[raw_tracepoints] Need help with ringbuffer

[isu-kim]

Background

Hi, I have been learning eBPF recently. However, I came across a problem that I cannot solve.

I was trying to gather system calls using tracepoint/raw_tracepoints/sys_enter. Then store those system call values into a ringbuffer then submit so that golang side can receive the data using channel.

eBPF code

I tried to mimic ringbuffer code from the official examples. Last time I tried to do the same thing with kprobe/tcp_v4_rcv, it worked. However with tracepoint/raw_tracepoints/sys_enter, it did not. Here is the full code:

//go:build ignore

#define __TARGET_ARCH_x86
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_core_read.h>
#include <bpf/bpf_tracing.h>

char __license[] SEC("license") = "Dual MIT/GPL";

struct event {
        u32 pid;
        int syscall_nr;
};

struct {
        __uint(type, BPF_MAP_TYPE_RINGBUF);
        __uint(max_entries, 1 << 24);
} events SEC(".maps");

// Force emitting struct event into the ELF.
const struct event *unused __attribute__((unused));

SEC("tracepoint/raw_syscalls/sys_enter")
int tracepoint_raw_sys_enter(struct trace_event_raw_sys_enter *ctx) {
    // Get PID information of current context.
    u64 id   = bpf_get_current_pid_tgid();
    u32 tgid = id >> 32;
    struct event *data;

    // Reserve ringbuffer for future use.
    data = bpf_ringbuf_reserve(&events, sizeof(struct event), 0);
    data->syscall_nr = ctx->id;
    data->pid = tgid;
    bpf_ringbuf_submit(data, 0);
    return 0;
}

Golang Code

This code is almost the same as the example code, but just uses tracepoint instead of kprobe.

package main

import (
        "bytes"
        "encoding/binary"
        "errors"
        "log"
        "os"
        "os/signal"
        "syscall"

        "github.com/cilium/ebpf/link"
        "github.com/cilium/ebpf/ringbuf"
        "github.com/cilium/ebpf/rlimit"
)

// $BPF_CLANG and $BPF_CFLAGS are set by the Makefile.
//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc $BPF_CLANG -cflags $BPF_CFLAGS -type event bpf ringbuffer.c -- -I../headers

func main() {
        // Subscribe to signals for terminating the program.
        stopper := make(chan os.Signal, 1)
        signal.Notify(stopper, os.Interrupt, syscall.SIGTERM)

        // Allow the current process to lock memory for eBPF resources.
        if err := rlimit.RemoveMemlock(); err != nil {
                log.Fatal(err)
        }

        // Load pre-compiled programs and maps into the kernel.
        objs := bpfObjects{}
        if err := loadBpfObjects(&objs, nil); err != nil {
                log.Fatalf("loading objects: %v", err)
        }
        defer objs.Close()

        tp, err := link.Tracepoint("raw_syscalls", "sys_enter", objs.TracepointRawSysEnter, nil)
        if err != nil {
                log.Fatalf("opening tracepoint: %s", err)
        }
        defer tp.Close();

        // Open a ringbuf reader from userspace RINGBUF map described in the
        // eBPF C program.
        rd, err := ringbuf.NewReader(objs.Events)
        if err != nil {
                log.Fatalf("opening ringbuf reader: %s", err)
        }
        defer rd.Close()

        // Close the reader when the process receives a signal, which will exit
        // the read loop.
        go func() {
                <-stopper

                if err := rd.Close(); err != nil {
                        log.Fatalf("closing ringbuf reader: %s", err)
                }
        }()

        log.Println("Waiting for events..")

        // bpfEvent is generated by bpf2go.
        var event bpfEvent
        for {
                record, err := rd.Read()
                if err != nil {
                        if errors.Is(err, ringbuf.ErrClosed) {
                                log.Println("Received signal, exiting..")
                                return
                        }
                        log.Printf("reading from reader: %s", err)
                        continue
                }

                // Parse the ringbuf event entry into a bpfEvent structure.
                if err := binary.Read(bytes.NewBuffer(record.RawSample), binary.LittleEndian, &event); err != nil {
                        log.Printf("parsing ringbuf event: %s", err)
                        continue
                }

                log.Printf("pid: %d\tsyscall: %d\n", event.Pid, event.SyscallNr)
        }
}

Problem

When I execute my code after go build, I get following error

loading objects: field TracepointRawSysEnter: program tracepoint_raw_sys_enter: load program: permission denied: 9: (63) *(u32 *)(r0 +4) = r1: R0 invalid mem access 'mem_or_null' (15 line(s) omitted)

I have tried solving this by adding a dummy kprobe in eBPF code, however did not solve the problem either. However, once I have removed

    data = bpf_ringbuf_reserve(&events, sizeof(struct event), 0);

from the code, this successfully ran. Also, bpf_ringbuf_reserve worked when I used kprobe instead of tracepoint. That makes me confusing.

I have been googling and searching the web for a long time, however was not able to find solutions for this.
It would be very helpful for me if anybody might take a time off to save me...

Also, my kernel version is 5.15.0-67 for your information.

Thanks!

[chenhengqi]

You must check data against NULL:

if (!data)
    return 0;

[isu-kim]

Yes! that solved the issue.
I think I missed checking against NULL.
Thanks for your help!