Skip to content

program: perform CO-RE against all kmod #1794

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 23, 2025
Merged

Conversation

lmb
Copy link
Collaborator

@lmb lmb commented Jun 4, 2025

This fixes a long standing issue with our CO-RE implementation. Please see the commit message for details.

@github-actions github-actions bot added the breaking-change Changes exported API label Jun 4, 2025
@lmb lmb force-pushed the core-relocate-all-kmod branch from 5f4ad1f to ff276d7 Compare June 4, 2025 08:43
@lmb
Copy link
Collaborator Author

lmb commented Jun 4, 2025

The breaking change is renaming Cache.KernelModules, which hasn't been released yet.

@lmb
Copy link
Collaborator Author

lmb commented Jun 4, 2025

@tpapagian could you give this PR a try against tetragon, with your work around to create a merged BTF removed?

@brycekahle same for you, could you see how this fares for datadog agent?

Thanks!

@tpapagian
Copy link
Member

@tpapagian could you give this PR a try against tetragon, with your work around to create a merged BTF removed?

Sure, will check that possibly tomorrow and I will let you know.

@brycekahle
Copy link
Contributor

I'm seeing a lot of CO-RE errors like invalid constant 0xffffffff. I'm going to check whether they are coming from this branch or main.

@brycekahle
Copy link
Contributor

OK. Those errors are happening on main too.

@lmb
Copy link
Collaborator Author

lmb commented Jun 5, 2025

@brycekahle mind filing a bug?

@tpapagian
Copy link
Member

Things seems to work as expected in Tetragon using this PR and by removed the merged BTF code. Thanks!

@brycekahle
Copy link
Contributor

mind filing a bug?

@lmb Will do. I was going to try and git bisect it first.

lmb added 2 commits June 19, 2025 16:48
Accessing raw[0] is only valid if the length is > 0.

Signed-off-by: Lorenz Bauer <lmb@isovalent.com>
CO-RE relocations are currently performed against vmlinux types only.
If a program attaches to a function in a kernel module we also
relocate against types in that module. This has the downside that
it's not possible to inspect a variable with a type defined in a
kernel module when tracing a function in vmlinux itself.

The historical reason for this is that our BTF parsing was quite
expensive. Now that we have lazy loading we can afford to relocate
against all types in the kernel.

Below is the change in performance against the last release:

    core: 1
    goos: linux
    goarch: amd64
    pkg: github.com/cilium/ebpf
    cpu: 13th Gen Intel(R) Core(TM) i7-1365U
                        │    base.txt    │              all.txt               │
                        │     sec/op     │   sec/op     vs base               │
    NewCollectionManyProgs   336.94m ± 205%   16.38m ± 2%  -95.14% (p=0.002 n=6)

                        │    base.txt     │               all.txt               │
                        │      B/op       │     B/op      vs base               │
    NewCollectionManyProgs   112.541Mi ± 45%   4.011Mi ± 0%  -96.44% (p=0.002 n=6)

                        │    base.txt    │              all.txt               │
                        │   allocs/op    │  allocs/op   vs base               │
    NewCollectionManyProgs   386.00k ± 202%   39.78k ± 0%  -89.70% (p=0.002 n=6)

Fixes: cilium#1511

Signed-off-by: Lorenz Bauer <lmb@isovalent.com>
@lmb lmb force-pushed the core-relocate-all-kmod branch from ff276d7 to 0f53bd8 Compare June 19, 2025 15:48
@lmb lmb marked this pull request as ready for review June 19, 2025 15:48
@lmb lmb requested review from dylandreimerink and a team as code owners June 19, 2025 15:48
@lmb lmb merged commit 9958a4f into cilium:main Jun 23, 2025
18 checks passed
@lmb lmb deleted the core-relocate-all-kmod branch June 23, 2025 14:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
breaking-change Changes exported API
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants