You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
The inability to directly read the filename in sys_enter_openat is due to the fact that upon entering the system call, the filename (a user space pointer) may not have been fully resolved and filled into memory yet, so it cannot be correctly read via bpf_probe_read_user(). Therefore, I wrote the following code. However, when running the script generation command, an error occurred. How should I handle this to solve the problem? To Reproduce
Steps to reproduce the behavior. Please include:
package openat
// $BPF_CLANG and $BPF_CFLAGS are set by the Makefile.
//go:generate bpf2go -cc $BPF_CLANG -cflags $BPF_CFLAGS bpf openat.bpf.c -- -I../headers
error
Compiled /root/go/src/tp-test/ebpf/openat/bpf_bpfel.o
Stripped /root/go/src/tp-test/ebpf/openat/bpf_bpfel.o
Error: can't write /root/go/src/tp-test/ebpf/openat/bpf_bpfel.go: can't generate types: template: common:19:4: executing "common" at <$.TypeDeclaration>: error calling TypeDeclaration: Struct:"openat_args": field 1: type *btf.Pointer: not supported
Expected behavior
run go generate should be succeed
The text was updated successfully, but these errors were encountered:
The problem here is fname_ptr as you've probably figured out. Pointers are not supported because we can't put C pointer values into Go pointer types. Taking a pointer from kernel space and doing something with it in user space in general is complicated. The way to work around this is by changing the type declaration:
Instead of a pointer you store the raw value of the pointer. In userspace you can retrieve that value and do with it what you want (maybe via ptrace?), but you can't stuff it into a Go pointer.
lmb
changed the title
type *btf.Pointer: not supported
bpf2go: type *btf.Pointer: not supported
Jun 15, 2023
Describe the bug
The inability to directly read the filename in sys_enter_openat is due to the fact that upon entering the system call, the filename (a user space pointer) may not have been fully resolved and filled into memory yet, so it cannot be correctly read via bpf_probe_read_user(). Therefore, I wrote the following code. However, when running the script generation command, an error occurred. How should I handle this to solve the problem?
To Reproduce
Steps to reproduce the behavior. Please include:
file openat.bpf.c
doc.go
error
Expected behavior
run go generate should be succeed
The text was updated successfully, but these errors were encountered: