I am trying to iterate over vm_area_struct whenever the user space program calls the function hello. How to do so?
mm->mmap is not available anymore. We need to iterate the maple tree mm_mt. But for_each_vma is not working with error shown below.
I want to ultimately be able to copy one of the vm_area pages but I am stuck at a step prior to that. Mentioning this in case it's an X/Y Problem.
My code:
from bcc import BPF
bpf_text = r"""
#include <uapi/linux/ptrace.h>
#include <linux/sched.h>
#include <linux/mm_types.h>
#include <linux/mm.h>
#include <linux/bpf.h>
int hello_enter(struct pt_regs *ctx) {
bpf_trace_printk("Hello\n");
struct task_struct *ts = (struct task_struct *)bpf_get_current_task();
bpf_trace_printk("%u\n", ts->pid);
struct mm_struct *mm = ts->mm;
if (mm) {
struct vm_area_struct *vma;
VMA_ITERATOR(iter, mm, 0);
for_each_vma(iter, vma) {
//virt_size += vma->vm_end - vma->vm_start;
//bpf_trace_printk("%lx\t%lx", vma->vm_start, vma->vm_end);
}
} else {
bpf_trace_printk("No memory management structure (mm) found\n");
}
return 0;
}
"""
# Load BPF program
b = BPF(text=bpf_text)
# Attach uprobe
b.attach_uprobe(name="./test.out", sym="hello", fn_name="hello_enter")
# Print traced messages
b.trace_print()
Error:
sudo python as2.py
In file included from /virtual/main.c:2:
In file included from include/uapi/linux/ptrace.h:183:
In file included from arch/x86/include/asm/ptrace.h:5:
In file included from arch/x86/include/asm/segment.h:7:
arch/x86/include/asm/ibt.h:77:8: warning: 'nocf_check' attribute ignored; use -fcf-protection to enable the attribute [-Wignored-attributes]
extern __noendbr u64 ibt_save(bool disable);
^
arch/x86/include/asm/ibt.h:32:34: note: expanded from macro '__noendbr'
#define __noendbr __attribute__((nocf_check))
^
arch/x86/include/asm/ibt.h:78:8: warning: 'nocf_check' attribute ignored; use -fcf-protection to enable the attribute [-Wignored-attributes]
extern __noendbr void ibt_restore(u64 save);
^
arch/x86/include/asm/ibt.h:32:34: note: expanded from macro '__noendbr'
#define __noendbr __attribute__((nocf_check))
^
2 warnings generated.
bpf: Failed to load program: Invalid argument
jump out of range from insn 41 to 58
processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
Traceback (most recent call last):
File "/mnt/veracrypt3/projects/ebpf/as2.py", line 39, in <module>
b.attach_uprobe(name="./test.out", sym="hello", fn_name="hello_enter")
File "/usr/lib/python3.11/site-packages/bcc/__init__.py", line 1383, in attach_uprobe
fn = self.load_func(fn_name, BPF.KPROBE)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.11/site-packages/bcc/__init__.py", line 526, in load_func
raise Exception("Failed to load BPF program %s: %s" %
Exception: Failed to load BPF program b'hello_enter': Invalid argument