加载BPF程序时触发Invalid argument (EINVAL)错误的排查求助

Hey there, let's break down the possible reasons you're hitting that EINVAL error when loading your minimal BPF program—even if you think the program itself is solid. Here are the most common culprits to check:

Don't underestimate the BPF verifier's strictness. Even tiny, seemingly harmless code can get rejected for violating safety rules. For example:

• Uninitialized variables (e.g., using an int without setting its value before passing it to a helper like bpf_printk)
• Invalid memory access patterns (even accidental ones in simplified code)
• Missing helper function permissions (if you're calling any helpers, you need to declare allowed helpers in your program's license section or via user-space loader flags)

The fix: Always grab the BPF verifier log—this is the single most useful tool for debugging. In your user-space loader code, add code to capture and print the log:

#define BPF_LOG_BUF_SIZE 65536
char bpf_log_buf[BPF_LOG_BUF_SIZE];

struct bpf_attr attr = {0};
attr.log_buf = (unsigned long)bpf_log_buf;
attr.log_size = BPF_LOG_BUF_SIZE;
attr.log_level = 1;
// ... fill other attr fields (prog_type, insn_cnt, etc.)

int prog_fd = bpf(BPF_PROG_LOAD, &attr, sizeof(attr));
if (prog_fd < 0) {
    fprintf(stderr, "Load failed: %s\nVerifier log:\n%s\n", strerror(errno), bpf_log_buf);
    exit(1);
}

The log will tell you exactly why the verifier rejected your program.

More often than not, EINVAL comes from incorrect setup in your loader code, not the BPF program itself. Double-check these:

• Wrong program type: If you're loading a kprobe program, make sure attr.prog_type is set to BPF_PROG_TYPE_KPROBE (not BPF_PROG_TYPE_TRACEPOINT or another type)
• Mismatched attach type: For kprobes, attr.attach_type should be BPF_KPROBE_ENTRY or BPF_KPROBE_RETURN depending on what you're doing
• Incorrect instruction count: attr.insn_cnt must exactly match the number of BPF instructions in your program (if you're reading from an ELF, ensure you're counting correctly)
• Invalid map file descriptors: If your program uses maps, make sure you've created the map first and passed a valid FD to attr.map_fd (or attr.map_fds for multiple maps)

BPF evolves fast, and some features or helpers might not be supported in your kernel version. For example:

• Certain helper functions (like bpf_get_current_task_btf) require kernel 5.8+
• Kprobe attachment via BPF might need CONFIG_KPROBES and CONFIG_BPF_KPROBE_OVERRIDE enabled in your kernel config

Check:

• Run bpftool version to see your kernel's BPF support level
• Verify kernel config flags with zcat /proc/config.gz | grep -E 'CONFIG_BPF|CONFIG_KPROBES'

Loading BPF programs requires specific privileges:

• For kernels 5.8+, you need the CAP_BPF capability
• Older kernels require CAP_SYS_ADMIN

If you're running the loader as a regular user, you might hit permission-related issues that manifest as EINVAL (instead of the more obvious EPERM in some cases). Try running your loader with sudo, or set the required capabilities on the executable:

sudo setcap cap_bpf,cap_sys_admin+ep your_loader_binary

Use bpftool to load your program directly—it will print detailed errors without needing to tweak your loader code:

bpftool prog load test_overhead_kprobe_kern.o /sys/fs/bpf/test_prog

If this fails, the output will point you straight to the problem.

内容的提问来源于stack exchange，提问作者dippynark