在跑3-fentry-unlink出现错误

[ToviHe]

具体错误如下

ubuntu@ubuntu-2204:~/ebpf$ ./ecc code/bpf-developer-tutorial/src/3-fentry-unlink/fentry-link.bpf.c 
INFO [ecc_rs::bpf_compiler] Compiling bpf object...
INFO [ecc_rs::bpf_compiler] Generating package json..
INFO [ecc_rs::bpf_compiler] Packing ebpf object and config into code/bpf-developer-tutorial/src/3-fentry-unlink/package.json...
ubuntu@ubuntu-2204:~/ebpf$ sudo ./ecli run code/bpf-developer-tutorial/src/3-fentry-unlink/package.json 
INFO [faerie::elf] strtab: 0x406 symtab 0x440 relocs 0x488 sh_offset 0x488
libbpf: prog 'do_unlinkat': failed to attach: ERROR: strerror_r(-524)=22
Error: Failed to run native eBPF program

Caused by:
    Bpf error: Failed to start polling: Bpf("Failed to load and attach: Failed to attach program `do_unlinkat`: Internal error: bpf call \"libbpf_rs::program::Program::attach::{{closure}}\" returned NULL"), RecvError

[yunwei37]

Please provide your kernel version and OS version, thanks.

[marunrun]

在使用 arm64 ,kernel 5.15.0-131-generic 的时候出现同样错误。 应该是 arm64 内核版本不支持， 需要 6.0 版本

建议在本章文档中也可以说明一下 @yunwei37

参考 learning eBPF 文档：

A more efficient mechanism for tracing the entry to and exit from kernel functions
was introduced along with the idea of BPF trampoline in kernel version 5.5 (on x86
processors; BPF trampoline support doesn’t arrive for ARM processors until Linux
6.0). If you’re using a recent enough kernel, fentry/fexit is now the preferred method
for tracing the entry to or exit from a kern

https://kernelnewbies.org/Linux_6.0#ARM