static variable in xdp

static variable in xdp

[Benjamin Beckmeyer]

Hi all,

I hope you could help me with a static variable problem in xdp.
Here is my source:

static __u32 last_xid = 0;

static __always_inline int profinet_process_packet(struct xdp_md *ctx, __u64 off) {
    void *data_end = (void *)(long)ctx->data_end;
    void *data = (void *)(long)ctx->data;
    struct profinet_hdr *p_hdr;
    __u16 profinet_frame_id;
//  static __u32 last_xid;

    p_hdr = data + off;

    if (p_hdr + 1 > data_end)
        return XDP_DROP;

    profinet_frame_id = bpf_htons(p_hdr->frame_id);

    if ((profinet_frame_id >= 0x0100 && profinet_frame_id <=0x7fff) ||
        (profinet_frame_id == 0x0020) ||
        (profinet_frame_id == 0xbbff) ||
        (profinet_frame_id == 0xfefc) ||
        (profinet_frame_id == 0xf7ff))
            return XDP_DROP;

    if (p_hdr->xid == last_xid)
        return XDP_DROP;
    else
        last_xid = p_hdr->xid;

    return XDP_PASS;
}

At the moment I'm using kernel version 6.0.2 and iproute2-6.0.0.
I also tried to load the the filter with xdp_loader (xdp_tools).

Output from ip:
$ ip link set dev eth0 xdpgeneric obj xdp_prog_kern.o sec
 eks_filter

Prog section 'eks_filter' rejected: Permission denied (13)!
 - Type:         6
 - Instructions: 48 (0 over limit)
 - License:      GPL

Verifier analysis:

Error fetching program/map!

Output from xdp_loader:
$ ./xdp_loader -deth0 -A --filename xdp_prog_kern.o --pro
gsec eks_filter
libbpf: failed to guess program type based on ELF section name 'eks_filter'
libbpf: supported section(type) names are: socket kprobe/ uprobe/ 
kretprobe/ uretprobe/ classifier action tracepoint/ tp/ raw_tracepoint/ 
raw_tp/ tp_btf/ xdp perf_event lwt_in lwt_out lwt_xmit lwt_seg6local 
cgroup_skb/ingress cgroup_skb/egress cgroup/skb cgroup/sock 
cgroup/post_bind4 cgroup/post_bind6 cgroup/dev sockops sk_skb/stream_parser 
sk_skb/stream_verdict sk_skb sk_msg lirc_mode2 flow_dissector cgroup/bind4 
cgroup/bind6 cgroup/connect4 cgroup/connect6 cgroup/sendmsg4 
cgroup/sendmsg6 cgroup/recvmsg4 cgroup/recvmsg6 cgroup/sysctl 
cgroup/getsockopt cgroup/setsockopt
Success: Loaded BPF-object(xdp_prog_kern.o) and used section(eks_filter)
 - XDP prog attached on device:eth0(ifindex:2)
 - Pinning maps in /sys/fs/bpf/eth0/
libbpf: failed to pin map: Operation not permitted
ERR: pinning maps

With this command it loads something, because after that I lost the profinet 
connection.

I breaked it down to this if clause

    if (p_hdr->xid == last_xid)
        return XDP_DROP;
    else
        last_xid = p_hdr->xid;

if I uncommented the else part

    if (p_hdr->xid == last_xid)
        return XDP_DROP;
//    else
//        last_xid = p_hdr->xid;

it works as expected. Like you see above I also tried to put the variable global
and I set it to volatile too. 

Do I miss another bound checking? I mean p_hdr was already accessed.

Hopefully you could guide me to the correct way or maybe have some hints for me.
If you need any more information, please let me know.

Thanks in advance.

