即使成功加载了 bpf 代码，ebpf 尾调用也不起作用

Question

#include "bpf/bpf_helpers.h"
#include <linux/bpf.h>
char _license[] SEC("license") = "GPL";
struct bpf_map_def SEC("maps") jump_table = {
    .type = BPF_MAP_TYPE_PROG_ARRAY,
    .key_size = sizeof(__u32),
    .value_size = sizeof(__u32),
    .max_entries = 100,
};

SEC("xdp_1")
int test_func(struct xdp_md *ctx) {
  bpf_printk("tail call\n");
  return XDP_PASS;
}

SEC("xdp")
int xdp_pass_func(struct xdp_md *ctx) {
  __u32 zero = 0;
  bpf_tail_call(ctx, &jump_table, zero);
  bpf_printk("tail call failed\n");
  return XDP_PASS;
}

when i look cat /sys/kernel/debug/tracing/trace_pipe , it shows tail call failed ,but i don't know whats wrong,here is my load code

func main() {
    if err := rlimit.RemoveMemlock(); err != nil {
        log.Fatal(err)
        return
    }
    var obj aclObjects
    err := loadAclObjects(&obj, nil)
    if err != nil {
        log.Fatal(err)
        return
    }
    err = obj.JumpTable.Put(uint32(0), uint32(obj.TestFunc.FD()))
    if err != nil {
        log.Fatal(err)
        return
    }
    link, err := netlink.LinkByName("ens33")
    if err != nil {
        log.Fatal(err)
        return
    }
    err = netlink.LinkSetXdpFd(link, obj.XdpPassFunc.FD())
    if err != nil {
        log.Fatal(err)
        return
    }
}

the bpf code can be loaded, but it seems some thing wrong with tail_call，i wrote it according to linux source code，someone can help me?

Answer 1

As you realised and mentioned in your answer, the file descriptor referencing the program will indeed be closed when the loader exits.

If nothing else references the program, it is unloaded. What can hold such a reference?

• Said file descriptor, as long as the loader remains open.
• If the program is attached to certain hooks (for example: networking hooks), it remains in place even after the loading process exists.
• If the program is pinned, it's kept as well. This is the very purpose of pinning a program to the virtual BPF file system. See this reference for some details on pinning to the bpffs , or more generally, this post on the lifetime of eBPF objects .

What you want is to pin your program before your loader exits (It seems you use goebpf? Apparently the library has a Pin() function , which should probably help).

Answer 2

我发现加载程序退出时prog fd会关闭的问题，所以我保持程序阻塞并且尾调用工作正常，我不知道为什么fd关闭是一个问题，希望有人能回答