Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpftrace v0.20.1, Linux 4.19 - ERROR: Error loading program #3011

Closed
giorio94 opened this issue Feb 20, 2024 · 3 comments · Fixed by #3149
Closed

bpftrace v0.20.1, Linux 4.19 - ERROR: Error loading program #3011

giorio94 opened this issue Feb 20, 2024 · 3 comments · Fixed by #3149
Labels
bug Something isn't working

Comments

@giorio94
Copy link

What reproduces the bug? Provide code if possible.

The latest version (v0.20.1) of bpftrace run against a 4.19 kernel (specifying the path to the BTF file through the BPFTRACE_BTF environment variable) fails to load (apparently any) program. v0.19.1 works fine in the same environment. I managed to bisect the issue as being caused by #2804.

BPFTRACE_BTF="/boot/btf-$(uname -r)" bpftrace -e 'kprobe:do_nanosleep { printf("hi\n"); }' -v

INFO: node count: 6
Attaching 1 probe...

Error log:
magic: 0xeb9f
version: 1
flags: 0x0
hdr_len: 24
type_off: 0
type_len: 76
str_off: 76
str_len: 78
btf_total_size: 178
[1] PTR (anon) type_id=2
[2] INT int8 size=1 bits_offset=0 nr_bits=8 encoding=SIGNED
[3] Invalid kind:13
ERROR: Error loading program: kprobe:do_nanosleep

I'm running a 4.19 VM through https://github.com/cilium/little-vm-helper:

lvh images pull --cache quay.io/lvh-images/kind:4.19-20240201.165956 --dir images
lvh run --image images/kind_4.19.qcow2 --daemonize -p 2222:22 --serial-port 0 --cpu=4 --mem=6G --cpu-kind host --console-log-file /tmp/console.log

bpftrace --info output

System
  OS: Linux 4.19.306 #1 SMP Thu Feb 1 17:01:42 UTC 2024
  Arch: x86_64

Build
  version: v0.20.1
  LLVM: 17.0.6
  unsafe probe: no
  bfd: no
  libdw (DWARF support): yes

Kernel helpers
  probe_read: yes
  probe_read_str: yes
  probe_read_user: no
  probe_read_user_str: no
  probe_read_kernel: no
  probe_read_kernel_str: no
  get_current_cgroup_id: yes
  send_signal: no
  override_return: yes
  get_boot_ns: no
  dpath: no
  skboutput: no
  get_tai_ns: no
  get_func_ip: no
  jiffies64: no

Kernel features
  Instruction limit: 131072
  Loop support: no
  btf: yes
  module btf: no
  map batch: no
  uprobe refcount (depends on Build:bcc bpf_attach_uprobe refcount): no

Map types
  hash: yes
  percpu hash: yes
  array: yes
  percpu array: yes
  stack_trace: yes
  perf_event_array: yes
  ringbuf: no

Probe types
  kprobe: yes
  tracepoint: yes
  perf_event: yes
  kfunc: no
  kprobe_multi: no
  uprobe_multi: no
  raw_tp_special: no
  iter: no
@giorio94 giorio94 added the bug Something isn't working label Feb 20, 2024
@viktormalik
Copy link
Contributor

Looking at

[3] Invalid kind:13
ERROR: Error loading program: kprobe:do_nanosleep

Kind 13 is BTF_KIND_FUNC_PROTO which was added by torvalds/linux@2667a2626f4d to kernel version 5.0. To support a kernel as old as 4.19, we'd probably have to add an option not to emit BTF for our programs. That will prevent some features to be used but should make at least basic probes work.

@ajor @danobi @jordalgo what do you think? 4.19 is a stable kernel.

FWIW, I'm not sure how this will work once we start delegating more things (like prog loading) to libbpf. It's supposed to be backwards-compatible but I'm not sure to what extent.

@ajor
Copy link
Member

ajor commented Feb 20, 2024

Looks like libbpf will have us covered when we fully switch over: https://github.com/libbpf/libbpf/blob/445486dcbf9ddd8b3ca799a98ace58d23cee31a1/src/libbpf.c#L2829-L2833

@viktormalik
Copy link
Contributor

Nice. In that case, I'm slightly in favor of not fixing this now and rather investing in switching to libbpf.

@bernhardkaindl bernhardkaindl mentioned this issue May 4, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix bpftrace for older kernels: Fallback to no func_infos, no BTF xenserver-next/bpftrace
3 participants
@ajor @viktormalik @giorio94