Re: Building eBPF programs
* Steve Grubb: >> We certainly do not support building eBPF programs against glibc >> headers. There is no eBPF port of glibc, after all. > > Suricata made it through the Debian/Ubuntu build systems. So, that > leaves me trying to figure out how push this through ours since other > distros did it. It merely appears to work. There will be other things which are broken. Any “#ifdef __x86_64__” in the headers will lead to incorrect preprocessing, for example. That definitely affects kernel UAPI headers, too. A reasonably quick way to fix this needs to focus on the eBPF toolchain. They need to preprocess and analyze the headers as if they were extracting information for an FFI library, i.e., precisely follow the compiler behavior for the host and its ABI. This includes having the correct set of preprocessor defines, the right type sizes and alignments, and the exact same structure layout rules. Thanks, Florian ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Re: Building eBPF programs
On Friday, October 18, 2019 9:59:11 AM EDT Chris Adams wrote: > Once upon a time, Tom Hughes said: > > > Well I imagine clang will define it when targetting x86_64 output > > but in this case he is targetting BPF output instead. > > > > Adding -D__x86_64__ to the command line may be the quickest workaround > > for now though. > > Yes, but in my VERY limited understanding, a given compiled eBPF object > is only for the specific kernel it was compiled against. The kernel > headers define structures differently for different architectures, so to > use them, you have to have the right defines in the compiler. > > There's probably a better way than just using -D__x86_64__ though, since > that would (obviously) only be correct on x86_64. Fedora supports other > architectures, so there should be a more generic way to get the correct > architecture macros defined. Passing the __x86_64__ flag seems to work. At least it works for one arch. -Steve ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Re: Building eBPF programs
Did you check the following? https://patchwork.ozlabs.org/patch/870656/ https://code.forksand.com/oisf/suricata/commit/7906c521cdde5b1d0eb3ce379b8e343c3055653f Iñaki On Fri, 18 Oct 2019 at 15:22, Steve Grubb wrote: > > On Friday, October 18, 2019 4:39:10 AM EDT Florian Weimer wrote: > > * Steve Grubb: > > > I am in the process of building a new version of suricata, an IDS > > > program that watches network traffic. It has a new module that uses eBPF > > > for high speed network packet categorization. When building, it uses the > > > following command: > > > > > > /usr/bin/clang -Wall -Iinclude -O2 \ > > > > > > -I/usr/include/x86_64-linux-gnu/ \ > > > -D__KERNEL__ -D__ASM_SYSREG_H \ > > > -target bpf -S -emit-llvm xdp_lb.c -o xdp_lb.ll > > > > > > It eventually includes /usr/include/features.h which in turn includes > > > /usr/include/gnu/stubs.h. That file has this code: > > > > > > #if !defined __x86_64__ > > > # include > > > #endif > > > > > > I don't think __x86_64__ is defined as the program is aimed at eBPF in > > > the kernel. In rawhide, we no longer have glibc-devel(x86-32) to allow > > > this to resolve. However, I think that the assumption of not having > > > __x86_64__ defined means we are targeting i686 is wrong. What should I do? > > > Do we not support eBPF programs on Fedora? > > > > We certainly do not support building eBPF programs against glibc > > headers. There is no eBPF port of glibc, after all. > > Suricata made it through the Debian/Ubuntu build systems. So, that leaves me > trying to figure out how push this through ours since other distros did it. I > have a feeling that it is not using the 32 bit headers at all. It's the > !defined __86_64__ test that causes the file to be pulled in. > > > You need to figure out why the program includes glibc headers, and avoid > > doing that. It's like any other cross-compilation in this regard. > > It's because eBPF programs are written to access the linux kernel internals. > This means it needs to pull in kernel headers to define data structures. The > full chain of includes that leads to the problem is this: > > /usr/lib64/ccache/clang -Wall -Iinclude -O2 \ > -I/usr/include/x86_64-linux-gnu/ \ > -D__KERNEL__ -D__ASM_SYSREG_H \ > -target bpf -S -emit-llvm xdp_lb.c -o xdp_lb.ll > In file included from xdp_lb.c:26: > In file included from /usr/include/linux/if_tunnel.h:6: > In file included from /usr/include/linux/if.h:28: > In file included from /usr/include/sys/socket.h:22: > In file included from /usr/include/features.h:474: > /usr/include/gnu/stubs.h:7:11: fatal error: 'gnu/stubs-32.h' file not found > # include > ^~~~ > 1 error generated. > > Not sure how to proceed. I suspect this will be a bigger problem as more > people start to take advantage of the eBPF facility. > > -Steve > > ___ > devel mailing list -- devel@lists.fedoraproject.org > To unsubscribe send an email to devel-le...