4

I got this error message on ubuntu 19.04 when I try to execute sudo ./mineonlyret which is the user space program which loads an ebpf program and it is described after. I tried the same configuration on ubuntu 18.04 and it worked without errors. Which can be the cause of this error? If you need more details let me know.

libbpf: Error loading ELF section .BTF: 0.

mineonlyret_user.c

// SPDX-License-Identifier: GPL-2.0
#include <stdio.h>
#include <assert.h>
#include <linux/bpf.h>
#include "libbpf.h"
#include <unistd.h>
#include <arpa/inet.h>
#include <linux/if_ether.h>

int main(int ac, char **argv)
{
    int sock, prog_fd;
    struct bpf_object *obj;
    char filename[256];

    if (bpf_prog_load("mineonlyret_kern.o", BPF_PROG_TYPE_SOCKET_FILTER,
              &obj, &prog_fd))
        return 1;

    /* open up a packet socket */
    sock = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));  
    if(sock < 0){
        printf("socket");
        return -1;
    }

    /* attach the filter */
    assert(setsockopt(sock, SOL_SOCKET, SO_ATTACH_BPF, &prog_fd,
              sizeof(prog_fd)) == 0);

    int i;
        char buf[65535];
    for (i = 0; i < 5; i++) {
        printf("ci\n");
            int res = recvfrom(sock, buf, sizeof(buf), 0, NULL, 0);
            printf("res=%d\n", res);

        sleep(5);
    }

    return 0;
}

mineonlyret_kern.c

#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/if_packet.h>
#include <linux/ip.h>
#include <linux/udp.h>
#include <linux/in.h>
#include "bpf_helpers.h"
#include <stddef.h>
SEC("socket")
int bpf_sk_prog(struct __sk_buff *skb)
{

        return 0;

}
char _license[] SEC("license") = "GPL";

I compile the _kern.c with

clang -S -I. -O2 -emit-llvm -c mineonlyret_kern.c -o - | llc -march=bpf -filetype=obj -o mineonlyret_kern.o

and the _user.c with

gcc  -o mineonlyret mineonlyret_user.c -I../libbpf/src/  ../libbpf/src/libbpf.a -lelf

Also here I have another doubt: why If I use the shared version of the library it doesn't work? I mean If I execute

gcc  -o mineonlyret mineonlyret_user.c -I../libbpf/src/  -L../libbpf/src/ -lbpf

Directory tree

.
├── libbpf
│   ├── include
│   ├── src
│   │   ├── libbpf.so
│   │   └── libbpf.a
└── libbpfebpf
    |── mineonlyret_user.c
    |── mineonlyret_kern.c
Maicake
  • 1,046
  • 10
  • 34
  • 2
    It could come from the difference of versions for clang between your two machines, maybe? What versions to you use? Regarding the shared library, what error do you get? Also what version of libbpf do you use? – Qeole Nov 18 '19 at 14:23
  • UBUNTU: 18.04 clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final) libbpf I think 0.0.3 (I git cloned the repository before october) UBUNTU: 19.04 clang version 8.0.0-3 (tags/RELEASE_800/final) libbpf I think 0.0.5 (I git cloned the repository yesterday) When I execute gcc -o mineonlyret mineonlyret_user.c -I../libbpf/src -L ../libbpf/src/ -lbpf seems to compile fine. But when I execute the program ./mineonlyret I got the error: error while loading shared libraries: libbpf.so.0: cannot open shared object file: No such file or directory (the error is not shown if I compile with .a – Maicake Nov 18 '19 at 15:01
  • Errata corrige: in UBUNTU 18.04 I have libbpf 0.0.4 because it contains btf__parse_elf definition – Maicake Nov 18 '19 at 15:22
  • 1
    For the shared lib stuff: it looks like your system cannot find the shared library. Have you compiled libbpf.so and installed it on your system? If so, is it at the location expected by your binary (`ldd mineonlyret`)? Is it in your ldconfig cache (`ldconfig -p`)? – Qeole Nov 18 '19 at 16:28
  • 1
    Not sure for your libbpf ELF/BTF error. It's probably a matter of compatibility between clang and libbpf versions, because it hits when the lib parses your object file, before the data is actually sent to the kernel (so independent from kernel or Ubuntu version). But other than this I'm not sure. Try older libbpf, or more recent clang, would be my advice. – Qeole Nov 18 '19 at 16:30
  • On ubuntu 19.04 I tried all the combinations, like clang 8.0.0 and libbpf 0.3, 0.4 , 0.5 -> always the same error. Then I tried to use clang 6.0.0 (as I did on ubuntu 18.04) with libbpf 0.3, 0.4, 05. I got always the same error. In the case of clang 6.0.0 and libbpf 0.3 the message is slightly different "libbpf: Error loading ELF section .BTF: -22. Ignored and continue." I don't understand if I can ignore this error since from the definition of BTF "BTF (BPF Type Format) is the metadata format which encodes the debug info related to BPF program/map. " – Maicake Nov 19 '19 at 13:54
  • 1
    You can most probably ignore the error if libbpf can continue, BTF is for debug. See [example](https://twitter.com/qeole/status/1113410147622117376). Use `-g` flag with clang (v8+) when compiling if you want BTF. Also have you tried removing `-S` flag, does it change something? I was thinking trying a newer version of clang (see [LLVM APT repo](http://apt.llvm.org/#install_dev)) rather than an older one, if you have the possibility. – Qeole Nov 20 '19 at 12:05

1 Answers1

5

You need to specify -g to request Clang to generate .BTF (it also will generate DWARF debug info, but you can ignore or strip it out, it's not used by libbpf). While .BTF initially used to be an optional extra information for better debugging and BPF assembly dumps, it grew into a pretty much required part of modern BPF application (at least those that use libbpf), so make sure you always have '-g' specified.

Andrii Nakryiko
  • 136
  • 1
  • 3