BTFhub, in collaboration with the BTFhub Archive repository, supplies BTF files for all published kernels that lack native support for embedded BTF. This joint effort ensures that even kernels without built-in BTF support can effectively leverage the benefits of eBPF programs, promoting compatibility across various kernel versions.
License: Apache License 2.0
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot]")
Commit 560ef68 ("example: remove examples from this repo") removed the example code.
This broke the links in README section "How can I use it ?"
up until now i used ./btfgen.sh <core.o> to generate the BTF files for my code
but now i need to run ./extract.sh first
i didn't see any reference in the documentation for that change
To use as input the following issue:
and to make sure we are covering the most common k8s public cloud kernels there are.
Related:
https://bugs.launchpad.net/ubuntu/+source/dwarves/+bug/2025370
Atttempt of having latest version always built:
#89
Keeping this issue opened until solved.
Minimal binary from libbpf-bootstrap source was modified to remove usage of global variables and use custom btf path while opening.
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
char LICENSE[] SEC("license") = "Dual BSD/GPL";
SEC("tp/syscalls/sys_enter_write")
int handle_tp(void *ctx)
{
int pid = bpf_get_current_pid_tgid() >> 32;
bpf_printk("BPF triggered from PID %d.\n", pid);
return 0;
}
/* Open BPF application */
// bpf object open options
char *btf_file;
struct bpf_object_open_opts openopts = {};
openopts.sz = sizeof(struct bpf_object_open_opts);
btf_file = getenv("EXAMPLE_BTF_FILE");
if (btf_file != NULL)
openopts.btf_custom_path = strdup(btf_file);
skel = minimal_bpf__open_opts(&openopts);
if (!skel) {
fprintf(stderr, "Failed to open BPF skeleton\n");
return 1;
}
/* Load & verify BPF programs */
err = minimal_bpf__load(skel);
if (err) {
fprintf(stderr, "Failed to load and verify BPF skeleton\n");
goto cleanup;
}
Execution on Centos 7.9.2009
[root@localhost c]# uname -r
3.10.0-1160.45.1.el7.x86_64
[root@localhost c]# EXAMPLE_BTF_FILE=/tmp/3.10.0-1160.45.1.el7.x86_64.btf ./minimal
libbpf: loading object 'minimal_bpf' from buffer
libbpf: elf: section(3) tp/syscalls/sys_enter_write, size 72, link 0, flags 6, type=1
libbpf: sec 'tp/syscalls/sys_enter_write': found program 'handle_tp' at insn offset 0 (0 bytes), code size 9 insns (72 bytes)
libbpf: elf: section(4) .reltp/syscalls/sys_enter_write, size 16, link 12, flags 40, type=9
libbpf: elf: section(5) license, size 13, link 0, flags 3, type=1
libbpf: license of minimal_bpf is Dual BSD/GPL
libbpf: elf: section(6) .rodata, size 28, link 0, flags 2, type=1
libbpf: elf: section(7) .BTF, size 531, link 0, flags 0, type=1
libbpf: elf: section(9) .BTF.ext, size 128, link 0, flags 0, type=1
libbpf: elf: section(12) .symtab, size 144, link 1, flags 0, type=2
libbpf: looking for externs among 6 symbols...
libbpf: collected 0 externs total
libbpf: map 'minimal_.rodata' (global data): at sec_idx 6, offset 0, flags 480.
libbpf: map 0 is "minimal_.rodata"
libbpf: sec '.reltp/syscalls/sys_enter_write': collecting relocation for section(3) 'tp/syscalls/sys_enter_write'
libbpf: sec '.reltp/syscalls/sys_enter_write': relo #0: insn #2 against '.rodata'
libbpf: prog 'handle_tp': found data map 0 (minimal_.rodata, sec 6, off 0) for insn 2
libbpf: Kernel doesn't support BTF, skipping uploading it.
libbpf: prog 'handle_tp': relo #0: kernel doesn't support global data
libbpf: prog 'handle_tp': failed to relocate data references: -95
libbpf: failed to load object 'minimal_bpf'
libbpf: failed to load BPF skeleton 'minimal_bpf': -95
Failed to load and verify BPF skeleton
Similarly, execution fails on Ubuntu 18.04 (4.15.0-136-generic) even after supplying a btf file obtained from the btfhub archive.
My basic question is as follows:
The go version of btfhub doesn't need bpftool. The only usage in this repo is in the tools/btfgen.sh script, which isn't something used in the GitHub actions.
When creating a system using GCP Debian 10, I found that the kernel version is 4.19.0-22-cloud-amd64. However, the BTF file for this version is currently missing from BTFHub.
I suspect that the failure of the scheduler in this project is preventing synchronization with the Debian system. It appears that the scheduler is unable to download the BTFHub project, potentially due to expired authorization.
Can you please assist with this issue? Thank you.
I can not find examples directory， I can to study this progrom.
I believe that if you removed a BTF .tar.xz file and re-ran the script, you would get a different output. The actual BTF should be the same, but because tar is preserving mtime, users, and possible other data, the .tar.xz file will always be different.
I can see two potential avenues to explore:
WDYT?
We would like to introduce a flexible URL API that will be the primary interface to obtain BTF files.
For example: https://archive.btfhub.io/v1/ubuntu/20.04/x86_64/5.11.0-1007-azure.btf.tar.xz -> https://raw.githubusercontent.com/aquasecurity/btfhub/main/archive/ubuntu/20.04/x86_64/5.11.0-1007-azure.btf.tar.xz.
Motivations:
/v1) we can also evolve the public facing api without breakage.All kernels being released, from now on, to Ubuntu Bionic and Focal, have BTF support. This means that there is no need to keep adding BTF files for them (and some existing BTF files might be removed).
This is also true for centos8, all released kernels support BTF files and we should stop updating the hub and remove the BTF files for the kernels that support it already.
Same with Fedora...
