tetragon: Move ksyms.KernelSymbols call early in validation

The ksyms.KernelSymbols call is expensive, let's do it just once. Signed-off-by: Jiri Olsa <jolsa@kernel.org>
cilium · Feb 13, 2025 · fc8865a · fc8865a
1 parent 8309741
commit fc8865a
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 9 deletions.
diff --git a/pkg/btf/validation.go b/pkg/btf/validation.go
@@ -44,15 +44,9 @@ func (e *ValidationFailed) Error() string {
 // NB: turns out we need more than BTF information for the validation (see
 // syscalls). We still keep this code in the btf package for now, and we can
 // move it once we found a better home for it.
-func ValidateKprobeSpec(bspec *btf.Spec, call string, kspec *v1alpha1.KProbeSpec) error {
+func ValidateKprobeSpec(bspec *btf.Spec, call string, kspec *v1alpha1.KProbeSpec, ks *ksyms.Ksyms) error {
 	var fn *btf.Func
 
-	// get kernel symbols
-	ks, err := ksyms.KernelSymbols()
-	if err != nil {
-		return fmt.Errorf("validateKprobeSpec: ksyms.KernelSymbols: %w", err)
-	}
-
 	// check if this functio name is part of a kernel module
 	if kmod, err := ks.GetKmod(call); err == nil {
 		// get the spec from the kernel module and continue the validation with that
@@ -64,7 +58,7 @@ func ValidateKprobeSpec(bspec *btf.Spec, call string, kspec *v1alpha1.KProbeSpec
 	}
 
 	origCall := call
-	err = bspec.TypeByName(call, &fn)
+	err := bspec.TypeByName(call, &fn)
 	if err != nil && kspec.Syscall {
 		// Try with system call prefix
 		call, err = arch.AddSyscallPrefix(call)

diff --git a/pkg/sensors/tracing/generickprobe.go b/pkg/sensors/tracing/generickprobe.go
@@ -28,6 +28,7 @@ import (
 	"github.com/cilium/tetragon/pkg/idtable"
 	"github.com/cilium/tetragon/pkg/k8s/apis/cilium.io/v1alpha1"
 	"github.com/cilium/tetragon/pkg/kernels"
+	"github.com/cilium/tetragon/pkg/ksyms"
 	"github.com/cilium/tetragon/pkg/logger"
 	"github.com/cilium/tetragon/pkg/metrics/kprobemetrics"
 	"github.com/cilium/tetragon/pkg/observer"
@@ -449,6 +450,12 @@ func preValidateKprobes(name string, kprobes []v1alpha1.KProbeSpec, lists []v1al
 		return err
 	}
 
+	// get kernel symbols
+	ks, err := ksyms.KernelSymbols()
+	if err != nil {
+		return fmt.Errorf("validateKprobeSpec: ksyms.KernelSymbols: %w", err)
+	}
+
 	for i := range kprobes {
 		f := &kprobes[i]
 
@@ -508,7 +515,7 @@ func preValidateKprobes(name string, kprobes []v1alpha1.KProbeSpec, lists []v1al
 
 		for idx := range calls {
 			// Now go over BTF validation
-			if err := btf.ValidateKprobeSpec(btfobj, calls[idx], f); err != nil {
+			if err := btf.ValidateKprobeSpec(btfobj, calls[idx], f, ks); err != nil {
 				if warn, ok := err.(*btf.ValidationWarn); ok {
 					logger.GetLogger().WithFields(logrus.Fields{
 						"sensor": name,