kmod co-re

go.mod

@@ -3,7 +3,7 @@ module github.com/DataDog/ebpf-manager
 go 1.21.0
 
 require (
-	github.com/cilium/ebpf v0.13.0
+	github.com/cilium/ebpf v0.13.3-0.20240223092312-4ad27ae4a655
 	github.com/vishvananda/netlink v1.2.1-beta.2.0.20230807190133-6afddb37c1f0
 	github.com/vishvananda/netns v0.0.4
 	golang.org/x/sys v0.17.0

go.sum

@@ -1,5 +1,5 @@
-github.com/cilium/ebpf v0.13.0 h1:K+41peBnbROzY6nHc9Kq79B4lnJpiF/BMpBuoTGAWSY=
-github.com/cilium/ebpf v0.13.0/go.mod h1:DHp1WyrLeiBh19Cf/tfiSMhqheEiK8fXFZ4No0P1Hso=
+github.com/cilium/ebpf v0.13.3-0.20240223092312-4ad27ae4a655 h1:SPEhKYlMdugnegbD7OHVG8G3Btuvo80BbiJqqxPLiLM=
+github.com/cilium/ebpf v0.13.3-0.20240223092312-4ad27ae4a655/go.mod h1:DHp1WyrLeiBh19Cf/tfiSMhqheEiK8fXFZ4No0P1Hso=
 github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
 github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=

manager.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/cilium/ebpf"
+	"github.com/cilium/ebpf/btf"
 	"golang.org/x/sys/unix"
 )
 
@@ -109,7 +110,7 @@ type Options struct {
 	// `RLIMIT_MEMLOCK` If a limit is provided here it will be applied when the manager is initialized.
 	RLimit *unix.Rlimit
 
-	// KeepKernelBTF - Defines if the kernel types defined in VerifierOptions.Programs.KernelTypes should be cleaned up
+	// KeepKernelBTF - Defines if the kernel types defined in VerifierOptions.Programs.KernelTypes and KernelModuleTypes should be cleaned up
 	// once the manager is done using them. By default, the manager will clean them up to save up space. DISCLAIMER: if
 	// your program uses "manager.CloneProgram", you might want to enable "KeepKernelBTF". As a workaround, you can also
 	// try to strip as much as possible the content of "KernelTypes" to reduce the memory overhead.
@@ -122,6 +123,9 @@ type Options struct {
 	// SkipRingbufferReaderStartup - Ringbuffer maps whose name is set to true with this option will not have their reader goroutine started when calling the manager.Start() function.
 	// RingBuffer.Start() can then be used to start reading events from the corresponding RingBuffer.
 	SkipRingbufferReaderStartup map[string]bool
+
+	// KernelModuleBTFLoadFunc is a function to provide custom loading of BTF for kernel modules on-demand as programs are loaded
+	KernelModuleBTFLoadFunc func(kmodName string) (*btf.Spec, error)
 }
 
 // InstructionPatcherFunc - A function that patches the instructions of a program
@@ -568,6 +572,35 @@ func (m *Manager) InitWithOptions(elf io.ReaderAt, options Options) error {
 		}
 	}
 
+	if options.KernelModuleBTFLoadFunc != nil {
+		for _, p := range m.collectionSpec.Programs {
+			mod, err := p.KernelModule()
+			if err != nil {
+				resetManager(m)
+				return fmt.Errorf("kernel module search for %s: %w", p.AttachTo, err)
+			}
+			if mod == "" {
+				continue
+			}
+
+			if options.VerifierOptions.Programs.KernelModuleTypes == nil {
+				options.VerifierOptions.Programs.KernelModuleTypes = make(map[string]*btf.Spec)
+			}
+
+			// try default BTF first
+			modBTF, err := btf.LoadKernelModuleSpec(mod)
+			if err != nil {
+				// try callback function next
+				modBTF, err = options.KernelModuleBTFLoadFunc(mod)
+				if err != nil {
+					resetManager(m)
+					return fmt.Errorf("kernel module BTF load for %s: %w", mod, err)
+				}
+			}
+			options.VerifierOptions.Programs.KernelModuleTypes[mod] = modBTF
+		}
+	}
+
 	// Load pinned maps and pinned programs to avoid loading them twice
 	if err = m.loadPinnedObjects(); err != nil {
 		resetManager(m)
@@ -600,6 +633,7 @@ func (m *Manager) Start() error {
 	if !m.options.KeepKernelBTF {
 		// release kernel BTF. It should no longer be needed
 		m.options.VerifierOptions.Programs.KernelTypes = nil
+		m.options.VerifierOptions.Programs.KernelModuleTypes = nil
 	}
 
 	// clean up tracefs