libbpf-bootstrap icon indicating copy to clipboard operation
libbpf-bootstrap copied to clipboard

Is it possible to compile or run a BPF program that invokes task_struct in an environment without BTF support

Open Pyrokine opened this issue 1 year ago • 2 comments

My environment does not support BTF and CO-RE (cannot enable CONFIG_DEBUG_INFO_BTF), but I need task_struct to get some task info. What's the best way to implement the code?

libbpf: kernel BTF is missing at '/sys/kernel/btf/vmlinux', was CONFIG_DEBUG_INFO_BTF enabled?
libbpf: failed to find valid kernel BTF
libbpf: Error loading vmlinux BTF: -3
libbpf: failed to load object 'bootstrap_bpf'
libbpf: failed to load BPF skeleton 'bootstrap_bpf': -3
Failed to load and verify BPF skeleton

Pyrokine avatar Jul 31 '24 13:07 Pyrokine

You'll have to use kernel headers, which I believe are packaged as a separate package on some distros.

anakryiko avatar Aug 02 '24 19:08 anakryiko

What's the best way to implement the code?

seems like overkill but I think a good practice is to build your own kernel with the custom flags for BPF, generate the bzImage (or the other compressed kernel image formats), then boot it into QEMU alongside a simple initramfs.cpio.gz, which is often based on busybox. It would also have little overhead since it isn't a full-fledged distribution, just the needed to run the kernel and try some programs, so you compile on the host and test on the guest. You can also copy files from the target to the host and vice-versa, which is enough for you to get the vmlinux header which comes with the BTF dependencies, and solve the problem with the distro not having the kernel headers.

// edit: this often overlaps with some LFS concepts. I wonder why I don't see this being discussed in BPF communities that much.

deomorxsy avatar Nov 26 '24 05:11 deomorxsy