why my bpftrace program can not run on linux kernel version 4.18

359 views Asked by At
/* FILENAME: vfs_open.bt */

#include <linux/path.h>
#include <linux/dcache.h>

kprobe:vfs_open
{
    printf("open path: %s\n", str(((struct path *)arg0)->dentry->d_name.name));
}

Since struct path and struct dentry are defined in the path.h and dcache.h in the directory of /usr/src/kernels/4.18.0-348.7.1.el8_5.x86_64/include, I run this program on linux kernel version 4.18 in this way:

sudo bpftrace -I /usr/src/kernels/4.18.0-348.7.1.el8_5.x86_64/include/ -I /usr/src/kernels/4.18.0-348.7.1.el8_5.x86_64/arch/x86/include vfs_open.bt

But bpftrace always reports: "ERROR: Include headers with missing type definitions or install BTF information to your system."

Of course on kernel ver 4.18, there is no BTF support exists, but I have given the right include dir search path as above, why bpftrace still reports error? someone can help me?

I have checked all include file directories, but I still can not make it, oops!

1

There are 1 answers

0
jiufei19 On

I got the answer from Github, on my linux kernel 4.18, bpftrace command should be written in this way:

sudo BPFTRACE_KERNEL_SOURCE=/usr/src/kernels/4.18.0-348.7.1.el8_5.x86_64/ bpftrace vfs_open.bt