Re: Reading Pinned maps in eBPF Programs


Tristan Mayfield
 

I wanted to chime in and mention that I've seen the BTF error before when trying to declare maps the way shown in https://github.com/torvalds/linux/blob/master/tools/testing/selftests/bpf/progs/test_pinning.c.

I have tested kernel 4.15 and 5.4 (vanilla Ubuntu 18.04 and 20 respectively) and both have the same issue. Looking through libbpf it looks like the call would be coming from:

bpf_object__open() -> __bpf_object__open() -> bpf_object__elf_collect() -> bpf_object__init/finalize_btf()

I haven't run through a debugger yet to verify that's the issue, but I have verified on the opensnoop code Ian posted.
I'm not sure why the deprecated version of map declaration doesn't cause this BTF workflow while the newer one does, but I'll look through and debug today and if I can find it I'll send out a message. I'd be interested to know if that above code is doing something that triggers BTF reliance though.

Tristan

Join {iovisor-dev@lists.iovisor.org to automatically receive all group messages.