Add eBPF support to ubuntu:22.04 -kvm variant kernel

[Thomas Parrott]

[ Impact ]

Unable to run k8s and other software relying on Cilium.

[ Fix ]

Enable required configs and prerequisite.
Which consist of:
CONFIG_BPF_JIT
CONFIG_BPF_JIT_DEFAULT_ON
CONFIG_NET_EGRESS
CONFIG_NET_SCHED
CONFIG_NET_SCH_INGRESS
CONFIG_NET_CLS
CONFIG_NET_CLS_CGROUP
CONFIG_NET_CLS_BPF
CONFIG_NET_CLS_ACT
CONFIG_NET_SCH_FIFO
CONFIG_CRYPTO_USER_API
CONFIG_CRYPTO_USER_API_HASH
CONFIG_SCHEDSTATS

These configs are already enabled in generic kernel.

[ Test Plan ]

Tested with Cilium successfully.

[ Where problems could occur ]

eBPF misbehavior.
Network regression due to enable network configuration.

[Thibf (thibf)]

@tomparrot I see there is also other BPF options that are diverging from generic and disabled.
Can you share if any of them would be needed ?
As we are in SRU context, I want to keep the minimal set of changes.
- CONFIG_BPF_LSM
Enable BPF LSM Instrumentation
- CONFIG_BPF_STREAM_PARSER
enable BPF STREAM_PARSER
- CONFIG_BPF_KPROBE_OVERRIDE
Enable BPF programs to override a kprobed function
- CONFIG_IPV6_SEG6_BPF
- CONFIG_NET_ACT_BPF
Say Y here to execute BPF code on packets. The BPF code will decide
if the packet should be dropped or not.
- CONFIG_NET_CLS_BPF
If you say Y here, you will be able to classify packets based on
programmable BPF (JIT'ed) filters as an alternative to ematches.
- CONFIG_USERMODE_DRIVER
This builds kernel module with several embedded BPF programs that are
pinned into BPF FS mount point as human readable files that are
useful in debugging and introspection of BPF programs and maps.

By default I would enable all network ones, but your opinion would be appreciated.

[Thomas Parrott (tomparrott)]

Yes, if you could bring them as close as possible to the generic options that would be great.

[Jon Seager (jnsgruk)]

Hey - I initially raised this with @tomparrott because our new K8s uses Cilium by default, and it felt wonky that it couldn't be deployed on LXD VMs.

The requirements for Cilium are on this page: https://docs.cilium.io/en/stable/operations/system_requirements/#base-requirements

That said, Tom's point about being as close to possible to generic seems valid, given that I was able to deploy to LXD machines that had the generic kernel deployed :)

[Thibf (thibf)]

Unfortunately matching the generic kernel configuration isn't a possibility, that would introduce too much changes, I did push for this before without success.
However, for k8s here, it results in 13 configs which should be ok.
Here is all that I enabled :
    CONFIG_BPF_JIT
    CONFIG_BPF_JIT_DEFAULT_ON
    CONFIG_NET_EGRESS
    CONFIG_NET_SCHED
    CONFIG_NET_SCH_INGRESS
    CONFIG_NET_CLS
    CONFIG_NET_CLS_CGROUP
    CONFIG_NET_CLS_BPF
    CONFIG_NET_CLS_ACT
    CONFIG_NET_SCH_FIFO
    CONFIG_CRYPTO_USER_API
    CONFIG_CRYPTO_USER_API_HASH
    CONFIG_SCHEDSTATS

Could you try the resulting kernel ? It's available here : https://people.canonical.com/~thibf/2073973/

[Jon Seager (jnsgruk)]

Hey! Thank you for the quick turnaround - confirmed that I was able to start a 22.04 LTS VM on LXD, then install the linux-image and linux-modules debs and both Cilium and Parca Agent functioned correctly wrt to the BPF subsystem!

[Thibf (thibf)]

Patch submitted: https://lists.ubuntu.com/archives/kernel-team/2024-July/152466.html

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-kvm/5.15.0-1066.71 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-kvm' to 'verification-done-jammy-linux-kvm'. If the problem still exists, change the tag 'verification-needed-jammy-linux-kvm' to 'verification-failed-jammy-linux-kvm'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-kvm - 5.15.0-1066.71

---------------
linux-kvm (5.15.0-1066.71) jammy; urgency=medium

  * jammy/linux-kvm: 5.15.0-1066.71 -proposed tracker (LP: #2075889)

  * Jammy update: v5.15.162 upstream stable release (LP: #2073765)
    - [Config] kvm: Enable CONFIG_SCSI_SAS_ATTRS

  * Add eBPF support to ubuntu:22.04 -kvm variant kernel (LP: #2073973)
    - [Config] kvm: Enable minimal subset of config for k8s support

  [ Ubuntu: 5.15.0-121.131 ]

  * jammy/linux: 5.15.0-121.131 -proposed tracker (LP: #2076347)
  * jammy:linux bpf selftest do not build (LP: #2076334)
    - SAUCE: Revert "bpf: Allow reads from uninit stack"

  [ Ubuntu: 5.15.0-120.130 ]

  * jammy/linux: 5.15.0-120.130 -proposed tracker (LP: #2075903)
  * Packaging resync (LP: #1786013)
    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
      (main/2024.08.05)
  * Jammy update: v5.15.163 upstream stable release (LP: #2075170)
    - Compiler Attributes: Add __uninitialized macro
    - locking/mutex: Introduce devm_mutex_init()
    - drm/lima: fix shared irq handling on driver remove
    - media: dvb: as102-fe: Fix as10x_register_addr packing
    - media: dvb-usb: dib0700_devices: Add missing release_firmware()
    - IB/core: Implement a limit on UMAD receive List
    - scsi: qedf: Make qedf_execute_tmf() non-preemptible
    - crypto: aead,cipher - zeroize key buffer after use
    - drm/amdgpu: Initialize timestamp for some legacy SOCs
    - drm/amd/display: Check index msg_id before read or write
    - drm/amd/display: Check pipe offset before setting vblank
    - drm/amd/display: Skip finding free audio for unknown engine_id
    - media: dw2102: Don't translate i2c read into write
    - sctp: prefer struct_size over open coded arithmetic
    - firmware: dmi: Stop decoding on broken entry
    - Input: ff-core - prefer struct_size over open coded arithmetic
    - wifi: mt76: replace skb_put with skb_put_zero
    - net: dsa: mv88e6xxx: Correct check for empty list
    - media: dvb-frontends: tda18271c2dd: Remove casting during div
    - media: s2255: Use refcount_t instead of atomic_t for num_channels
    - media: dvb-frontends: tda10048: Fix integer overflow
    - i2c: i801: Annotate apanel_addr as __ro_after_init
    - powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
    - orangefs: fix out-of-bounds fsid access
    - kunit: Fix timeout message
    - powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
    - igc: fix a log entry using uninitialized netdev
    - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
    - jffs2: Fix potential illegal address access in jffs2_free_inode
    - s390/pkey: Wipe sensitive data on failure
    - tools/power turbostat: Remember global max_die_id
    - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
    - tcp_metrics: validate source addr length
    - KVM: s390: fix LPSWEY handling
    - e1000e: Fix S0ix residency on corporate systems
    - net: allow skb_datagram_iter to be called from any context
    - wifi: wilc1000: fix ies_len type in connect path
    - riscv: kexec: Avoid deadlock in kexec crash path
    - netfilter:...