No kernels for Amazon Linux 1 are present. Although end-of-life, it is in maintenance support through June 30, 2023 (https://aws.amazon.com/blogs/aws/update-on-amazon-linux-ami-end-of-life/).
Slightly different from Amazon Linux 2, the repodata is a bz2 archive. But otherwise, everything is pretty much the same. The kernel debug symbol packages are found in the amzn-updates-debuginfo repo. The base url for which is: http://packages.us-east-1.amazonaws.com/2018.03/updates/85446a8a5f59/debuginfo/x86_64
Hello,
I noticed some Debian kernels are missing:
Debian 9:
Debian 10:
(And all of their variants)
Is this a mistake? Is their a reason why there's no BTF for them?
After doing minor adjustments to btfhub code for fedor release, I'm getting:
2023/03/09 02:06:01 SKIP: 5.0.9-301.fc30.x86_64.btf.tar.xz exists
2023/03/09 02:06:01 DEBUG: end pkg kernel-debuginfo-5.0.9-301.fc30.x86_64 (1/1)
2023/03/09 02:06:01 DEBUG: start pkg kernel-debuginfo-4.13.9-300.fc27.x86_64 (1/2)
2023/03/09 02:06:01 SKIP: 4.13.9-300.fc27.x86_64.btf.tar.xz exists
2023/03/09 02:06:01 DEBUG: end pkg kernel-debuginfo-4.13.9-300.fc27.x86_64 (1/2)
2023/03/09 02:06:01 DEBUG: start pkg kernel-debuginfo-4.18.19-100.fc27.x86_64 (2/2)
2023/03/09 02:06:01 DEBUG: downloading kernel-debuginfo-4.18.19-100.fc27.x86_64
2023/03/09 02:06:28 DEBUG: finished downloading kernel-debuginfo-4.18.19-100.fc27.x86_64 in 26.532340464s
2023/03/09 02:06:28 DEBUG: extracting vmlinux from /home/rafaeldtinoco/work/ebpf/btfhub/archive/fedora/27/x86_64/4.18.19-100.fc27.x86_64.rpm
2023/03/09 02:06:28 ERROR: kernel-debuginfo-4.18.19-100.fc27.x86_64: extracting vmlinux from /home/rafaeldtinoco/work/ebpf/btfhub/archive/fedora/27/x86_64/vmlinux-4.18.19-100.fc27.x86_64: not implemented
2023/03/09 02:09:21 DEBUG: finished downloading kernel-debuginfo-4.11.12-100.fc24.x86_64 in 3m20.22025926s
2023/03/09 02:09:21 DEBUG: extracting vmlinux from /home/rafaeldtinoco/work/ebpf/btfhub/archive/fedora/24/x86_64/4.11.12-100.fc24.x86_64.rpm
2023/03/09 02:09:21 ERROR: kernel-debuginfo-4.11.12-100.fc24.x86_64: extracting vmlinux from /home/rafaeldtinoco/work/ebpf/btfhub/archive/fedora/24/x86_64/vmlinux-4.11.12-100.fc24.x86_64: not implemented
2023/03/09 02:09:56 DEBUG: finished downloading kernel-debuginfo-4.13.16-100.fc25.x86_64 in 3m54.863718228s
2023/03/09 02:09:56 DEBUG: extracting vmlinux from /home/rafaeldtinoco/work/ebpf/btfhub/archive/fedora/25/x86_64/4.13.16-100.fc25.x86_64.rpm
2023/03/09 02:09:56 ERROR: kernel-debuginfo-4.13.16-100.fc25.x86_64: extracting vmlinux from /home/rafaeldtinoco/work/ebpf/btfhub/archive/fedora/25/x86_64/vmlinux-4.13.16-100.fc25.x86_64: not implemented
2023/03/09 02:10:06 DEBUG: finished downloading kernel-debuginfo-4.16.11-100.fc26.x86_64 in 4m5.097627896s
2023/03/09 02:10:06 DEBUG: extracting vmlinux from /home/rafaeldtinoco/work/ebpf/btfhub/archive/fedora/26/x86_64/4.16.11-100.fc26.x86_64.rpm
2023/03/09 02:10:06 ERROR: kernel-debuginfo-4.16.11-100.fc26.x86_64: extracting vmlinux from /home/rafaeldtinoco/work/ebpf/btfhub/archive/fedora/26/x86_64/vmlinux-4.16.11-100.fc26.x86_64: not implemented
The fedora ExtractKernel() method is named Exctract() only.
When running the btfgen.sh script for my bpf objects, then the output will be only empty directories.
> ./btfgen.sh -a x86_64 -o recorder.bpf.o.amd64
centos/7/x86_64
centos/8/x86_64
fedora/29/x86_64
fedora/30/x86_64
fedora/31/x86_64
fedora/32/x86_64
fedora/33/x86_64
fedora/34/x86_64
ubuntu/18.04/x86_64
ubuntu/20.04/x86_64
> find ../custom-archive/
../custom-archive/
../custom-archive/centos
../custom-archive/centos/8
../custom-archive/centos/8/x86_64
../custom-archive/centos/7
../custom-archive/centos/7/x86_64
../custom-archive/ubuntu
../custom-archive/ubuntu/20.04
../custom-archive/ubuntu/20.04/x86_64
../custom-archive/ubuntu/18.04
../custom-archive/ubuntu/18.04/x86_64
../custom-archive/fedora
../custom-archive/fedora/33
../custom-archive/fedora/33/x86_64
../custom-archive/fedora/34
../custom-archive/fedora/34/x86_64
../custom-archive/fedora/32
../custom-archive/fedora/32/x86_64
../custom-archive/fedora/30
../custom-archive/fedora/30/x86_64
../custom-archive/fedora/29
../custom-archive/fedora/29/x86_64
../custom-archive/fedora/31
../custom-archive/fedora/31/x86_64
../custom-archive/.gitignore
Did I miss anything?
This is rather not an issue but something that could be improved.
