Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error: the BPF_PROG_LOAD syscall failed. #1002

Open
Godones opened this issue Jul 28, 2024 · 1 comment
Open

Error: the BPF_PROG_LOAD syscall failed. #1002

Godones opened this issue Jul 28, 2024 · 1 comment

Comments

@Godones
Copy link

Godones commented Jul 28, 2024

When I used a variable initialized to 0 in the program, an error occurred while loading the ebpf program.
The test code is as follows:

static mut MASK: usize = 1;
static mut MASK2: usize = 0;
#[kprobe]
pub fn myapp(ctx: ProbeContext) -> u32 {
    unsafe {
        MASK += 1;
        MASK2 +=1;
    }
    0
}

The error message is as follows:

Error: the BPF_PROG_LOAD syscall failed. Verifier output: 0: R1=ctx(off=0,imm=0) R10=fp0
0: (18) r1 = 0xffff8e21015e6f10       ; R1_w=map_value(off=0,ks=4,vs=8,imm=0)
2: (79) r2 = *(u64 *)(r1 +0)          ; R1_w=map_value(off=0,ks=4,vs=8,imm=0) R2_w=scalar()
3: (07) r2 += 1                       ; R2_w=scalar()
4: (7b) *(u64 *)(r1 +0) = r2          ; R1_w=map_value(off=0,ks=4,vs=8,imm=0) R2_w=scalar()
5: (18) r1 = 0xffff8e21015e5a00       ; R1_w=map_ptr(off=0,ks=4,vs=8,imm=0)
7: (79) r2 = *(u64 *)(r1 +0)          ; R1_w=map_ptr(off=0,ks=4,vs=8,imm=0) R2_w=ptr_bpf_map_ops(off=0,imm=0)
8: (07) r2 += 1                       ; R2_w=ptr_bpf_map_ops(off=1,imm=0)
9: (7b) *(u64 *)(r1 +0) = r2
only read from bpf_array is supported
verification time 16 usec
stack depth 0
processed 8 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
@harry-xm
Copy link

only read from bpf_array is supported

You are trying to access a static item, which is not supported in BPF. You will need to maintain state in a BPF map:

The eBPF Virtual Machine, where our eBPF programs will be run, is a constrained runtime environment:

  • There is only 512 bytes of stack (or 256 bytes if we are using tail calls).
  • There is no access to heap space and data must instead be written to maps.

https://aya-rs.dev/book/#ebpf-program-constraints

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants