Weird error " FnSeqWrite for program type Tracing not supported" about ebpf

[lmb]

cc @rgo3

[rgo3]

Hello @Andreagit97!

The current behaviour of HaveProgramHelper(ebpf.Tracing, asm.FnSeqWrite) is a bug as it is returning a false negative. Previous to c7ba7f0 calling HaveProgramHelper(ebpf.Tracing, ...) would result in no feature probe for Tracing. Now that we have a probe for program type Tracing, this part of HaveProgramHelper(ebpf.Tracing, ...) will pass but we don't actually create a valid probe for any possible program type/helper combination which yields the false negative.

I'll spend some more time to investigate other options but the output of bpftool feature probe doesn't give hopeful results:

eBPF helpers supported for program type tracing:
	Could not determine which helpers are available
eBPF helpers supported for program type struct_ops:
	Could not determine which helpers are available
eBPF helpers supported for program type ext:
	Could not determine which helpers are available
eBPF helpers supported for program type lsm:
	Could not determine which helpers are available

I'm afraid that creating a generalized helper probe for certain program types (StructOps, Tracing, Extension, LSM) might be quite hard/cumbersome if available helpers depend on the attach type as well. In that case the easiest solution for now could be fixing the bug by returning an inconclusive result telling the caller that we are not able to probe helpers for those program types.

Wrt to HaveProgramType(ebpf.Tracing), there is currently no API to check different attach types, e.g. ebpf.AttachTraceIter. HaveProgramType is really only responsible to ensure a program type is available in the kernel, regardless of the attach type.

[Andreagit97]

I'm afraid that creating a generalized helper probe for certain program types (StructOps, Tracing, Extension, LSM) might be quite hard/cumbersome if available helpers depend on the attach type as well. In that case the easiest solution for now could be fixing the bug by returning an inconclusive result telling the caller that we are not able to probe helpers for those program types.

It seems a reasonable fix! thank you

Wrt to HaveProgramType(ebpf.Tracing), there is currently no API to check different attach types, e.g. ebpf.AttachTraceIter. HaveProgramType is really only responsible to ensure a program type is available in the kernel, regardless of the attach type.

Got it! thank you for the explanation