libbpf: CO-RE program fexit cannot log event on specific function - ebpf

Question

I want to create a program that logs a message when net_ns_net_exit function in the kernel is called.
SEC("fexit/net_ns_net_exit")
int BPF_PROG(net_ns_net_exit, struct net *net, long ret)
#endif
{
__u64 netns_inum = BPF_CORE_READ(net, ns.inum);
debugf("removing: netns_inum: %u", netns_inum);
return 0;
}
bpftool v7.0.0
using libbpf v1.0
features: libbfd, libbpf_strict, skeletons
I am building in on Ubuntu 22.04 with kernel 5.15.0-52-generic, AMD. The program works well on this machine, but when I try to run it on GCP with kernel version 5.10.133+ it fails with error:
libbpf: failed to find kernel BTF type ID of 'net_ns_net_exit': -3
libbpf: prog 'net_ns_net_exit': failed to prepare load attributes: -3
libbpf: prog 'net_ns_net_exit': failed to load: -3
libbpf: failed to load object 'remove_net_ns'
libbpf: failed to load BPF skeleton 'remove_net_ns': -3
loading remove_net_ns skeleton failed with error: -3
I've checked if vmlinux is available on machines and I found that both: GCP and my local ubuntu have: /sys/kernel/btf/vmlinux. I've checked the content(with vim) on the VM and I've noticed that my VM has net_ns_net_exit but GCP doesn't. I am not sure if it's related and how exactly make it works. Method: net_ns_net_exit was introduced to the kernel a long time ago so I've expected that it should be available. Maybe someone had this problem and has some advice or knows how to approach this issue?

Answer 1

The fexit hook points don't offer a stable API. So if the function you are trying to trace is inlined (as seems to be the case with your GCP kernel), then your only choice is to find another function that gives you the same information.