf_printk? Does BCC replace or remove .rodata sections and use another way to to make it work ?

from libbpf-bootstrap.

@anakryiko Thanks a lot, it works after I remove my_pid and add #define BPF_NO_GLOBAL_DATA in bpf code.

from libbpf-bootstrap.

From the README: minimal is just that – a minimal practical BPF application example. It doesn't use or require BPF CO-RE, so should run on quite old kernels.
Obviously, my Ubuntu 18.04 kernel 4.15.0-180 is too quite an old a kernel. For someone just starting out with bpf, it would be helpful to have an example on how to avoid the global variable (my_pid) by using a map.

from libbpf-bootstrap.

From the README: minimal is just that – a minimal practical BPF application example. It doesn't use or require BPF CO-RE, so should run on quite old kernels. Obviously, my Ubuntu 18.04 kernel 4.15.0-180 is too quite an old a kernel. For someone just starting out with bpf, it would be helpful to have an example on how to avoid the global variable (my_pid) by using a map.

For anyone else running across this, I was able to change this to use an array. my_pid becomes this:

// Create an array with 1 entry instead of a global variable
// which does not work with older kernels
struct {
    __uint(type, BPF_MAP_TYPE_ARRAY);
    __uint(max_entries, 1);
    __type(key, u32);
    __type(value, pid_t);
} my_pid SEC(".maps");

The tracepoint hook now contains this:

SEC("tp/syscalls/sys_enter_write")
int handle_tp(void *ctx)
{
    u32 index = 0;
    pid_t pid = bpf_get_current_pid_tgid() >> 32;
    pid_t *user_pid = bpf_map_lookup_elem(&my_pid, &index);
    if (user_pid)
    {
        if (*user_pid == pid)
            bpf_printk("BPF triggered from PID %d.\n", pid);
    }
    return 0;
}

and the user-space program sets it's pid into the first element of the array after the the skeleton load:

    /* ensure BPF program only handles write() syscalls from our process */
    pid = getpid();
    bpf_map__update_elem(skel->maps.my_pid, &index, sizeof(index), &pid, sizeof(pid_t), BPF_ANY);

where index is defined unsigned index = 0;

from libbpf-bootstrap.

How about we add minimal_legacy example which will define BPF_NO_GLOBAL_DATA (to avoid global variables for bpf_printk()) and do the map as you shown above?

PR #84 adds this example.

from libbpf-bootstrap.

We can close this now that PR #84 has been merged.

from libbpf-bootstrap.