@lists.fedoraproject.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org -- Iñaki Úcar ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Re: Building eBPF programs
On 18/10/2019 14:59, Chris Adams wrote: Once upon a time, Tom Hughes said: Well I imagine clang will define it when targetting x86_64 output but in this case he is targetting BPF output instead. Adding -D__x86_64__ to the command line may be the quickest workaround for now though. Yes, but in my VERY limited understanding, a given compiled eBPF object is only for the specific kernel it was compiled against. The kernel headers define structures differently for different architectures, so to use them, you have to have the right defines in the compiler. Right so clang should probably default to setting the normal host defines when the target is BPF so maybe somebody should open a bug with clang about it... Tom -- Tom Hughes (t...@compton.nu) http://compton.nu/ ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Re: Building eBPF programs
Once upon a time, Tom Hughes said: > Well I imagine clang will define it when targetting x86_64 output > but in this case he is targetting BPF output instead. > > Adding -D__x86_64__ to the command line may be the quickest workaround > for now though. Yes, but in my VERY limited understanding, a given compiled eBPF object is only for the specific kernel it was compiled against. The kernel headers define structures differently for different architectures, so to use them, you have to have the right defines in the compiler. There's probably a better way than just using -D__x86_64__ though, since that would (obviously) only be correct on x86_64. Fedora supports other architectures, so there should be a more generic way to get the correct architecture macros defined. -- Chris Adams ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Re: Building eBPF programs
On 18/10/2019 14:33, Chris Adams wrote: Once upon a time, Steve Grubb said: Not sure how to proceed. I suspect this will be a bigger problem as more people start to take advantage of the eBPF facility. I think the issue is that you are building with clang, not gcc. gcc defines __x86_64__ by default (on the appropriate systems of course), so I expect the kernel headers assume it is defined. You probably would have a number of other issues without the expected gcc macros, since there are other conditionals that expect __x86_64__ (and potentially other gcc macros) to exist. Well I imagine clang will define it when targetting x86_64 output but in this case he is targetting BPF output instead. Adding -D__x86_64__ to the command line may be the quickest workaround for now though. Tom -- Tom Hughes (t...@compton.nu) http://compton.nu/ ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Re: Building eBPF programs
Once upon a time, Steve Grubb said: > Not sure how to proceed. I suspect this will be a bigger problem as more > people start to take advantage of the eBPF facility. I think the issue is that you are building with clang, not gcc. gcc defines __x86_64__ by default (on the appropriate systems of course), so I expect the kernel headers assume it is defined. You probably would have a number of other issues without the expected gcc macros, since there are other conditionals that expect __x86_64__ (and potentially other gcc macros) to exist. I don't know if there's some flag or configuration option to clang to have it define the same common macros as gcc. -- Chris Adams ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Re: Building eBPF programs
