Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S937427AbdCJNux convert rfc822-to-8bit (ORCPT ); Fri, 10 Mar 2017 08:50:53 -0500 Received: from mga03.intel.com ([134.134.136.65]:18594 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934534AbdCJNta (ORCPT ); Fri, 10 Mar 2017 08:49:30 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.36,141,1486454400"; d="scan'208";a="942849332" From: "Dorau, Lukasz" To: Alexei Starovoitov , "netdev@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "linux-trace-users-owner@vger.kernel.org" , Steven Rostedt , Ingo Molnar CC: "Jelinek, Sarah" , "Slusarz, Marcin" , "Chernookyi, Vitalii" , "Buella, Gabor" , "Lebioda, Pawel" , "goldshtn@gmail.com" , "bgregg@netflix.com" Subject: Cannot attach BPF to tracepoints Thread-Topic: Cannot attach BPF to tracepoints Thread-Index: AdKZox9m9mGQgrCGR363UPtmnvK0xQ== Date: Fri, 10 Mar 2017 13:49:20 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [163.33.239.181] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 793 Lines: 29 Hi, I cannot attach BPF to tracepoints. I used bcc's (https://github.com/iovisor/bcc) trace.py tool: https://github.com/iovisor/bcc/blob/master/tools/trace.py to test this issue: # /usr/share/bcc/tools/trace t:syscalls:sys_enter_open ioctl(PERF_EVENT_IOC_SET_BPF): Invalid argument Failed to attach BPF to tracepoint # /usr/share/bcc/tools/trace t:syscalls:sys_exit_open ioctl(PERF_EVENT_IOC_SET_BPF): Invalid argument Failed to attach BPF to tracepoint However it is possible to attach BPF to raw tracepoints: # /usr/share/bcc/tools/trace t:raw_syscalls:sys_enter # /usr/share/bcc/tools/trace t:raw_syscalls:sys_exit and to kprobes: # /usr/share/bcc/tools/trace 'sys_open "%s", arg1' # /usr/share/bcc/tools/trace 'r::sys_open "%s", arg1' Can it be a bug in BPF code? Regards, Lukasz