Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CO:RE Support: Add support for embedding and loading BTF for the running host #715

Open
kakkoyun opened this issue Aug 17, 2022 · 4 comments · May be fixed by #1131
Open

CO:RE Support: Add support for embedding and loading BTF for the running host #715

kakkoyun opened this issue Aug 17, 2022 · 4 comments · May be fixed by #1131
Assignees
Labels
area/eBPF Something involving eBPF enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed

Comments

@kakkoyun
Copy link
Member

kakkoyun commented Aug 17, 2022

Using https://github.com/aquasecurity/btfhub, we can download the specific BTF definitions for the major kernel versions and embed those BTF definitions into the binaries.

CONFIG_DEBUG_INFO_BTF=y is enabled in the Kernel config; it's easy to find BTF definitions for the kernel under /sys/kernel/btf/vmlinux. However, if it's not there, we need a way to provide them if we claim that we're truly CO:RE.

BTF definitions for the major Kernel versions can be downloaded from the hub, embedded, and loaded with the correct definitions when initializing the libbpf loader.

Tracee does this, and this article explains the process in detail https://opensource.com/article/22/9/ebpf-monitor-traffic-tracee

@kakkoyun kakkoyun added enhancement New feature or request area/eBPF Something involving eBPF labels Aug 17, 2022
@v-thakkar
Copy link
Contributor

I think we should start with the 5.2 kernel requirement and add in the documentation that it's possible to support older kernels. We should only add this feature if we find the users that require it.

@kakkoyun
Copy link
Member Author

I think we should start with the 5.2 kernel requirement and add in the documentation that it's possible to support older kernels. We should only add this feature if we find the users that require it.

I recently revisited what the supported features for the kernel version are. FWIW, BTF type format is supporter version 4.18, and above https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md I think we can have it since we claim to support 4.19 and above.

@v-thakkar
Copy link
Contributor

While basic support for BTF indeed existed since 4.18, the more important thing to have the information about is when support for the BTF APIs we'll have in use with the stack unwinding feature landed in the kernel. And depending upon that we can decide if it's worth adding support for the CO-RE via BTF Hub(for the older versions) or not.

For example, some stuff from older BTF things might already be outdated anyway.

@kakkoyun
Copy link
Member Author

Let's see how it goes. As of now, all the things we need for unwinding are in the perf_event context, so we might not need this.

@kakkoyun kakkoyun changed the title Add support for dynamically downloading and loading BTF for the running host Add support for embedding and loading BTF for the running host Sep 7, 2022
@kakkoyun kakkoyun changed the title Add support for embedding and loading BTF for the running host CO:RE Support: Add support for embedding and loading BTF for the running host Sep 7, 2022
@kakkoyun kakkoyun added good first issue Good for newcomers help wanted Extra attention is needed labels Sep 7, 2022
@kakkoyun kakkoyun added this to the v0.11.0 milestone Oct 10, 2022
@kakkoyun kakkoyun self-assigned this Dec 12, 2022
@kakkoyun kakkoyun linked a pull request Dec 14, 2022 that will close this issue
13 tasks
@kakkoyun kakkoyun removed this from the v0.12.0 milestone Mar 15, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/eBPF Something involving eBPF enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants