bpf: bpf_probe_read helper restriction on s390x

bpf: bpf_probe_read helper restriction on s390x

[Jiri Olsa]

hi,
with following commit:
  0ebeea8ca8a4 bpf: Restrict bpf_probe_read{, str}() only to archs where they work

the bpf_probe_read BPF helper is restricted on architectures that
have 'non overlapping address space' and select following config:

   select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE

there's also nice explanation in this commit's changelog:
  6ae08ae3dea2 bpf: Add probe_read_{user, kernel} and probe_read_{user, kernel}_str helpers


We have a problem with bpftrace not working properly on s390x because
bpf_probe_read is no longer available, and bpftrace does not use
bpf_probe_read_(user/kernel) variants yet.

My question is if s390x is 'arch with overlapping address space' and we
could fix this by adding ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE for s390x
or we need to fix bpftrace to detect this, which we probably need to do
in any case ;-)

thanks,
jirka

Re: bpf: bpf_probe_read helper restriction on s390x

[Sumanth Korikkar]

Hi Jiri,

Sorry about the noise. My email seems to be rejected to the list. Resending
with plain text.

s390 has overlapping address space. As suggested by the commit,
ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE should not be enabled for s390 kernel.
This should be changed in bpftrace application.

Even if we enable ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE, bpf_probe_read will
only work in certain cases like kernel pointer deferences (kprobes).  User
pointer deferences in uprobes/kprobes/etc will fail or have some invalid data

I am looking forward to this fix: https://github.com/iovisor/bpftrace/pull/1141
OR probe split in bpftrace.

Thank you

Best Regards
Sumanth

Re: bpf: bpf_probe_read helper restriction on s390x

[Jiri Olsa]

On Mon, Jul 06, 2020 at 08:33:15AM +0200, Sumanth Korikkar wrote:
> Hi Jiri,
> 
> s390 has overlapping address space. As suggested by the commit,
> ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE should not be enabled for s390
> kernel.
> 
> This should be changed in bpftrace application.
> 
> Even if we enable ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE, bpf_probe_read
> will only work in certain cases like kernel pointer deferences (kprobes). 
> User pointer deferences in uprobes/kprobes/etc will fail or have some
> invalid data
> 
> I am looking forward to this fix:
> https://github.com/iovisor/bpftrace/pull/1141 OR probe split in bpftrace.

did not see this, will review ;-) thanks a lot!

jirka

> 
> (Resending as some cc from my email client failed.)
> 
> Thank you
> 
> Best Regards
> Sumanth Korikkar
> > Jiri Olsa <jolsa@redhat.com> wrote on 07/05/2020 09:42:25 PM:
> > 
> > > Subject: [EXTERNAL] bpf: bpf_probe_read helper restriction on s390x
> > >
> > > hi,
> > > with following commit:
> > >   0ebeea8ca8a4 bpf: Restrict bpf_probe_read{, str}() only to archs
> > > where they work
> > >
> > > the bpf_probe_read BPF helper is restricted on architectures that
> > > have 'non overlapping address space' and select following config:
> > >
> > >    select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
> > >
> > > there's also nice explanation in this commit's changelog:
> > >   6ae08ae3dea2 bpf: Add probe_read_{user, kernel} and probe_read_
> > > {user, kernel}_str helpers
> > >
> > >
> > > We have a problem with bpftrace not working properly on s390x because
> > > bpf_probe_read is no longer available, and bpftrace does not use
> > > bpf_probe_read_(user/kernel) variants yet.
> > >
> > > My question is if s390x is 'arch with overlapping address space' and we
> > > could fix this by adding ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE for
> > s390x
> > > or we need to fix bpftrace to detect this, which we probably need to do
> > > in any case ;-)
> > >
> > > thanks,
> > > jirka
> > >
> > 
> -- 
> Sumanth Korikkar
>