** Description changed: - We need to run BPF filters to analyse and monitor network traffic. The - BPF filters are created by skydive (http://skydive.network). Currently - skydive fails to install BPF filters on s390x (using Ubuntu 18.04 - currently, soon moving to Ubuntu 20.04). + [Impact] + Some bpf programs will fail to execute on s390x, returning EFAULT when they should be able to read user memory. + + [Test case] + apt-get source linux + mkdir -p /usr/lib/perf/ + cp -a linux-5.4.0/tools/perf/include /usr/lib/perf/ + probe_read=$(grep -w probe_read /usr/lib/perf/include/bpf/bpf.h) + probe_read_user=${probe_read//read/read_user} + sed -i "/probe_read)/i$probe_read_user" /usr/lib/perf/include/bpf/bpf.h + probe_read_user_str=${probe_read//read/read_user_str} + sed -i "/probe_read)/i$probe_read_user_str" /usr/lib/perf/include/bpf/bpf.h + + ed - linux-5.4.0/tools/perf/examples/bpf/augmented_raw_syscalls.c << EOF + 100c + int string_len = probe_read_user_str(&augmented_arg->value, arg_len, arg); + . + w + EOF + perf trace -eopenat,augmented_raw_syscalls.c cat /etc/passwd > /dev/null + + You should see: + 0.332 ( 0.002 ms): cat/3223 openat(dfd: CWD, filename: "/etc/passwd") = 3 + instead of + 0.334 ( 0.003 ms): cat/3739 openat(dfd: CWD, filename: "") = 3 + + [Potential regressions] + One potential regression is that unprivileged code can be able to exploit the changes to read or write kernel memory. + + + -------------------------------------------------------------------------- + + + We need to run BPF filters to analyse and monitor network traffic. The BPF filters are created by skydive (http://skydive.network). Currently skydive fails to install BPF filters on s390x (using Ubuntu 18.04 currently, soon moving to Ubuntu 20.04). Because of these failures, we decided to try the BPF samples that come with the kernel first. These samples also fail on s390x while they work fine on Intel. shense@boe-build:~/bionic/samples/bpf$ uname -a Linux boe-build 4.15.0-112-generic #113-Ubuntu SMP Thu Jul 9 23:40:36 UTC 2020 s390x s390x s390x GNU/Linux Example instructions: sudo apt install -y dpkg-dev clang llvm libelf-dev sudo apt-get source linux-image-unsigned-$(uname -r) cd linux-4.15.0/ make headers_install make samples/bpf/ Errors: shense@boe-build:~/bionic/samples/bpf$ sudo ./test_map_in_map [sudo] password for shense: invalid relo for insn[4].code 0x85 bpf_load_program() err=22 0: (bf) r7 = r1 1: (b7) r1 = 0 2: (63) *(u32 *)(r10 -32) = r1 3: (bf) r1 = r7 4: (85) call unknown#-1 BPF_CALL uses reserved fields 0: (bf) r7 = r1 1: (b7) r1 = 0 2: (63) *(u32 *)(r10 -32) = r1 3: (bf) r1 = r7 4: (85) call unknown#-1 BPF_CALL uses reserved fields - shense@boe-build:~/bionic/samples/bpf$ sudo ./map_perf_test invalid relo for insn[22].code 0x85 bpf_load_program() err=22 0: (bf) r7 = r1 1: (18) r1 = 0x207265743a25646e 3: (7b) *(u64 *)(r10 -16) = r1 4: (18) r1 = 0x705f616c6c6f632e 6: (7b) *(u64 *)(r10 -24) = r1 7: (18) r1 = 0x5f6c72755f686d61 9: (7b) *(u64 *)(r10 -32) = r1 10: (18) r1 = 0x7420737472657373 12: (7b) *(u64 *)(r10 -40) = r1 13: (18) r1 = 0x4661696c65642061 15: (7b) *(u64 *)(r10 -48) = r1 16: (b7) r1 = 0 17: (73) *(u8 *)(r10 -8) = r1 18: (b7) r2 = 1 19: (7b) *(u64 *)(r10 -72) = r2 20: (63) *(u32 *)(r10 -76) = r1 21: (bf) r1 = r7 22: (85) call unknown#-1 BPF_CALL uses reserved fields 0: (bf) r7 = r1 1: (18) r1 = 0x207265743a25646e 3: (7b) *(u64 *)(r10 -16) = r1 4: (18) r1 = 0x705f616c6c6f632e 6: (7b) *(u64 *)(r10 -24) = r1 7: (18) r1 = 0x5f6c72755f686d61 9: (7b) *(u64 *)(r10 -32) = r1 10: (18) r1 = 0x7420737472657373 12: (7b) *(u64 *)(r10 -40) = r1 13: (18) r1 = 0x4661696c65642061 15: (7b) *(u64 *)(r10 -48) = r1 16: (b7) r1 = 0 17: (73) *(u8 *)(r10 -8) = r1 18: (b7) r2 = 1 19: (7b) *(u64 *)(r10 -72) = r2 20: (63) *(u32 *)(r10 -76) = r1 21: (bf) r1 = r7 22: (85) call unknown#-1 BPF_CALL uses reserved fields
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1888507 Title: [UBUNTU 18.04] BPF programs fail on Ubuntu s390x To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-z-systems/+bug/1888507/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
