> > From: Vamsi Kodavanty <vamsi@xxxxxxxxxxxxxxxxxx> > > Date: Thu, 7 Jan 2021 17:31:11 -0800 > > To: Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx> > > Cc: bpf <bpf@xxxxxxxxxxxxxxx> > > > > > > Right. Libbpf only supports a newer and safer way to attach to > > kprobes. For your experiments, try to stick to tracepoints and you'll > > have a better time. > > > > But it's another thing I've been meaning to add to libbpf for > > supporting older kernels. I even have code written to do legacy kprobe > > attachment, just need to find time to send a patch to add it as a > > fallback for kernels that don't support new kprobe interface. Initially I'd like to thank you *a lot* for this thread, it helped me creating: https://github.com/rafaeldtinoco/portablebpf showing up exactly what was discussed here AND I could run the same binary in v4.15 and v.5.8 kernels as long as BTF was generated with: https://github.com/rafaeldtinoco/portablebpf/blob/master/patches/link-vmlinux.sh.patch Specially the attach_kprobe_legacy() function: https://github.com/rafaeldtinoco/portablebpf/blob/master/mine.c#L31 I wanted to reply here in case others also face this. Only bad thing was kernel v4.15 missed global data support as showed in: https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md But using perf event was good enough for an example. - rafaeldtinoco
