[ISSUE] rpi5-kernel: can't run eBPF tools due to missing BTF debug info

[ISSUE] rpi5-kernel: can't run eBPF tools due to missing BTF debug info

[kdrag0n]

[-- Attachment #1: Type: text/plain, Size: 1488 bytes --]

New issue by kdrag0n on void-packages repository

https://github.com/void-linux/void-packages/issues/53258

Description:
### Is this a new report?

Yes

### System Info

Void 6.6.42_1 aarch64 Unknown notuptodate rrnFFF

### Package(s) Affected

rpi5-kernel-6.6.42_1

### Does a report exist for this bug with the project's home (upstream) and/or another distro?

_No response_

### Expected behaviour

`execsnoop` and other eBPF tracing tools from `bcc-tools` run successfully.

### Actual behaviour

`execsnoop` doesn't start because the kernel is missing BTF debug info, which is required for eBPF CO-RE:

```
libbpf: kernel BTF is missing at '/sys/kernel/btf/vmlinux', was CONFIG_DEBUG_INFO_BTF enabled?
libbpf: failed to find valid kernel BTF
modprobe: FATAL: Module kheaders not found in directory /lib/modules/6.6.42_1
Unable to find kernel headers. Try rebuilding kernel with CONFIG_IKHEADERS=m (module) or installing the kernel development package for your running kernel version.
chdir(/lib/modules/6.6.42_1/build): No such file or directory
Traceback (most recent call last):
  File "/usr/bin/execsnoop", line 272, in <module>
    b = BPF(text=bpf_text)
        ^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/bcc/__init__.py", line 480, in __init__
    raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
Exception: Failed to compile BPF module <text>
```

### Steps to reproduce

1. `xbps-install bcc-tools`
2. `execsnoop`

Re: rpi5-kernel: can't run eBPF tools due to missing BTF debug info

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 998 bytes --]

New comment by classabbyamp on void-packages repository

https://github.com/void-linux/void-packages/issues/53258#issuecomment-2550506046

Comment:
the rpi-kernel package is based on the default config provided for the board, so its config is very... minimal. in #53559 i'm bringing it more inline with what most void kernels do, and can confirm it works there:
```
bash-5.2# execsnoop
COMM             PID     PPID    RET ARGS
sshd-session     16048   337       0 /usr/libexec/sshd-session -D -R
sh               16051   16050     0 /bin/sh
tput             16052   16051     0 /usr/bin/tput colors
dircolors        16053   16051     0 /usr/bin/dircolors --sh /etc/colors/DIR_COLORS.256color
grep             16054   16051     0 /usr/bin/grep -Eqi ^COLOR.*none /etc/colors/DIR_COLORS.256color
cat              16056   16055     0 /usr/bin/cat /dev/null /etc/debuginfod/*.urls
tr               16057   16055     0 /usr/bin/tr \n  
bash             16058   16051     0 /usr/bin/bash
```

Re: rpi5-kernel: can't run eBPF tools due to missing BTF debug info

[kdrag0n]

[-- Attachment #1: Type: text/plain, Size: 157 bytes --]

New comment by kdrag0n on void-packages repository

https://github.com/void-linux/void-packages/issues/53258#issuecomment-2553108975

Comment:
Nice, thanks!

Re: [ISSUE] [CLOSED] rpi5-kernel: can't run eBPF tools due to missing BTF debug info

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 1491 bytes --]

Closed issue by kdrag0n on void-packages repository

https://github.com/void-linux/void-packages/issues/53258

Description:
### Is this a new report?

Yes

### System Info

Void 6.6.42_1 aarch64 Unknown notuptodate rrnFFF

### Package(s) Affected

rpi5-kernel-6.6.42_1

### Does a report exist for this bug with the project's home (upstream) and/or another distro?

_No response_

### Expected behaviour

`execsnoop` and other eBPF tracing tools from `bcc-tools` run successfully.

### Actual behaviour

`execsnoop` doesn't start because the kernel is missing BTF debug info, which is required for eBPF CO-RE:

```
libbpf: kernel BTF is missing at '/sys/kernel/btf/vmlinux', was CONFIG_DEBUG_INFO_BTF enabled?
libbpf: failed to find valid kernel BTF
modprobe: FATAL: Module kheaders not found in directory /lib/modules/6.6.42_1
Unable to find kernel headers. Try rebuilding kernel with CONFIG_IKHEADERS=m (module) or installing the kernel development package for your running kernel version.
chdir(/lib/modules/6.6.42_1/build): No such file or directory
Traceback (most recent call last):
  File "/usr/bin/execsnoop", line 272, in <module>
    b = BPF(text=bpf_text)
        ^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/bcc/__init__.py", line 480, in __init__
    raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
Exception: Failed to compile BPF module <text>
```

### Steps to reproduce

1. `xbps-install bcc-tools`
2. `execsnoop`