Search code examples
ebpflibbpf

libbpf: failed to guess program from ELF section 'filter'

After compilation of the ebpf code, when loading it into the kernel it is showing an error.

Program section:

SEC("filter")
int icmp_timestamp(struct __sk_buff *skb) {
    // Load the Ethernet protocol
    void *data_end = (void *)(long)skb->data_end;
    void *data = (void *)(long)skb->data;
    struct ethhdr *eth = data;

Error:

libbpf: failed to guess program type from ELF section 'filter' libbpf: supported section(type) names are: socket sk_reuseport/migrate sk_reuseport kprobe+ uprobe+ uprobe.s+ kretprobe+ uretprobe+ uretprobe.s+ kprobe.multi+ kretprobe.multi+ ksyscall+ kretsyscall+ usdt+ tc classifier action tracepoint+ tp+ raw_tracepoint+ raw_tp+ raw_tracepoint.w+

How to overcome this problem. Thank you for the solution

Solution

  • libbpf is telling you that the section name should point to the type of BPF program you want this to be. For example, if you want to later attach this program to an XDP hook you need a BPF program of type XDP with:

    SEC("xdp")

    The list of supported section names can be found at https://github.com/libbpf/libbpf/blob/v1.2.2/src/libbpf.c#L8894. A + at the end means that it can either be the exact SEC("kprobe") or well-formed SEC("kprobe/extras") with a proper / separator.