bpftune is not supported on centos 5.4.119

[Fin-chan]

i'm trying to run bpftune on kernel（Linux VM-216-74-centos 5.4.119-1）with the following configuration:

root@VM-216-74-centos src (main) # zgrep BPF /proc/config.gz 
CONFIG_CGROUP_BPF=y
CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
# CONFIG_BPF_JIT_ALWAYS_ON is not set
CONFIG_NETFILTER_XT_MATCH_BPF=m
# CONFIG_BPFILTER is not set
CONFIG_NET_CLS_BPF=m
# CONFIG_NET_ACT_BPF is not set
CONFIG_BPF_JIT=y
# CONFIG_BPF_STREAM_PARSER is not set
CONFIG_HAVE_EBPF_JIT=y
CONFIG_BPF_EVENTS=y
# CONFIG_BPF_KPROBE_OVERRIDE is not set
# CONFIG_TEST_BPF is not set

and after building from commit 22926812a555eac910eac0699100bac0f8776f1b I get the error：

bpftune: set caps (count 1)
bpftune: set caps (count 2)
bpftune: drop caps (count 1)
bpftune: set caps (count 2)
bpftune: libbpf: loading object 'probe_bpf' from buffer
bpftune: libbpf: elf: section(3) fentry/setup_net, size 88, link 0, flags 6, type=1
bpftune: libbpf: sec 'fentry/setup_net': found program 'entry__setup_net' at insn offset 0 (0 bytes), code size 11 insns (88 bytes)
bpftune: libbpf: elf: section(4) iter/tcp, size 128, link 0, flags 6, type=1
bpftune: libbpf: sec 'iter/tcp': found program 'probe_cong_iter' at insn offset 0 (0 bytes), code size 16 insns (128 bytes)
bpftune: libbpf: elf: section(5) tp_btf/neigh_create, size 16, link 0, flags 6, type=1
bpftune: libbpf: sec 'tp_btf/neigh_create': found program 'bpftune_neigh_create' at insn offset 0 (0 bytes), code size 2 insns (16 bytes)
bpftune: libbpf: elf: section(6) cgroup/sysctl, size 16, link 0, flags 6, type=1
bpftune: libbpf: sec 'cgroup/sysctl': found program 'sysctl_write' at insn offset 0 (0 bytes), code size 2 insns (16 bytes)
bpftune: libbpf: elf: section(7) license, size 7, link 0, flags 3, type=1
bpftune: libbpf: license of probe_bpf is GPL v2
bpftune: libbpf: elf: section(8) .rodata, size 24, link 0, flags 2, type=1
bpftune: libbpf: elf: section(9) .bss, size 25, link 0, flags 3, type=8
bpftune: libbpf: elf: section(10) .maps, size 128, link 0, flags 3, type=1
bpftune: libbpf: elf: section(21) .BTF, size 148477, link 0, flags 0, type=1
bpftune: libbpf: elf: section(23) .BTF.ext, size 428, link 0, flags 0, type=1
bpftune: libbpf: elf: section(31) .symtab, size 792, link 1, flags 0, type=2
bpftune: libbpf: looking for externs among 33 symbols...
bpftune: libbpf: collected 0 externs total
bpftune: libbpf: map 'ring_buffer_map': at sec_idx 10, offset 0.
bpftune: libbpf: map 'ring_buffer_map': found type = 27.
bpftune: libbpf: map 'ring_buffer_map': found max_entries = 131072.
bpftune: libbpf: map 'netns_map': at sec_idx 10, offset 16.
bpftune: libbpf: map 'netns_map': found type = 1.
bpftune: libbpf: map 'netns_map': found key [12], sz = 8.
bpftune: libbpf: map 'netns_map': found value [12], sz = 8.
bpftune: libbpf: map 'netns_map': found max_entries = 65536.
bpftune: libbpf: map 'netns_map': found map_flags = 0x0.
bpftune: libbpf: map 'last_event_map': at sec_idx 10, offset 56.
bpftune: libbpf: map 'last_event_map': found type = 1.
bpftune: libbpf: map 'last_event_map': found key [12], sz = 8.
bpftune: libbpf: map 'last_event_map': found value [12], sz = 8.
bpftune: libbpf: map 'last_event_map': found max_entries = 65536.
bpftune: libbpf: map 'probe_hash_map': at sec_idx 10, offset 88.
bpftune: libbpf: map 'probe_hash_map': found type = 1.
bpftune: libbpf: map 'probe_hash_map': found key [12], sz = 8.
bpftune: libbpf: map 'probe_hash_map': found value [12], sz = 8.
bpftune: libbpf: map 'probe_hash_map': found max_entries = 65536.
bpftune: libbpf: map 'probe_hash_map': found map_flags = 0x0.
bpftune: libbpf: map 'probe_bp.rodata' (global data): at sec_idx 8, offset 0, flags 480.
bpftune: libbpf: map 4 is "probe_bp.rodata"
bpftune: libbpf: map 'probe_bp.bss' (global data): at sec_idx 9, offset 0, flags 400.
bpftune: libbpf: map 5 is "probe_bp.bss"
bpftune: libbpf: loading kernel BTF '/sys/kernel/btf/vmlinux': 0
