Merge pull request #323 from bobrik/ivan/external-btf

Enabled support for external BTF

README.md

@@ -167,6 +167,15 @@ The following additional capabilities might be needed:
   which is the preferred way, but only available since Linux v6.6.
   See: https://github.com/torvalds/linux/commit/0ce7c12e88cf
 
+## External BTF Support
+
+Execution of eBPF programs requires kernel data types normally available
+in `/sys/kernel/btf/vmlinux`, which is created during kernel build process.
+However, on some older kernel configurations, this file might not be available.
+If that's the case, an external BTF file can be supplied with `--btf.path`.
+An archive of BTFs for all some older distros and kernel versions can be
+found [here](https://github.com/aquasecurity/btfhub-archive).
+
 ## Supported scenarios
 
 Currently the only supported way of getting data out of the kernel is via maps.

cmd/ebpf_exporter/main.go

@@ -28,6 +28,7 @@ func main() {
 	listenAddress := kingpin.Flag("web.listen-address", "The address to listen on for HTTP requests (fd://0 for systemd activation).").Default(":9435").String()
 	metricsPath := kingpin.Flag("web.telemetry-path", "Path under which to expose metrics.").Default("/metrics").String()
 	capabilities := kingpin.Flag("capabilities.keep", "Comma separated list of capabilities to keep (cap_syslog, cap_bpf, etc.), 'all' or 'none'").Default("all").String()
+	btfPath := kingpin.Flag("btf.path", "Optional BTF file path.").Default("").String()
 	kingpin.Version(version.Print("ebpf_exporter"))
 	kingpin.HelpFlag.Short('h')
 	kingpin.Parse()
@@ -56,7 +57,7 @@ func main() {
 		log.Fatalf("Error parsing configs: %v", err)
 	}
 
-	e, err := exporter.New(configs)
+	e, err := exporter.New(configs, *btfPath)
 	if err != nil {
 		log.Fatalf("Error creating exporter: %s", err)
 	}

exporter/exporter.go

@@ -3,6 +3,7 @@ package exporter
 import (
 	"bufio"
 	"bytes"
+	"errors"
 	"fmt"
 	"log"
 	"net/http"
@@ -41,10 +42,11 @@ type Exporter struct {
 	attachedProgs            map[string]map[*libbpfgo.BPFProg]bool
 	descs                    map[string]map[string]*prometheus.Desc
 	decoders                 *decoder.Set
+	btfPath                  string
 }
 
 // New creates a new exporter with the provided config
-func New(configs []config.Config) (*Exporter, error) {
+func New(configs []config.Config, btfPath string) (*Exporter, error) {
 	enabledConfigsDesc := prometheus.NewDesc(
 		prometheus.BuildFQName(prometheusNamespace, "", "enabled_configs"),
 		"The set of enabled configs",
@@ -97,6 +99,7 @@ func New(configs []config.Config) (*Exporter, error) {
 		attachedProgs:       map[string]map[*libbpfgo.BPFProg]bool{},
 		descs:               map[string]map[string]*prometheus.Desc{},
 		decoders:            decoders,
+		btfPath:             btfPath,
 	}, nil
 }
 
@@ -116,10 +119,22 @@ func (e *Exporter) Attach() error {
 			return fmt.Errorf("multiple configs with name %q", cfg.Name)
 		}
 
-		module, err := libbpfgo.NewModuleFromFileArgs(libbpfgo.NewModuleArgs{
+		args := libbpfgo.NewModuleArgs{
 			BPFObjPath:      cfg.BPFPath,
 			SkipMemlockBump: true, // Let libbpf itself decide whether it is needed
-		})
+		}
+
+		if e.btfPath != "" {
+			if _, err := os.Stat(e.btfPath); err == nil {
+				args.BTFObjPath = e.btfPath
+			} else if errors.Is(err, os.ErrNotExist) {
+				return fmt.Errorf("could not find BTF file %q", e.btfPath)
+			} else {
+				return fmt.Errorf("failed to retrieve file info for %q: %v", e.btfPath, err)
+			}
+		}
+
+		module, err := libbpfgo.NewModuleFromFileArgs(args)
 		if err != nil {
 			return fmt.Errorf("error creating module from %q for config %q: %v", cfg.BPFPath, cfg.Name, err)
 		}