Error creating perf_kprobe PMU

[adrianlzt]

Describe the bug
Error initializing kyanos.

Using the latest release available (kyanos_1.4.0_linux_amd64.tar.gz) with Arch linux:

❯ uname -a
Linux arco 6.11.8-zen1-2-zen #1 ZEN SMP PREEMPT_DYNAMIC Fri, 15 Nov 2024 15:34:57 +0000 x86_64 GNU/Linux

~
❯ sudo kyanos

  ⣷ 🦜 Kyanos Loading...

  ..............................
  ..............................
  🍩 Kyanos starting... 1ns
  🍎 Loaded eBPF maps & programs. 596.71211ms
  🍓 Setup traffic filters 62.675µs

  Press ctrl+c to exit
FATA[0000] Attach failed: creating perf_kprobe PMU (arch-specific fallback for "__skb_datagram_iter"): token __x64___skb_datagram_iter: not found: no such file or directory, functions: [{kprobe/__skb_datagram_iter SkbCopyDatagramIter}]

[hengyoush]

Thank you for you replies, can you tell me your kernel version (with uname -ar).

[adrianlzt]

It is in the bug report :)

❯ uname -ar
Linux arco 6.11.8-zen1-2-zen #1 ZEN SMP PREEMPT_DYNAMIC Fri, 15 Nov 2024 15:34:57 +0000 x86_64 GNU/Linu

[hengyoush]

Please execute this command and send the result:
cat /proc/kallsyms | grep -E '__skb_datagram_iter|copy_datagram'

[adrianlzt]

❯ cat /proc/kallsyms | grep -E '__skb_datagram_iter|copy_datagram'
0000000000000000 T __pfx_skb_copy_datagram_from_iter
0000000000000000 T skb_copy_datagram_from_iter
0000000000000000 t __pfx___skb_datagram_iter.constprop.0
0000000000000000 t __skb_datagram_iter.constprop.0
0000000000000000 t __pfx___skb_datagram_iter.constprop.1
0000000000000000 t __skb_datagram_iter.constprop.1
0000000000000000 T __pfx_skb_copy_datagram_iter
0000000000000000 T skb_copy_datagram_iter
0000000000000000 t __pfx___skb_datagram_iter.constprop.2
0000000000000000 t __skb_datagram_iter.constprop.2
0000000000000000 T __pfx___traceiter_skb_copy_datagram_iovec
0000000000000000 T __traceiter_skb_copy_datagram_iovec
0000000000000000 T __pfx___probestub_skb_copy_datagram_iovec
0000000000000000 T __probestub_skb_copy_datagram_iovec
0000000000000000 t __pfx_perf_trace_skb_copy_datagram_iovec
0000000000000000 t perf_trace_skb_copy_datagram_iovec
0000000000000000 t __pfx_trace_event_raw_event_skb_copy_datagram_iovec
0000000000000000 t trace_event_raw_event_skb_copy_datagram_iovec
0000000000000000 t __pfx_trace_raw_output_skb_copy_datagram_iovec
0000000000000000 t trace_raw_output_skb_copy_datagram_iovec
0000000000000000 t __pfx___bpf_trace_skb_copy_datagram_iovec
0000000000000000 t __bpf_trace_skb_copy_datagram_iovec
0000000000000000 T __SCT__tp_func_skb_copy_datagram_iovec
0000000000000000 d __tpstrtab_skb_copy_datagram_iovec
0000000000000000 r __ksymtab_skb_copy_datagram_from_iter
0000000000000000 r __ksymtab_skb_copy_datagram_iter
0000000000000000 d print_fmt_skb_copy_datagram_iovec
0000000000000000 d trace_event_fields_skb_copy_datagram_iovec
0000000000000000 d trace_event_type_funcs_skb_copy_datagram_iovec
0000000000000000 d event_skb_copy_datagram_iovec
0000000000000000 D __SCK__tp_func_skb_copy_datagram_iovec
0000000000000000 d event_class_skb_copy_datagram_iovec
0000000000000000 D __tracepoint_skb_copy_datagram_iovec
0000000000000000 d __bpf_trace_tp_map_skb_copy_datagram_iovec
0000000000000000 d __event_skb_copy_datagram_iovec

[hengyoush]

It seems that compilers perform optimizations and rename functions in the kernel. I will try to find a way to solve this. Thank you very much.