More CO-RE? Taming the effects of compiler optimizations on BPF tracing
summary
CO-RE helps BPF programs run across kernels but compiler optimizations hide about 7,000 of ~56,000 kernel symbols from BTF, breaking fentry/fexit tracing for ~800 SRA-suffixed functions and many others. The talk shows a proof‑of‑concept that parses late DWARF location info to detect optimized-away arguments, and proposes using BTF decoration tags plus relocations or multiple BTF entries so tracing tools can either skip, attach to optimized suffixes, or recover accurate argument locations.
AI-written summary · about
chapters (16)
- 0:00Introduction to BPF tracing
- 1:02Motivation for accurate tracing
- 2:07Survey of missing kernel functions
- 3:31Static and cold functions
- 5:15Partially inlined functions
- 6:19Optimized function signatures
- 8:46Constant propagation issues
- 10:50Hard cases and solutions
- 12:15CO-RE philosophy for functions
- 13:38Tagging and annotations proposal
- 15:23Proof of concept demonstration
- 18:12Key principles for BTF
- 19:37Case study: copy_query_item
- 20:38Why this matters
- 21:20Summary and next steps
- 28:04Q&A discussion
related talks
21mPortable BPF with CO:RE
15mBPF Access Control and CO-RE in Android
46mbpftrace internals
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
34mWhat's new in the BPF world?
25mKernel tracing with BPF
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
47mBPF: The Status of BTF, producers, consumers.