libbpf: failed to find BTF ID for ksym

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,

I am working on a tracing tool for which I need know the address of some kernel data structures. The tool should be CO-RE and I am using libbpf (through the libbpf-rs Rust bindings, but this is not the issue I assume). However, I am having trouble to use ksyms with libbpf.

To get the address of the data structure (in my case skbuff_fclone_cache), I use an extern ksym declaration in my BPF code like this:

extern struct kmem_cache *skbuff_fclone_cache __ksym;

This compiles just fine, opening the compiled bytecode with libbpf also works. From the debug log[1], it can be seen that the extern is identified. However, loading the object fails with the following error:

libbpf: loading kernel BTF '/sys/kernel/btf/vmlinux': 0
libbpf: extern (ksym) 'skbuff_fclone_cache': failed to find BTF ID in kernel BTF(s).
libbpf: failed to load object 'skbuffTime_bpf'
libbpf: failed to load BPF skeleton 'skbuffTime_bpf': -22

I found, that libbpf has a check if it needs to load the BTF information or /proc/kallsyms. In my case, it loads the BTF information and cannot find the ksym in there. Searching in the BTF from the running kernel (bpftool btf dump file /sys/kernel/btf/vmlinux format raw | grep "skbuff_fclone_cache") indeed gives no results. However, it can be found in kallsyms (cat /proc/kallsyms | grep "skbuff_fclone_cache" gives one result). Therefore, a resolution of the ksym with kallsyms will probably work but is not even attempted.

Now, I am not really sure where the root cause of the issue can be found. Should the ksym be present in the BTF information (i.e., the issue comes from building the kernel) or is the BPF object file broken (i.e., an issue with clang) or is the identification of the ksym wrong (i.e., the issue is in the libbpf loading code). Or something completely different? Does anyone have a hint on what goes wrong here?

Some version information:
I am running Ubuntu 20.04, the kernel version is 5.8.0-45-generic (from HWE). The kernel has been build on the system to enable BTF; otherwise, the configuration is identical to the Ubuntu upstream. It has been compiled with gcc 9.3.0 and pahole v1.17. I am compiling the BPF code with clang 10.0.0 and tested with different libbpf versions from the GitHub mirror (0.2, 0.3, and 99bc17633).

Thank you already for taking a look at my issue!

Best regards,
Felix Maurer



[1]: Full libbpf opening debug log:
libbpf: loading object 'skbuffTime_bpf' from buffer
libbpf: elf: section(3) fexit/kmem_cache_alloc, size 176, link 0, flags 6, type=1 libbpf: sec 'fexit/kmem_cache_alloc': found program 'kmem_cache_alloc' at insn offset 0 (0 bytes), code size 22 insns (176 bytes) libbpf: elf: section(4) .relfexit/kmem_cache_alloc, size 32, link 26, flags 0, type=9 libbpf: elf: section(5) fexit/kmem_cache_alloc_node, size 176, link 0, flags 6, type=1 libbpf: sec 'fexit/kmem_cache_alloc_node': found program 'kmem_cache_alloc_node' at insn offset 0 (0 bytes), code size 22 insns (176 bytes) libbpf: elf: section(6) .relfexit/kmem_cache_alloc_node, size 32, link 26, flags 0, type=9
libbpf: elf: section(7) license, size 4, link 0, flags 3, type=1
libbpf: license of skbuffTime_bpf is GPL
libbpf: elf: section(8) .maps, size 24, link 0, flags 3, type=1
libbpf: elf: section(17) .BTF, size 4419, link 0, flags 0, type=1
libbpf: elf: section(19) .BTF.ext, size 440, link 0, flags 0, type=1
libbpf: elf: section(26) .symtab, size 263040, link 1, flags 0, type=2
libbpf: looking for externs among 10960 symbols...
libbpf: collected 1 externs total
libbpf: extern (ksym) #0: symbol 10959, name skbuff_fclone_cache
libbpf: map 'events': at sec_idx 8, offset 0.
libbpf: map 'events': found type = 4.
libbpf: map 'events': found key_size = 4.
libbpf: map 'events': found value_size = 4.
libbpf: sec '.relfexit/kmem_cache_alloc': collecting relocation for section(3) 'fexit/kmem_cache_alloc' libbpf: sec '.relfexit/kmem_cache_alloc': relo #0: insn #2 against 'skbuff_fclone_cache' libbpf: prog 'kmem_cache_alloc': found extern #0 'skbuff_fclone_cache' (sym 10959) for insn #2
libbpf: sec '.relfexit/kmem_cache_alloc': relo #1: insn #14 against 'events'
libbpf: prog 'kmem_cache_alloc': found map 0 (events, sec 8, off 0) for insn #14 libbpf: sec '.relfexit/kmem_cache_alloc_node': collecting relocation for section(5) 'fexit/kmem_cache_alloc_node' libbpf: sec '.relfexit/kmem_cache_alloc_node': relo #0: insn #2 against 'skbuff_fclone_cache' libbpf: prog 'kmem_cache_alloc_node': found extern #0 'skbuff_fclone_cache' (sym 10959) for insn #2 libbpf: sec '.relfexit/kmem_cache_alloc_node': relo #1: insn #14 against 'events' libbpf: prog 'kmem_cache_alloc_node': found map 0 (events, sec 8, off 0) for insn #14



[Index of Archives]     [Linux Samsung SoC]     [Linux Rockchip SoC]     [Linux Actions SoC]     [Linux for Synopsys ARC Processors]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]


  Powered by Linux