How to prepare Android device or Emulator for epbf programs

[kochia3]

Bit of guide to how prepare Android devices or Emulators to run an eBPF programs compiled for them would be useful due to scarcity of resources on the subject.

[kochia3]

Device: Android Emulator x86_64 Kernel version: 5.10.66-android12

error when running bootstrap from examples directory:

emulator64_x86_64:/data/local/tmp # ./bootstrap
libbpf: failed to find valid kernel BTF
libbpf: Error loading vmlinux BTF: -3
libbpf: failed to load object 'bootstrap_bpf'
libbpf: failed to load BPF skeleton 'bootstrap_bpf': -3
Failed to load and verify BPF skeleton

file bootstrap:

bootstrap: ELF shared object, 64-bit LSB x86-64, dynamic (/system/bin/linker64), for Android 23, built by NDK r22 (7026061), stripped

when running minimal:

emulator64_x86_64:/data/local/tmp # ./minimal
libbpf: loading object 'minimal_bpf' from buffer
libbpf: elf: section(3) tp/syscalls/sys_enter_write, size 104, link 0, flags 6, type=1
libbpf: sec 'tp/syscalls/sys_enter_write': found program 'handle_tp' at insn offset 0 (0 bytes), code size 13 insns (104 bytes)
libbpf: elf: section(4) .reltp/syscalls/sys_enter_write, size 32, link 22, flags 0, type=9
libbpf: elf: section(5) license, size 13, link 0, flags 3, type=1
libbpf: license of minimal_bpf is Dual BSD/GPL
libbpf: elf: section(6) .bss, size 4, link 0, flags 3, type=8
libbpf: elf: section(7) .rodata, size 28, link 0, flags 2, type=1
libbpf: elf: section(13) .BTF, size 605, link 0, flags 0, type=1
libbpf: elf: section(15) .BTF.ext, size 160, link 0, flags 0, type=1
libbpf: elf: section(22) .symtab, size 768, link 1, flags 0, type=2
libbpf: looking for externs among 32 symbols...
libbpf: collected 0 externs total
libbpf: map 'minimal_.bss' (global data): at sec_idx 6, offset 0, flags 400.
libbpf: map 0 is "minimal_.bss"
libbpf: map 'minimal_.rodata' (global data): at sec_idx 7, offset 0, flags 480.
libbpf: map 1 is "minimal_.rodata"
libbpf: sec '.reltp/syscalls/sys_enter_write': collecting relocation for section(3) 'tp/syscalls/sys_enter_write'
libbpf: sec '.reltp/syscalls/sys_enter_write': relo #0: insn #2 against 'my_pid'
libbpf: prog 'handle_tp': found data map 0 (minimal_.bss, sec 6, off 0) for insn 2
libbpf: sec '.reltp/syscalls/sys_enter_write': relo #1: insn #6 against '.rodata'
libbpf: prog 'handle_tp': found data map 1 (minimal_.rodata, sec 7, off 0) for insn 6
libbpf: map 'minimal_.bss': created successfully, fd=4
libbpf: map 'minimal_.rodata': created successfully, fd=5
libbpf: failed to open '/sys/kernel/tracing/events/syscalls/sys_enter_write/id': No such file or directory
libbpf: failed to determine tracepoint 'syscalls/sys_enter_write' perf event ID: No such file or directory
libbpf: prog 'handle_tp': failed to create tracepoint 'syscalls/sys_enter_write' perf event: No such file or directory
libbpf: prog 'handle_tp': failed to auto-attach: -2
Failed to attach BPF skeleton
2|emulator64_x86_64:/data/local/tmp #

[kochia3]

uname -a

Linux localhost 5.10.66-android12-9-00021-g2c152aa32942-ab8087165 #1 SMP PREEMPT Fri Jan 14 17:35:16 UTC 2022 x86_64

file minimal:

minimal: ELF shared object, 64-bit LSB x86-64, dynamic (/system/bin/linker64), for Android 23, built by NDK r22 (7026061), stripped

[kochia3]

Used mount -t debugfs none /sys/kernel/debug to mount debubfs but still there is no syscalls dir under /sys/kernel/tracing/events

[anakryiko]

cc @waruqi, who added Android xmake.lua support

[anakryiko]

but this specific issue might mean that you have either too old kernel or some kernel config is not enabled. CONFIG_FTRACE_SYSCALLS=y might be the one you are missing.