On 1/23/23 16:21, Jason Ling wrote:
Some context:
The devices I am interested in have a small kernel partition (~16MB).
Building the kernel with CONFIG_DEBUG_INFO_BTF=y increases the kernel
size by about ~1.7M.
So I've tried to use an external BTF (generating my own vmlinux BTF
and placing it on a more spacious partition) but it seems like my
eBPFs that attach to fexit hooks now fail loading. According to some
comments in libbpf this seems to be expected.
e.g an eBPF program that looks like this
SEC("fexit/ksys_unshare")
int BPF_PROG(handle_exit, unsigned long unshare_flags, int rv) {
}
fails the loading process.
My guess is that there is additional debug/BTF information beyond what
is available in vmlinux BTF that gets linked into vmlinuz and without
this information the attaching to certain hooks fail.
IIRC, the verifier running in the kernel also needs BTF to verify the code.
That means you need a way to load BTF to kernel manually as well.
So my question is:
is there a way to achieve my goal of using a kernel that has been
built with CONFIG_DEBUG_INFO_BTF=n and still be able to use
fentry/fexit type hooks?
