Bcc: Exception: Failed to compile BPF text

[mithunk18]

Hi,
I am trying to test bcc on arm64 platform (linux kernel: 4.9.44).
Copied all the generated libs for LLVM, clang and bcc.
but when we run the example on the target getting below error:
root@user # /usr/share/bcc/examples/hello_world.py
chdir(/lib/modules/4.9.44/build): No such file or directory
Traceback (most recent call last):
File "/usr/share/bcc/examples/hello_world.py", line 12, in
BPF(text='int kprobe__sys_clone(void *ctx) { bpf_trace_printk("Hello, World!\n"); return 0; }').trace_print()
File "/usr/lib64/python2.7/site-packages/bcc/__init__.py", line 318, in __init__
raise Exception("Failed to compile BPF text")
Exception: Failed to compile BPF text

Please let me know how to solve the above exception ? Is Kernel source is required to be added in the target?

[mithunk18]

I am able to run the bcc tools after copying the kernel source to the target and link to the build directory.

So is it kernel source is required in the target to work with bpf?

[palmtenor]

Yes, Kernel source (kernel-devel) is needed during compilation

[yangluoshen]

I am able to run the bcc tools after copying the kernel source to the target and link to the build directory.

So is it kernel source is required in the target to work with bpf?

Hi @mithunk18, @palmtenor , I got the same issue, could you tell me how to solve it for more detials?
thank you!
for example, how to "copying the kernel source to the target"?

Actually，I run "apt-get -t jessie-backports install -y linux-base linux-image-uname -r linux-headers-uname -r", but it seem dosen't work.

[palmtenor]

As said, you need the kernel-devel package, which should be installed at /lib/modules/YOUR_UNAME/build

[bennettnw2]

Can I get a bit of help here? Sorry to bring up an old post but I am not sure why I cannot get this to run. I've been at this for about 4 hours now and I thought this article would for sure help me out. I got it to run on Ubuntu just fine but I've tried on Centos 7 and 8, Debian 10 and Fedora 28. I always get the same error. This is the Fedora attempt:

I think all the kernel flags are properly set here:

[root@li1831-106 ~]# cat /boot/config-4.17.14-202.fc28.x86_64 | grep BPF
CONFIG_CGROUP_BPF=y
CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT_ALWAYS_ON=y
CONFIG_NETFILTER_XT_MATCH_BPF=m
CONFIG_NET_CLS_BPF=m
CONFIG_NET_ACT_BPF=m
CONFIG_BPF_JIT=y
CONFIG_BPF_STREAM_PARSER=y
CONFIG_LWTUNNEL_BPF=y
CONFIG_HAVE_EBPF_JIT=y
CONFIG_BPF_EVENTS=y
# CONFIG_BPF_KPROBE_OVERRIDE is not set
# CONFIG_TEST_BPF is not set
[root@li1831-106 ~]# cat /boot/config-4.17.14-202.fc28.x86_64 | grep NET_ACT
CONFIG_NET_ACT_POLICE=m
CONFIG_NET_ACT_GACT=m
CONFIG_NET_ACT_MIRRED=m
CONFIG_NET_ACT_SAMPLE=m
CONFIG_NET_ACT_IPT=m
CONFIG_NET_ACT_NAT=m
CONFIG_NET_ACT_PEDIT=m
CONFIG_NET_ACT_SIMP=m
CONFIG_NET_ACT_SKBEDIT=m
CONFIG_NET_ACT_CSUM=m
CONFIG_NET_ACT_VLAN=m
CONFIG_NET_ACT_BPF=m
CONFIG_NET_ACT_CONNMARK=m
CONFIG_NET_ACT_SKBMOD=m
CONFIG_NET_ACT_IFE=m
CONFIG_NET_ACT_TUNNEL_KEY=m
[root@li1831-106 ~]# cat /boot/config-4.17.14-202.fc28.x86_64 | grep NET_SCH_SFQ
CONFIG_NET_SCH_SFQ=m

I installed with:

root@li1831-106 ~]# echo -e '[iovisor]\nbaseurl=https://repo.iovisor.org/yum/nightly/f27/$basearch\nenabled=1\ngpgcheck=0' | sudo tee /etc/yum.repos.d/iovisor.repo
[iovisor]
baseurl=https://repo.iovisor.org/yum/nightly/f27/$basearch
enabled=1
gpgcheck=0
[root@li1831-106 ~]# sudo dnf install bcc-tools kernel-headers kernel-devel
[...]
Complete!

And tried to run and fix with:

[root@li1831-106 ~]# cd /usr/share/bcc/tools/
[root@li1831-106 tools]# ./execsnoop
modprobe: FATAL: Module kheaders not found in directory /lib/modules/4.17.14-202.fc28.x86_64
Unable to find kernel headers. Try rebuilding kernel with CONFIG_IKHEADERS=m (module)
chdir(/lib/modules/4.17.14-202.fc28.x86_64/build): No such file or directory
Traceback (most recent call last):
  File "./execsnoop", line 170, in <module>
    b = BPF(text=bpf_text)
  File "/usr/lib/python2.7/site-packages/bcc/__init__.py", line 343, in __init__
    raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
Exception: Failed to compile BPF module <text>
[root@li1831-106 tools]# ls -l /lib/modules/4.17.14-202.fc28.x86_64/build
lrwxrwxrwx. 1 root root 40 Aug 15  2018 /lib/modules/4.17.14-202.fc28.x86_64/build -> /usr/src/kernels/4.17.14-202.fc28.x86_64
[root@li1831-106 tools]# dnf whatprovides 4.17.14-202.fc28.x86_64
Repository 'iovisor' is missing name in configuration, using id.
Last metadata expiration check: 0:04:43 ago on Wed 29 Jan 2020 08:15:39 PM UTC.
Error: No Matches found
[root@li1831-106 tools]# dnf whatprovides /usr/src/kernels/4.17.14-202.fc28.x86_64
Repository 'iovisor' is missing name in configuration, using id.
Last metadata expiration check: 0:05:25 ago on Wed 29 Jan 2020 08:15:39 PM UTC.
Error: No Matches found
[root@li1831-106 tools]# dnf whatprovides /lib/modules/4.17.14-202.fc28.x86_64/build
Repository 'iovisor' is missing name in configuration, using id.
Last metadata expiration check: 0:06:10 ago on Wed 29 Jan 2020 08:15:39 PM UTC.
kernel-core-4.17.14-202.fc28.x86_64 : The Linux kernel
Repo        : @System
Matched from:
Filename    : /lib/modules/4.17.14-202.fc28.x86_64/build
[root@li1831-106 tools]# dnf install -y kernel-core-4.17.14-202.fc28.x86_64
Repository 'iovisor' is missing name in configuration, using id.
Last metadata expiration check: 0:07:52 ago on Wed 29 Jan 2020 08:15:39 PM UTC.
Package kernel-core-4.17.14-202.fc28.x86_64 is already installed, skipping.
Dependencies resolved.
Nothing to do.
Complete!
[root@li1831-106 tools]# dnf install -y kernel-devel-4.17.14-202.fc28.x86_64
Repository 'iovisor' is missing name in configuration, using id.
Last metadata expiration check: 0:08:20 ago on Wed 29 Jan 2020 08:15:39 PM UTC.
No match for argument: kernel-devel-4.17.14-202.fc28.x86_64
Error: Unable to find a match
[root@li1831-106 tools]# uname -r
4.17.14-202.fc28.x86_64

[bennettnw2]

Hmm, I have a feeling it may have something to do with the cloud instance I am running. These have been Linode instances and I think that maybe the reason? On to more testing!

[bennettnw2]

Yup, getting closer but no Lemonade just yet.
Installing Kernel Headers