aquasecurity/btfhub

pahole cannot generate BTF from SLES 15 kernels

brycekahle opened this issue · 5 comments

brycekahle commented

SP4 doesn't need it because it has BTF embedded, but at least SP1, SP2, and SP3 are affected. See acmel/dwarves#10

You will see no output from pahole --btf-encode-detached.

Even simple queries fail:

$ pahole -C task_struct vmlinux-5.14.21-150400.22.1-default
WARNING: DW_TAG_partial_unit used, some types will not be considered!
         Probably this was optimized using a tool like 'dwz'
         A future version of pahole will support this.
pahole: type 'task_struct' not found

Even objdump doesn't understand it

$ objdump --dwarf=pubtypes vmlinux-5.14.21-150400.22.1-default

vmlinux-5.14.21-150400.22.1-default:     file format elf64-x86-64
brycekahle commented

There is a branch of dwarves that seems to work: https://github.com/acmel/dwarves/tree/alt_dwarf

rafaeldtinoco commented

I'm following acmel/dwarves#10 (comment), feel free to propose a new pahole static binary into tools/bin/arch directory if you think it is worth it (now that we will need a specific version, might be worth).

brycekahle commented

After further investigation, the problem is more complicated. It works with SP3, but doesn't work with 15 SP1 or SP2.

  • 👍1
brycekahle commented

We can definitely explore including a static binary though, that would simplify setup on some distros.

  • 👍1
rafaeldtinoco commented

Latest pahole being installed in Ubuntus:

#95

from the repo. TODO: make it agnostic (through a docker image building both bpftool and pahole ?) and then check if this issue is already fixed with the version being pointed by the pahole submodule.