Unable to run kprobe example about libbpf-bootstrap

[anakryiko]

yes, you need kernel BTF for CO-RE to work. You can work around that for such trivial example by adding

#define BPF_NO_PRESERVE_ACCESS_INDEX

before vmlinux.h include, but is there any reason why you can't upgrade your Ubuntu to something a bit more modern that will restrict you less in what you can do with BPF?

[Darrilla]

Yes, I have a huge set of BCC-style kprobes that we are using with Centos 7/RHEL servers, amazon Linux 1 & 2, ubuntu 18.04 +, etc. The goal is to migrate these to libbpf and BPF CO-RE using btfhub files for the older kernels. I assumed this would be possible after seeing the BTF files for the kernels we currently support via BCC and kernel headers.

[Darrilla]

BTW, I did modify this kprobe example to load the BTF for my kernel using the opts:

struct bpf_object_open_opts openopts = {};
openopts.sz = sizeof(struct bpf_object_open_opts);
openopts.btf_custom_path = "/tmp/vmlinux.btf";
...
...
/* Load and verify BPF application */
skel = kprobe_bpf__open_opts(&openopts);

/tmp/vmlinux.btf is the file I obtained for my kernel from btfhub-archives.

[Darrilla]

#define BPF_NO_PRESERVE_ACCESS_INDEX

Adding this define did not resolve the issue.

[Darrilla]

Even after adding

#define BPF_NO_GLOBAL_DATA
#define BPF_NO_PRESERVE_ACCESS_INDEX

there is still a problem due to, I believe, the usage of BPF_CORE_READ:

filename = BPF_CORE_READ(name, name);

When I code around this using bpf_probe_read_user, I am able to get things to work. This brings me back to a core question (no pun intented), are the bpf core helpers not going to work on older kernels even if you have the BTF for that kernel available?

[anakryiko]

it should work with btf_custom_path. What's the libbpf debug log output once you specify custom BTF?

[Darrilla]

I got this working. My BTF file didn't have all of the symbols I needed for this. I have run this example on 4.15.0-180-generic and on 3.10.0-957 (centos 7.6).