arg#0 reference type('UNKNOWN ') size cannot be determined:

[Sobeston]

Hi,

I saw support for C++ and Rust services, and wanted to see if it worked on some Zig networking code using lsquic:

beyla-1        | time=2025-01-04T04:56:27.225Z level=ERROR msg="couldn't trace process. Stopping process tracer" component=discover.TraceAttacher error="loading and assigning BPF objects: field ProtocolHttp2: program protocol_http2: load program: argument list too long: 159: (15) if r9 == 0x0 goto pc+12 BPF program is too large. Processed 1000001 insn (613 line(s) omitted)"
beyla-1        | Error Log:
beyla-1        |  arg#0 reference type('UNKNOWN ') size cannot be determined: -22
beyla-1        | 0: R1=ctx() R10=fp0
beyla-1        | ; int protocol_http2(void *ctx) { @ protocol_http2.h:206
beyla-1        | 0: (b7) r6 = 0                        ; R6_w=0
beyla-1        | ; int zero = 0; @ protocol_common.h:58
beyla-1        | 1: (63) *(u32 *)(r10 -96) = r6        ; R6_w=0 R10=fp0 fp-96=????0
beyla-1        | 2: (bf) r2 = r10                      ; R2_w=fp0 R10=fp0
beyla-1        | ;  @ protocol_common.h:0
beyla-1        | 3: (07) r2 += -96                     ; R2_w=fp-96
beyla-1        | ; return bpf_map_lookup_elem(&protocol_args_mem, &zero); @ protocol_common.h:59
beyla-1        | 4: (18) r1 = 0xffffa06688fdf800       ; R1_w=map_ptr(map=protocol_args_m,ks=4,vs=88)
beyla-1        | 6: (85) call bpf_map_lookup_elem#1    ; R0_w=map_value_or_null(id=1,map=protocol_args_m,ks=4,vs=88)

Some details:

• 6.12.7-arch1-1 kernel with a zen 3 CPU
• /sys/kernel/btf/vmlinux exists, and CONFIG_DEBUG_INFO_BTF=y
• bpftool prog show lists a few programs
• Tried with the beyla:latest, :1.9, and :1 images
• It correctly found the program based off BEYLA_OPEN_PORT, but crashed a few seconds later.
• No traces were submitted as far as I know.

Feel free to close if this isn't interesting. But either way, maybe some code path could be improved so that the error is more obvious.

[rafaelroquetto]

Hi @Sobeston, thank you for bringing this up. This is definitely interesting and is a cool use case. This seems to be related to #1447 - I checked and it seems our docker images are out of date. I will follow up and keep you posted.

[grcevski]

Yeah, as @rafaelroquetto mentioned, I think this is related to #1447. I believe we only merged that in main @rafaelroquetto, correct? @Sobeston, would it be possible for you try with beyla:main?

What caused the issue is not zig support, but the 6.11 I believe changed how the eBPF verifier counts the instructions and we had to refactor the code a bit to make it work.

[rafaelroquetto]

@grcevski is right, I just verified and the issue is not present in beyla:main.

[Sobeston]

Tried the beyla:main image, and it works! It does not find the quic networking calls, but I think that's expected (beyla doesn't have support for it as far as I can tell). But it does pick up the http requests we are doing 👍.

[grcevski]

Thanks for confirming @Sobeston! Would you like to create a feature request for supporting quic networking calls and then I think we can close this issue?

[Sobeston]

Opened a feature request here (I think I can't add labels to it?) #1490

Closing