On 2025-01-05 14:03, Shung-Hsi Yu wrote:
Hi Levi,
On Sat, Jan 04, 2025 at 11:02:43AM +0800, Levi Zim wrote: [...]
Hi,
I think there's some problem with this backport.
My eBPF program fails to load due to this backport with a "BPF program is too large." error. But it could successfully load on 6.13-rc5 and a kernel built directly from 41f6f64e6999 ("bpf: support non-r10 register spill/fill to/from stack in precision tracking").
Can confirm. I think it's probably because missed opportunity of state pruning without patches from the same series[1].
Hi Shung-Hsi,
Given that 41f6f64e6999 is the first commit from that series and my program can successfully load on a kernel directly built from upstream commit 41f6f64e6999.
I think it is unlikely that it is caused by missing patches from the same series.
Probably there are some dependent patches for 41f6f64e6999 not present in LTS 6.6 but present in v6.8.x where 41f6f64e6999 comes from.
Given it's a regression, I'll sent a revert patch and try to figure out the rest later.
Thanks!
Levi
Thanks for the report!
Shung-Hsi
1: https://lore.kernel.org/all/20231205184248.1502704-1-andrii@kernel.org/
To reproduce, run ./tracexec ebpf log -- /bin/ls
Prebuilt binary: https://github.com/kxxt/tracexec/releases/download/v0.8.0/tracexec-x86_64-un... Source code: https://github.com/kxxt/tracexec/
Best regards, Levi
[...]