CO-RE (Compile Once - Run Everywhere) technology is more than a year old now. It allows observing systems’ structs through eBPF without installing kernel headers (kernel-devel package) & recompiling tools on every machine. It’s done by including premade & compressed debugging info directly into the …

It’s already at unstable - so you can test it. We’ll include it for all Kernel >= 5.4

According to this doc , some major Linux distributions come with kernel BTF already built in: Fedora 31+ RHEL 8.2+ OpenSUSE Tumbleweed (in the next release, as of 2020-06-04) Arch Linux (from kernel 5.7.1.arch1-1) Ubuntu 20.10 Debian 11 (amd64/arm64)

Kindly ping and ask. :sweat_smile: Is there any plan for manjaro to follow up turning CONFIG_DEBUG_INFO_BTF on ?

Pinging @nightmare-2021 , the master of the manjaro kernels :wink:

Will be included with the next update for the kernels 5.10 + 5.11 + 5.12

Thanks a lot, that will definitely be a fantastic feature!

Hello! I’m using kernel 5.10.42 which doesn’t seem to have BTF enabled (There is no entry for /sys/kernel/btf) Should it be added to future 5.10.x versions or should I upgrade my kernel to have it?

BTF will not be added, cause it growes up the kernel for more then 120 MB plus !!!

That’s too bad. The future of Linux is eBPF, and CO-RE is the future of eBPF. I am maintaining an open source project named Tracee, which is eBPF based, and we are about to add CO-RE support to it. With CO-RE, the compiled binary will be able to run on kernels which have BTF enabled out of the box…

So we are talking about this project: [image] aquasecurity/tracee Linux Runtime Security and Forensics using eBPF. Contribute to aquasecurity/tracee development by creating an account on GitHub. If we look at Arch and our config of our kernel I see this: --…

Please test and give feedback: https://sourceforge.net/projects/manjarodev/files/users/philm/linux512-btf/ If extramodules like nvidia are needed, let me know.

Manjaro Linux Forum

CO-RE support in kernel

Feedback Feature Request

kernel

philm 17 June 2021 19:32 19

GitLab

[pkg-upd] 5.12.11-2 (!1) · Merge requests · Packages / Core / linux512

enable BTF support see also: http://www.brendangregg.com/blog/2020-11-04/bpf-co-re-btf-libbpf.html

show post in topic

Home
Categories
Guidelines
Terms of Service
Privacy Policy

Powered by Discourse, best viewed with JavaScript enabled