Verify eBPF BTF Support on Arch Linux ARM

1. Check whether BTF support is present on your Arch Linux ARM endpoint.

   1. Verify that the BTF sysfs file exists and is approximately 7–8 MB:

      ls -lh /sys/kernel/btf/vmlinux

      A file approximately 7–8 MB in size indicates BTF is enabled. "No such file or directory" means BTF is missing.
   2. Check the key kernel configuration options:

      zcat /proc/config.gz | grep -E "CONFIG_DEBUG_INFO_BTF|CONFIG_DEBUG_INFO_NONE"

      The expected output when BTF is enabled:

      # CONFIG_DEBUG_INFO_NONE is not set
      CONFIG_DEBUG_INFO_BTF=y

   3. Install bpftool and list BTF objects:

      sudo pacman -S --noconfirm bpf
      sudo bpftool btf list

      The expected output when BTF is present: 1: name [vmlinux] size XXXXXXB. An empty result or error indicates no BTF support.

   If all three checks pass, your kernel supports eBPF. Proceed with the Prisma Agent. If any check fails, continue to the next step to recompile your kernel.
2. If BTF support is missing, recompile the Arch Linux ARM kernel with BTF enabled.

   This process takes approximately 30–60 minutes on aarch64 hardware. To roll back to the original kernel if the new kernel fails to boot, restore the backup from a recovery shell:

   sudo cp /boot/Image.bak /boot/Image && sudo reboot

   1. Install the required build dependencies, including pahole, which is required for BTF generation:

      sudo pacman -S --noconfirm --needed \
          pahole \
          bc \
          git \
          python \
          xmlto \
          flex \
          bison \
          kmod \
          wget

   2. Create a build directory and download the kernel source and patch:

      mkdir -p ~/kernel-build
      cd ~/kernel-build
      wget https://www.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.xz
      wget https://www.kernel.org/pub/linux/kernel/v7.x/patch-7.1.1.xz

   3. Download the Arch Linux ARM board-specific patches:

      cd ~/kernel-build
      git clone --depth=1 https://github.com/archlinuxarm/PKGBUILDs.git

   4. Extract the kernel source and apply the patches:

      cd ~/kernel-build
      tar xf linux-7.1.tar.xz
      xz -d patch-7.1.1.xz
      patch -d linux-7.1 -p1 < patch-7.1.1
      PKGDIR=~/kernel-build/PKGBUILDs/core/linux-aarch64
      cd ~/kernel-build/linux-7.1
      patch -p1 < "$PKGDIR/0001-arm64-dts-rockchip-disable-pwm0-on-rk3399-firefly.patch"
      patch -p1 < "$PKGDIR/0002-pps-Compatibility-hack-should-be-X86-specific.patch"
      patch -p1 < "$PKGDIR/0003-Revert-arm64-dts-rockchip-Move-rk3568-PCIe3-MSI-to-u.patch"
      patch -p1 < "$PKGDIR/0004-serial-amba-pl011-add-arm-pl011-axi-binding-for-RP1.patch"
      patch -p1 < "$PKGDIR/0005-arm64-dts-rpi5-add-RP1-UART0-GPIO14-15-console.patch"

   5. Configure the kernel to enable BTF support:

      cd ~/kernel-build/linux-7.1
      zcat /proc/config.gz > .config
      scripts/config --disable CONFIG_DEBUG_INFO_NONE
      scripts/config --enable  CONFIG_DEBUG_INFO
      scripts/config --enable  CONFIG_DEBUG_INFO_DWARF5
      scripts/config --enable  CONFIG_DEBUG_INFO_BTF
      make ARCH=arm64 olddefconfig

   6. Build the kernel using all available cores:

      make ARCH=arm64 -j$(nproc)

   7. Install the kernel modules:

      sudo make ARCH=arm64 modules_install

   8. Back up the existing kernel image and install the new one:

      sudo cp /boot/Image /boot/Image.bak
      sudo cp arch/arm64/boot/Image /boot/Image

   9. Back up the existing device tree blobs and install the new ones:

      sudo cp -r /boot/dtbs /boot/dtbs.bak
      sudo make ARCH=arm64 dtbs_install INSTALL_DTBS_PATH=/boot/dtbs

   10. Reboot the system:

       sudo reboot

   11. After reboot, repeat step 1 to verify that BTF support is now active.