"Daniel Xu" <dxu@...> writes:

On Sun, Feb 28, 2021, at 12:07 PM, bg.salunke09@... wrote:

Hi,

I'm looking into BTF and it's use case. Based on the document I
understood to run BPF programs across different kernel versions, it
needs to build with libbpf which depends on the BTF information.
Now to enable/to have BTF information on any Kernel, the kernel needs
to be re-build with "" flag.

I can see the BTF support in Linus introduced from *kernel version
5.1.0
(*https://www.kernel.org/doc/html/v5.1/bpf/btf.html?highlight=btf)
however I can still see the BTF information(/sys/kernel/btf/vmlinux) on
my 4.18.0-193.28.1.el8_2.x86_64 kernel.

What distro are you using? Your distro probably backported BTF
support.

Yeah, that's a RHEL version number (RHEL8.2 in this case, as seen by the
"el8_2" bit). Which means that as far as features are concerned, the
4.18 version number is basically a complete fiction at this point. For
BPF we basically backport everything, IIRC we made it up to upstream
kernel 5.4 for RHEL8.2...

-Toke

On Sun, Feb 28, 2021, at 12:07 PM, bg.salunke09@... wrote:

Hi,

I'm looking into BTF and it's use case. Based on the document I
understood to run BPF programs across different kernel versions, it
needs to build with libbpf which depends on the BTF information.
Now to enable/to have BTF information on any Kernel, the kernel needs
to be re-build with "" flag.

I can see the BTF support in Linus introduced from *kernel version
5.1.0
(*https://www.kernel.org/doc/html/v5.1/bpf/btf.html?highlight=btf)
however I can still see the BTF information(/sys/kernel/btf/vmlinux) on
my 4.18.0-193.28.1.el8_2.x86_64 kernel.

What distro are you using? Your distro probably backported BTF support.

Daniel

On Tue, Mar 2, 2021 at 08:22 PM, Andrii Nakryiko wrote:

On Tue, Mar 2, 2021 at 4:42 PM <bg.salunke09@...> wrote:

Thanks Andrii, for detailed answer.
Yes you are right, I'm looking for CO-RE. Basically I'm trying to build the eBPF program which can run on any linux kernel version using libbpf

What I understood from your blog https://facebookmicrosites.github.io/bpf/blog/2020/02/19/bpf-portability-and-co-re.html (Thanks for in depth blog post, appreciate it), to work libbpf based program
the BTF information should be available on the running host. Is my understanding correct?

Yes, correct.

Thank you for confirming! 

Btw, Is there any document to generate BTF information for a linux kernel? Or Is there a way to generate BTF info for running kernel i.e. at runtime and not at compile time? Thanks!

Yes, you can, if you have vmlinux image with DWARF information in it.
You can use pahole tool like this to add .BTF section to vmlinux
image:

pahole -J <path-to-vmlinux-image>

You most probably would want to make a local copy of vmlinux image, of
course. After that you can pass the path to that vmlinux with embedded
.BTF to libbpf to use for CO-RE relocations. See [0] for recent
discussion of the exact same topic. See also patch [1] that was aiming
to make this scenario better in libbpf (unfortunately it hasn't landed
yet, but it is pretty close to being done, so shouldn't be a problem
for you to pick up, if necessary).

This is certainly not the most straightforward and easiest path, but
if you want to get CO-RE working with older kernel for which you don't
have much control, it is definitely a possible way (as long as you
have DWARF, which is used to produce BTF for vmlinux).

[0] https://lore.kernel.org/bpf/CAEf4BzbJZLjNoiK8_VfeVg_Vrg=9iYFv+po-38SMe=UzwDKJ=Q@.../
[1] https://lore.kernel.org/bpf/B8801F77-37E8-4EF8-8994-D366D48169A3@.../

Go it. I'm following the discussion thread and patch. Thank you so much for your time. 

On Tue, Mar 2, 2021 at 4:42 PM <bg.salunke09@...> wrote:

Thanks Andrii, for detailed answer.
Yes you are right, I'm looking for CO-RE. Basically I'm trying to build the eBPF program which can run on any linux kernel version using libbpf

What I understood from your blog https://facebookmicrosites.github.io/bpf/blog/2020/02/19/bpf-portability-and-co-re.html (Thanks for in depth blog post, appreciate it), to work libbpf based program
the BTF information should be available on the running host. Is my understanding correct?

Yes, correct.

Btw, Is there any document to generate BTF information for a linux kernel? Or Is there a way to generate BTF info for running kernel i.e. at runtime and not at compile time? Thanks!

Yes, you can, if you have vmlinux image with DWARF information in it.
You can use pahole tool like this to add .BTF section to vmlinux
image:

pahole -J <path-to-vmlinux-image>

You most probably would want to make a local copy of vmlinux image, of
course. After that you can pass the path to that vmlinux with embedded
.BTF to libbpf to use for CO-RE relocations. See [0] for recent
discussion of the exact same topic. See also patch [1] that was aiming
to make this scenario better in libbpf (unfortunately it hasn't landed
yet, but it is pretty close to being done, so shouldn't be a problem
for you to pick up, if necessary).

