ebpf
ebpf copied to clipboard
kallsyms: change Modules caching strategy, cache address lookups
See individual commits for context.
At a high level:
- add caching for __ksym reference resolving
- stop caching all text symbols that have an associated kmod
- for both addresses and modules, cache only the requested symbols (pull-through cache)
- at the beginning of Collection creation, scan all ProgramSpecs and instructions for module and symbol references and request them in two batches
- perform individual symbol lookups (from the populated cache) in
newProgramWithOptionsonwards - don't open /proc/kallsyms during CollectionSpec loading