Looks like it works: $ sudo apt list | grep linux-raspi
WARNING: apt does not have a stable CLI interface. Use with caution in scripts. ... linux-raspi-headers-6.8.0-1008/noble-updates,noble-security,now 6.8.0-1008.8 arm64 [installed,automatic] linux-raspi-headers-6.8.0-1009/noble-proposed,now 6.8.0-1009.10 arm64 [installed,automatic] ... linux-raspi-tools-6.8.0-1009/noble-proposed,now 6.8.0-1009.10 arm64 [installed,automatic] linux-raspi/noble-proposed,now 6.8.0-1009.9 arm64 [installed] $ ls /sys/kernel/btf/vmlinux /sys/kernel/btf/vmlinux $ sudo bpftool feature probe kernel | grep -q "program_type tracing is available" && echo "true" || echo "false" true Bonus, falco looks like it works as well: $ sudo journalctl --unit=falco-modern-bpf Jul 31 17:52:52 cluster-node-0 systemd[1]: Started falco-modern-bpf.service - Falco: Container Native Runtime Security with modern ebpf. Jul 31 17:52:53 cluster-node-0 falco[19634]: Falco version: 0.38.1 (aarch64) Jul 31 17:52:53 cluster-node-0 falco[19634]: Falco initialized with configuration files: Jul 31 17:52:53 cluster-node-0 falco[19634]: /etc/falco/falco.yaml Jul 31 17:52:53 cluster-node-0 falco[19634]: System info: Linux version 6.8.0-1009-raspi (buildd@bos03-arm64-090) (aarch64-linux-gnu-gcc-13 (Ubuntu 13.2.0-23ubuntu4) 13.> Jul 31 17:52:53 cluster-node-0 falco[19634]: Loading rules from file /etc/falco/falco_rules.yaml Jul 31 17:52:53 cluster-node-0 falco[19634]: Loading rules from file /etc/falco/falco_rules.local.yaml Jul 31 17:52:53 cluster-node-0 falco[19634]: The chosen syscall buffer dimension is: 8388608 bytes (8 MBs) Jul 31 17:52:53 cluster-node-0 falco[19634]: Starting health webserver with threadiness 4, listening on 0.0.0.0:8765 Jul 31 17:52:53 cluster-node-0 falco[19634]: Loaded event sources: syscall Jul 31 17:52:53 cluster-node-0 falco[19634]: Enabled event sources: syscall Jul 31 17:52:53 cluster-node-0 falco[19634]: Opening 'syscall' source with modern BPF probe. Jul 31 17:52:53 cluster-node-0 falco[19634]: One ring buffer every '2' CPUs. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2065829 Title: BTF support missing from kernel To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux-raspi/+bug/2065829/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
