From: Konstantin Ananyev <konstantin.ananyev@huawei.com>
To: Stephen Hemminger <stephen@networkplumber.org>
Cc: Konstantin Ananyev <konstantin.v.ananyev@yandex.ru>,
"dev@dpdk.org" <dev@dpdk.org>
Subject: RE: BPF standardization
Date: Fri, 19 Jul 2024 18:29:12 +0000 [thread overview]
Message-ID: <cf8eb2eba0e6403db2c3403c503b43f5@huawei.com> (raw)
In-Reply-To: <20240719101323.5e880752@hermes.local>
> This was taken from how kernel converts cBPF and the prologue it generates.
> Surprising that verifier gags?
Indeed it looks strange...
Have to admit I didn't dig into how linux converter works...
Below is the patch I used to test it from DPDK UT - might be you'll spot something obvious here.
================
Subject: [PATCH 2/2] test/bpf: call linux verifier for converted cBPF filter
To ensure DPDK/kernel compatibility for converted cBPF filters, etc.
Signed-off-by: Konstantin Ananyev <konstantin.ananyev@huawei.com>
---
app/test/meson.build | 1 +
app/test/test_bpf.c | 11 +++++++++
app/test/test_bpf.h | 12 ++++++++++
app/test/test_bpf_verify_linux.c | 39 ++++++++++++++++++++++++++++++++
4 files changed, 63 insertions(+)
create mode 100644 app/test/test_bpf.h
create mode 100644 app/test/test_bpf_verify_linux.c
diff --git a/app/test/meson.build b/app/test/meson.build
index e29258e6ec..d46e688db5 100644
--- a/app/test/meson.build
+++ b/app/test/meson.build
@@ -35,6 +35,7 @@ source_file_deps = {
'test_bitops.c': [],
'test_bitratestats.c': ['metrics', 'bitratestats', 'ethdev'] + sample_packet_forward_deps,
'test_bpf.c': ['bpf', 'net'],
+ 'test_bpf_verify_linux.c': [],
'test_byteorder.c': [],
# 'test_cfgfile.c': ['cfgfile'],
'test_cksum.c': ['net'],
diff --git a/app/test/test_bpf.c b/app/test/test_bpf.c
index 7819d6aba9..749f9de20c 100644
--- a/app/test/test_bpf.c
+++ b/app/test/test_bpf.c
@@ -15,6 +15,7 @@
#include <rte_byteorder.h>
#include <rte_errno.h>
#include "test.h"
+#include "test_bpf.h"
#if !defined(RTE_LIB_BPF)
@@ -3431,10 +3432,13 @@ static const char * const sample_filters[] = {
static int
test_bpf_filter(pcap_t *pcap, const char *s)
{
+ int32_t rc;
struct bpf_program fcode;
struct rte_bpf_prm *prm = NULL;
struct rte_bpf *bpf = NULL;
+ static char logbuf[UINT16_MAX + 1];
+
if (pcap_compile(pcap, &fcode, s, 1, PCAP_NETMASK_UNKNOWN)) {
printf("%s@%d: pcap_compile('%s') failed: %s;\n",
__func__, __LINE__, s, pcap_geterr(pcap));
@@ -3451,6 +3455,13 @@ test_bpf_filter(pcap_t *pcap, const char *s)
printf("bpf convert for \"%s\" produced:\n", s);
rte_bpf_dump(stdout, prm->ins, prm->nb_ins);
+ rc = bpf_linux_verify(prm, logbuf, sizeof(logbuf));
+ printf("%s@%d: linux verifier reports: %d(%s);\n",
+ __func__, __LINE__, rc, strerror(-rc));
+ printf("linux verifier log: %s\n", logbuf);
+ if (rc != 0)
+ goto error;
+
bpf = rte_bpf_load(prm);
if (bpf == NULL) {
printf("%s@%d: failed to load bpf code, error=%d(%s);\n",
diff --git a/app/test/test_bpf.h b/app/test/test_bpf.h
new file mode 100644
index 0000000000..e5be2be920
--- /dev/null
+++ b/app/test/test_bpf.h
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef _TEST_BPF_H_
+#define _TEST_BPF_H_
+
+#include <rte_bpf.h>
+
+int bpf_linux_verify(const struct rte_bpf_prm *prm, char *logbuf,
+ uint32_t lbsz);
+
+#endif
diff --git a/app/test/test_bpf_verify_linux.c b/app/test/test_bpf_verify_linux.c
new file mode 100644
index 0000000000..2a42d61fb5
--- /dev/null
+++ b/app/test/test_bpf_verify_linux.c
@@ -0,0 +1,39 @@
+/* SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <stdint.h>
+#include <inttypes.h>
+#include <linux/bpf.h>
+#include <unistd.h>
+#include <sys/syscall.h>
+
+#include "test_bpf.h"
+
+int
+bpf_linux_verify(const struct rte_bpf_prm *prm, char *logbuf, uint32_t lbsz)
+{
+ int32_t rc;
+ union bpf_attr attr;
+
+ memset(&attr, 0, sizeof(attr));
+ attr.prog_type = BPF_PROG_TYPE_SOCKET_FILTER;
+ attr.insn_cnt = prm->nb_ins;
+ attr.insns = (uintptr_t)prm->ins;
+ attr.license = (uintptr_t)"GPL";
+ attr.log_buf = (uintptr_t)logbuf;
+ attr.log_size = lbsz;
+ attr.log_level = (logbuf == NULL) ? 0 : 3;
+
+ rc = syscall(SYS_bpf, BPF_PROG_LOAD, &attr, sizeof(attr));
+ if (rc < 0)
+ rc = -errno;
+ else {
+ /* closed fd for BPF prog */
+ close(rc);
+ rc = 0;
+ }
+
+ return rc;
+}
--
2.35.3
prev parent reply other threads:[~2024-07-19 18:29 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-30 23:23 Stephen Hemminger
2024-07-19 9:12 ` Konstantin Ananyev
2024-07-19 17:13 ` Stephen Hemminger
2024-07-19 18:29 ` Konstantin Ananyev [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cf8eb2eba0e6403db2c3403c503b43f5@huawei.com \
--to=konstantin.ananyev@huawei.com \
--cc=dev@dpdk.org \
--cc=konstantin.v.ananyev@yandex.ru \
--cc=stephen@networkplumber.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).