Re: bpf: bpf_probe_read helper restriction on s390x

On Mon, Jul 06, 2020 at 08:33:15AM +0200, Sumanth Korikkar wrote:

Hi Jiri,

s390 has overlapping address space. As suggested by the commit,
ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE should not be enabled for s390
kernel.

This should be changed in bpftrace application.

Even if we enable ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE, bpf_probe_read
will only work in certain cases like kernel pointer deferences (kprobes). 
User pointer deferences in uprobes/kprobes/etc will fail or have some
invalid data

I am looking forward to this fix:
https://github.com/iovisor/bpftrace/pull/1141 OR probe split in bpftrace.

did not see this, will review ;-) thanks a lot!

jirka

(Resending as some cc from my email client failed.)

Thank you

Best Regards
Sumanth Korikkar

quoted

Jiri Olsa [off-list ref] wrote on 07/05/2020 09:42:25 PM:

quoted

Subject: [EXTERNAL] bpf: bpf_probe_read helper restriction on s390x

hi,
with following commit:
  0ebeea8ca8a4 bpf: Restrict bpf_probe_read{, str}() only to archs
where they work

the bpf_probe_read BPF helper is restricted on architectures that
have 'non overlapping address space' and select following config:

   select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE

there's also nice explanation in this commit's changelog:
  6ae08ae3dea2 bpf: Add probe_read_{user, kernel} and probe_read_
{user, kernel}_str helpers


We have a problem with bpftrace not working properly on s390x because
bpf_probe_read is no longer available, and bpftrace does not use
bpf_probe_read_(user/kernel) variants yet.

My question is if s390x is 'arch with overlapping address space' and we
could fix this by adding ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE for

s390x

quoted

or we need to fix bpftrace to detect this, which we probably need to do
in any case ;-)

thanks,
jirka

-- 
Sumanth Korikkar