Cheers 
Benjamin

Re: static variable in xdp

[Toke Høiland-Jørgensen]

Benjamin Beckmeyer <beb@eks-engel.de> writes:

> Hi all,
>
> I hope you could help me with a static variable problem in xdp.
> Here is my source:
>
> static __u32 last_xid = 0;
>
> static __always_inline int profinet_process_packet(struct xdp_md *ctx, __u64 off) {
>     void *data_end = (void *)(long)ctx->data_end;
>     void *data = (void *)(long)ctx->data;
>     struct profinet_hdr *p_hdr;
>     __u16 profinet_frame_id;
> //  static __u32 last_xid;
>
>     p_hdr = data + off;
>
>     if (p_hdr + 1 > data_end)
>         return XDP_DROP;
>
>     profinet_frame_id = bpf_htons(p_hdr->frame_id);
>
>     if ((profinet_frame_id >= 0x0100 && profinet_frame_id <=0x7fff) ||
>         (profinet_frame_id == 0x0020) ||
>         (profinet_frame_id == 0xbbff) ||
>         (profinet_frame_id == 0xfefc) ||
>         (profinet_frame_id == 0xf7ff))
>             return XDP_DROP;
>
>     if (p_hdr->xid == last_xid)
>         return XDP_DROP;
>     else
>         last_xid = p_hdr->xid;
>
>     return XDP_PASS;
> }
>
> At the moment I'm using kernel version 6.0.2 and iproute2-6.0.0.
> I also tried to load the the filter with xdp_loader (xdp_tools).
>
> Output from ip:
> $ ip link set dev eth0 xdpgeneric obj xdp_prog_kern.o sec
>  eks_filter
>
> Prog section 'eks_filter' rejected: Permission denied (13)!
>  - Type:         6
>  - Instructions: 48 (0 over limit)
>  - License:      GPL
>
> Verifier analysis:
>
> Error fetching program/map!
>
> Output from xdp_loader:
> $ ./xdp_loader -deth0 -A --filename xdp_prog_kern.o --pro
> gsec eks_filter
> libbpf: failed to guess program type based on ELF section name 'eks_filter'
> libbpf: supported section(type) names are: socket kprobe/ uprobe/ 
> kretprobe/ uretprobe/ classifier action tracepoint/ tp/ raw_tracepoint/ 
> raw_tp/ tp_btf/ xdp perf_event lwt_in lwt_out lwt_xmit lwt_seg6local 
> cgroup_skb/ingress cgroup_skb/egress cgroup/skb cgroup/sock 
> cgroup/post_bind4 cgroup/post_bind6 cgroup/dev sockops sk_skb/stream_parser 
> sk_skb/stream_verdict sk_skb sk_msg lirc_mode2 flow_dissector cgroup/bind4 
> cgroup/bind6 cgroup/connect4 cgroup/connect6 cgroup/sendmsg4 
> cgroup/sendmsg6 cgroup/recvmsg4 cgroup/recvmsg6 cgroup/sysctl 
> cgroup/getsockopt cgroup/setsockopt
> Success: Loaded BPF-object(xdp_prog_kern.o) and used section(eks_filter)
>  - XDP prog attached on device:eth0(ifindex:2)
>  - Pinning maps in /sys/fs/bpf/eth0/
> libbpf: failed to pin map: Operation not permitted
> ERR: pinning maps

This does not look like the output of the xdp-loader from xdp-tools; are
you using the code from the xdp-tutorial? Try using the one from
xdp-tools instead...

Also, there's a hint here:

> libbpf: failed to guess program type based on ELF section name 'eks_filter'

You should use SEC("xdp") for XDP programs instead of custom section
names, those are deprecated...

-Toke

Re: static variable in xdp

[Benjamin Beckmeyer]

