ebpf icon indicating copy to clipboard operation
ebpf copied to clipboard

kallsyms: change Modules caching strategy, cache address lookups

Open ti-mo opened this issue 1 year ago • 1 comments

See individual commits for context.

At a high level:

  • add caching for __ksym reference resolving
  • stop caching all text symbols that have an associated kmod
  • for both addresses and modules, cache only the requested symbols (pull-through cache)
  • at the beginning of Collection creation, scan all ProgramSpecs and instructions for module and symbol references and request them in two batches
  • perform individual symbol lookups (from the populated cache) in newProgramWithOptions onwards
  • don't open /proc/kallsyms during CollectionSpec loading

ti-mo avatar Oct 17 '24 18:10 ti-mo