During tracee-ebpf regression tests, it was discovered that a CO-RE capable eBPF program, that relied on a kconfig BTF extern, could not be loaded with the following error: libbpf: prog 'tracepoint__raw_syscalls__sys_enter': failed to attach to raw tracepoint 'sys_enter': Invalid argument That happened because the CONFIG_ARCH_HAS_SYSCALL_WRAPPER variable had the wrong value, despite kconfig map existing, misleading the eBPF program execution (which would then have different pointers, not accepted by the verifier during load time). I got the patch proposed here by bisecting upstream tree with the testcase just described. I kindly ask you to include this patch in the LTS v5.4.x series so CO-RE (Compile Once - Run Everywhere) eBPF programs, relying in kconfig settings, can be correctly loaded in kernel series v5.4. Link: https://github.com/aquasecurity/tracee/issues/851#issuecomment-903074596 I have tested latest 5.4 stable tree with this patch and it fixes the issue. -rafaeldtinoco
