>> Hello :)
>>
>> I am currently having a problem and hope you can help me: My goal is to develop a BPF-program (see below) on a development machine and then deploy it to another machine to run it there using BPF CO:RE.
>> But the program does not load; bpf_object__load returns -EINVAL.
>>
>> Development machine:
>> - Ubuntu 20.04 LTS
>> - Linux 5.4.0-90-generic x86_64
>> - Kernel compiled with CONFIG_DEBUG_INFO_BTF=y, so BTF is available under /sys/kernel/btf/vmlinux
>> - clang version: 10.0.0-4ubuntu1
>> - llc version: 10.0.0
>>
>> Target machine:
>> - Ubuntu 18.10
>> - Linux 4.18.0-25-generic x86_64
>
> 4.18 is very old and obsolete and insecure and only supported by the
> vendor you are paying support from. Please upgrade to a more modern
> kernel (4.18 was released way back in 2018), if you wish to get help
> from the kernel community.
>
> Actually, the vendor you are paying for support to stay at this old
> kernel version should be able to provide help to you, why not ask them?
>
> thanks,
>
> greg k-h
Ubuntu 18.04 LTS is still out there and did not reach its end of maintenance; 18.10 is even a bit newer. So yes, it is not up to date, but I would not consider it very old or obsolete.
Actually, I am a student and not paying any vendor I could ask.
BPF CO:RE stands for Compile Once, Run >Everywhere<, so I do wonder why it does not work - it should, no matter wether it is kernel 4.18 or another one, should't it?.
I just get started to eBPF programming and find it difficult to get documentation and examples on how to do it in a not-deprecated way without using bcc, bpftrace or skeletons.
It is quite a simple program, why does it fail getting loaded on 4.18 but not on 5.4?:
SEC("kprobe/")
int trace_func_entry(struct pt_regs *ctx) {
u64 pid_tgid = bpf_get_current_pid_tgid();
u32 pid = pid_tgid;
int arg1;
int arg2;
arg1 = BPF_CORE_READ(ctx, di);
arg2 = PT_REGS_PARM2_CORE(ctx);
__u32 key = 0;
struct stack_trace_t* data;
data = bpf_map_lookup_elem(&stackdata_map, &key);
if (!data)
return 0;
size_t max_len = MAX_STACK_RAWTP * sizeof(__u64);
data->user_stack_size = bpf_get_stack(ctx, data->user_stack, max_len, BPF_F_USER_STACK);
return 0;
}
Thanks for any help
Dennis
