The BPF ethdev packet callback synchronization mechanism expects only
one dataplane thread per port/queue pair at a time. When
RTE_ETH_TX_OFFLOAD_MT_LOCKFREE is enabled, multiple threads can invoke
rte_eth_tx_burst() concurrently on the same queue without locks. This
breaks the callback parity counter and can lead to use-after-free or
deadlocks during BPF program unload.
Reject BPF Tx callback installation with -ENOTSUP when
RTE_ETH_TX_OFFLOAD_MT_LOCKFREE is enabled on the port or queue.
Add a unit test in test_bpf verifying this rejection.
Bugzilla ID: 2051
Fixes: a93ff62a8938 ("bpf: introduce basic Rx/Tx filters")
Cc: [email protected]
Reported-by: Stephen Hemminger <[email protected]>
Signed-off-by: Marat Khalili <[email protected]>
---
app/test/test_bpf.c | 103 ++++++++++++++++++++++++++++++++++++++++++++
lib/bpf/bpf_pkt.c | 46 ++++++++++++++++++++
2 files changed, 149 insertions(+)
diff --git a/app/test/test_bpf.c b/app/test/test_bpf.c
index 3205afaa63..02523984b5 100644
--- a/app/test/test_bpf.c
+++ b/app/test/test_bpf.c
@@ -4617,6 +4617,107 @@ test_bpf_elf_rx_load(load_elf_image_t load_elf_image)
return ret == 0 ? TEST_SUCCESS : TEST_FAILED;
}
+static int
+null_vdev_mt_setup(const char *name, uint16_t *port, struct rte_mempool *pool)
+{
+ struct rte_eth_conf conf = {
+ .txmode = {
+ .offloads = RTE_ETH_TX_OFFLOAD_MT_LOCKFREE,
+ },
+ };
+ struct rte_eth_txconf txconf = { };
+ struct rte_eth_rxconf rxconf = { };
+ int ret;
+
+ ret = rte_vdev_init(name, NULL);
+ TEST_ASSERT(ret == 0, "rte_vdev_init(%s) failed: %d", name, ret);
+
+ ret = rte_eth_dev_get_port_by_name(name, port);
+ TEST_ASSERT(ret == 0, "failed to get port id for %s: %d", name, ret);
+
+ ret = rte_eth_dev_configure(*port, 1, 1, &conf);
+ TEST_ASSERT(ret == 0, "failed to configure port %u: %d", *port, ret);
+
+ ret = rte_eth_tx_queue_setup(*port, 0, BPF_TEST_BURST, SOCKET_ID_ANY,
&txconf);
+ TEST_ASSERT(ret == 0, "failed to setup tx queue port %u: %d", *port,
ret);
+
+ ret = rte_eth_rx_queue_setup(*port, 0, BPF_TEST_BURST, SOCKET_ID_ANY,
+ &rxconf, pool);
+ TEST_ASSERT(ret == 0, "failed to setup rx queue port %u: %d", *port,
ret);
+
+ ret = rte_eth_dev_start(*port);
+ TEST_ASSERT(ret == 0, "failed to start port %u: %d", *port, ret);
+
+ return 0;
+}
+
+/* Test that installing a Tx filter is rejected when MT_LOCKFREE is enabled */
+static int
+test_bpf_elf_tx_mt_lockfree(load_elf_image_t load_elf_image)
+{
+ static const struct rte_bpf_arg prog_arg = {
+ .type = RTE_BPF_ARG_PTR,
+ .size = sizeof(struct dummy_net),
+ };
+ static const char null_dev[] = "net_null_bpf_mt";
+ struct rte_mempool *mb_pool = NULL;
+ struct rte_bpf *bpf = NULL;
+ uint16_t port = UINT16_MAX;
+ int ret;
+
+ mb_pool = rte_pktmbuf_pool_create("bpf_mt_test_pool", BPF_TEST_POOLSIZE,
+ 0, 0, RTE_MBUF_DEFAULT_BUF_SIZE,
+ SOCKET_ID_ANY);
+ TEST_ASSERT_NOT_NULL(mb_pool, "failed to create mempool");
+
+ ret = null_vdev_mt_setup(null_dev, &port, mb_pool);
+ if (ret != 0)
+ goto fail;
+
+ bpf = load_elf_image(app_test_bpf_filter_o, app_test_bpf_filter_o_len,
"filter",
+ NULL, 0, &prog_arg);
+ if (bpf == NULL) {
+ printf("%s@%d: failed to load BPF filter image\n",
