A set of toolchain to simplify the building and running eBPF program on kernels without native BTF support. It utilizes btfhub to drop the dependency of native BTF.
What's in it
This repo mainly contains three parts:
- A shell script
script/btfgen, which can be used to clone the
btfhubrepo, or create stripped btf based on the compiled eBPF program and pack the btf archives into
- A Rust crate
bpf-compatible-rs, which were used by eunomia-bpf to implement the unpacking and loading of the package that
- A Rust crate
bpf-compatible-sysand its C binding
btf_helpers.h, which could be linked to other programs. It implements the unpacking and loading of the tar archive that
btfgengenerates. It can load tar archive either embedded into the executable, or provided by an external source. Used together with the
btf_helpers.h, it can conveniently modify
struct bpf_object_open_opts*and set the
Usage - Manually use the toolchain
prepare steps could only be run once.
You will need a git repo like btfhub-archive, which contains prebuilt btf archive of various releases, archs, and kernels. We also provided a repo for demonstrating only (It contains a little number of kernel btf archives) https://github.com/eunomia-bpf/btfhub-archive.
The repo should have the structure like:
- Note: words in
<>are explanation of the folder name.
Prepare - build
make in the
bpf-compatible-sys folder. It will build
libbpf_compatible.a for you, which is a static library used to linked to libbpf programs
Prepare - Use
btfgen to fetch
./script/btfgen fetch to download the
https://github.com/aquasecurity/btfhub-archive repo to
~/.cache/eunomia/btfhub. You can use
BTFHUB_REPO_URL to override the repo url, or use
BTFHUB_CACHE_DIR to override the local directory.
Write your kernel program
Since generating the btf tar requires the compiled kernel program, so you should provide that first.
Create a btf tar archive with
./script/btfgen btfgen xxx.o -o min_core_btfs.tar.gz to pack the tailored btf archive into
xxx.o is the name of the compiled kernel program.
Create a linkable object of the btf archive
ld -r -b binary min_core_btfs.tar.gz -o min_core_btfs_tar.o to generate a linkable
min_core_btfs_tar.o. This file declares symbols named
_binary_min_core_btfs_tar_gz_end, indicating the range of the embed tar.gz file
Write the userspace program with
int ensure_core_btf(struct bpf_object_open_opts*) before opening the skeleton.
void clean_core_btf(struct bpf_object_open_opts*) before exiting. For example:
Link your userspace program,
It can be directly done by calling
clang <your_program> libbpf_compatible.a min_core_btf.tar.o
Usage - more simply
We have adapted the
libbpf-bootstrap to the
bpf-compatible toolchain. So there is a more simpler way:
- Put your
xxx.c (userspace space program) and
xxx.bpf.c(kernel program) in the
example/c folder, or directly modify an exist one
- Add the name (
xxx in the last row) to line 27 of
APPS = bootstrap execsnoop xxx
make xxx in