Portable BPF with CO:RE
summary
Tracee switches from per-kernel builds to a single libbpf CO:RE object that relocates type offsets using kernel BTF so one compiled .o runs across distributions and custom kernels. The team ships a static Go binary that embeds the BPF object, loads it at runtime, and uses bpf_core_read to access kernel memory. A companion BTF Hub supplies external .btf files for older kernels, cutting build failures and distribution-specific bug reports.
AI-written summary · about
chapters (9)
- 0:00Introduction to Tracy
- 0:54Challenges in BPF porting
- 2:14The need for portability
- 5:18How BPF CORE works
- 8:16Supporting custom kernels
- 10:30Code changes and vmlinux.h
- 13:57Distribution benefits
- 16:17Live demonstration
- 19:07Future work and resources
related talks
15mBPF Access Control and CO-RE in Android
32mMore CO-RE? Taming the effects of compiler optimizations on BPF tracing
45mSupporting BPF in the GNU Toolchain
47mBPF: The Status of BTF, producers, consumers.
34mBeyond the Hype: Cloud Native eBPF
34mWhat's new in the BPF world?
25mKernel tracing with BPF
28mbpftrace: what is it, what's new, and where is it going