+ __func__, __LINE__);
+ ret = TEST_FAILED;
+ goto fail;
+ }
+
+ /* Tx installation must fail with -ENOTSUP due to MT_LOCKFREE */
+ ret = rte_bpf_eth_tx_install(port, 0, bpf, 0);
+ if (ret != -ENOTSUP) {
+ printf("%s@%d: expected rte_bpf_eth_tx_install to return
-ENOTSUP, got %d\n",
+ __func__, __LINE__, ret);
+ ret = TEST_FAILED;
+ goto fail;
+ }
+
+ /* Rx installation on the same port must still succeed */
+ ret = rte_bpf_eth_rx_install(port, 0, bpf, 0);
+ if (ret != 0) {
+ printf("%s@%d: expected rte_bpf_eth_rx_install to succeed, got
%d\n",
+ __func__, __LINE__, ret);
+ ret = TEST_FAILED;
+ goto fail;
+ }
+ rte_bpf_eth_rx_unload(port, 0);
+ /* bpf is destroyed by rte_bpf_eth_rx_unload */
+ bpf = NULL;
+
+ ret = TEST_SUCCESS;
+
+fail:
+ if (bpf != NULL)
+ rte_bpf_destroy(bpf);
+
+ if (port != UINT16_MAX) {
+ rte_eth_dev_stop(port);
+ rte_vdev_uninit(null_dev);
+ }
+
+ rte_mempool_free(mb_pool);
+ return ret;
+}
static int
test_bpf_elf(void)
@@ -4633,6 +4734,8 @@ test_bpf_elf(void)
ret = test_bpf_elf_load(elf_image_loaders[li]);
if (ret == TEST_SUCCESS)
ret = test_bpf_elf_tx_load(elf_image_loaders[li]);
+ if (ret == TEST_SUCCESS)
+ ret =
test_bpf_elf_tx_mt_lockfree(elf_image_loaders[li]);
if (ret == TEST_SUCCESS)
ret = test_bpf_elf_rx_load(elf_image_loaders[li]);
}
diff --git a/lib/bpf/bpf_pkt.c b/lib/bpf/bpf_pkt.c
index 4223ef624e..eab85f7417 100644
--- a/lib/bpf/bpf_pkt.c
+++ b/lib/bpf/bpf_pkt.c
@@ -552,6 +552,48 @@ rte_bpf_eth_tx_unload(uint16_t port, uint16_t queue)
rte_spinlock_unlock(&cbh->lock);
}
+/*
+ * Check if the supplied port/queue pair is suitable for BPF callback
execution.
+ */
+static int
+bpf_eth_check_mt(const struct bpf_eth_cbh *cbh, uint16_t port, uint16_t queue)
+{
+ struct rte_eth_txq_info qinfo;
+ struct rte_eth_conf conf;
+ int ret;
+
+ if (cbh->type == BPF_ETH_TX) {
+ ret = rte_eth_dev_conf_get(port, &conf);
+ if (ret != 0) {
+ RTE_BPF_LOG_LINE(ERR,
+ "%s(%u, %u): failed to get device
configuration: %d;",
+ __func__, port, queue, ret);
+ return ret;
+ }
+
+ if ((conf.txmode.offloads & RTE_ETH_TX_OFFLOAD_MT_LOCKFREE) !=
0) {
+ RTE_BPF_LOG_LINE(ERR,
+ "%s(%u, %u): MT_LOCKFREE Tx offload is enabled
on port;",
+ __func__, port, queue);
+ return -ENOTSUP;
+ }
+
+ /*
+ * Ignore errors from tx_queue_info_get: the PMD might not
implement
+ * txq_info_get (e.g. net/null), or the queue might not be set
up yet.
+ */
+ if (rte_eth_tx_queue_info_get(port, queue, &qinfo) == 0 &&
+ (qinfo.conf.offloads &
RTE_ETH_TX_OFFLOAD_MT_LOCKFREE) != 0) {
+ RTE_BPF_LOG_LINE(ERR,
+ "%s(%u, %u): MT_LOCKFREE Tx offload is enabled
on queue;",
+ __func__, port, queue);
+ return -ENOTSUP;
+ }
+ }
+
+ return 0;
+}
+
static int
bpf_eth_elf_install(struct bpf_eth_cbh *cbh, uint16_t port, uint16_t queue,
struct rte_bpf *bpf, uint32_t flags)
@@ -572,6 +614,10 @@ bpf_eth_elf_install(struct bpf_eth_cbh *cbh, uint16_t
port, uint16_t queue,
if (bpf->prm.nb_prog_arg != 1)
return -EINVAL;
+ rc = bpf_eth_check_mt(cbh, port, queue);
+ if (rc != 0)
+ return rc;
+
if (cbh->type == BPF_ETH_RX)
frx = select_rx_callback(bpf->prm.prog_arg[0].type, flags);
else
--
2.43.0
