0

I've just compiled BPF examples from kernel tools/testing/selftests/bpf and tried to load as explained in http://cilium.readthedocs.io/en/v0.10/bpf/:

% tc filter add dev enp0s1 ingress bpf \
    object-file ./net-next.git/tools/testing/selftests/bpf/sockmap_parse_prog.o \
    section sk_skb1 verbose 
Program section 'sk_skb1' not found in ELF file!
Error fetching program/map!

This happens on Ubuntu 16.04.3 LTS with kernel 4.4.0-98, llvm and clang of version 3.8 installed from packages, iproute2 is the latest from github.

I suspect I'm running into some toolchain/kernel version/features mismatch.

What am I doing wrong?

pchaigno
  • 11,313
  • 2
  • 29
  • 54
Mark
  • 6,052
  • 8
  • 61
  • 129

1 Answers1

1

I do not know why tc complains. On my setup, with a similar command, the program loads. Still, here are some hints:

  • I think the problem might come, as you suggest, from some incompatibility between kernel headers version and iproute2, and that some relocation fails to occur, although on a quick investigation I did not find exactly why it refuses to load the section. On my side I'm using clang-3.8, latest iproute2, but also the latest kernel (some commit close to 4.14).

  • If you manage to load the section somehow, I believe you would still encounter problems when trying to attach the program in the kernel. The feature called “direct packet access” is only present on kernels 4.7 and higher. This is what makes you able to use skb->data and skb->data_end in your programs.

  • Then as a side note, this program sockmap_parse_prog.c is not meant to be used with tc. It is supposed to be attached directly to a socket (search for SOCKMAP_PARSE_PROG in file test_maps.c in the same directory to see how it is loaded there). Technically this does not prevent one to attach the program as a tc filter, but it will probably not work as expected. In particular, the value returned from the program will probably not have a meaning that tc classifier hook will understand.

So I would advise to try with a recent kernel, and to see if you have more success. Alternatively, try compiling and running the examples that you can find in your own kernel sources. Good luck!

Qeole
  • 8,284
  • 1
  • 24
  • 52
  • thanks for your comments. I will have to try build and install latest kernel/ Could you advise what TC-friendly bpf example I should try instead of `sockmap_parse_prog.c` ? – Mark Nov 24 '17 at 01:31
  • Alternatively, you could install a VM with a recent distro, I think Ubuntu 17.04 for example has kernel 4.8? For the samples, maybe you could start by running `samples/bpf/parse_simple.c`, it's a very basic program that seems to drop UDP packets with a given destination port number. Note you also have other samples under `tools/testing/selftests/bpf`. You can grep for `TC_ACT_` return codes to find programs that were written for tc. – Qeole Nov 24 '17 at 12:55