Hello, On Sun, 2016-06-12 at 20:35 +0200, Daniel Borkmann wrote: > On 06/12/2016 07:37 PM, Eric Leblond wrote: > > On Thu, 2016-06-09 at 17:34 -0700, Alexei Starovoitov wrote: > > > On Thu, Jun 09, 2016 at 11:10:05PM +0200, Eric Leblond wrote: > > > > Hello, > > > > > > > > I'm working on integrating ebpf cluster load balancing for > > > > AF_PACKET > > > > and I've got some problem to get real code inside the EBPF > > > > filter. > > > > > > > > I've tried different command lines in the build process. One of > > > > them > > > > is: > > > > clang-3.9 -Wall -O2 -emit-llvm -c hash_ports.c -o - | llc-3.9 > > > > -march=bpf -filetype=obj -o hash_ports.bpf > > > > > > > > If I use that one, then the generated code is almost void. If I > > > > remove > > > > the -O2 then I've got a generated code that fails during load. > > > > When > > > > not > > > > using -O2, I manage to load a trivial filter (return of static > > > > value). > > > > > > > > The C code is the following (a derivative of http-simple- > > > > filter.c > > > > used > > > > for testing): > > > > > > > > int filter(struct __sk_buff *skb) { > > > > uint8_t *cursor = 0; > > > > struct ethernet_t *ethernet = cursor_advance(cursor, > > > > sizeof(*ethernet)); > > > > > > this is bcc C syntax that is hiding the explicit > > > load_byte/half/word > > > operations > > > we have to do when using plain C. > > > If you want to compile C code with clang -O2 -target bpf file.c > > > -c -o > > > file.o > > > and copy .o around to be used in tc like: > > > tc filter add dev eth0 ingress bpf da obj file.o > > > then plain C should be used like in all samples/bpf/*_kern.c > > > examples. > > > Other folks like the convenience of bcc that hides clang/llvm > > > invocation. > > > It mostly applicable to tracing tools where both bcc-C and > > > corresponding python or lua bits are in the same file > > > like in iovisor/bcc/tools/* scripts. > > > The iovisor/bcc/examples/networking/* (where this http-simple- > > > filter.c came from) > > > are also suitable for networking and relying on pyroute2 to talk > > > to > > > kernel to create netns, veth and to attach bpf to qdisc. > > > > > > In summary there are several ways to write bpf C code: > > > 1. plain C syntax as in samples/bpf/*_kern.c > > > Pro: compiles with clang into .o > > > Con: .o requires elf loader (integrated into tc already for > > > networking), > > > > Yes, that's not an easy part. I've devel one loader for suricata > > but I > > will check the one in tc to see if I can take advantage of it. > > Sure, feel free to rip it out and adapt it. > > With AF_PACKET load balancing you mean a packet fanout eBPF demuxing > or > something else controlled via tc ingress?
I'm using fanout eBPF demuxing to implement load balancing in Suricata. Current alpha level code is here: https://github.com/regit/suricata/commit/f299abe90bfed3590a9f3de1179091 b7afc2d90c I'm currently working on the demuxing to implement something more realistic than what current demuxing function. > > If packet fanout, then you also need to adapt the program type into > BPF_PROG_TYPE_SOCKET_FILTER. Yes, already done that (or at least it seems to work). BR, -- Eric Leblond <e...@regit.org>