On Thu, Mar 30, 2023 at 10:21 AM andrea terzolo <andreaterzolo3@xxxxxxxxx> wrote: > > Hi all! > > If I can I would like to ask one question about the > `libbpf_probe_bpf_prog_type` API. The idea is to use `fentry/fexit` > bpf progs only if they are available and fall back to simple `kprobes` > when they are not. Is there a way to probe `BPF_TRACE_FENTRY` support > with `libbpf` APIs? I was looking at `libbpf_probe_bpf_prog_type` API > but it seems to check the `prog_type` rather than the `attach_type`, > when I call it `libbpf_probe_bpf_prog_type(BPF_PROG_TYPE_TRACING, > NULL);` it returns `1` even if `fentry/fexit` progs are not supported > on my machine. Is there a way to probe this feature with other > `libbpf` APIs? > looking at libbpf probing code, for BPF_PROG_TYPE_TRACING we choose BPF_TRACE_FENTRY attach type automatically (because it doesn't really matter whether its BPF_TRACE_FEXIT or BPF_MODIFY_RETURN, they all are either supported or none is). We then expect that verifier will complain with "attach_btf_id 1 is not a function" error. If we do see that error, we know that verifier supports fentry/fexit programs *in principle*, which is what we are checking with libbpf_probe_bpf_prog_type(). If kernel doesn't support fentry/fexit attachment for some specific function you'd like to attach to, that's a different matter. This would be equivalent to BPF_PROG_TYPE_KPROBE check -- we check if kprobes in general are supported, but not whether kprobing specific kernel function works. I assume by "not supported on my machine" you mean that you can't attach fentry/fexit to some function? If not, let me know, and we'd have to debug this further. If you want to know if some function can be traced with fentry/fexit, check below helper function from libbpf-tools ([0]) bool fentry_can_attach(const char *name, const char *mod) [0] https://github.com/iovisor/bcc/blob/master/libbpf-tools/trace_helpers.c#LL1043-L1043C58 > Thank you in advance for your time, > Andrea