bpftune: libbpf: map 'ring_buffer_map': failed to create: Invalid argument(-22)
bpftune: libbpf: failed to load object 'probe_bpf'
bpftune: libbpf: failed to load BPF skeleton 'probe_bpf': -22
bpftune: full bpftune support not available: Unknown error -22
bpftune: libbpf: loading object 'probe_bpf_legacy' from buffer
bpftune: libbpf: elf: section(3) kprobe/setup_net, size 88, link 0, flags 6, type=1
bpftune: libbpf: sec 'kprobe/setup_net': found program 'entry__setup_net' at insn offset 0 (0 bytes), code size 11 insns (88 bytes)
bpftune: libbpf: elf: section(4) raw_tracepoint/neigh_create, size 16, link 0, flags 6, type=1
bpftune: libbpf: sec 'raw_tracepoint/neigh_create': found program 'bpftune_neigh_create' at insn offset 0 (0 bytes), code size 2 insns (16 bytes)
bpftune: libbpf: elf: section(5) cgroup/sysctl, size 16, link 0, flags 6, type=1
bpftune: libbpf: sec 'cgroup/sysctl': found program 'sysctl_write' at insn offset 0 (0 bytes), code size 2 insns (16 bytes)
bpftune: libbpf: elf: section(6) license, size 7, link 0, flags 3, type=1
bpftune: libbpf: license of probe_bpf_legacy is GPL v2
bpftune: libbpf: elf: section(7) .rodata, size 24, link 0, flags 2, type=1
bpftune: libbpf: elf: section(8) .bss, size 25, link 0, flags 3, type=8
bpftune: libbpf: elf: section(9) .maps, size 128, link 0, flags 3, type=1
bpftune: libbpf: elf: section(20) .BTF, size 148032, link 0, flags 0, type=1
bpftune: libbpf: elf: section(22) .BTF.ext, size 284, link 0, flags 0, type=1
bpftune: libbpf: elf: section(30) .symtab, size 720, link 1, flags 0, type=2
bpftune: libbpf: looking for externs among 30 symbols...
bpftune: libbpf: collected 0 externs total
bpftune: libbpf: map 'ring_buffer_map': at sec_idx 9, offset 0.
bpftune: libbpf: map 'ring_buffer_map': found type = 27.
bpftune: libbpf: map 'ring_buffer_map': found max_entries = 131072.
bpftune: libbpf: map 'netns_map': at sec_idx 9, offset 16.
bpftune: libbpf: map 'netns_map': found type = 1.
bpftune: libbpf: map 'netns_map': found key [12], sz = 8.
bpftune: libbpf: map 'netns_map': found value [12], sz = 8.
bpftune: libbpf: map 'netns_map': found max_entries = 65536.
bpftune: libbpf: map 'netns_map': found map_flags = 0x0.
bpftune: libbpf: map 'last_event_map': at sec_idx 9, offset 56.
bpftune: libbpf: map 'last_event_map': found type = 1.
bpftune: libbpf: map 'last_event_map': found key [12], sz = 8.
bpftune: libbpf: map 'last_event_map': found value [12], sz = 8.
bpftune: libbpf: map 'last_event_map': found max_entries = 65536.
bpftune: libbpf: map 'probe_hash_map': at sec_idx 9, offset 88.
bpftune: libbpf: map 'probe_hash_map': found type = 1.
bpftune: libbpf: map 'probe_hash_map': found key [12], sz = 8.
bpftune: libbpf: map 'probe_hash_map': found value [12], sz = 8.
bpftune: libbpf: map 'probe_hash_map': found max_entries = 65536.
bpftune: libbpf: map 'probe_hash_map': found map_flags = 0x0.
bpftune: libbpf: map 'probe_bp.rodata' (global data): at sec_idx 7, offset 0, flags 480.
bpftune: libbpf: map 4 is "probe_bp.rodata"
bpftune: libbpf: map 'probe_bp.bss' (global data): at sec_idx 8, offset 0, flags 400.
bpftune: libbpf: map 5 is "probe_bp.bss"
bpftune: libbpf: loading kernel BTF '/sys/kernel/btf/vmlinux': 0
bpftune: libbpf: map 'ring_buffer_map': failed to create: Invalid argument(-22)
bpftune: libbpf: failed to load object 'probe_bpf_legacy'
bpftune: libbpf: failed to load BPF skeleton 'probe_bpf_legacy': -22
bpftune: legacy bpftune support not available: Unknown error -22
bpftune: libbpf: loading object 'probe_bpf_nobtf' from buffer
bpftune: libbpf: elf: section(3) kprobe/setup_net, size 16, link 0, flags 6, type=1
bpftune: libbpf: sec 'kprobe/setup_net': found program 'entry__setup_net' at insn offset 0 (0 bytes), code size 2 insns (16 bytes)
bpftune: libbpf: elf: section(4) raw_tracepoint/neigh_create, size 16, link 0, flags 6, type=1
bpftune: libbpf: sec 'raw_tracepoint/neigh_create': found program 'bpftune_neigh_create' at insn offset 0 (0 bytes), code size 2 insns (16 bytes)
bpftune: libbpf: elf: section(5) cgroup/sysctl, size 16, link 0, flags 6, type=1
bpftune: libbpf: sec 'cgroup/sysctl': found program 'sysctl_write' at insn offset 0 (0 bytes), code size 2 insns (16 bytes)
bpftune: libbpf: elf: section(6) license, size 7, link 0, flags 3, type=1
bpftune: libbpf: license of probe_bpf_nobtf is GPL v2
bpftune: libbpf: elf: section(7) .rodata, size 24, link 0, flags 2, type=1
bpftune: libbpf: elf: section(8) .bss, size 25, link 0, flags 3, type=8
bpftune: libbpf: elf: section(9) .maps, size 128, link 0, flags 3, type=1
bpftune: libbpf: elf: section(19) .BTF, size 2263, link 0, flags 0, type=1
bpftune: libbpf: elf: section(21) .BTF.ext, size 160, link 0, flags 0, type=1
bpftune: libbpf: elf: section(29) .symtab, size 672, link 1, flags 0, type=2
bpftune: libbpf: looking for externs among 28 symbols...
bpftune: libbpf: collected 0 externs total
bpftune: libbpf: map 'ring_buffer_map': at sec_idx 9, offset 0.
bpftune: libbpf: map 'ring_buffer_map': found type = 27.
bpftune: libbpf: map 'ring_buffer_map': found max_entries = 131072.
bpftune: libbpf: map 'netns_map': at sec_idx 9, offset 16.
bpftune: libbpf: map 'netns_map': found type = 1.
bpftune: libbpf: map 'netns_map': found key [12], sz = 8.
bpftune: libbpf: map 'netns_map': found value [12], sz = 8.
bpftune: libbpf: map 'netns_map': found max_entries = 65536.
bpftune: libbpf: map 'netns_map': found map_flags = 0x0.
bpftune: libbpf: map 'last_event_map': at sec_idx 9, offset 56.
bpftune: libbpf: map 'last_event_map': found type = 1.
bpftune: libbpf: map 'last_event_map': found key [12], sz = 8.
bpftune: libbpf: map 'last_event_map': found value [12], sz = 8.
bpftune: libbpf: map 'last_event_map': found max_entries = 65536.
bpftune: libbpf: map 'probe_hash_map': at sec_idx 9, offset 88.
bpftune: libbpf: map 'probe_hash_map': found type = 1.
bpftune: libbpf: map 'probe_hash_map': found key [12], sz = 8.
bpftune: libbpf: map 'probe_hash_map': found value [12], sz = 8.
bpftune: libbpf: map 'probe_hash_map': found max_entries = 65536.
bpftune: libbpf: map 'probe_hash_map': found map_flags = 0x0.
bpftune: libbpf: map 'probe_bp.rodata' (global data): at sec_idx 7, offset 0, flags 480.
bpftune: libbpf: map 4 is "probe_bp.rodata"
bpftune: libbpf: map 'probe_bp.bss' (global data): at sec_idx 8, offset 0, flags 400.
bpftune: libbpf: map 5 is "probe_bp.bss"
bpftune: libbpf: map 'ring_buffer_map': failed to create: Invalid argument(-22)
bpftune: libbpf: failed to load object 'probe_bpf_nobtf'
bpftune: libbpf: failed to load BPF skeleton 'probe_bpf_nobtf': -22
bpftune: no-BTF bpftune support not available (load): Unknown error -22
bpftune: netns cookie not supported, cannot monitor per-netns events
bpftune: netns cookie not supported
bpftune: drop caps (count 1)
bpftune: bpftune is not supported
bpftune: bpftune is not supported on this system; exiting

with:

root@VM-216-74-centos src (main) # cat /proc/sys/kernel/unprivileged_bpf_disabled
0

What is the cause of the problem and how do I fix it？

[alan-maguire]

This is expected for a 5.4 kernel unfortunately. The cause here is that BPF ring buffer support isn't present in 5.4 (unless the kernel in question has backported BPF ring buffer support from 5.6). The README mentions this in the "Getting started" section:

"From the kernel side, the kernel needs to support BPF ring buffer (around the 5.6 kernel, though 5.4 is supported on Oracle Linux as ring buffer support was backported), and kernel BTF is required (CONFIG_DEBUG_INFO_BTF=y). Verify /sys/kernel/btf/vmlinux is present."

That's what we see above:

"bpftune: libbpf: map 'ring_buffer_map': failed to create: Invalid argument(-22)"

So I'd recommend using a 5.6 or later kernel if possible.

[alan-maguire]

Closing this one as 5.4 support without ringbuf isn't possible