Search code examples
cheaderkernelebpfbcc-bpf

headers not working at a kernel level on eBPF code


So I'm developing something on eBPF.

I needed to use the unistd.h header because I wanted to use sleep function.

However, I realized that when I type in

#include <unistd.h>

these headers don't get included and I would get an error saying:

warning : implicit delcaration of function 'sleep' is invalid in C99 [-Wimplicit-Function-declaration] sleep (1);

I thought I have done something wrong somewhere else on the code so I tried to include that header on the example from the tutorial and it didn't work that way neither.

So from the code I have attached below, I tried to put a one second of delay before the message would be published.

Has anyone had a same issue and have somehow found a way to use that header inside the c code?

I would very much appreciate it if someone could land me some help!

Thanks a million!

I tried updating the kernel and moved all the header files to ёusr/local/includeё directory because it said on the internet that this is the place where the compiler first checks for headers but still didn't work.

So here's the code I tried but didn't work.

from bcc import BPF
BPF(text = 'int kprobe__sys_clone(void *ctx)
{
  #include <unistd.h>

  sleep(1);
  bpf_trace_printk("Hello World!\\n");
  return 0;
}
').trace_print()

Solution

  • I guess what you want is something like, https://github.com/iovisor/bcc/blob/master/examples/networking/xdp/xdp_drop_count.py Search "sleep" in that code.

    As @Ctx said, the function happens when clone syscall is triggered. There is no point to sleep() there, neither can you do it in the kernel calling sleep().

    You might want to understand the above example to see how it sets intervals to print stuff. Hope that helps.