On Friday, October 18, 2019 4:39:10 AM EDT Florian Weimer wrote: > * Steve Grubb: > > I am in the process of building a new version of suricata, an IDS > > program that watches network traffic. It has a new module that uses eBPF > > for high speed network packet categorization. When building, it uses the > > following command: > > > > /usr/bin/clang -Wall -Iinclude -O2 \ > > > > -I/usr/include/x86_64-linux-gnu/ \ > > -D__KERNEL__ -D__ASM_SYSREG_H \ > > -target bpf -S -emit-llvm xdp_lb.c -o xdp_lb.ll > > > > It eventually includes /usr/include/features.h which in turn includes > > /usr/include/gnu/stubs.h. That file has this code: > > > > #if !defined __x86_64__ > > # include > > #endif > > > > I don't think __x86_64__ is defined as the program is aimed at eBPF in > > the kernel. In rawhide, we no longer have glibc-devel(x86-32) to allow > > this to resolve. However, I think that the assumption of not having > > __x86_64__ defined means we are targeting i686 is wrong. What should I do? > > Do we not support eBPF programs on Fedora? > > We certainly do not support building eBPF programs against glibc > headers. There is no eBPF port of glibc, after all. Suricata made it through the Debian/Ubuntu build systems. So, that leaves me trying to figure out how push this through ours since other distros did it. I have a feeling that it is not using the 32 bit headers at all. It's the !defined __86_64__ test that causes the file to be pulled in. > You need to figure out why the program includes glibc headers, and avoid > doing that. It's like any other cross-compilation in this regard. It's because eBPF programs are written to access the linux kernel internals. This means it needs to pull in kernel headers to define data structures. The full chain of includes that leads to the problem is this: /usr/lib64/ccache/clang -Wall -Iinclude -O2 \ -I/usr/include/x86_64-linux-gnu/ \ -D__KERNEL__ -D__ASM_SYSREG_H \ -target bpf -S -emit-llvm xdp_lb.c -o xdp_lb.ll In file included from xdp_lb.c:26: In file included from /usr/include/linux/if_tunnel.h:6: In file included from /usr/include/linux/if.h:28: In file included from /usr/include/sys/socket.h:22: In file included from /usr/include/features.h:474: /usr/include/gnu/stubs.h:7:11: fatal error: 'gnu/stubs-32.h' file not found # include ^~~~ 1 error generated. Not sure how to proceed. I suspect this will be a bigger problem as more people start to take advantage of the eBPF facility. -Steve ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Re: Building eBPF programs
* Steve Grubb: > I am in the process of building a new version of suricata, and IDS program > that watches network traffic. It has a new module that uses eBPF for high > speed > network packet categorization. When building, it uses the following command: > > /usr/bin/clang -Wall -Iinclude -O2 \ > -I/usr/include/x86_64-linux-gnu/ \ > -D__KERNEL__ -D__ASM_SYSREG_H \ > -target bpf -S -emit-llvm xdp_lb.c -o xdp_lb.ll > > It eventually includes /usr/include/features.h which in turn includes > /usr/include/gnu/stubs.h. That file has this code: > > #if !defined __x86_64__ > # include > #endif > > I don't think __x86_64__ is defined as the program is aimed at eBPF in the > kernel. In rawhide, we no longer have glibc-devel(x86-32) to allow this to > resolve. However, I think that the assumption of not having __x86_64__ > defined means we are targeting i686 is wrong. What should I do? Do we not > support eBPF programs on Fedora? We certainly do not support building eBPF programs against glibc headers. There is no eBPF port of glibc, after all. You need to figure out why the program includes glibc headers, and avoid doing that. It's like any other cross-compilation in this regard. Thanks, Florian ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Re: Building eBPF programs
On Thu, 17 Oct 2019 22:21:39 +0100 Tom Hughes wrote: > On 17/10/2019 21:39, Steve Grubb wrote: > > On Thursday, October 17, 2019 4:21:44 PM EDT Tom Hughes wrote: > >> On 17/10/2019 20:44, Steve Grubb wrote: > >>> I don't think __x86_64__ is defined as the program is aimed at > >>> eBPF in the > >>> kernel. In rawhide, we no longer have glibc-devel(x86-32) to > >>> allow this to > >>> resolve. However, I think that the assumption of not having > >>> __x86_64__ defined means we are targeting i686 is wrong. What > >>> should I do? Do we not support eBPF programs on Fedora? > >> > >> I can still see glibc-devel.i686 in rawhide which provides that. > > > > In rawhide I got [1]: > > > > No matching package to install: 'glibc-devel(x86-32)' > > > > But on my local system, F30, it works fine. > > I just tried it with mock on F30: > > mock -r fedora-rawhide-x86_64 --install 'glibc-devel(x86-32)' > > and that worked fine. > > >> As far as I know the 32 bit multilib packages aren't going away. > > > > Hmm. I still wonder if the headers might need reworking to not > > assume 32 bit if the target is bpf. > > I don't know enough about how the BPF backend works to be > able to comment on that. I guess the problem will be building in koji, it isn't multi-lib capable. Dan ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Re: Building eBPF programs
