tcpconnlat libbpf tool: Unrecognized arg#0 type PTR

[marselester]

Hi! I am trying to implement a Go frontend for tcpconnlat, but getting Unrecognized arg#0 type PTR error. Can you please advice how it can be resolved? Thank you!

$ sudo go run ./cmd/tcpconnlat/
2021/11/04 23:13:43 failed to load BPF programs and maps: field TcpRcvStateProcess: program tcp_rcv_state_process: load program: permission denied: Unrecognized arg#0 type PTR
; int BPF_KPROBE(tcp_rcv_state_process, struct sock *sk)
0: (bf) r6 = r1
; int BPF_KPROBE(tcp_rcv_state_process, struct sock *sk)
1: (79) r1 = *(u64 *)(r6 +112)
2: (7b) *(u64 *)(r10 -8) = r1
3: (b7) r2 = 0
; struct event event = {};
4: (7b) *(u64 *)(r10 -16) = r2
last_idx 4 first_idx 0
regs=4 stack=0 before 3: (b7) r2 = 0
5: (7b) *(u64 *)(r10 -24) = r2
6: (7b) *(u64 *)(r10 -32) = r2
7: (7b) *(u64 *)(r10 -40) = r2
8: (7b) *(u64 *)(r10 -48) = r2
9: (7b) *(u64 *)(r10 -56) = r2
10: (7b) *(u64 *)(r10 -64) = r2
11: (7b) *(u64 *)(r10 -72) = r2
12: (7b) *(u64 *)(r10 -80) = r2
13: (7b) *(u64 *)(r10 -88) = r2
; if (sk->__sk_common.skc_state != TCP_SYN_SENT)
14: (71) r1 = *(u8 *)(r1 +18)
R1 invalid mem access 'inv'
processed 15 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

Note, instead of using fentry I tried kprobe. Here is the diff of tcpconnlat.bpf.c.

-SEC("fentry/tcp_v4_connect")
-int BPF_PROG(tcp_v4_connect, struct sock *sk)
+SEC("kprobe/tcp_v4_connect")
+int BPF_KPROBE(tcp_v4_connect, struct sock *sk)

-SEC("fentry/tcp_rcv_state_process")
-int BPF_PROG(tcp_rcv_state_process, struct sock *sk)
+SEC("kprobe/tcp_rcv_state_process")
+int BPF_KPROBE(tcp_rcv_state_process, struct sock *sk)

[lmb]

Try master, it should have fentry support since 35f5e51 cc @mehrdadrad

I don't think you can expect fentry code to work as a kprobe without any further changes.

[marselester]

Thank you, I will try that!

I don't think you can expect fentry code to work as a kprobe without any further changes.

The reason I decided to see if kprobe works instead of fentry is that the original tcpconnlat (with Python frontend) used kprobes. The C version of tcpconnlat used fentry for tcp_v4_connect and tcp_rcv_state_process, and kprobe for tcp_v6_connect.
The function signatures looked similar, and the error occurs at the top of the function. I didn't expect it to fail at if (sk->__sk_common.skc_state != TCP_SYN_SENT).

I thought maybe the issue is similar to iovisor/bcc#3190.

SEC("fentry/tcp_rcv_state_process")
int BPF_PROG(tcp_rcv_state_process, struct sock *sk)
{
	struct piddata *piddatap;
	struct event event = {};
	s64 delta;
	u64 ts;

	if (sk->__sk_common.skc_state != TCP_SYN_SENT)
		return 0;
	// ...
}

SEC("fentry/tcp_v4_connect")
int BPF_PROG(tcp_v4_connect, struct sock *sk)
{
	return trace_connect(sk);
}

SEC("kprobe/tcp_v6_connect")
int BPF_KPROBE(tcp_v6_connect, struct sock *sk)
{
	return trace_connect(sk);
}

[marselester]

It worked out, thank you!

[Engg-blogger]

@marselester : I was trying to implement something similar. Could you please share your code on how you implemented tcp_connect on kprobe?

[marselester]

The code I was working on is here https://github.com/marselester/libbpf-tools/tree/master/cmd/tcpconnlat.