执行nettrace -p icmp --detail --diag --date --debug报ebpf无法加载

[hezhiye]

环境: Linux localhost 5.10.110-android-x86_64+ 配置： CONFIG_KALLSYMS=y CONFIG_DEBUG_INFO_BTF=y CONFIG_BPF_SYSCALL=y CONFIG_FTRACE=y CONFIG_DYNAMIC_FTRACE CONFIG_KPROBES=y CONFIG_KPROBE_EVENTS=y BTF_MODULES=y 但CONFIG_DEBUG_INFO_BTF_MODULES没有该选项

错误信息： 93: (15) if r1 == 0x0 goto pc+28 frame1: R0=invP(id=0) R1_w=invP(id=0,umax_value=255,var_off=(0x0; 0xff)) R2=invP(id=0,umax_value=4294967295,var_off=(0x0; 0xffffffff)) R6=fp-208 R7=map_value(id=0,off=0,ks=4,vs=168,imm=0) R8_w=invP0 R9w=invP(id=0) R10=fp0 fp-56=mmmmmmmm fp-64=invP4294967295 fp-72=mmmmmmmm fp-80=fp fp-88=invP1 94: (b7) r1 = 16 95: (bf) r3 = r9 96: (0f) r3 += r1 97: (bf) r1 = r10 ; 98: (07) r1 += -40 ; dev = (skb->dev); 99: (b7) r2 = 8 100: (85) call bpf_probe_read_kernel#113 101: (79) r3 = (u64 )(r10 -40) ; if (!dev) { 102: (55) if r3 != 0x0 goto pc+162 frame1: R0=invP(id=0) R3_w=invP0 R6=fp-208 R7=mapvalue(id=0,off=0,ks=4,vs=168,imm=0) R8=invP0 R9=invP(id=2) R10=fp0 fp-40=mmmmmmmm fp-56=mmmmmmmm fp-64=invP4294967295 fp-72=mmmmmmmm fp-80=fp fp-88=invP1 103: (b7) r1 = 24 104: (0f) r9 += r1 105: (bf) r1 = r10 ; 106: (07) r1 += -40 ; struct sock *sk = (skb->sk); 107: (b7) r2 = 8 108: (bf) r3 = r9 109: (85) call bpf_probe_read_kernel#113 110: (79) r3 = (u64 )(r10 -40) ; if (!sk) 111: (15) if r3 == 0x0 goto pc+9 frame1: R0=invP(id=0) R3_w=invP(id=0) R6=fp-208 R7=map_value(id=0,off=0,ks=4,vs=168,imm=0) R8=invP0 R9=invP(id=3) R10=fp0 fp-40=mmmmmmmm fp-56=mmmmmmmm fp-64=invP4294967295 fp-72=mmmmmmmm fp-80=fp fp-88=invP1 112: failed to resolve CO-RE relocation [965] struct sock.sk_common.skc_net.net (0:0:12:0 @ offset 48) processed 88 insns (limit 1000000) max_states_per_insn 0 total_states 6 peak_states 6 mark_read 3 -- END PROG LOAD LOG -- libbpf: prog 'trace_napi_gro_receive_entry': failed to load: -22 libbpf: failed to load object 'kprobe' libbpf: failed to load BPF skeleton 'kprobe': -22 ERROR: failed to load kprobe-based eBPF ERROR: failed to load kprobe-based bpf

[menglongdong]

看样子你的内核不支持网络命名空间？CONFIG_NET_NS应该是没有配置，这个应该很少有不配置的场景。

Anyway，我稍后做点调整适配该场景吧。

[menglongdong]

麻烦看一下最新的dev分支的代码能否解决你的这个问题

[hezhiye]

CONFIG_NET_NS是没有设置

[hezhiye]

有编译好的吗？上传一个 我这个是嵌入式设备，内核是裁减过的

[menglongdong]

有的： nettrace.zip

[hezhiye]

可以正常跑了，但有错误打印 BUG: eBPF is loaded successfully DEBUG: begin to attach eBPF program... libbpf: prog 'trace_tcp_in_window': failed to create kprobe 'tcp_in_window.UNIQUE_ID_ddebug678+0x0' perf event: Invalid argument retring to attach in legacy mode, prog=trace_tcp_in_window, func=tcp_in_window.UNIQUE_ID_ddebug678 DEBUG: command: (echo 'p:tcp_in_window_UNIQUE_ID_ddebug678 tcp_in_window.UNIQUE_ID_ddebug678' >> /sys/kernel/debug/tracing/kprobe_events) 2>&1, status:1 WARN: failed to create kprobe: tcp_inwindowUNIQUE_ID_ddebug678 ERROR: failed to manually attach program prog=__trace_tcp_in_window, func=tcp_in_window.UNIQUE_ID_ddebug678 libbpf: prog 'rettrace_tcp_in_window': failed to create kretprobe 'tcp_in_window.UNIQUE_ID_ddebug678+0x0' perf event: Invalid argument retring to attach in legacy mode, prog=rettrace_tcp_in_window, func=tcp_in_window.UNIQUE_ID_ddebug678 DEBUG: command: (echo 'r:ret_tcp_in_window_UNIQUE_ID_ddebug678 tcp_in_window.__UNIQUE_ID_ddebug678' >> /sys/kernel/debug/tracing/kprobe_events) 2>&1, status:1 WARN: failed to create kprobe: ret_tcp_inwindowUNIQUE_ID_ddebug678 ERROR: failed to manually attach program prog=ret__trace_tcp_in_window, func=tcp_in_window.__UNIQUE_ID_ddebug678 DEBUG: eBPF program attached successfully begin trace... DEBUG: create entry: 1ee8bc0, ffff891500c20d00, size: 156 DEBUG: fake ctx alloc: 1f31990, ffff891500c20d00

[menglongdong]

正常，不影响