From 74cbaeca20a5a7b55ba66edeb328b5663e1a658f Mon Sep 17 00:00:00 2001 From: Lohith Gowda M Date: Wed, 15 Jul 2026 14:13:30 +0530 Subject: [PATCH] Enable eBPF tracing support (tracepoints, uprobes, tc) for x86_64 and arm64 6.1.158 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Enable the kernel tracing subsystem needed for eBPF-based tracing programs on the 6.1.158 guest kernels, keeping both architectures aligned: - CONFIG_TRACEPOINTS=y - CONFIG_FTRACE=y - CONFIG_FUNCTION_TRACER=y - CONFIG_UPROBES=y - CONFIG_UPROBE_EVENTS=y - CONFIG_NET_CLS_BPF=y Why: we run an eBPF-based runtime-security agent inside E2B sandboxes. With in-kernel BTF now enabled (#26), its eBPF programs still fail to load with EINVAL, because the guest kernel has the entire kprobe/uprobe tracing stack compiled out — none of the above symbols are set, so the kernel rejects any tracing-type BPF program at load time. This set intentionally excludes CONFIG_KPROBES/CONFIG_KPROBE_EVENTS, which would additionally require CONFIG_MODULES (loadable kernel module support) since CONFIG_KPROBES depends on MODULES in this kernel version. That's a materially bigger capability change than a tracing flag, so we're leaving kprobe-based support out of this PR and scoping it to what uprobes + tracepoints + the BPF traffic classifier can cover. Impact: this is not a no-op like a debug-info flag. It compiles in the ftrace/uprobe infrastructure (a modest binary size increase and the fixed nop-patching overhead ftrace's function tracer adds), but no tracer or probe is actually active unless something explicitly attaches one - e.g. our runtime-security agent's uprobe-based hooks. No existing kernel code paths, behavior, or struct layout change as a result. Verified against the actual 6.1.158 kernel source (arch/Kconfig, kernel/trace/Kconfig, net/sched/Kconfig): none of these six symbols depend on CONFIG_MODULES, and their existing prerequisites (CONFIG_PERF_EVENTS, CONFIG_ARCH_SUPPORTS_UPROBES, CONFIG_MMU, CONFIG_NET_SCHED, CONFIG_NET_CLS, CONFIG_HAVE_FUNCTION_TRACER, CONFIG_TRACING_SUPPORT) are already enabled in both arch configs. --- configs/arm64/6.1.158.config | 8 ++++++-- configs/x86_64/6.1.158.config | 8 ++++++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/configs/arm64/6.1.158.config b/configs/arm64/6.1.158.config index 9587d69..77a1050 100644 --- a/configs/arm64/6.1.158.config +++ b/configs/arm64/6.1.158.config @@ -1341,7 +1341,7 @@ CONFIG_NET_CLS=y # CONFIG_NET_CLS_U32 is not set # CONFIG_NET_CLS_FLOW is not set # CONFIG_NET_CLS_CGROUP is not set -# CONFIG_NET_CLS_BPF is not set +CONFIG_NET_CLS_BPF=y # CONFIG_NET_CLS_FLOWER is not set # CONFIG_NET_CLS_MATCHALL is not set CONFIG_NET_EMATCH=y @@ -3324,8 +3324,12 @@ CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS=y CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y CONFIG_HAVE_SYSCALL_TRACEPOINTS=y CONFIG_HAVE_C_RECORDMCOUNT=y +CONFIG_TRACEPOINTS=y CONFIG_TRACING_SUPPORT=y -# CONFIG_FTRACE is not set +CONFIG_FTRACE=y +CONFIG_FUNCTION_TRACER=y +CONFIG_UPROBES=y +CONFIG_UPROBE_EVENTS=y # CONFIG_SAMPLES is not set # CONFIG_STRICT_DEVMEM is not set diff --git a/configs/x86_64/6.1.158.config b/configs/x86_64/6.1.158.config index c4060bb..2129f5d 100644 --- a/configs/x86_64/6.1.158.config +++ b/configs/x86_64/6.1.158.config @@ -1346,7 +1346,7 @@ CONFIG_NET_CLS=y # CONFIG_NET_CLS_U32 is not set # CONFIG_NET_CLS_FLOW is not set # CONFIG_NET_CLS_CGROUP is not set -# CONFIG_NET_CLS_BPF is not set +CONFIG_NET_CLS_BPF=y # CONFIG_NET_CLS_FLOWER is not set # CONFIG_NET_CLS_MATCHALL is not set CONFIG_NET_EMATCH=y @@ -3229,8 +3229,12 @@ CONFIG_HAVE_FENTRY=y CONFIG_HAVE_OBJTOOL_MCOUNT=y CONFIG_HAVE_C_RECORDMCOUNT=y CONFIG_HAVE_BUILDTIME_MCOUNT_SORT=y +CONFIG_TRACEPOINTS=y CONFIG_TRACING_SUPPORT=y -# CONFIG_FTRACE is not set +CONFIG_FTRACE=y +CONFIG_FUNCTION_TRACER=y +CONFIG_UPROBES=y +CONFIG_UPROBE_EVENTS=y # CONFIG_SAMPLES is not set CONFIG_HAVE_SAMPLE_FTRACE_DIRECT=y CONFIG_HAVE_SAMPLE_FTRACE_DIRECT_MULTI=y