chenhengqi
commented
2 years ago Could you check whether syscalls/sys_enter_mount tracepoint exists ?
Open setNull opened 2 years ago
chenhengqi
commented
2 years ago Could you check whether syscalls/sys_enter_mount tracepoint exists ?
Rtoax
commented
1 year ago I got the same problem, This could be an issue with different OS's kernel version.
CentOS-Stream-9 for example:
$ sudo ./mountsnoop
libbpf: prog 'mount_entry': failed to create BPF link for perf_event FD 11: -13 (Permission denied)
libbpf: prog 'mount_entry': failed to attach to tracepoint 'syscalls/sys_enter_mount': Permission denied
libbpf: prog 'mount_entry': failed to auto-attach: -13
failed to attach BPF programs: -13
$ sudo ./execsnoop
libbpf: prog 'tracepoint__syscalls__sys_exit_execve': failed to create BPF link for perf_event FD 12: -13 (Permission denied)
libbpf: prog 'tracepoint__syscalls__sys_exit_execve': failed to attach to tracepoint 'syscalls/sys_exit_execve': Permission denied
libbpf: prog 'tracepoint__syscalls__sys_exit_execve': failed to auto-attach: -13
failed to attach BPF programs
$ sudo ./opensnoop
libbpf: prog 'tracepoint__syscalls__sys_exit_open': failed to create BPF link for perf_event FD 15: -13 (Permission denied)
libbpf: prog 'tracepoint__syscalls__sys_exit_open': failed to attach to tracepoint 'syscalls/sys_exit_open': Permission denied
libbpf: prog 'tracepoint__syscalls__sys_exit_open': failed to auto-attach: -13
failed to attach BPF programsThe tracepoint exist.
$ sudo bpftrace -lv tracepoint:syscalls:sys_enter_mount
tracepoint:syscalls:sys_enter_mount
int __syscall_nr
char * dev_name
char * dir_name
char * type
unsigned long flags
void * data
setNull
commented
1 year ago Hi @chenhengqi , I revisit here...found this issue may be related to force type casting in bpf progs on arm64 platform. f.ex., a few changes like below world make it work，here "ctx->args[1]" is int，while "flags" is unsigned long
@@ -113,7 +113,7 @@ SEC("tracepoint/syscalls/sys_enter_umount")
int umount_entry(struct trace_event_raw_sys_enter *ctx)
{
const char *dest = (const char *)ctx->args[0];
- __u64 flags = (__u64)ctx->args[1];
+ __u64 flags = 0;//(__u64)ctx->args[1];
return probe_entry(NULL, dest, NULL, flags, NULL, UMOUNT);
}Still not work out the reason, any idea? Thanks.
setNull
commented
1 year ago Hi @chenhengqi , more info...
I found the failure is at https://github.com/torvalds/linux/blob/master/kernel/events/core.c#L10490 ,
at where prog->aux->max_ctx_offset is bigger than return value of trace_event_get_offsets in arm64, 5.10.120 kernel.
I'm still trying to understand how this issue happen.
However, if I change code to visit ctx using BPF_CORE_READ macro, it works well.
several changes like below,
SEC("tracepoint/syscalls/sys_enter_umount")
int umount_entry(struct trace_event_raw_sys_enter *ctx)
{
const char *dest = (const char *)ctx->args[0];
- __u64 flags = (__u64)ctx->args[1];
+ __u64 flags = (__u64)BPF_CORE_READ(ctx, args[1]);
return probe_entry(NULL, dest, NULL, flags, NULL, UMOUNT);
}Does this fix make sense for you?
setNull
commented
1 year ago Hi @chenhengqi , more info... I found the failure is at https://github.com/torvalds/linux/blob/master/kernel/events/core.c#L10490 , at where
prog->aux->max_ctx_offsetis bigger than return value oftrace_event_get_offsetsin arm64, 5.10.120 kernel.I'm still trying to understand how this issue happen. However, if I change code to visit
ctxusingBPF_CORE_READmacro, it works well. several changes like below,SEC("tracepoint/syscalls/sys_enter_umount") int umount_entry(struct trace_event_raw_sys_enter *ctx) { const char *dest = (const char *)ctx->args[0]; - __u64 flags = (__u64)ctx->args[1]; + __u64 flags = (__u64)BPF_CORE_READ(ctx, args[1]); return probe_entry(NULL, dest, NULL, flags, NULL, UMOUNT); }Does this fix make sense for you?
Hi @yonghong-song @chenhengqi , please look into this, should I make a PR fot this?
chenhengqi
commented
1 year ago @setNull Thanks for the details. What's your kernel version ? I can't reproduce locally.
setNull
commented
1 year ago @setNull Thanks for the details. What's your kernel version ? I can't reproduce locally.
5.10.120 arm64
setNull
commented
1 year ago @chenhengqi
Hi team,
I'm trying to run mountsnoop on arm64 target, but failed as below,
How should I get start with this error? Thanks.