Search code examples
linux-kernelkernelebpf

Can I use eBPF to trace functions defined in my own kernel modules？

I am trying to use eBPF to trace functions defined in my own kernel modules, but get error.

libbpf: prog 'my_test_print': failed to find kernel BTF type ID of 'my_test_print': -3
libbpf: prog 'my_test_print': failed to prepare load attributes: -3
libbpf: prog 'my_test_print': failed to load: -3
libbpf: failed to load object 'ringbuffer_bpf'
libbpf: failed to load BPF skeleton 'ringbuffer_bpf': -3

I defined the function called my_test_print and use

EXPORT_SYMBOL(my_test_print);

to expose the symbol. I also checked my kernel config:

CONFIG_DEBUG_INFO_BTF=y
CONFIG_PAHOLE_HAS_SPLIT_BTF=y
CONFIG_DEBUG_INFO_BTF_MODULES=y

So is it possible to use eBPF to trace functions defined in my own kernel modules? How can I make it?

I find this has similar question, but no answer.

Solution

  • libbpf: prog 'my_test_print': failed to find kernel BTF type ID of 'my_test_print': -3

    This error is thrown here. It happens when this function returns an error.

    Looking at the logic in find_kernel_btf_id it expects that any symbol in a module be in the form of <module-name>:<symbol> and any symbols without the module name as prefix are expected to be present in vmlinux.

    So you should be able to specify SEC("fentry/my_module:my_test_print") or whatever your equivalent is.

    EDIT:

    After re-reading, it turns out the <module>: prefix is optional. If specified, other modules are ignored in case the same symbol name is used in multiple modules. But as OP noted, this turned out not to be the root cause of the stated issue.