❦ 4 novembre 2019 18:55 +0530, Vasudeva Sathish Kamath <[email protected]>:
> I'm trying simple oneliner with bpftrace given in the man pages. For example
> following
>
> bpftrace -e 'tracepoint:syscalls:sys_enter_execve { join(args->argv); }'
>
> It fails with following error message
>
> Error creating map: 'join': Invalid argument
> Error creating printf map: Invalid argument
> Creation of the required BPF maps has failed.
> Make sure you have all the required permissions and are not confined (e.g.
> like
> snapcraft does). `dmesg` will likely have useful output for further
> troubleshooting
>
> But dmesg does not have any relevant messages. Even running sample tools
> shipped with bpftrace
> program like execsnoop.bt gives same above message.
>
> I'm unsure if this is package issue or some issue in my system. I'm using
> standard Debian unstable
> with default Debian kernel. Please let me know if this is something
> wrong from myside.
I get the same results. Also, it doesn't work with a 5.2 kernel either.
Using "strace -febpf", I see the following:
bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_HASH,
key_size=2296983664, value_size=8, max_entries=8, map_flags=0x1000 /*
BPF_F_??? */, inner_map_fd=0, map_name="", map_ifindex=0}, 112) = -1
EINVAL (Invalid argument)
So, the values seem bogus. libbpfcc has been updated recently and it
doesn't seem to manage a stable ABI. Just recompiling bpftrace against
the new one makes it work. I am tempted to just bump the version and
call it a day.
--
The naked truth of it is, I have no shirt.
-- William Shakespeare, "Love's Labour's Lost"
signature.asc
Description: PGP signature
