CODEWITHSUNDEEP
c++linuxbpfebpf
Dennis
Dennis

Reputation: 340

Linux BTF: bpftool: Failed to get EHDR from /sys/kernel/btf/vmlinux

I am trying to start with BPF CO:RE Development. Using Ubuntu 20.04 LTS in a VM, I needed to recompile the kernel and install pahole (from apt install dwarves) so that BTF is enabled (I set CONFIG_DEBUG_FS=y and CONFIG_DEBUG_INFO_BTF=y).

So my setup is:

/sys/kernel/btf/vmlinux exists and can be read out with cat.

But bpftool shows the following error:

$ sudo bpftool btf dump file /sys/kernel/btf/vmlinux format c

libbpf: failed to get EHDR from /sys/kernel/btf/vmlinux
Error: failed to load BTF from /sys/kernel/btf/vmlinux: Unknown error -4001

From https://github.com/libbpf/libbpf/blob/master/src/libbpf.h it looks like it is LIBBPF_ERRNO__FORMAT, /* BPF object format invalid */ but I can not find out what's wrong.

Does anybody know where the mistake might be?

Thanks in advance!

EDIT: Added bpftool version

Upvotes: 6

Views: 5804

Answers (2)

Dennis
Dennis

Reputation: 340

Update: It looks like bpftool only accepts a ELF-file with the compiled runnning kernel in it, but my /sys/kernel/btf/vmlinux is not:

$ file /sys/kernel/btf/vmlinux 
/sys/kernel/btf/vmlinux: data

Same for /boot/vmlinuz:

$ sudo file /boot/vmlinuz-5.4.0-90-generic 
/boot/vmlinuz-5.4.0-90-generic: Linux kernel x86 boot executable bzImage, version 5.4.0-90-generic (root@elde-dev) #101+test1 SMP Tue Nov 23 16:38:41 UTC 2021, RO-rootFS, swap_dev 0xD, Normal VGA

Does anybody know why my /sys/kernel/btf/vmlinux does not show the right format?

I found this workaround:
Using this script (https://elixir.bootlin.com/linux/latest/source/scripts/extract-vmlinux) as suggested here (https://unix.stackexchange.com/questions/610672/where-is-the-linux-kernel-elf-file-located) I could get the "working" vmlinux-file which then could be read by bpftool. But this can not really be the right way for BPF CO:RE I guess... Also, in all the tutorials, bpftool is used directly with /sys/kernel/btf/vmlinux.
So why do I get the wrong format?

EDIT: As suggested above, just downoad the newest linux kernel, compile bpftool from there and use that.

Upvotes: -1

pchaigno
pchaigno

Reputation: 13198

You need to update bpftool to support a fallback to reading BTF as raw data if the input file is not an object file. The minimum bpftool version required is v5.5 as that's the Linux release where the patch landed. In general, I would recommend to always use the latest bpftool version as there are no backports.

Upvotes: 6

Related Questions