iovisor / iovisor/bcc

bpf: Failed to load program: Invalid argument

Open
#4,723 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

Hi.
I'm still newbie in eBPF/Kernel issues so I'll appreciate your help here.
I run a simple hello-world code in c. This code runs as expected under Ubuntu 18.04.
My task is to create a docker that runs this code under centos 7.
My kernel version is : 4.15.0-213-generic.

When I call to **yum install kernel-devel**, it installs 3.10.0-1160.95.1.el7.x86_64 under /usr/src/kernels/ (can't seem to find the 4.15.0.213 version of kernel).
The same for **yum install kernel-headers**.

Here is my dockerfile:

FROM library/centos:7
RUN yum install -y bcc bcc-tools bcc-devel bcc-doc elfutils-libelf-devel-0.176-5.el7.x86_64

COPY . /app
WORKDIR /app

RUN cmake .
RUN make

CMD ["./hello_world"]

Docker build command runs successfully but it fails when I run it with the following error:
bpf: Failed to load program: Invalid argument
attach failed Failed to load kprobe__execve: -1

When I run it with strace:

open("/sys/kernel/debug/tracing/trace_pipe", O_RDONLY) = 3
bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_KPROBE, insn_cnt=30, insns=0x7fe99039f7d8, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(3, 10, 0), prog_flags=0, prog_name="execve", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 112) = -1 EINVAL (Invalid argument)
bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_KPROBE, insn_cnt=30, insns=0x7fe99039f7d8, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(3, 10, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 112) = -1 EINVAL (Invalid argument)
bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_KPROBE, insn_cnt=30, insns=0x7fe99039f7d8, license="GPL", log_level=1, log_size=65536, log_buf="", kern_version=KERNEL_VERSION(3, 10, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 112) = -1 EINVAL (Invalid argument)
write(2, "bpf: Failed to load program: Inv"..., 46bpf: Failed to load program: Invalid argument
) = 46
write(2, "\n", 1
) = 1
stat("/etc/sysconfig/64bit_strstr_via_64bit_strstr_sse2_unaligned", 0x7ffda64d73b0) = -1 ENOENT (No such file or directory)
write(2, "attach failed ", 14attach failed ) = 14
write(2, "Failed to load kprobe__execve: -"..., 33Failed to load kprobe__execve: -1) = 33

Running my code with gdb, doesn't say much:

Starting program: /app/./hello_world
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
warning: JITed object file architecture unknown is not compatible with target architecture i386:x86-64.
bpf: Failed to load program: Invalid argument

attach failed Failed to load kprobe__execve: -1

Attaching main.cpp.

Thanks in advance.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the Dockerfile, the hello_world entry point, and the difference between the host kernel 4.15.0-213 and CentOS 7's 3.10 kernel-devel. Reproduce the failure and inspect the BPF_PROG_LOAD calls shown by strace. Done means identifying the compatibility cause and documenting or verifying a working container setup where kprobe__execve attaches successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, centos, cmake, docker, linux
Domain
devops, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.