Loading custom BPF programs at early boot (initrd)

Loading custom BPF programs at early boot (initrd)

[Alban Crequy]

Hello,

I’m looking to load and attach a BPF program at early boot, that is
before the rootfs is mounted in read-write mode. This is for tracing
I/O operations on disk.

Without BPF, this can be done with a kernel module and then use Dracut
+ dkms to update the initrd. But I am looking to avoid custom kernel
modules and I would like to have a solution with BPF working on most
Linux distros without too much maintenance work for each distro.

I’ve noticed the bpf_preload module, but from the discussion below, I
gather that it does not allow to load custom bpf modules:
https://github.com/torvalds/linux/tree/master/kernel/bpf/preload
https://lwn.net/Articles/889466/

Do you know of prior-art or recommendation how to do this correctly,
and hopefully without a custom kernel module?

Best regards,
Alban

Re: Loading custom BPF programs at early boot (initrd)

[Cong Wang]

Hi Alban,

On Wed, Jun 04, 2025 at 04:50:15PM +0200, Alban Crequy wrote:
> Hello,
> 
> I’m looking to load and attach a BPF program at early boot, that is
> before the rootfs is mounted in read-write mode. This is for tracing
> I/O operations on disk.
> 
> Without BPF, this can be done with a kernel module and then use Dracut
> + dkms to update the initrd. But I am looking to avoid custom kernel
> modules and I would like to have a solution with BPF working on most
> Linux distros without too much maintenance work for each distro.
> 
> I’ve noticed the bpf_preload module, but from the discussion below, I
> gather that it does not allow to load custom bpf modules:
> https://github.com/torvalds/linux/tree/master/kernel/bpf/preload
> https://lwn.net/Articles/889466/
> 
> Do you know of prior-art or recommendation how to do this correctly,
> and hopefully without a custom kernel module?

I must miss something here... but dracut should allow to pack any binary
(e.g. your own eBPF program) into initramfs and allow to customize your
own init script too. With the eBPF binary and bpftool and/or other
loading script packed into initramfs, you can get what you want without
bothering a kernel module?

Something like below?

install_items+="/path/to/your/ebpf_program"
# pack bpftool if you need
# pack libbpf if you need
inst_hook pre-mount 50 "/path/to/your_loading_script"

Regards,
Cong