Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

repository: BTFHUB should contain BTF files for all kernel modules #70

Open
rafaeldtinoco opened this issue Mar 5, 2023 · 4 comments
Open

Comments

@rafaeldtinoco
Copy link
Contributor

Currently BTFHUB supports BTF files only for the main kernel image (vmlinux) but not for the included modules. This means that, if an eBPF program needs to kprobe a module function, for example, in a kernel without internal BTF information it would not be possible (as the program would have to load an external BTF file describing that module and those BTF files don't exist).

Things to observe:

  • We will need to extract BTF information from vmlinux and all the module objects and have a SINGLE BTF file containing all the BTF information. That will allow us to use "btfgen" (bpftool gen min_core_btf feature) to generate a minimum BTF file for 1 or multiple objects (even when the objects use type information from the kernel modules).
@rafaeldtinoco
Copy link
Contributor Author

rafaeldtinoco commented Mar 8, 2023

@brycekahle Please make sure to constantly rebase as I'm documenting the code and changing some variable names for better "first readers" understanding. Of course, if you are tackling this offline.

If you can't work on this, let me know, then we can try to either split work or I can try to address it myself.

Cheers!

@brycekahle
Copy link
Collaborator

I'm going to start working on this next week. First, I need to establish the proper generation procedure. I think pahole can handle multiple files, but I need to verify.

@brycekahle
Copy link
Collaborator

In talking with cilium/ebpf maintainers, it seems that split kernel module BTF files are the preferred approach. This mirrors what a kernel does that natively exposes BTF.

@brycekahle
Copy link
Collaborator

For those following along, working through this on our fork: DataDog#7

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants