iovisor / iovisor/bcc

Exception: Failed to attach BPF program do_ret_sys_kill to kretprobe sys_kill

Open
#3,070 14 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

i try this command,not working

root@localhost:/usr/share# killsnoop
cannot attach kprobe, Function not implemented
Traceback (most recent call last):
File "/usr/share/bcc/tools/killsnoop", line 125, in
b.attach_kretprobe(event=kill_fnname, fn_name="do_ret_sys_kill")
File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 709, in attach_kretprobe
(fn_name, event))
Exception: Failed to attach BPF program do_ret_sys_kill to kretprobe sys_kill

i using [adeb](https://github.com/joelagnel/adeb) running on android pixel4xl
kernel versiong 4.14 (4.14.170-g551313822-dirty_audio-g199e9bf)
bcc version latest

kernel config

CONFIG_BPF=y
CONFIG_BPF_JIT=y
CONFIG_HAVE_EBPF_JIT=y
CONFIG_KPROBE_EVENTS=y
CONFIG_UPROBE_EVENTS=y
CONFIG_BPF_EVENTS=y
CONFIG_DEBUG_PREEMPT=y
CONFIG_PREEMPTIRQ_EVENTS=y
CONFIG_FTRACE_SYSCALLS=y

I don't know what to do

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with /usr/share/bcc/tools/killsnoop at the attach_kretprobe call and inspect bcc/__init__.py around attach_kretprobe. Reproduce the failure on the reported Android Pixel 4 XL kernel, then compare the kernel's kprobe and BPF support with the required sys_kill hook. Done means identifying the compatibility cause and recording a supported configuration or a reproducible fix.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, linux, python
Domain
devtools, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.