בתאריך יום ב׳, 12 באוק׳ 2020 ב-20:02 מאת Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx>: > > On Sun, Oct 11, 2020 at 7:10 PM Yaniv Agman <yanivagman@xxxxxxxxx> wrote: > > > > Trying to load kprobes on ubuntu 4.15.0, I get the following error: > > libbpf: load bpf program failed: Invalid argument > > > > The same kprobes load successfully using bcc > > > > After some digging, I found that the issue was with the kernel version > > given to the bpf syscall. While libbpf calculated the value 265984 for > > the kern_version argument, bcc used 266002. > > It turns out that some distros (e.g. ubuntu, debian) change the patch > > number of the kernel version, as detailed in: > > https://github.com/ajor/bpftrace/issues/8 > > > > I didn't find a proper API in libbpf to load kprobes in such cases - > > is there any? > > Yes, you can override kernel version that libbpf determines from > utsname with a special variable in your BPF code: > > int KERNEL_VERSION SEC("version") = 123; Thanks! This is trivial, I should have thought about it myself. For some reason, I thought that the loader should handle that, but if I include int KERNEL_VERSION SEC("version") = LINUX_VERSION_CODE; It should just work Thanks again!