On 17/10/2019 21:39, Steve Grubb wrote: On Thursday, October 17, 2019 4:21:44 PM EDT Tom Hughes wrote: On 17/10/2019 20:44, Steve Grubb wrote: I don't think __x86_64__ is defined as the program is aimed at eBPF in the kernel. In rawhide, we no longer have glibc-devel(x86-32) to allow this to resolve. However, I think that the assumption of not having __x86_64__ defined means we are targeting i686 is wrong. What should I do? Do we not support eBPF programs on Fedora? I can still see glibc-devel.i686 in rawhide which provides that. In rawhide I got [1]: No matching package to install: 'glibc-devel(x86-32)' But on my local system, F30, it works fine. I just tried it with mock on F30: mock -r fedora-rawhide-x86_64 --install 'glibc-devel(x86-32)' and that worked fine. As far as I know the 32 bit multilib packages aren't going away. Hmm. I still wonder if the headers might need reworking to not assume 32 bit if the target is bpf. I don't know enough about how the BPF backend works to be able to comment on that. Tom -- Tom Hughes (t...@compton.nu) http://compton.nu/ ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Re: Building eBPF programs
On Thursday, October 17, 2019 4:21:44 PM EDT Tom Hughes wrote: > On 17/10/2019 20:44, Steve Grubb wrote: > > I don't think __x86_64__ is defined as the program is aimed at eBPF in > > the > > kernel. In rawhide, we no longer have glibc-devel(x86-32) to allow this > > to > > resolve. However, I think that the assumption of not having __x86_64__ > > defined means we are targeting i686 is wrong. What should I do? Do we not > > support eBPF programs on Fedora? > > I can still see glibc-devel.i686 in rawhide which provides that. In rawhide I got [1]: No matching package to install: 'glibc-devel(x86-32)' But on my local system, F30, it works fine. > As far as I know the 32 bit multilib packages aren't going away. Hmm. I still wonder if the headers might need reworking to not assume 32 bit if the target is bpf. -Steve [1] - https://kojipkgs.fedoraproject.org//work/tasks/2047/38352047/ mock_output.log ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Re: Building eBPF programs
On 17/10/2019 20:44, Steve Grubb wrote: I don't think __x86_64__ is defined as the program is aimed at eBPF in the kernel. In rawhide, we no longer have glibc-devel(x86-32) to allow this to resolve. However, I think that the assumption of not having __x86_64__ defined means we are targeting i686 is wrong. What should I do? Do we not support eBPF programs on Fedora? I can still see glibc-devel.i686 in rawhide which provides that. As far as I know the 32 bit multilib packages aren't going away. Tom -- Tom Hughes (t...@compton.nu) http://compton.nu/ ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Building eBPF programs
Hello, I am in the process of building a new version of suricata, and IDS program that watches network traffic. It has a new module that uses eBPF for high speed network packet categorization. When building, it uses the following command: /usr/bin/clang -Wall -Iinclude -O2 \ -I/usr/include/x86_64-linux-gnu/ \ -D__KERNEL__ -D__ASM_SYSREG_H \ -target bpf -S -emit-llvm xdp_lb.c -o xdp_lb.ll It eventually includes /usr/include/features.h which in turn includes /usr/include/gnu/stubs.h. That file has this code: #if !defined __x86_64__ # include #endif I don't think __x86_64__ is defined as the program is aimed at eBPF in the kernel. In rawhide, we no longer have glibc-devel(x86-32) to allow this to resolve. However, I think that the assumption of not having __x86_64__ defined means we are targeting i686 is wrong. What should I do? Do we not support eBPF programs on Fedora? Thanks, -Steve ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
