Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rpi5-kernel: can't run eBPF tools due to missing BTF debug info #53258

Open
kdrag0n opened this issue Nov 29, 2024 · 2 comments · May be fixed by #53559
Open

rpi5-kernel: can't run eBPF tools due to missing BTF debug info #53258

kdrag0n opened this issue Nov 29, 2024 · 2 comments · May be fixed by #53559
Labels
bug Something isn't working

Comments

@kdrag0n
Copy link

kdrag0n commented Nov 29, 2024

Is this a new report?

Yes

System Info

Void 6.6.42_1 aarch64 Unknown notuptodate rrnFFF

Package(s) Affected

rpi5-kernel-6.6.42_1

Does a report exist for this bug with the project's home (upstream) and/or another distro?

No response

Expected behaviour

execsnoop and other eBPF tracing tools from bcc-tools run successfully.

Actual behaviour

execsnoop doesn't start because the kernel is missing BTF debug info, which is required for eBPF CO-RE:

libbpf: kernel BTF is missing at '/sys/kernel/btf/vmlinux', was CONFIG_DEBUG_INFO_BTF enabled?
libbpf: failed to find valid kernel BTF
modprobe: FATAL: Module kheaders not found in directory /lib/modules/6.6.42_1
Unable to find kernel headers. Try rebuilding kernel with CONFIG_IKHEADERS=m (module) or installing the kernel development package for your running kernel version.
chdir(/lib/modules/6.6.42_1/build): No such file or directory
Traceback (most recent call last):
  File "/usr/bin/execsnoop", line 272, in <module>
    b = BPF(text=bpf_text)
        ^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/bcc/__init__.py", line 480, in __init__
    raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
Exception: Failed to compile BPF module <text>

Steps to reproduce

  1. xbps-install bcc-tools
  2. execsnoop
@kdrag0n kdrag0n added bug Something isn't working needs-testing Testing a PR or reproducing an issue needed labels Nov 29, 2024
@classabbyamp classabbyamp removed the needs-testing Testing a PR or reproducing an issue needed label Dec 18, 2024
@classabbyamp
Copy link
Member

the rpi-kernel package is based on the default config provided for the board, so its config is very... minimal. in #53559 i'm bringing it more inline with what most void kernels do, and can confirm it works there:

bash-5.2# execsnoop
COMM             PID     PPID    RET ARGS
sshd-session     16048   337       0 /usr/libexec/sshd-session -D -R
sh               16051   16050     0 /bin/sh
tput             16052   16051     0 /usr/bin/tput colors
dircolors        16053   16051     0 /usr/bin/dircolors --sh /etc/colors/DIR_COLORS.256color
grep             16054   16051     0 /usr/bin/grep -Eqi ^COLOR.*none /etc/colors/DIR_COLORS.256color
cat              16056   16055     0 /usr/bin/cat /dev/null /etc/debuginfod/*.urls
tr               16057   16055     0 /usr/bin/tr \n  
bash             16058   16051     0 /usr/bin/bash

@classabbyamp classabbyamp linked a pull request Dec 18, 2024 that will close this issue
@kdrag0n
Copy link
Author

kdrag0n commented Dec 19, 2024

Nice, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants