iovisor / bcc

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

[question]: Run ebpf demo failed.

yuluo-yx opened this issue · comments

1. env

I install bcc by source code:

apt purge bpfcc-tools libbpfcc python3-bpfcc
wget https://github.com/iovisor/bcc/releases/download/v0.25.0/bcc-src-with-submodule.tar.gz
tar xf bcc-src-with-submodule.tar.gz
cd bcc/
apt install -y python-is-python3
apt install -y bison build-essential cmake flex git libedit-dev   libllvm11 llvm-11-dev libclang-11-dev zlib1g-dev libelf-dev libfl-dev python3-distutils
apt install -y checkinstall
mkdir build
cd build/
cmake -DCMAKE_INSTALL_PREFIX=/usr -DPYTHON_CMD=python3 ..
make
checkinstall
  1. os: ubuntu 20.04
  2. python3

2. ebpf code

#!/usr/bin/python3

from bcc import BPF
from time import sleep

# 定义 eBPF 程序
bpf_text = """
#include <uapi/linux/ptrace.h>

BPF_HASH(stats, u32);

int count(struct pt_regs *ctx) {
    u32 key = 0;
    u64 *val, zero=0;
    val = stats.lookup_or_init(&key, &zero);
    (*val)++;
    return 0;
}
"""

# 编译 eBPF 程序
b = BPF(text=bpf_text, cflags=["-Wno-macro-redefined"])

# 加载 eBPF 程序
b.attach_kprobe(event="tcp_sendmsg", fn_name="count")

name = {
  0: "tcp_sendmsg"
}
# 输出统计结果
while True:
    try:
        #print("Total packets: %d" % b["stats"][0].value)
        for k, v in b["stats"].items():
           print("{}: {}".format(name[k.value], v.value))
        sleep(1)
    except KeyboardInterrupt:
        exit()

3. error info

bpf: Argument list too long. Program  too large (0 insns), at most 4096 insns

Traceback (most recent call last):
  File "./test.py", line 25, in <module>
    b.attach_kprobe(event="tcp_sendmsg", fn_name="count")
  File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 851, in attach_kprobe
    fn = self.load_func(fn_name, BPF.KPROBE)
  File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 526, in load_func
    raise Exception("Failed to load BPF program %s: %s" %
Exception: Failed to load BPF program b'count': Argument list too long
commented

CentOS Linux release 8.2.2004 (Core)
4.18.0-193.6.3.el8_2.x86_64
bcc 0.30.0
python3.6

run helloworld failed too
BPF(text='int kprobe__sys_clone(void *ctx) { bpf_trace_printk("Hello, World!\\n"); return 0; }').trace_print()

error msg
bpf: Argument list too long. Program too large (0 insns), at most 4096 insns
Traceback (most recent call last):
File "", line 1, in
File "/usr/local/lib/python3.6/site-packages/bcc-0.30.0+e7109fa0-py3.6.egg/bcc/init.py", line 487, in init
File "/usr/local/lib/python3.6/site-packages/bcc-0.30.0+e7109fa0-py3.6.egg/bcc/init.py", line 1465, in _trace_autoload
File "/usr/local/lib/python3.6/site-packages/bcc-0.30.0+e7109fa0-py3.6.egg/bcc/init.py", line 527, in load_func
Exception: Failed to load BPF program b'kprobe__sys_clone': Argument list too long