elastic / ebpf

Elastic's eBPF
Other
67 stars 11 forks source link

EventProbe: support for aarch64 #84

Closed mmat11 closed 2 years ago

mmat11 commented 2 years ago

trampoline type programs are only implemented on x86 (https://elixir.bootlin.com/linux/latest/C/ident/arch_prepare_bpf_trampoline)

To support aarch64, fentry/fexits needs to be replaced with kprobes/tracepoints

mmat11 commented 2 years ago

https://github.com/elastic/ebpf/pull/87