Friday, February 4, 2022

[SOLVED] fail to attach eBPF blob

Issue

I've just compiled BPF examples from kernel tools/testing/selftests/bpf and tried to load as explained in http://cilium.readthedocs.io/en/v0.10/bpf/:

% tc filter add dev enp0s1 ingress bpf \
    object-file ./net-next.git/tools/testing/selftests/bpf/sockmap_parse_prog.o \
    section sk_skb1 verbose 
Program section 'sk_skb1' not found in ELF file!
Error fetching program/map!

This happens on Ubuntu 16.04.3 LTS with kernel 4.4.0-98, llvm and clang of version 3.8 installed from packages, iproute2 is the latest from github.

I suspect I'm running into some toolchain/kernel version/features mismatch.

What am I doing wrong?


Solution

I do not know why tc complains. On my setup, with a similar command, the program loads. Still, here are some hints:

  • I think the problem might come, as you suggest, from some incompatibility between kernel headers version and iproute2, and that some relocation fails to occur, although on a quick investigation I did not find exactly why it refuses to load the section. On my side I'm using clang-3.8, latest iproute2, but also the latest kernel (some commit close to 4.14).

  • If you manage to load the section somehow, I believe you would still encounter problems when trying to attach the program in the kernel. The feature called “direct packet access” is only present on kernels 4.7 and higher. This is what makes you able to use skb->data and skb->data_end in your programs.

  • Then as a side note, this program sockmap_parse_prog.c is not meant to be used with tc. It is supposed to be attached directly to a socket (search for SOCKMAP_PARSE_PROG in file test_maps.c in the same directory to see how it is loaded there). Technically this does not prevent one to attach the program as a tc filter, but it will probably not work as expected. In particular, the value returned from the program will probably not have a meaning that tc classifier hook will understand.

So I would advise to try with a recent kernel, and to see if you have more success. Alternatively, try compiling and running the examples that you can find in your own kernel sources. Good luck!



Answered By - Qeole
Answer Checked By - Mildred Charles (WPSolving Admin)
at