vmware / vmware/photon

Missing CONFIG_TRACEPOINTS in linux-esx kernels

Open
#1,223 3 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

kernel waiting-for-response
Dominant language
C
Stars
3.2k
Forks
692
PR merge metrics
No merged PRs in 30d

Description

I was trying to have Falco running on Photon OS with linux-esx kernel but it can't work because of the esx kernel config.

root@photon-1d270acad7c [ ~ ]# falco-driver-loader
* Running falco-driver-loader for: falco version=0.29.1, driver version=17f5df52a7d9ed6bb12d3b1768460def8439936d
* Running falco-driver-loader with: driver=module, compile=yes, download=yes
* Unloading falco module, if present
* Trying to load a system falco module, if present
* Looking for a falco module locally (kernel 4.19.198-1.ph3-esx)
* Trying to download a prebuilt falco module from https://download.falco.org/driver/17f5df52a7d9ed6bb12d3b1768460def8439936d/falco_photon_4.19.198-1.ph3-esx_1.ko
curl: (22) The requested URL returned error: 404 Not Found
Unable to find a prebuilt falco module
* Trying to dkms install falco module with GCC /usr/bin/gcc
DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"

Kernel preparation unnecessary for this kernel.  Skipping...

Building module:
cleaning build area...
'/tmp/falco-dkms-make'....
cleaning build area...

DKMS: build completed.

falco.ko.xz:
Running module version sanity check.
 - Original module
   - No original module exists within this kernel
 - Installation
   - Installing to /lib/modules/4.19.198-1.ph3-esx/kernel/extra/

depmod...

DKMS: install completed.
* falco module installed in dkms, trying to insmod
* Unable to insmod falco module
Consider compiling your own falco driver and loading it or getting in touch with the Falco community

So I decided to check the module:

root@photon-1d270acad7c [ ~ ]# insmod /lib/modules/4.19.198-1.ph3-esx/kernel/extra/falco.ko.xz
insmod: ERROR: could not insert module /lib/modules/4.19.198-1.ph3-esx/kernel/extra/falco.ko.xz: Unknown symbol in module
root@photon-1d270acad7c [ ~ ]# cat /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/4.19.198-1.ph3-esx/x86_64/log/make.log 
DKMS make.log for falco-17f5df52a7d9ed6bb12d3b1768460def8439936d for kernel 4.19.198-1.ph3-esx (x86_64)
Wed Aug 11 09:09:40 UTC 2021
'/tmp/falco-dkms-make' -C /lib/modules/4.19.198-1.ph3-esx/build M=/var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build modules
make[1]: Entering directory '/usr/src/linux-headers-4.19.198-1.ph3-esx'
  CC [M]  /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/main.o
  CC [M]  /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/dynamic_params_table.o
  CC [M]  /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/fillers_table.o
  CC [M]  /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/flags_table.o
  CC [M]  /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/ppm_events.o
  CC [M]  /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/ppm_fillers.o
  CC [M]  /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/event_table.o
  CC [M]  /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/syscall_table.o
  CC [M]  /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/ppm_cputime.o
  LD [M]  /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/falco.o
  Building modules, stage 2.
  MODPOST 1 modules
WARNING: "tracepoint_probe_register" [/var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/falco.ko] undefined!
WARNING: "for_each_kernel_tracepoint" [/var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/falco.ko] undefined!
WARNING: "tracepoint_probe_unregister" [/var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/falco.ko] undefined!
  CC      /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/falco.mod.o
  LD [M]  /var/lib/dkms/falco/17f5df52a7d9ed6bb12d3b1768460def8439936d/build/falco.ko
make[1]: Leaving directory '/usr/src/linux-headers-4.19.198-1.ph3-esx'

I searched for tracepoint_probe_register being undefined and I found this. So I checked the kernel config:

root@photon-1d270acad7c [ ~ ]# grep -e CONFIG_TRACEPOINTS -e CONFIG_HAVE_SYSCALL_TRACEPOINTS /boot/config-4.19.198-1.ph3-esx
CONFIG_HAVE_SYSCALL_TRACEPOINTS=y

root@photon-1d270acad7c [ ~ ]# grep -e CONFIG_TRACEPOINTS -e CONFIG_HAVE_SYSCALL_TRACEPOINTS /boot/config-4.19.132-6.ph3 
CONFIG_TRACEPOINTS=y
CONFIG_HAVE_SYSCALL_TRACEPOINTS=y

Even with other esx versions, CONFIG_TRACEPOINTS is not there, while it's available in all the other variants.
Is it expected? Was it done on purpose?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Compare /boot/config-4.19.198-1.ph3-esx with /boot/config-4.19.132-6.ph3 and inspect the ESX kernel configuration for CONFIG_TRACEPOINTS and the reported undefined symbols. Done means determining whether the missing option is intentional and documenting or correcting the ESX configuration so the Falco module can load.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.