btf: mmap vmlinux if possible

The kernel recently gained the ability to mmap vmlinux BTF, which
allows us to not allocate a couple megabytes of heap memory.

See torvalds/linux@a539e2a

Signed-off-by: Lorenz Bauer <lmb@isovalent.com>

Author: lmb

.github/workflows/ci.yml

@@ -7,7 +7,7 @@ on:
 
 env:
   TMPDIR: /tmp
-  CI_MAX_KERNEL_VERSION: '6.11'
+  CI_MAX_KERNEL_VERSION: '6.15'
   CI_MAX_EFW_VERSION: '0.21.0'
   CI_MIN_CLANG_VERSION: '13'
   go_version: '~1.24'

btf/kernel.go

@@ -5,13 +5,15 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"runtime"
 	"slices"
 	"sort"
 	"sync"
 
 	"github.com/cilium/ebpf/internal"
 	"github.com/cilium/ebpf/internal/linux"
 	"github.com/cilium/ebpf/internal/platform"
+	"github.com/cilium/ebpf/internal/unix"
 )
 
 // globalCache amortises decoding BTF across all users of the library.
@@ -110,7 +112,7 @@ func loadCachedKernelModuleSpec(module string) (*Spec, error) {
 	return spec, nil
 }
 
-func loadKernelSpec() (_ *Spec, _ error) {
+func loadKernelSpec() (*Spec, error) {
 	if platform.IsWindows {
 		return nil, internal.ErrNotSupportedOnOS
 	}
@@ -119,8 +121,31 @@ func loadKernelSpec() (_ *Spec, _ error) {
 	if err == nil {
 		defer fh.Close()
 
-		spec, err := LoadSplitSpecFromReader(fh, nil)
-		return spec, err
+		info, err := fh.Stat()
+		if err != nil {
+			return nil, fmt.Errorf("stat vmlinux: %w", err)
+		}
+
+		// NB: It's not safe to mmap arbitrary files because mmap(2) doesn't
+		// guarantee that changes made after mmap are not visible in the mapping.
+		//
+		// This is not a problem for vmlinux, since it is always a read-only file.
+		raw, err := unix.Mmap(int(fh.Fd()), 0, int(info.Size()), unix.PROT_READ, unix.MAP_PRIVATE)
+		if err != nil {
+			return LoadSplitSpecFromReader(fh, nil)
+		}
+
+		spec, err := loadRawSpec(raw, nil)
+		if err != nil {
+			_ = unix.Munmap(raw)
+			return nil, fmt.Errorf("load vmlinux: %w", err)
+		}
+
+		runtime.SetFinalizer(spec.decoder.sharedBuf, func(_ *sharedBuf) {
+			_ = unix.Munmap(raw)
+		})
+
+		return spec, nil
 	}
 
 	file, err := findVMLinux()

btf/kernel_test.go

@@ -2,6 +2,7 @@ package btf
 
 import (
 	"os"
+	"runtime"
 	"testing"
 
 	"github.com/cilium/ebpf/internal/testutils"
@@ -14,10 +15,19 @@ func TestLoadKernelSpec(t *testing.T) {
 		t.Skip("/sys/kernel/btf/vmlinux not present")
 	}
 
-	_, err := LoadKernelSpec()
+	spec, err := LoadKernelSpec()
 	if err != nil {
 		t.Fatal("Can't load kernel spec:", err)
 	}
+
+	if !testutils.IsVersionLessThan(t, "linux:6.15") {
+		maps, err := os.ReadFile("/proc/self/maps")
+		qt.Assert(t, qt.IsNil(err))
+		qt.Assert(t, qt.StringContains(string(maps), " /sys/kernel/btf/vmlinux\n"))
+	}
+
+	// Prevent finalizer from unmapping vmlinux.
+	runtime.KeepAlive(spec)
 }
 
 func TestLoadKernelModuleSpec(t *testing.T) {

btf/unmarshal.go

@@ -13,13 +13,22 @@ import (
 	"sync"
 )
 
+// sharedBuf is a buffer which may be shared between multiple decoders.
+//
+// It must not be modified. Some sharedBuf may be backed by an mmap-ed file, in
+// which case the sharedBuf has a finalizer. sharedBuf must therefore always be
+// passed as a pointer.
+type sharedBuf struct {
+	raw []byte
+}
+
 type decoder struct {
 	// Immutable fields, may be shared.
 
 	base      *decoder
 	byteOrder binary.ByteOrder
-	raw       []byte
-	strings   *stringTable
+	*sharedBuf
+	strings *stringTable
 	// The ID for offsets[0].
 	firstTypeID TypeID
 	// Map from TypeID to offset of the marshaled data in raw. Contains an entry
@@ -121,7 +130,7 @@ func newDecoder(raw []byte, bo binary.ByteOrder, strings *stringTable, base *dec
 	return &decoder{
 		base,
 		bo,
-		raw,
+		&sharedBuf{raw},
 		strings,
 		firstTypeID,
 		offsets,
@@ -177,7 +186,7 @@ func rebaseDecoder(d *decoder, base *decoder) (*decoder, error) {
 	return &decoder{
 		base,
 		d.byteOrder,
-		d.raw,
+		d.sharedBuf,
 		d.strings,
 		d.firstTypeID,
 		d.offsets,
@@ -220,7 +229,7 @@ func (d *decoder) copy(copiedTypes map[Type]Type) *decoder {
 	return &decoder{
 		d.base.copy(copiedTypes),
 		d.byteOrder,
-		d.raw,
+		d.sharedBuf,
 		d.strings,
 		d.firstTypeID,
 		d.offsets,