This is certainly not the most straightforward and easiest path, but
if you want to get CO-RE working with older kernel for which you don't
have much control, it is definitely a possible way (as long as you
have DWARF, which is used to produce BTF for vmlinux).

[0] https://lore.kernel.org/bpf/CAEf4BzbJZLjNoiK8_VfeVg_Vrg=9iYFv+po-38SMe=UzwDKJ=Q@mail.gmail.com/
[1] https://lore.kernel.org/bpf/B8801F77-37E8-4EF8-8994-D366D48169A3@araalinetworks.com/

Thanks Andrii, for detailed answer.  
Yes you are right, I'm looking for CO-RE. Basically I'm trying to build the eBPF program which can run on any linux kernel version using libbpf

What I understood from your blog https://facebookmicrosites.github.io/bpf/blog/2020/02/19/bpf-portability-and-co-re.html (Thanks for in depth blog post, appreciate it), to work libbpf based program 
the BTF information should be available on the running host. Is my understanding correct?

Btw, Is there any document to generate BTF information for a linux kernel?  Or Is there a way to generate BTF info for running kernel i.e. at runtime and not at compile time? Thanks! 

"Andrii Nakryiko" <andrii.nakryiko@...> writes:

On Sun, Feb 28, 2021 at 12:37 PM <bg.salunke09@...> wrote:

[Edited Message Follows]

Hi,

I'm looking into BTF and it's use case. Based on the document I understood to run BPF programs across different kernel versions, it needs to build with libbpf which depends on the BTF information.
Now to enable/to have BTF information on any Kernel, the kernel needs to be re-build with "" flag.

I can see the BTF support in Linux introduced from kernel version 5.1.0 (https://www.kernel.org/doc/html/v5.1/bpf/btf.html?highlight=btf)
however I can still see the BTF information(/sys/kernel/btf/vmlinux) on my 4.18.0-193.28.1.el8_2.x86_64 kernel.

I'm little confused here how old kernel can generate BTF info if the was support added recently.

Can I get information about oldest linux kernel version that can support BTF?

/sys/kernel/btf/vmlinux appeared in 5.4 kernel (upstream version). If
you see it on 4.18, that means someone backported the changes.

Yeah, that looks like a RHEL/CentOS kernel version number, which means
the 4.18 bit is mostly fiction at this point (at least as far as BPF is
concerned). IIRC we backported up to upstream kernel 5.4 for RHEL 8.2,
which seems to be what you're running (from the el8_2 bit of the
version), and I guess that fits with the availability of
/sys/kernel/btf/vmlinux

-Toke

On Sun, Feb 28, 2021 at 12:37 PM <bg.salunke09@...> wrote:

[Edited Message Follows]

Hi,

I'm looking into BTF and it's use case. Based on the document I understood to run BPF programs across different kernel versions, it needs to build with libbpf which depends on the BTF information.
Now to enable/to have BTF information on any Kernel, the kernel needs to be re-build with "" flag.

I can see the BTF support in Linux introduced from kernel version 5.1.0 (https://www.kernel.org/doc/html/v5.1/bpf/btf.html?highlight=btf)
however I can still see the BTF information(/sys/kernel/btf/vmlinux) on my 4.18.0-193.28.1.el8_2.x86_64 kernel.

I'm little confused here how old kernel can generate BTF info if the was support added recently.

Can I get information about oldest linux kernel version that can support BTF?

/sys/kernel/btf/vmlinux appeared in 5.4 kernel (upstream version). If
you see it on 4.18, that means someone backported the changes. But for
BPF CO-RE (which I assume is what you are referring to) to work,
kernel itself doesn't need to "support BTF", it just needs to have
.BTF data built-in inside its vmlinux binary image, and that image
needs to be in one of the supported locations (see [0]). Starting from
5.2 kernel CONFIG_DEBUG_INTO_BTF=y is supported with adds .BTF section
as part of the kernel build process.

But one could technically add .BTF by using pahole tool (part of
dwarves package) even before that, as long as vmlinux image contains
DWARF information.

So in short, the easiest way is to get the latest kernel you can. But
with enough persistence and effort you can get kernel BTF embedded for
pretty much any kernel version.


[0] https://github.com/libbpf/libbpf/blob/master/src/btf.c#L4589-L4598

bg.salunke09@... asked:

Can I get information about oldest linux kernel version that can support BTF?

The basic support appears to have been added by

commit e83b9f55448afce3fe1abcd1d10db9584f8042a6
Author: Andrii Nakryiko <andriin@...>
Date: Tue Apr 2 09:49:50 2019 -0700
kbuild: add ability to generate BTF type info for vmlinux

The inquiry "git branch --contains e83b9f55448a" will tell you which
of your branches contains this commit.

Hope this helps,
Alison Chaiken
Aurora Innovation