BTF support missing from kernel

[Alan Gillingham]

OS: Ubuntu Server LTS 24.04, 6.8.0-1004-raspi

The OS is missing support for BTF which is needed in order to use XDP.
BTF is compiled into the x86 Ubuntu kernel but not on the raspi which is missing the directory /sys/kernel/btf.

As a result, I am unable to use XDP AF_XDP sockets because my BPF program fails to load with errors:

BPF program load failed: invalid argument.
btf_vmlinux is malformed

Is BTF intentionally removed and can it be added?

[Alexis Couvreur (acouvreur)]

I have the same issue with kernel version 5.15.0-1055-raspi.

All flags seems to state that BTF is enabled, but when using it, it states that it's not supported.

Unable to load eBPF watcher for process events" component=discover.ProcessWatcher interval=5s error="loading and assigning BPF objects: field KprobeSysBind: program kprobe_sys_bind: apply CO-RE relocations: load kernel spec: no BTF found for kernel version 5.15.0-1055-raspi: not supported

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[gclawes (gclawes)]

This also prevents the use of the falcosecurity modern_ebpf driver on 6.8.0-1007-raspi:

root@pi01:~# uname -a
Linux pi01 6.8.0-1007-raspi #7-Ubuntu SMP PREEMPT_DYNAMIC Mon Jun 24 10:21:12 UTC 2024 aarch64 aarch64 aarch64 GNU/Linux
root@pi01:~# bpftool feature probe kernel | grep -q "program_type tracing is available" && echo "true" || echo "false"
false

docs: https://falco.org/docs/event-sources/kernel/#requirements