chore: enable BTF debug info in guest debug config#5857
Open
bane-stealthium wants to merge 4 commits intofirecracker-microvm:mainfrom
Open
chore: enable BTF debug info in guest debug config#5857bane-stealthium wants to merge 4 commits intofirecracker-microvm:mainfrom
bane-stealthium wants to merge 4 commits intofirecracker-microvm:mainfrom
Conversation
bane-stealthium
force-pushed
the
main
branch
2 times, most recently
from
d83f4d9 to
daf4124
Compare
Enable CONFIG_DEBUG_INFO_BTF in the guest debug kernel config to support extended eBPF functionality in guest VMs. Signed-off-by: Branislav Brzak <branislav.brzak@stealthium.io>
Manciukic
approved these changes
Apr 29, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #5857 +/- ##
=======================================
Coverage 82.79% 82.79%
=======================================
Files 276 276
Lines 29764 29764
=======================================
Hits 24643 24643
Misses 5121 5121
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
JackThomson2
approved these changes
Apr 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Enable
CONFIG_DEBUG_INFO_BTFin the guest debug kernel config to support extended eBPF functionality in guest VMs.Reason
BTF (BPF Type Format) is a metadata format that embeds rich type information into the kernel and BPF programs. Without it, eBPF is limited to basic tracing and simple programs. With BTF enabled, guests gain access to CO-RE (Compile Once – Run Everywhere), which allows eBPF programs to adapt to different kernel versions at load time without recompilation. It also unlocks advanced program types (e.g. fentry/fexit, LSM hooks), map introspection, and tools like
bpftoolthat depend on type information to inspect running programs and maps. EnablingCONFIG_DEBUG_INFO_BTFin the guest debug config is the prerequisite for all of this extended eBPF functionality inside Firecracker guest VMs.Enabling BTF does increase the kernel image size: measured builds show
vmlinuxon 6.1 kernel growing from 51 MB to 55 MB (~4 MB / ~8%). Guest RAM usage reflects a similar uptick, as the.BTFsection is mapped into kernel memory at boot. The 4 MB is largely read-only, page-cache-friendly data that the kernel shares efficiently across cores and does not compete with guest workload memory. Firecracker guests are routinely provisioned with hundreds of megabytes to several gigabytes of RAM, making a fixed 4 MB kernel metadata cost negligible, well under 1% of any realistic guest configuration. The tradeoff is asymmetric: a one-time, bounded memory cost in exchange for unlocking the full modern eBPF stack (CO-RE, fentry/fexit, LSM, bpftool introspection) that would otherwise require per-kernel-version BPF bytecode or be unavailable entirely.Why enable it on the stock config, instead of letting end-user enable it when necessary? It resolves an in-between state of currently released Firecracker VM kernels. In current shape eBPF support is built in but is only partial and forces eBPF programs to use manual offsets or per-kernel compilation. This proposed change brings stock Firecracker kernels to modern eBPF support, enabling easy use of threat detection and monitoring tools within microVMs.
License Acceptance
By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache 2.0 license. For more information on following Developer
Certificate of Origin and signing off your commits, please check CONTRIBUTING.md.
PR Checklist
tools/devtool checkbuild --allto verify that the PR passesbuild checks on all supported architectures.
tools/devtool checkstyleto verify that the PR passes theautomated style checks.
how they are solving the problem in a clear and encompassing way.
[na] I have updated any relevant documentation (both in code and in the docs)
in the PR.
[na] I have mentioned all user-facing changes in
CHANGELOG.md.[na] If a specific issue led to this PR, this PR closes the issue.
[na] When making API changes, I have followed the Runbook for Firecracker API changes.
integration tests.
[na] I have linked an issue to every new
TODO.[na] This functionality cannot be added in rust-vmm.