Bug#849841: [src:linux] bpfcc-tools don't work on 4.8 signed kernels
Hi,
On Sun, Jan 1, 2017 at 10:19 PM, Ben Hutchings <ben@decadent.org.uk> wrote:
> Control: reassign -1 src:linux 4.8.11-1
> Control: severity -1 normal
> Control: tag -1 moreinfo
> The signed and unsigned kernels have exactly the same code. The only
> way they can differe in behaviour is on a system with Secure Boot
> enabled, where the signed one could be bootable (and then disable
> unsigned modules etc.) while the unsigned one does not.
>
> Given that you've been able to boot unsigned kernels, I don't believe
> signing has anything to do with this problem.
>
> You're not comparing the same versions of the signed and unsigned
> kernels, so perhaps there was a regression between 4.7 and 4.8 that was
> corrected between 4.8.11 and 4.8.15. Unfortunately we're not able to
> provide a signed image for 4.8.15-1 as it failed to build on one
> architecture. This should be corrected in the next version.
>
> Please report whether the next update to linux-signed-4.8.0-2-amd64
> fixes this.
>
I think I find the problem, when the kernel header don't match the kernel image,
bpfcc will throw Invalid argument exception, following is my test log:
root@debsidamd64:~# /usr/share/doc/bpfcc-tools/examples/hello_world.py
bpf: Invalid argument
Traceback (most recent call last):
File "/usr/share/doc/bpfcc-tools/examples/hello_world.py", line 11,
in <module>
BPF(text='int kprobe__sys_clone(void *ctx) {
bpf_trace_printk("Hello, World!\\n"); return 0; }').trace_print()
File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 203, in __init__
self._trace_autoload()
File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 679,
in _trace_autoload
fn = self.load_func(func_name, BPF.KPROBE)
File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 243,
in load_func
raise Exception("Failed to load BPF program %s" % func_name)
Exception: Failed to load BPF program kprobe__sys_clone
root@debsidamd64:/home/liang# dpkg -i
linux-headers-4.8.0-2-amd64_4.8.11-1_amd64.deb
linux-headers-4.8.0-2-common_4.8.11-1_amd64.deb
dpkg: 警告: 即将把 linux-headers-4.8.0-2-amd64 从 4.8.15-1 降级到 4.8.11-1
(正在读取数据库 ... 系统当前共安装有 192043 个文件和目录。)
正准备解包 linux-headers-4.8.0-2-amd64_4.8.11-1_amd64.deb ...
正在将 linux-headers-4.8.0-2-amd64 (4.8.11-1) 解包到 (4.8.15-1) 上 ...
dpkg: 警告: 即将把 linux-headers-4.8.0-2-common 从 4.8.15-1 降级到 4.8.11-1
正准备解包 linux-headers-4.8.0-2-common_4.8.11-1_amd64.deb ...
正在将 linux-headers-4.8.0-2-common (4.8.11-1) 解包到 (4.8.15-1) 上 ...
正在设置 linux-headers-4.8.0-2-common (4.8.11-1) ...
正在设置 linux-headers-4.8.0-2-amd64 (4.8.11-1) ...
root@debsidamd64:/home/liang# /usr/share/doc/bpfcc-tools/examples/hello_world.py
sshd-762 [000] d... 275.571167: : Hello, World!
sshd-1750 [000] d... 275.578291: : Hello, World!
console-kit-dae-1088 [000] d... 278.033478: : Hello, World!
root@debsidamd64:/home/liang# dpkg -l |grep 4.8.11
ii linux-headers-4.8.0-2-amd64 4.8.11-1
amd64 Header files for Linux 4.8.0-2-amd64
ii linux-headers-4.8.0-2-common 4.8.11-1
amd64 Common header files for Linux 4.8.0-2
ii linux-image-4.8.0-2-amd64 4.8.11-1
amd64 Linux 4.8 for 64-bit PCs (signed)
It looks not a kernel bug, but a kernel team's bug. If signed and
unsigned kernel use the same header files, they should have the exact
same version in Debian archive.
--
Liang Guo
http://guoliang.me/
Reply to: