Bcc: ebpf : permission denied error

[nagmat1]

I have been working on profiler which traces i/o information using eBPF. Suddenly it started to give permission denied error. Below is the error code :

bpf: Failed to load program: Permission denied
0: (bf) r6 = r1
1: (85) call bpf_get_current_pid_tgid#14
2: (7b) *(u64 *)(r10 -24) = r0
3: (79) r3 = *(u64 *)(r6 +112)
4: (b7) r6 = 0
5: (7b) *(u64 *)(r10 -16) = r6
6: (bf) r1 = r10
7: (07) r1 += -16
8: (b7) r2 = 8
9: (85) call bpf_probe_read#4
10: (79) r3 = *(u64 *)(r10 -16)
11: (6b) *(u16 *)(r10 -2) = r6
12: (7b) *(u64 *)(r10 -16) = r6
13: (07) r3 += 32
14: (bf) r1 = r10
15: (07) r1 += -16
16: (b7) r2 = 8
17: (85) call bpf_probe_read#4
18: (79) r3 = *(u64 *)(r10 -16)
19: (bf) r1 = r10
20: (07) r1 += -2
21: (b7) r2 = 2
22: (85) call bpf_probe_read#4
23: (69) r2 = *(u16 *)(r10 -2)
24: (18) r1 = 0xffff97d3d94c9400
26: (57) r2 &= 61440
27: (15) if r2 == 0x8000 goto pc+4
 R0=inv(id=0) R1=map_ptr(id=0,off=0,ks=8,vs=132) R2=inv(id=0,umax_value=61440,var_off=(0x0; 0xf000)) R6=inv0 R10=fp0
28: (bf) r2 = r10
29: (07) r2 += -24
30: (85) call bpf_map_delete_elem#3
31: (05) goto pc+16
48: (95) exit
from 27 to 32: R0=inv(id=0) R1=map_ptr(id=0,off=0,ks=8,vs=132) R2=inv32768 R6=inv0 R10=fp0
32: (bf) r2 = r10
33: (07) r2 += -24
34: (85) call bpf_map_lookup_elem#1
35: (bf) r6 = r0
36: (15) if r6 == 0x0 goto pc+11
 R0=map_value(id=0,off=0,ks=8,vs=132,imm=0) R6=map_value(id=0,off=0,ks=8,vs=132,imm=0) R10=fp0
37: (85) call bpf_ktime_get_ns#5
38: (63) *(u32 *)(r6 +16) = r0
 R0=inv(id=0) R6=map_value(id=0,off=0,ks=8,vs=132,imm=0) R10=fp0
39: (77) r0 >>= 32
40: (63) *(u32 *)(r6 +20) = r0
 R0=inv(id=0,umax_value=4294967295,var_off=(0x0; 0xffffffff)) R6=map_value(id=0,off=0,ks=8,vs=132,imm=0) R10=fp0
41: (18) r1 = 0xffff97d3d94c9400
43: (bf) r2 = r10
44: (07) r2 += -24
45: (bf) r3 = r6
46: (b7) r4 = 0
47: (85) call bpf_map_update_elem#2
R3 type=map_value expected=fp

Traceback (most recent call last):
  File "2diopro.py", line 64, in <module>
    b.attach_kprobe(event="ext4_file_read_iter", fn_name="ext4_file_iter_entry")
  File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 679, in attach_kprobe
    fn = self.load_func(fn_name, BPF.KPROBE)
  File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 412, in load_func
    (func_name, errstr))
Exception: Failed to load BPF program ext4_file_iter_entry: Permission denied

Is it an issue with the program or is it fault from eBPF? My kernel version is :

4.15.0-115-generic

[netedwardwu]

Does the symbol of ext4_file_read_iter exist in 4.15.0-115 /proc/kallsyms?

[yonghong-song]

As the error message mentioned,

R3 type=map_value expected=fp

for 4.15, you cannot lookup a map, get a map_value and use it as input to another map_value for map update.
The map_value used for map update needs to be on stack. This restriction has been lifted in later kernels.