I found out that there are some BTF files with the exact same content for different kernel versions:
$ fdupes -r ./archive/
./archive/centos/8/x86_64/4.18.0-147.3.1.el8_1.x86_64.btf
./archive/centos/8/x86_64/4.18.0-147.5.1.el8_1.x86_64.btf
./archive/centos/7/x86_64/3.10.0-1062.4.2.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-1062.4.3.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-1160.2.1.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-1160.2.2.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-1160.24.1.el7.x86_64.failed
./archive/centos/8/x86_64/4.18.0-240.el8.x86_64.failed
./archive/centos/7/x86_64/3.10.0-1160.41.1.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-1160.45.1.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-327.36.2.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-327.36.3.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-327.3.1.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-327.4.4.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-1062.1.1.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-1062.1.2.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-693.1.1.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-693.2.2.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-514.6.1.el7.x86_64.btf
./archive/centos/7/x86_64/3.10.0-514.6.2.el7.x86_64.btf
./archive/ubuntu/18.04/x86_64/4.15.0-106-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-108-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1020-azure.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1022-azure.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1047-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1048-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1050-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1033-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1034-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-115-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-117-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1014-azure.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1018-azure.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1045-aws.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1047-aws.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1022-aws.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1024-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-121-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-122-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-123-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-124-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-109-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-111-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-112-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1103-azure.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1104-azure.btf
./archive/ubuntu/18.04/x86_64/4.15.0-69-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-70-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-129-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-130-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-132-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-134-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1034-aws.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1035-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-24-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-29-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1028-azure.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1030-azure.btf
./archive/ubuntu/18.04/x86_64/5.4.0-40-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-42-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1028-aws.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1029-aws.btf
./archive/ubuntu/18.04/x86_64/5.4.0-45-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-47-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1039-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1040-aws.btf
./archive/ubuntu/18.04/x86_64/5.4.0-51-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-52-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-53-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-54-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1093-azure.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1095-azure.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1077-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1079-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1086-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1087-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-156-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-158-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1023-azure.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1025-azure.btf
./archive/ubuntu/18.04/x86_64/4.15.0-74-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-76-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1080-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1082-aws.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1059-azure.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1061-azure.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1073-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1076-aws.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1018-aws.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1020-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1096-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1097-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1091-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1092-aws.btf
./archive/ubuntu/18.04/x86_64/5.4.0-84-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-86-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-44-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-45-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-139-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-140-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1057-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1058-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1110-azure.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1111-azure.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1035-azure.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1036-azure.btf
./archive/ubuntu/18.04/x86_64/4.15.0-60-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-62-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-64-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1048-azure.btf
./archive/ubuntu/18.04/x86_64/5.4.0-1049-azure.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1011-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1016-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-151-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-153-generic.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1099-aws.btf
./archive/ubuntu/18.04/x86_64/4.15.0-1101-aws.btf
./archive/ubuntu/18.04/x86_64/5.4.0-59-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-60-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-62-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-64-generic.btf
./archive/ubuntu/18.04/x86_64/5.4.0-65-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1020-azure.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1022-azure.btf
./archive/ubuntu/20.04/x86_64/5.4.0-26-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-28-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-29-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1045-aws.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1047-aws.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1022-aws.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1024-aws.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1015-aws.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1017-aws.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1034-aws.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1035-aws.btf
./archive/ubuntu/20.04/x86_64/5.4.0-40-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-42-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-45-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-47-generic.btf
./archive/ubuntu/20.04/x86_64/5.8.0-1040-azure.btf
./archive/ubuntu/20.04/x86_64/5.8.0-1041-azure.btf
./archive/ubuntu/20.04/x86_64/5.8.0-1042-azure.btf
./archive/ubuntu/20.04/x86_64/5.8.0-25-generic.btf
./archive/ubuntu/20.04/x86_64/5.8.0-28-generic.btf
./archive/ubuntu/20.04/x86_64/5.8.0-29-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-52-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-53-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-54-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1023-azure.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1025-azure.btf
./archive/ubuntu/20.04/x86_64/5.4.0-31-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-33-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1059-azure.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1061-azure.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1018-aws.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1020-aws.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1021-aws.btf
./archive/ubuntu/20.04/x86_64/5.4.0-84-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-86-generic.btf
./archive/ubuntu/20.04/x86_64/5.8.0-34-generic.btf
./archive/ubuntu/20.04/x86_64/5.8.0-36-generic.btf
./archive/ubuntu/20.04/x86_64/5.8.0-38-generic.btf
./archive/ubuntu/20.04/x86_64/5.8.0-40-generic.btf
./archive/ubuntu/20.04/x86_64/5.8.0-41-generic.btf
./archive/ubuntu/20.04/x86_64/5.8.0-43-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1016-azure.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1019-azure.btf
./archive/ubuntu/20.04/x86_64/5.11.0-1017-azure.btf
./archive/ubuntu/20.04/x86_64/5.11.0-1019-azure.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1035-azure.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1036-azure.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1048-azure.btf
./archive/ubuntu/20.04/x86_64/5.4.0-1049-azure.btf
./archive/ubuntu/20.04/x86_64/5.4.0-37-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-39-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-59-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-60-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-62-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-64-generic.btf
./archive/ubuntu/20.04/x86_64/5.4.0-65-generic.btf
I think this could be optimized to reduce the storage needs by replacing the duplicated ones with a symlink. The feasibility and importance of this optimization is related to the adopted storage solution -> #12.
I need to use bpf tool on some non-distro kernels, but these kernels are not turned on DEBUG_INFO_BTF=y
we use git to store both the btf generation script, and also the resulting btf artifacts. this was very easy for the poc stage of btfhub, but now is a good opportunity to reevaluate the storage requirements. If we want to stay in github world, we have:
basic requirements are:
(note it doesn't have to be a free service. paid services are also fine)
I'm in favor of option 4 - AWS S3.
I noticed that some of the compressed files that should contain the .btf file are empty.
$ du -ah . | grep ".btf.tar.xz" | sort -rh | tail -n 5
4,0K ./ubuntu/20.04/x86_64/5.11.0-25-generic.btf.tar.xz
4,0K ./ubuntu/20.04/x86_64/5.11.0-22-generic.btf.tar.xz
4,0K ./ubuntu/18.04/x86_64/4.15.0-153-generic.btf.tar.xz
4,0K ./centos/8/x86_64/4.18.0-240.el8.x86_64.btf.tar.xz
4,0K ./centos/7/x86_64/3.10.0-1160.24.1.el7.x86_64.btf.tar.xz
@mauriciovasquezbernal discovered that our BTFs for Fedora (and likely CentOS) are wrong. When comparing types of a running Fedora 31 and the BTFs we have for it, there are mismatches that should NOT be there. This happens because of different config options that change types (like task_struct) adding or removing fields.
By compiling latest dwarves from upstream in Fedora 31 and checking with:
$ pahole -E -C task_struct > from-sysfs.txt
$ pahole -Fdwarf -j external /usr/lib/debug/lib/modules/5.8.18-100.fc31.x86_64/vmlinux
$ pahole -E -C task_struct ./external > from-external.txt
$ diff from-sysfs.txt from-external.txt | wc -l
0
I discovered that I made a mistake when generating the BTFs. The RHEL-like distros have 2 kernels:
And I used the 2nd one, instead of the 1st, to generate the BTFs. Obviously those BTFs are not compatible as the kernel-debug has debug options enabled and its types are different than the vanilla kernel.
I'm changing the update.sh file to re-download all packages and re-generate the BTFs for CentOS and Fedora. This might take awhile, will be running in background and I'll close this issue when done.
Yesterday I have uploaded 2 aws BTF files for recent 5.11 HWE kernels for focal. This issue is to make sure update.sh is also monitoring for AWS kernels within Bionic and Focal repositories.
I has many machines that are linux kernel 5.x 。 But I find the project(https://github.com/aquasecurity/btfhub-archive) only having centos 7 5.4。so may be incompatible, my program run error.
int tc_ingress(struct __sk_buff *skb)
{
__u32 len = skb->len;
void *data_end = (void *)(__u64)skb->data_end;
void *data = (void *)(__u64)skb->data;
__u32 tc_classid = skb->tc_classid;
char* l2_data_start = data;
char* l2_data_end = data_end;
unsigned long long int l2_pkt_len = (unsigned long long int)(l2_data_end - l2_data_start);
// if print len, it error, can not running.
// if print skb->protocol it success
// if print l2_pkt_len it success
// if print tc_classid but the value of tc_classid is 0。it should not 0.
}
Hello, I'm trying to understand why there is so much failed file in the repo.
Here is the current list of failed BTF files in the archive:
>> find . -name "*.failed"
./centos/7/x86_64/3.10.0-1160.24.1.el7.x86_64.failed
./centos/8/x86_64/4.18.0-240.el8.x86_64.failed
./ubuntu/20.04/arm64/5.4.0-1065-aws.failed
./ubuntu/20.04/arm64/5.11.0-1028-aws.failed
./ubuntu/20.04/arm64/5.4.0-1063-aws.failed
./ubuntu/20.04/arm64/5.4.0-1064-aws.failed
./ubuntu/20.04/arm64/5.4.0-1061-aws.failed
./ubuntu/20.04/x86_64/5.4.0-1065-aws.failed
./ubuntu/20.04/x86_64/5.11.0-1028-aws.failed
./ubuntu/20.04/x86_64/5.4.0-1063-aws.failed
./ubuntu/20.04/x86_64/5.4.0-1064-aws.failed
./ubuntu/20.04/x86_64/5.4.0-1061-aws.failed
./ubuntu/18.04/arm64/4.15.0-1119-aws.failed
./ubuntu/18.04/arm64/5.4.0-1065-aws.failed
./ubuntu/18.04/arm64/5.4.0-1063-aws.failed
./ubuntu/18.04/arm64/5.4.0-1064-aws.failed
./ubuntu/18.04/arm64/5.4.0-1061-aws.failed
./ubuntu/18.04/x86_64/4.15.0-1119-aws.failed
./ubuntu/18.04/x86_64/5.4.0-37-generic.failed
./ubuntu/18.04/x86_64/5.4.0-1065-aws.failed
./ubuntu/18.04/x86_64/5.4.0-1063-aws.failed
./ubuntu/18.04/x86_64/5.4.0-1064-aws.failed
./ubuntu/18.04/x86_64/5.4.0-1061-aws.failed
Most (and possibly all) of the ubuntu aws failed files are the result of downloading shim packages that depends on the unsigned version of package. For example for 4.15.0-1119-aws:
>> curl -O http://ddebs.ubuntu.com/pool/main/l/linux-signed-aws/linux-image-4.15.0-1119-aws-dbgsym_4.15.0-1119.127_amd64.ddeb
>> dpkg -I linux-image-4.15.0-1119-aws-dbgsym_4.15.0-1119.127_amd64.ddeb
new Debian package, version 2.0.
size 2088 bytes: control archive=564 bytes.
381 bytes, 11 lines control
196 bytes, 2 lines md5sums
Package: linux-image-4.15.0-1119-aws-dbgsym
Source: linux-signed-aws
Version: 4.15.0-1119.127
Architecture: amd64
Maintainer: Canonical Kernel Team <[email protected]>
Installed-Size: 9
Depends: linux-image-unsigned-4.15.0-1119-aws-dbgsym
Section: devel
Priority: optional
Description: Signed kernel image aws
A link to the debugging symbols for the aws signed kernel.
And linux-image-unsigned-4.15.0-1119-aws-dbgsym actually contains the vmlinux and could thus be used to compute the actual BTF file. Now the question: what would be in your opinion the best way to handle this situation ?
The new golang update app seems to be leaving .ddeb leftovers:
https://github.com/aquasecurity/btfhub/actions/runs/4349701197/jobs/7599658679
This could be mitigated by not syncing the ddebs or checking why the leftovers were there in the first place.
Files added in recent PRs to btfhub-archive (aquasecurity/btfhub-archive#26, aquasecurity/btfhub-archive#21, aquasecurity/btfhub-archive#25, etc.) have a path prefix on the compressed file:
# file added before
$ tar -tf ubuntu/20.04/x86_64/5.4.0-1067-gke.btf.tar.xz
5.4.0-1067-gke.btf
# file added in recent PRs
$ tar -tf ubuntu/20.04/x86_64/5.4.0-1068-gke.btf.tar.xz
home/ubuntu/btfhub/archive/ubuntu/focal/x86_64/5.4.0-1068-gke.btfI think we should keep the structure in all files (without any path). @brycekahle would you mind checking this please?
The list of files I identified with the problem are:
ubuntu/20.04/x86_64/5.4.0-1068-gke.btf.tar.xz
ubuntu/18.04/x86_64/4.15.0-1159-azure.btf.tar.xz
ubuntu/18.04/x86_64/4.15.0-202-generic.btf.tar.xz
ol/7/x86_64/4.1.12-124.32.3.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.22.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.19.5.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.18.5.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.0.0.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-94.8.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.23.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-112.17.3.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.62.1.0.3.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-112.14.5.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.24.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.62.1.0.2.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.23.4.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.26.5.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.19.7.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.53.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.18.6.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.36.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.1.3.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.19.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.12.2.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.16.4.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.14.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.23.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-112.16.4.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.5.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.26.12.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-103.7.4.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.24.3.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.34.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.21.3.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.81.1.0.2.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.4.2.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-37.2.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.26.3.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.36.1.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.18.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.9.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.26.10.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.9.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.0.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-37.2.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.21.2.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.27.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-112.14.10.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.16.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.24.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.4.3.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.35.4.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.7.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.27.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.5.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.17.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.16.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.29.3.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.76.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.49.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.62.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.10.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.12.2.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.27.2.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.81.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-112.14.13.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-112.14.11.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.34.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.21.3.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.33.4.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.12.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-94.7.8.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.15.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-37.6.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.17.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.66.1.0.2.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.62.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.18.9.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.1.2.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-103.3.8.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.4.3.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-94.3.4.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-94.8.5.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-94.5.7.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.12.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.29.4.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.71.1.0.2.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.30.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-103.7.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.49.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.16.3.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.27.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-94.3.5.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.31.1.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.66.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.21.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.18.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-37.6.3.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.14.3.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.28.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.1.3.0.3.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.37.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.27.2.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-103.9.6.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-37.3.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-103.9.7.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.18.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.25.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.80.1.0.2.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-112.16.7.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-112.14.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.38.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-94.3.6.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-37.4.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.29.3.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-94.1.8.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.19.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-103.9.4.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-32.1.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.14.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.21.2.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.20.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.26.7.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-32.2.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.4.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.33.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.64.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.20.7.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.14.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-94.2.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.59.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.13.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.14.5.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.22.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-112.14.14.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.20.3.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-103.7.3.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.31.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-94.3.7.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.12.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-103.6.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-32.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.22.4.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.15.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.76.1.0.2.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-37.5.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-112.14.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-94.3.8.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.17.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.24.5.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.6.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.10.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.59.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.12.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.35.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.1.28.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-37.6.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.25.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.51.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.1.2.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.28.3.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.23.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.16.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.0.0.0.2.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.5.1.0.2.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.1.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.1.3.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-103.9.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.1.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.4.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-94.5.9.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.80.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.28.5.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.36.4.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.32.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.18.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.71.1.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-61.63.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-103.10.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.26.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1062.7.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.53.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.10.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-1160.66.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-94.8.3.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-32.2.3.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.19.4.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/3.10.0-957.0.0.0.1.el7.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.22.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.19.6.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.32.3.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.28.6.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-94.3.9.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-103.3.8.1.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.36.3.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.15.4.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.19.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-124.35.2.el7uek.x86_64.btf.tar.xz
ol/7/x86_64/4.1.12-112.14.15.el7uek.x86_64.btf.tar.xz
debian/10/x86_64/4.19.0-23-cloud-amd64.btf.tar.xz
debian/10/x86_64/4.19.0-23-amd64.btf.tar.xz
debian/10/x86_64/4.19.0-23-rt-amd64.btf.tar.xz
fedora/28/x86_64/4.16.3-301.fc28.x86_64.btf.tar.xz
fedora/28/x86_64/5.0.16-100.fc28.x86_64.btf.tar.xz
fedora/25/x86_64/4.8.6-300.fc25.x86_64.btf.tar.xz
fedora/26/x86_64/4.11.8-300.fc26.x86_64.btf.tar.xz
fedora/31/x86_64/5.3.7-301.fc31.x86_64.btf.tar.xz
fedora/24/x86_64/4.5.5-300.fc24.x86_64.btf.tar.xz
fedora/27/x86_64/4.13.9-300.fc27.x86_64.btf.tar.xz
amzn/2018/x86_64/4.14.299-152.520.amzn1.x86_64.btf.tar.xz
amzn/2018/x86_64/4.14.294-150.533.amzn1.x86_64.btf.tar.xz
amzn/2018/x86_64/4.14.26-46.32.amzn1.x86_64.btf.tar.xz
Thanks!
I think it could be valuable to have CI checks for btfhub-archive PRs. This would allow us to enforce some quality standards, such as:
pahole argumentsI'm not sure there is a way to do this without having files in-tree of the btfhub-archive repo. This means consumers would need to ignore a .github folder (or equivalent).
I'm currently working at:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1926330
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1949286
trying to make Ubuntu SRU team to accept a new package into Bionic and Focal main archive. This package is just like a dwarves-dfsg from Impish, backported to both Bionic and Focal, but it contains only the pahole-btf binary.
