ERROR loading BPF program with a verifier message "invalid func unknown#114"

[d0u9]

I am trying to follow this tutorial, and failed due to this error.

As a newbie to eBPF. It is really hard to figure out what is going on.

[rhdxmr]

Hello @d0u9

BPF helper function number 114 is bpf_probe_read_user_str. It was first shown at kernel v5.5.

If your kernel is older than v5.5 you can not call the function because it does not exist in your kernel. But you can call old version of it, bpf_probe_read_str instead.

[rhdxmr]

BPF subsystem in the Linux kernel is still in development rapidly. So if you don't mind, I recommend you to use recent version of kernel if you are interested in BPF. It would be better experience. But of course, it is not a must-do.

[d0u9]

Hi, @rhdxmr.

Thanks very much for your quick reply.

Does the first error, error on bpf_load_btf: magic: 0xeb9f, not matter? And who reports these errors? The kernel?

[rhdxmr]

@d0u9
The first error message means error loading BTF to kernel. Message starting from "magic ..." is written by BPF verifier of kernel.
But loading BTF is optional procedure so that failure of the procedure does not affect the whole process.

[rhdxmr]

And.. I am not sure why loading BTF failed.

The verifier log says the btf type whose id is 6 is illegal (it mentions vlen != 0). But I don't have idea why the BTF info is corrupted. It is generated by LLVM and redbpf corrects it a little bit. But I have not experienced this symptom..

[d0u9]

Ok, I get it. Thanks for your kind help.

[rhdxmr]

@d0u9
I wrote about this problem into the tutorial to help new users not struggle with this problem again.
See #217 for more information.
Thanks.