Thursday 4 November 2021

Re: eBPF support in HWE kernels + userland changes needed

On Wed, Nov 3, 2021 at 12:23 PM Rafael David Tinoco
<rafaeldtinoco@gmail.com> wrote:
>
> Hello list,
>
> I have been trying to address this issue for sometime now, without success. Hopefully this can gain some traction with this e-mail. I know many of you address most of your efforts into the current development version, but I'd like to call attention for something I judge is important for the LTS versions in the cloud world (regarding eBPF only).
>
> eBPF CO-RE technology [1][2] is becoming the base for cloud native introspection / networking / performance tools, and many projects are starting to use it. Examples I can remember off the top of my head are:
>
> - cilium
> - inspektor gadget
> - sysdig
> - datadog agent
> - tracee (the one I currently work with)
> - sysmon tool for linux (does not need BTF but might in near future)
>
> But, because of LP #1926330, HWE kernels aren't enabling CONFIG_DEBUG_INFO_BTF.
>
> After libbpf started supporting external BTF files (converted from DWARF), I have created the following project:
>
> - https://github.com/aquasecurity/btfhub/
>
> containing BTF files for all existing Ubuntu HWE kernels (and from other distros) I could get. But now, -generic 5.11 HWE kernels don't have their debug packages published (another bug I was told kernel team was already aware).
>
> It's becoming very hard to help Ubuntu LTS to be eBPF CO-RE capable. All other distros already are (as you can see at the btfhub README.md page).
>
> -- Problems:
>
> - #1 = Ubuntu HWE kernels aren't being compiled with BTF support, something that is critical for eBPF CO-RE, turning an eBPF object portable among different kernel versions.
>
> https://github.com/aquasecurity/btfhub/issues/9
> https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1926330
> https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1949286

Hi Rafael,
glad to "see" you.
It seems pahole is only a build time dependency to enable the kernel
to be able to build this dwarf info.
If it is indeed build-time only then it does not need to pass the MIR process.
As long as the kernel team is happy with using it at build time to
generate this extra data you should be fine.

> My proposal to this problem is the "MIR" bug I created with a package called "pahole-btf". It is a backport of Impish's dwarves "pahole" binary (only) to Bionic and Focal. If this package is added to [main], then it will allow HWE kernels to use a recent "pahole-btf" binary in vmlinux-link script and generate correct BTF debug information for those kernels, allowing eBPF CO-RE technology to work.
>
> Would that be acceptable ? If not, what is the alternative ?
>
> - #2 = Ubuntu HWE kernels should always have dbg packages published in ddebs. What happened to 5.11 kernels ? Why can't we have access to the debug packages ?
>
> Could I get some help/feedback in addressing those issues ? Thank you!
>
> ----
> [1] https://nakryiko.com/posts/bpf-portability-and-co-re/
> [2] https://github.com/aquasecurity/btfhub/tree/main/tools
>
> rafaeldtinoco
> --
> ubuntu-devel mailing list
> ubuntu-devel@lists.ubuntu.com
> Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel

--
Christian Ehrhardt
Staff Engineer, Ubuntu Server
Canonical Ltd

--
ubuntu-devel mailing list
ubuntu-devel@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel