On Mon, Oct 12, 2020 at 2:21 PM Yaniv Agman <yanivagman@xxxxxxxxx> wrote: > > בתאריך יום ב׳, 12 באוק׳ 2020 ב-20:02 מאת Andrii Nakryiko > <andrii.nakryiko@xxxxxxxxx>: > > > > On Sun, Oct 11, 2020 at 7:10 PM Yaniv Agman <yanivagman@xxxxxxxxx> wrote: > > > > > > Trying to load kprobes on ubuntu 4.15.0, I get the following error: > > > libbpf: load bpf program failed: Invalid argument > > > > > > The same kprobes load successfully using bcc > > > > > > After some digging, I found that the issue was with the kernel version > > > given to the bpf syscall. While libbpf calculated the value 265984 for > > > the kern_version argument, bcc used 266002. > > > It turns out that some distros (e.g. ubuntu, debian) change the patch > > > number of the kernel version, as detailed in: > > > https://github.com/ajor/bpftrace/issues/8 > > > > > > I didn't find a proper API in libbpf to load kprobes in such cases - > > > is there any? > > > > Yes, you can override kernel version that libbpf determines from > > utsname with a special variable in your BPF code: > > > > int KERNEL_VERSION SEC("version") = 123; > > Thanks! This is trivial, I should have thought about it myself. > For some reason, I thought that the loader should handle that, but if I include libbpf does handle that automatically, but it has to get the kernel version from utsname() call, which apparently doesn't always match what kernel believes LINUX_VERSION_CODE is. > int KERNEL_VERSION SEC("version") = LINUX_VERSION_CODE; > It should just work > > Thanks again!
