Skip to content

Helper function bpf_probe_read_kernel

v5.5

Definition

Copyright (c) 2015 The Libbpf Authors. All rights reserved.

Safely attempt to read size bytes from kernel space address unsafe_ptr and store the data in dst.

Returns

0 on success, or a negative error in case of failure.

static long (* const bpf_probe_read_kernel)(void *dst, __u32 size, const void *unsafe_ptr) = (void *) 113;

Usage

This helper could be very helpful in cases, when we need to access some global kernel variable or structure. It should be also used in case, when BPF program works in cooperation with some particular kernel module and needs to access to its global variables or structures to obtain some configuration settings, counters values, etc.

Program types

This helper call can be used in the following program types:

Example

/* Some loadable kernel module with global variable to share */

#include <linux/init.h>       // Macros for module initialization
#include <linux/module.h>     // Core header for loading modules
#include <linux/kernel.h>     // Kernel logging macros

const int test_kmod_var = 666;

static int __init test_kmod_init(void)
{
    printk(KERN_INFO "Hello, world, test_var=%d\n", test_kmod_var);

    return 0;
}

static void __exit test_kmod_exit(void)
{
    printk(KERN_INFO "Goodbye, world!\n");
}

module_init(test_kmod_init);
module_exit(test_kmod_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Your Name");
MODULE_DESCRIPTION("A simple module");
MODULE_VERSION("1.0");

/* BPF program, which uses global variables from kernel
 * and from some loadable module
 */

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include "bpf_tracing_net.h"

extern const void test_kmod_var __ksym;
extern const void jiffies __ksym;

SEC("xdp")
int xdp_test(struct xdp_md *xdp) {

    u64 kernel_jiffies;
    u32 loadable_kmod_var;

    bpf_probe_read_kernel(&kernel_jiffies, 8, &jiffies);

    bpf_printk(">>> %s: Can access jiffies=%lu\n", __func__, kernel_jiffies);

    bpf_probe_read_kernel(&loadable_kmod_var, 4, &test_kmod_var);

    bpf_printk(">>> %s: Can also access test_kmod_var=%lu\n", __func__, loadable_kmod_var);

    return XDP_PASS;
}