On Sun, Oct 11, 2020 at 7:10 PM Yaniv Agman <yanivagman@xxxxxxxxx> wrote: > > Trying to load kprobes on ubuntu 4.15.0, I get the following error: > libbpf: load bpf program failed: Invalid argument > > The same kprobes load successfully using bcc > > After some digging, I found that the issue was with the kernel version > given to the bpf syscall. While libbpf calculated the value 265984 for > the kern_version argument, bcc used 266002. > It turns out that some distros (e.g. ubuntu, debian) change the patch > number of the kernel version, as detailed in: > https://github.com/ajor/bpftrace/issues/8 > > I didn't find a proper API in libbpf to load kprobes in such cases - > is there any? Yes, you can override kernel version that libbpf determines from utsname with a special variable in your BPF code: int KERNEL_VERSION SEC("version") = 123;
