logoalt Hacker News

linuxftwtoday at 1:03 PM1 replyview on HN

This is all covered in the eBPF documentation. CORE was introduced over 6 years ago.


Replies

mackmantoday at 1:35 PM

CORE only works on kernels that support BTF. This post introduces one workaround which is to generate BTF data for kernels without it. That's still only half the problem though. You also need to write your eBPF program so every kernel verifier passes it, even though every kernel's eBPF verifier has different bugs, capabilities, and complexity limits. I maintain a large eBPF program that supports 4.14 through 6.14. We implemented our own version of CORE before CORE really existed. In reality, it's a lot more work than "compile once run everywhere."

show 2 replies