[examples tcprtt_sockops] load program: invalid argument: unknown func bpf_get_current_pid_tgid

[PizerLiu]

[florianl]

bpf_get_current_pid_tgid() is a function that is not supported by the eBPF program type of BPF_PROG_TYPE_SOCK_OPS.
Not every eBPF helper function is available with every eBPF program type. Please consult https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md to get an overview of functions that are supported by program type.

[PizerLiu]

I executed it directly in the code space of github. I added a bpf_get_current_pid_tgid method in the tcprtt_sockops example. When executed, an error was reported: load program: invalid argument: unknown func bpf_get_current_pid_tgid. I executed another example ringbuffer and it was executed correctly. Same environment, why is this?

[florianl]

In the ringbuffer example a BPF_PROG_TYPE_KPROBE eBPF program is used. bpf_get_current_pid_tgid() is one of the eBPF helper functions, that can be used by the eBPF program type BPF_PROG_TYPE_KPROBE.

On the other hand, the tcprtt_sockops example uses a eBPF program type BPF_PROG_TYPE_SOCK_OPS. BPF_PROG_TYPE_SOCK_OPS eBPF programs can not make use of the eBPF helper bpf_get_current_pid_tgid().

It is the eBPF program type which defines which eBPF helpers are available or not. In this case, the eBPF program type is different, which explains the different results.

[PizerLiu]

Thanks brother, I am a beginner and not very familiar with the kernel. How can I find the corresponding Hook points according to my needs? Where can I query the Hook points and corresponding function parameters, etc., and whether it supports the use of bpf_help Functions, the organization of this information should be more important for beginners. I look forward to your guidance. Thank you again.