Re: [PATCH bpf-next v7 1/2] libbpf: support selective kernel module BTF loading via bpf_object_open_opts

[Fuyu Zhao <zhaofuyu@vivo.com>]

On 9/7/2026 4:33 PM, Jiri Olsa wrote:
> On Mon, Sep 07, 2026 at 01:38:46PM +0800, Fuyu Zhao wrote:
> 
> SNIP
> 
>>  static int load_module_btfs(struct bpf_object *obj)
>>  {
>>  	struct bpf_btf_info info;
>> @@ -5825,6 +5842,9 @@ static int load_module_btfs(struct bpf_object *obj)
>>  	if (!kernel_supports(obj, FEAT_MODULE_BTF))
>>  		return 0;
>>  
>> +	if (obj->btf_module_allowlist_cnt == 0)
>> +		return 0;
>> +
>>  	while (true) {
>>  		err = bpf_btf_get_next_id(id, &id);
>>  		if (err && errno == ENOENT)
>> @@ -5867,6 +5887,11 @@ static int load_module_btfs(struct bpf_object *obj)
>>  			continue;
>>  		}
>>  
>> +		if (!is_btf_mod_allowed(obj, name)) {
>> +			close(fd);
>> +			continue;
>> +		}
>> +
>>  		btf = btf_get_from_fd(fd, obj->btf_vmlinux);
>>  		err = libbpf_get_error(btf);
>>  		if (err) {
>> @@ -5891,6 +5916,10 @@ static int load_module_btfs(struct bpf_object *obj)
>>  			break;
>>  		}
>>  		obj->btf_module_cnt++;
>> +
>> +		if (obj->btf_module_allowlist &&
> 
> IIUC you don't need to check obj->btf_module_allowlist,
> because obj->btf_module_allowlist_cnt is -1 by default?
> 

Yes, that's correct. I'll remove the
obj->btf_module_allowlist check to keep the code simpler.

>> +		    obj->btf_module_allowlist_cnt == obj->btf_module_cnt)
>> +			break;
>>  	}
>>  
>>  	if (err) {
>> @@ -8426,8 +8455,10 @@ static struct bpf_object *bpf_object_open(const char *path, const void *obj_buf,
>>  					  const struct bpf_object_open_opts *opts)
>>  {
>>  	const char *kconfig, *btf_tmp_path, *token_path;
>> +	const char **mod_allow;
>> +	int mod_allow_cnt;
>>  	struct bpf_object *obj;
>> -	int err;
>> +	int err, i, j;
>>  	char *log_buf;
>>  	size_t log_size;
>>  	__u32 log_level;
>> @@ -8470,6 +8501,22 @@ static struct bpf_object *bpf_object_open(const char *path, const void *obj_buf,
>>  	if (token_path && strlen(token_path) >= PATH_MAX)
>>  		return ERR_PTR(-ENAMETOOLONG);
>>  
>> +	mod_allow = OPTS_GET(opts, btf_module_allowlist, NULL);
>> +	mod_allow_cnt = OPTS_GET(opts, btf_module_allowlist_cnt, 0);
>> +
>> +	if ((!mod_allow && mod_allow_cnt > 0) || mod_allow_cnt < 0)
>> +		return ERR_PTR(-EINVAL);
>> +
>> +	for (i = 0; i < mod_allow_cnt; i++) {
>> +		if (!mod_allow[i] || !mod_allow[i][0])
>> +			return ERR_PTR(-EINVAL);
>> +
>> +		for (j = 0; j < i; j++) {
>> +			if (strcmp(mod_allow[i], mod_allow[j]) == 0)
>> +				return ERR_PTR(-EINVAL);
>> +		}
> 
> do we care if user supplied same name multiple times?
> 

Yes, we care about duplicate names. We reject them so that each entry
in the allowlist represents a unique module. This allows the
load_module_btfs() loop to exit early once all requested module BTFs
have been loaded.

> thanks,
> jirka
> 
>> +	}
>> +
>>  	obj = bpf_object__new(path, obj_buf, obj_buf_sz, obj_name);
>>  	if (IS_ERR(obj))
>>  		return obj;