Linux BTF: bpftool: Failed to get EHDR from /sys/kernel/btf/vmlinux-CodePudding

I am trying to start with BPF CO:RE Development. Using Ubuntu 20.04 LTS in a VM, I needed to recompile the kernel and install pahole (from apt install dwarves) so that BTF is enabled (I set CONFIG_DEBUG_FS=y and CONFIG_DEBUG_INFO_BTF=y).

So my setup is:

Ubuntu 20.04
Kernel 5.4.0-90-generic
bpftool --version: /usr/lib/linux-tools/5.4.0-90-generic/bpftool v5.4.148

/sys/kernel/btf/vmlinux exists and can be read out with cat.

But bpftool shows the following error:

$ sudo bpftool btf dump file /sys/kernel/btf/vmlinux format c

libbpf: failed to get EHDR from /sys/kernel/btf/vmlinux
Error: failed to load BTF from /sys/kernel/btf/vmlinux: Unknown error -4001

From https://github.com/libbpf/libbpf/blob/master/src/libbpf.h it looks like it is LIBBPF_ERRNO__FORMAT, /* BPF object format invalid */ but I can not find out what's wrong.

Does anybody know where the mistake might be?

Thanks in advance!

EDIT: Added bpftool version

CodePudding user response：

You need to update bpftool to support a fallback to reading BTF as raw data if the input file is not an object file. The minimum bpftool version required is v5.5 as that's the Linux release where the patch landed. In general, I would recommend to always use the latest bpftool version as there are no backports.

CodePudding user response：

Update: It looks like bpftool only accepts a ELF-file with the compiled runnning kernel in it, but my /sys/kernel/btf/vmlinux is not:

$ file /sys/kernel/btf/vmlinux 
/sys/kernel/btf/vmlinux: data

Same for /boot/vmlinuz:

$ sudo file /boot/vmlinuz-5.4.0-90-generic 
/boot/vmlinuz-5.4.0-90-generic: Linux kernel x86 boot executable bzImage, version 5.4.0-90-generic (root@elde-dev) #101 test1 SMP Tue Nov 23 16:38:41 UTC 2021, RO-rootFS, swap_dev 0xD, Normal VGA

Does anybody know why my /sys/kernel/btf/vmlinux does not show the right format?

I found this workaround:
Using this script (https://elixir.bootlin.com/linux/latest/source/scripts/extract-vmlinux) as suggested here (https://unix.stackexchange.com/questions/610672/where-is-the-linux-kernel-elf-file-located) I could get the "working" vmlinux-file which then could be read by bpftool. But this can not really be the right way for BPF CO:RE I guess... Also, in all the tutorials, bpftool is used directly with /sys/kernel/btf/vmlinux.
So why do I get the wrong format?