On Wed, Mar 3, 2021 at 10:15 AM Rafael David Tinoco <rafaeldtinoco@xxxxxxxxxx> wrote: > > > > From: Vamsi Kodavanty <vamsi@xxxxxxxxxxxxxxxxxx> > > > Date: Thu, 7 Jan 2021 17:31:11 -0800 > > > To: Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx> > > > Cc: bpf <bpf@xxxxxxxxxxxxxxx> > > > > > > > > > Right. Libbpf only supports a newer and safer way to attach to > > > kprobes. For your experiments, try to stick to tracepoints and you'll > > > have a better time. > > > > > > But it's another thing I've been meaning to add to libbpf for > > > supporting older kernels. I even have code written to do legacy kprobe > > > attachment, just need to find time to send a patch to add it as a > > > fallback for kernels that don't support new kprobe interface. > > Initially I'd like to thank you *a lot* for this thread, it helped me > creating: > > https://github.com/rafaeldtinoco/portablebpf > > showing up exactly what was discussed here AND I could run the same > binary in v4.15 and v.5.8 kernels as long as BTF was generated with: > > https://github.com/rafaeldtinoco/portablebpf/blob/master/patches/link-vmlinux.sh.patch I was wondering if it might be useful to have a script that would use pahole to do DWARF to BTF conversion for existing vmlinux image (e.g., from /boot/vmlinux-$(uname -r)), assuming DWARF is in that vmlinux (or could be found somewhere nearby), and then would spit out only .BTF contents as a binary file, which can be passed to libbpf on bpf_object__open(). That seems useful and there have been at least a few cases where people tried to use CO-RE on old kernels pre-CONFIG_DEBUG_INFO_BTF, but were always confused by how to get that BTF data. [cc Arnaldo] It would also simplify things a bunch if pahole had an option to emit .BTF into a separate non-ELF file, instead of modifying vmlinux in-place. WDYT? > > Specially the attach_kprobe_legacy() function: > > https://github.com/rafaeldtinoco/portablebpf/blob/master/mine.c#L31 > > I wanted to reply here in case others also face this. Great, glad it worked out. It would be great if you could contribute legacy kprobe support for libbpf as a proper patch, since it probably would be useful for a bunch of other people stuck with old kernels. > > Only bad thing was kernel v4.15 missed global data support as showed in: > > https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md > > But using perf event was good enough for an example. > > - rafaeldtinoco
