Problem attaching fentry due to missing BTF on older kernel

[bartebor]

Hi,
I'm trying to load two BPF programs into CentOS kernel 3.10.0-1160.80.1.el7.x86_64 with no runtime BTF support (no /sys/kernel/btf/vmlinux):

• kprobe tcp_set_state
• fentry udp_sendmsg

I am using btf.LoadSpec to load BTF from external type file into KernelTypes option. This works flawlessly for kprobe, but fails in fentry:

field WatchUdpSendmsg4: program watch_udp_sendmsg4: attach Tracing/TraceFEntry: load kernel spec: no BTF found for kernel version 3.10.0-1160.80.1.el7.x86_64: not supported

As far as I see, BTF file I read is utilized while resolving CO-RE relocations and apparently this is sufficient for kprobe. But for fentry I'm getting into LoadKernelSpec which is oblivious to KernelTypes option and tries to read nonexistent /sys/kernel/btf/vmlinux (and also tries few ELF file locations). Why is that? Couldn't we just reuse KernelTypes here?

I'm using cilium/ebpf v0.11.0.

[lmb]

Even if we searched KernelTypes we'd get an error from the kernel since fentry / fexit require the kernel to have BTF built in. Hence we don't attempt to use it in the first place.

Note that the library isn't tested against anything older than 4.9 and we also don't test against RH / CentOS frankenkernels.

[bartebor]

I can live with that; the days of these old systems are numbered. Thanks for your response!