Em Wed, Mar 03, 2021 at 11:05:44PM -0800, Andrii Nakryiko escreveu: > On Wed, Mar 3, 2021 at 10:15 AM Rafael David Tinoco > <rafaeldtinoco@xxxxxxxxxx> wrote: > > > > > > From: Vamsi Kodavanty <vamsi@xxxxxxxxxxxxxxxxxx> > > > > Date: Thu, 7 Jan 2021 17:31:11 -0800 > > > > To: Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx> > > > > Cc: bpf <bpf@xxxxxxxxxxxxxxx> > > > > > > > > > > > > Right. Libbpf only supports a newer and safer way to attach to > > > > kprobes. For your experiments, try to stick to tracepoints and you'll > > > > have a better time. > > > > > > > > But it's another thing I've been meaning to add to libbpf for > > > > supporting older kernels. I even have code written to do legacy kprobe > > > > attachment, just need to find time to send a patch to add it as a > > > > fallback for kernels that don't support new kprobe interface. > > > > Initially I'd like to thank you *a lot* for this thread, it helped me > > creating: > > > > https://github.com/rafaeldtinoco/portablebpf > > > > showing up exactly what was discussed here AND I could run the same > > binary in v4.15 and v.5.8 kernels as long as BTF was generated with: > > > > https://github.com/rafaeldtinoco/portablebpf/blob/master/patches/link-vmlinux.sh.patch > > I was wondering if it might be useful to have a script that would use > pahole to do DWARF to BTF conversion for existing vmlinux image (e.g., > from /boot/vmlinux-$(uname -r)), assuming DWARF is in that vmlinux (or > could be found somewhere nearby), and then would spit out only .BTF > contents as a binary file, which can be passed to libbpf on > bpf_object__open(). That seems useful and there have been at least a > few cases where people tried to use CO-RE on old kernels > pre-CONFIG_DEBUG_INFO_BTF, but were always confused by how to get that > BTF data. > > [cc Arnaldo] > It would also simplify things a bunch if pahole had an option to emit > .BTF into a separate non-ELF file, instead of modifying vmlinux > in-place. WDYT? Sure, that is a nice addition, makes it more flexible to cover this usecase. - Arnaldo > > > > Specially the attach_kprobe_legacy() function: > > > > https://github.com/rafaeldtinoco/portablebpf/blob/master/mine.c#L31 > > > > I wanted to reply here in case others also face this. > > Great, glad it worked out. It would be great if you could contribute > legacy kprobe support for libbpf as a proper patch, since it probably > would be useful for a bunch of other people stuck with old kernels. > > > > > Only bad thing was kernel v4.15 missed global data support as showed in: > > > > https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md > > > > But using perf event was good enough for an example. > > > > - rafaeldtinoco