This way, the HWE kernel builds for those Ubuntu versions can depend on this new binary package and use /usr/bin/pahole-btf to create BTF at:
https://elixir.bootlin.com/linux/v5.14.14/source/scripts/link-vmlinux.sh#L218
The PPA bellow contains the binary package ready for MIR (Main Inclusion Request):
https://launchpad.net/~rafaeldtinoco/+archive/ubuntu/pahole-btf
With that binary, Bionic and Focal are able to encode correct BTF information within ELF (and as raw files).
Note: This is a tracking bug only (to track upstream work).
Both directories could be removed from git tree and created when/if needed. Should we do this ?
Due to some upstream issue, the 5.11 HWE kernels do not have their symbols published anywhere. If you check 'Packages' file from the ddebs.ubuntu.com repository you will find:
Package: linux-image-5.11.0-34-generic-dbgsym
Architecture: amd64
Version: 5.11.0-34.36~20.04.1
Priority: optional
Section: devel
Source: linux-signed-hwe-5.11
Maintainer: Canonical Kernel Team <[email protected]>
Installed-Size: 23
Depends: linux-image-unsigned-5.11.0-34-generic-dbgsym
Filename: pool/main/l/linux-signed-hwe-5.11/linux-image-5.11.0-34-generic-dbgsym_5.11.0-34.36~20.04.1_amd64.ddeb
Size: 16556
MD5sum: de46adfcbf1550a8c8ea39dc41d55461
SHA1: 44c1efc1d9a409dbc9fcfeff3de4a2381eeb680b
SHA256: 469848f54b2b4e4d6e0de5e2f95ebfaefc185fcfe27564f8da2daa571f1c7fd2
SHA512: 2d26c09e2c555f334662dda73a568b2f338e3db6312d86069e2e824d7fe7482436d40fb8df4d87319906f2b9df871cdbc70dacaef59871125af9b290c240967e
Description: Signed kernel image generic
A link to the debugging symbols for the generic signed kernel.
Problem is that this is different from previous, and working, 5.4.0-X and 5.8.0-X kernels. As you can see those packages are minimal in size (16556) and don't contain any debug data.
Summary: without the DWARF symbols for those kernels, the BTF files can't be generated.
I have already contacted Ubuntu kernel team and the conversation was:
10:16 AM <rafaeldtinoco> Im getting "E: Package 'linux-image-unsigned-5.11.0-34-generic-dbgsym' has no installation candidate" in ubuntu focal.
10:18 AM <rafaeldtinoco> looks like I can get dbgsyms for aws kernels, for example, but not for -generic- ones
10:19 AM <rafaeldtinoco> linux-image-5.11.0-27-generic-dbgsym
10:19 AM <rafaeldtinoco> linux-image-5.11.0-22-generic-dbgsym
10:19 AM <rafaeldtinoco> linux-image-5.11.0-25-generic-dbgsym
10:19 AM <rafaeldtinoco> linux-image-5.11.0-34-generic-dbgsym
10:21 AM <rafaeldtinoco> unsigned ones are empty, the signed ones dont seem to exist fyi ^
10:22 AM <rafaeldtinoco> 5.4 and 5.8 hwe kernels are good
10:26 AM <klebers> rafaeldtinoco, hey! we are aware of the issue and it's on our list to fix it
10:26 AM <rafaeldtinoco> klebers: oh, great then. thanks!
I'll keep this issue opened here if anyone else faces the issue. Will close when this is solved.
The example linked in the README in this section:
How can I use it ?
This is a code example of how you should use BTFhub to add support to legacy kernels to your eBPF project.
which links to https://github.com/aquasecurity/btfhub/blob/main/example doesn't exist anymore.
I'd suggest we add back the example since it would help with the adoption of btfhub.
We're trying to integrate this in Inspektor Gadget (inspektor-gadget/inspektor-gadget#221). So far it works great on Ubuntu but we're having some issues on Fedora (probably also on CentOS).
In order to download the right file we use something like the following:
source /etc/os-release
KERNEL=$(uname -r)
URL="https://github.com/aquasecurity/btfhub/raw/main/$ID/$VERSION_ID/$KERNEL.btf.tar.xz"
...
It generates an URL as https://github.com/aquasecurity/btfhub/raw/main/fedora/29/5.3.11-100.fc29.x86_64.btf.tar.xz, but this gives a 404 because this file on this repo doesn't have the x86_64 suffix (https://github.com/aquasecurity/btfhub/raw/main/fedora/29/5.3.11-100.fc29.btf.tar.xz).
I'm wondering if that prefix should be included in this repo or if I should use a different way to generate the path to download the file.
Thanks!
Currently BTFHUB supports BTF files only for the main kernel image (vmlinux) but not for the included modules. This means that, if an eBPF program needs to kprobe a module function, for example, in a kernel without internal BTF information it would not be possible (as the program would have to load an external BTF file describing that module and those BTF files don't exist).
Things to observe:
bpftool gen min_core_btf feature) to generate a minimum BTF file for 1 or multiple objects (even when the objects use type information from the kernel modules).Would you be open to a Go version of the update.sh script? For some distros (RHEL, Oracle) the BTF generation is the majority of the time, so parallelizing the kernel download and BTF generation would drastically speed things up.
Hey folks, do you think it would make sense to support multiple architectures within this repository, for example arm 64 bit?
Improve documentation of the new golang code recently introduced (for newcomers/contributors to be able to quickly ramp up on the code).
Tasks:
Currently we have 2 bpftool binaries in order to generate the tailored BTF files. Instead of having binaries in the repo, now that bpftool has a GitHub repository:
https://github.com/libbpf/bpftool
We can simply have that repository as a submodule and compile bpftool as part of the process of using it.
SP4 doesn't need it because it has BTF embedded, but at least SP1, SP2, and SP3 are affected. See acmel/dwarves#10
You will see no output from pahole --btf-encode-detached.
Even simple queries fail:
$ pahole -C task_struct vmlinux-5.14.21-150400.22.1-default
WARNING: DW_TAG_partial_unit used, some types will not be considered!
Probably this was optimized using a tool like 'dwz'
A future version of pahole will support this.
pahole: type 'task_struct' not foundEven objdump doesn't understand it
$ objdump --dwarf=pubtypes vmlinux-5.14.21-150400.22.1-default
vmlinux-5.14.21-150400.22.1-default: file format elf64-x86-64Linux admin-pc 4.18.0-10-generic #11-Ubuntu SMP Thu Oct 11 15:13:55 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
I compile a simple test program，when I run with btf file, I obtained the following error message：
libbpf: loading openat2_kern.o
libbpf: elf: section(3) kprobe/, size 16, link 0, flags 6, type=1
libbpf: sec 'kprobe/': found program 'bpf_prog' at insn offset 0 (0 bytes), code size 2 insns (16 bytes)
libbpf: elf: section(4) license, size 4, link 0, flags 3, type=1
libbpf: license of openat2_kern.o is GPL
libbpf: elf: section(5) .eh_frame, size 48, link 0, flags 2, type=1
libbpf: elf: skipping unrecognized data section(5) .eh_frame
libbpf: elf: section(6) .rel.eh_frame, size 16, link 7, flags 0, type=9
libbpf: elf: skipping relo section(6) .rel.eh_frame for section(5) .eh_frame
libbpf: elf: section(7) .symtab, size 120, link 1, flags 0, type=2
libbpf: looking for externs among 5 symbols...
libbpf: collected 0 externs total
kernel is 267008
find program is ok
libbpf: load bpf program failed: Invalid argument
libbpf: failed to load program 'bpf_prog'
libbpf: failed to load object 'openat2_kern.o'
load object file error!
The btf file I'm using comes from the github repository: https://github.com/aquasecurity/btfhub-archive/
// openat2_kern.c
#define BPF_NO_GLOBAL_DATA
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
SEC("kprobe/__x64_sys_write")
int bpf_prog(struct pt_regs *ctx)
{
char msg[] = "hello world!\n";
// bpf_trace_printk(msg, sizeof(msg));
return 0;
}
char _license[] SEC("license")="GPL";//openat2_user.c
#include <bpf/bpf.h>
#include <bpf/libbpf.h>
#include <linux/bpf.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/resource.h>
#define DEBUGFS "/sys/kernel/debug/tracing/"
void read_trace_pipe(void){
int trace_fd;
trace_fd = open(DEBUGFS "trace_pipe", O_RDONLY,0);
if(trace_fd < 0)
return ;
while(1){
static char buf[4096]={0x00};
ssize_t sz;
sz = read(trace_fd, buf, sizeof(buf) - 1);
if(sz > 0){
buf[sz] = 0;
puts(buf);
}
}
}
static void bump_memlock_rlimit(void)
{
struct rlimit rlim_new = {
.rlim_cur = RLIM_INFINITY,
.rlim_max = RLIM_INFINITY,
};
if (setrlimit(RLIMIT_MEMLOCK, &rlim_new)) {
fprintf(stderr, "Failed to increase RLIMIT_MEMLOCK limit!\n");
exit(1);
}
}
static int libbpf_print_fn(enum libbpf_print_level level, const char *format, va_list args)
{
return vfprintf(stdout, format, args);
}
int load_bpf_file(const char * object_name){
struct bpf_object * objs;
struct bpf_program * prog;
struct bpf_link * link = NULL;
bump_memlock_rlimit();
/* Set up libbpf errors and debug info callback */
libbpf_set_print(libbpf_print_fn);
struct bpf_object_open_opts openopts = {};
openopts.sz = sizeof(struct bpf_object_open_opts);
openopts.btf_custom_path = strdup("4.18.0-13-generic.btf");
printf("%s\n",openopts.btf_custom_path);
objs = bpf_object__open_file(object_name,&openopts);
if(objs&&libbpf_get_error(objs)){
fprintf(stderr, "open object file error!\n");
goto cleanup;
}
prog = bpf_object__find_program_by_name(objs, "bpf_prog");
if(!prog){
fprintf(stderr, "ERROR: finding a prog in obj file failed\n");
fprintf(stderr, "%s\n",strerror(errno));
goto cleanup;
}
printf("find program is ok\n");
if(bpf_object__load(objs)){
fprintf(stderr, "load object file error!\n");
goto cleanup;
}
printf("load prog is ok\n");
link = bpf_program__attach(prog);
if(libbpf_get_error(link)){
fprintf(stderr, "ERROR: bpf_program__attach failed.\n");
goto cleanup;
}
return 0;
cleanup:
bpf_link__destroy(link);
bpf_object__close(objs);
return -1;
}
int main(void)
{
if(load_bpf_file("openat2_kern.o")){
return -1;
}
read_trace_pipe();
return 0;
}Unfortunately, I cannot clone the repository any more because the LFS is over the data quota:
> git clone https://github.com/aquasecurity/btfhub.git
Cloning into 'btfhub'...
remote: Enumerating objects: 2586, done.
remote: Counting objects: 100% (2580/2580), done.
remote: Compressing objects: 100% (2488/2488), done.
remote: Total 2586 (delta 58), reused 2554 (delta 32), pack-reused 6
Receiving objects: 100% (2586/2586), 1.72 MiB | 3.57 MiB/s, done.
Resolving deltas: 100% (58/58), done.
Downloading archive/centos/7/arm64/3.18.9-200.el7.aarch64.btf.tar.xz (636 KB)
Error downloading object: archive/centos/7/arm64/3.18.9-200.el7.aarch64.btf.tar.xz (85841b9): Smudge error: Error downloading archive/centos/7/arm64/3.18.9-200.el7.aarch64.btf.tar.xz (85841b9e1e654a4b3a689a808c763e07085c205073b004e27946994dc449588a): batch response: This repository is over its data quota. Account responsible for LFS bandwidth should purchase more data packs to restore access.
Errors logged to /…/btfhub/.git/lfs/logs/20211105T110512.338475748.log
Use `git lfs logs last` to view the log.
error: external filter 'git-lfs filter-process' failed
fatal: archive/centos/7/arm64/3.18.9-200.el7.aarch64.btf.tar.xz: smudge filter lfs failed
warning: Clone succeeded, but checkout failed.
You can inspect what was checked out with 'git status'
and retry with 'git restore --source=HEAD :/'
The version of bpftool shipped with the repo doesn't support the BTF files added in aquasecurity/btfhub-archive#10.
$ INPUT=<foo>/ebpf/btfhub-archive/debian/9/x86_64/4.9.0-19-amd64.btf
$ OUTPUT=/tmp/foo.btf
# doesn't matter
$ OBJ=inspektor-gadget/pkg/gadgets/trace/bind/tracer/bindsnoop_bpfel_x86.o
# shipped bpftool doesn't work
$ ./tools/bin/bpftool.x86_64 version
./tools/bin/bpftool.x86_64 v6.7.0
using libbpf v0.7
features: libbpf_strict, skeletons
$ ./tools/bin/bpftool.x86_64 gen min_core_btf $INPUT $OUTPUT $OBJ
Error: failed parsing '<foo>/ebpf/btfhub-archive/debian/9/x86_64/4.9.0-19-amd64.btf' BTF file: Invalid argument
Error: failed to allocate info structure: Invalid argument
# problem is not related to min_core_btf
$ ./tools/bin/bpftool.x86_64 btf dump file $INPUT
Error: failed to load BTF from <foo>/ebpf/btfhub-archive/debian/9/x86_64/4.9.0-19-amd64.btf: Unknown error -22
# new bpftool works
$ bpftool version
bpftool v7.1.0
using libbpf v1.1
features: libbfd, skeletons
$ bpftool gen min_core_btf $INPUT $OUTPUT $OBJ
echo $?
0
$ bpftool btf dump file $INPUT
<lot of lines printed>Oracle Linux 7 kernels are missing.
Debug symbols for Oracle Linux kernels are at: https://oss.oracle.com/ol7/debuginfo/
OL release 7.8 is the first to ship with eBPF support according to documentation: https://docs.oracle.com/en/operating-systems/oracle-linux/7/relnotes7.8/ol7-features-changes.html#ol7-techpreview
Those beginning kernels are:
A recent blog post indicates that newer releases provide BTFs. Assuming those are the latest available given the recentness of the blog post:
BTFs for kernels between those versions may be produced for use.
error: RPC failed; HTTP 408 curl 22 The requested URL returned error: 408
send-pack: unexpected disconnect while reading sideband packet
fatal: the remote end hung up unexpectedly
ERROR: btf gen: pahole --btf_encode_detached /home/runner/work/btfhub/btfhub/btfhub/archive/ol/7/x86_64/4.1.12-124.73.2.el7uek.x86_64.btf /home/runner/work/btfhub/btfhub/btfhub/archive/ol/7/x86_64/vmlinux-4.1.12-124.73.2.el7uek.x86_64: exec: "pahole": executable file not found in $PATH
Now that the repository has a new golang binary tool to update the new kernels, documentation should be updated. Other documentation tasks needed:
I'm recording this here for later investigation, but it seems this kernel has invalid DWARF data that pahole cannot generate BTF from:
[41] FWD (anon) Error emitting BTF type
Encountered error while encoding BTF.
Digging through the pahole/libbpf code, it seems a name is required for FWD types.
If you don't want me to record issues like this here, just let me know.
Opening this issue per @mauriciovasquezbernal request. It makes sense that btfgen knows how to handle multiple objects for the tailored BTF files generation (so one can tailor the BTFs based on multiple objects).
This will avoid new downloads, over and over, on re-runs, of the first kernel package that contains a BTF ELF section on it. Currently this is the way it works:
.btf.tar.xz file are skiped..failed file is skiped.Hello, I am from the Apache SkyWalking community. By reading this blog, I learned that BTFGen can make eBPF programs portable. This is a great idea, and we'd love to add it to our SkyWalking Rover project.
However, during the integration, we found that the btfhub-archive project did not add the LICENSE file, so we could not add it to the binary LICENSE statement file. So, could we help add the license file to this project?
You could get more information through this PR. Hope to get your reply, thanks!
I saw that you closed the issue in the archive repository, so I created a new issue here to track :) @rafaeldtinoco
The archive is inconsistent with naming and folder structure. Most follow the ID and VERSION or VERSION_ID (truncated to just the major version) fields of /etc/os-release. Oracle Linux 7 and amzn 1 (amazon 2018.03) currently do not follow that convention. Whether intentional or inadvertent, this is a solid convention to maintain.
NAME="Amazon Linux AMI"
VERSION="2018.03"
ID="amzn"
ID_LIKE="rhel fedora"
VERSION_ID="2018.03"
PRETTY_NAME="Amazon Linux AMI 2018.03"
ANSI_COLOR="0;33"
CPE_NAME="cpe:/o:amazon:linux:2018.03:ga"
HOME_URL="http://aws.amazon.com/amazon-linux-ami/"
NAME="Oracle Linux Server"
VERSION="7.9"
ID="ol"
ID_LIKE="fedora"
VARIANT="Server"
VARIANT_ID="server"
VERSION_ID="7.9"
PRETTY_NAME="Oracle Linux Server 7.9"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:oracle:linux:7:9:server"
HOME_URL="https://linux.oracle.com/"
BUG_REPORT_URL="https://bugzilla.oracle.com/"
ORACLE_BUGZILLA_PRODUCT="Oracle Linux 7"
ORACLE_BUGZILLA_PRODUCT_VERSION=7.9
ORACLE_SUPPORT_PRODUCT="Oracle Linux"
ORACLE_SUPPORT_PRODUCT_VERSION=7.9
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.