Hi Toke,

>> Hi all,
>>
>> I hope you could help me with a static variable problem in xdp.
>> Here is my source:
>>
>> static __u32 last_xid = 0;
>>
>> static __always_inline int profinet_process_packet(struct xdp_md *ctx, __u64 off) {
>>     void *data_end = (void *)(long)ctx->data_end;
>>     void *data = (void *)(long)ctx->data;
>>     struct profinet_hdr *p_hdr;
>>     __u16 profinet_frame_id;
>> //  static __u32 last_xid;
>>
>>     p_hdr = data + off;
>>
>>     if (p_hdr + 1 > data_end)
>>         return XDP_DROP;
>>
>>     profinet_frame_id = bpf_htons(p_hdr->frame_id);
>>
>>     if ((profinet_frame_id >= 0x0100 && profinet_frame_id <=0x7fff) ||
>>         (profinet_frame_id == 0x0020) ||
>>         (profinet_frame_id == 0xbbff) ||
>>         (profinet_frame_id == 0xfefc) ||
>>         (profinet_frame_id == 0xf7ff))
>>             return XDP_DROP;
>>
>>     if (p_hdr->xid == last_xid)
>>         return XDP_DROP;
>>     else
>>         last_xid = p_hdr->xid;
>>
>>     return XDP_PASS;
>> }
>>
>> At the moment I'm using kernel version 6.0.2 and iproute2-6.0.0.
>> I also tried to load the the filter with xdp_loader (xdp_tools).
>>
>> Output from ip:
>> $ ip link set dev eth0 xdpgeneric obj xdp_prog_kern.o sec
>>  eks_filter
>>
>> Prog section 'eks_filter' rejected: Permission denied (13)!
>>  - Type:         6
>>  - Instructions: 48 (0 over limit)
>>  - License:      GPL
>>
>> Verifier analysis:
>>
>> Error fetching program/map!
>>
>> Output from xdp_loader:
>> $ ./xdp_loader -deth0 -A --filename xdp_prog_kern.o --pro
>> gsec eks_filter
>> libbpf: failed to guess program type based on ELF section name 'eks_filter'
>> libbpf: supported section(type) names are: socket kprobe/ uprobe/ 
>> kretprobe/ uretprobe/ classifier action tracepoint/ tp/ raw_tracepoint/ 
>> raw_tp/ tp_btf/ xdp perf_event lwt_in lwt_out lwt_xmit lwt_seg6local 
>> cgroup_skb/ingress cgroup_skb/egress cgroup/skb cgroup/sock 
>> cgroup/post_bind4 cgroup/post_bind6 cgroup/dev sockops sk_skb/stream_parser 
>> sk_skb/stream_verdict sk_skb sk_msg lirc_mode2 flow_dissector cgroup/bind4 
>> cgroup/bind6 cgroup/connect4 cgroup/connect6 cgroup/sendmsg4 
>> cgroup/sendmsg6 cgroup/recvmsg4 cgroup/recvmsg6 cgroup/sysctl 
>> cgroup/getsockopt cgroup/setsockopt
>> Success: Loaded BPF-object(xdp_prog_kern.o) and used section(eks_filter)
>>  - XDP prog attached on device:eth0(ifindex:2)
>>  - Pinning maps in /sys/fs/bpf/eth0/
>> libbpf: failed to pin map: Operation not permitted
>> ERR: pinning maps
> This does not look like the output of the xdp-loader from xdp-tools; are
> you using the code from the xdp-tutorial? Try using the one from
> xdp-tools instead...
>
> Also, there's a hint here:
>
>> libbpf: failed to guess program type based on ELF section name 'eks_filter'
> You should use SEC("xdp") for XDP programs instead of custom section
> names, those are deprecated...
>
> -Toke

thanks for your reply. I forget about one thing. I'm cross compiling the xdp-loader 
for armv7. So far it looks good. I had a little fight with the xdp-loader but it 
seems to work now. The hint with SEC was really good.

It seems that not the xdp program was the problem, it was more the problem which 
tool you use to load it. 

xdp-loader no problem, while ip throws still this output.

Anyways, it works. Thanks for your help.

Cheers 
Benjamin

Re: static variable in xdp

[Toke Høiland-Jørgensen]

Benjamin Beckmeyer <beb@eks-engel.de> writes:

> Hi Toke,
>
>>> Hi all,
>>>
>>> I hope you could help me with a static variable problem in xdp.
>>> Here is my source:
>>>
>>> static __u32 last_xid = 0;
>>>
>>> static __always_inline int profinet_process_packet(struct xdp_md *ctx, __u64 off) {
>>>     void *data_end = (void *)(long)ctx->data_end;
>>>     void *data = (void *)(long)ctx->data;
>>>     struct profinet_hdr *p_hdr;
>>>     __u16 profinet_frame_id;
>>> //  static __u32 last_xid;
>>>
>>>     p_hdr = data + off;
>>>
>>>     if (p_hdr + 1 > data_end)
>>>         return XDP_DROP;
>>>
>>>     profinet_frame_id = bpf_htons(p_hdr->frame_id);
>>>
>>>     if ((profinet_frame_id >= 0x0100 && profinet_frame_id <=0x7fff) ||
>>>         (profinet_frame_id == 0x0020) ||
>>>         (profinet_frame_id == 0xbbff) ||
>>>         (profinet_frame_id == 0xfefc) ||
>>>         (profinet_frame_id == 0xf7ff))
>>>             return XDP_DROP;
>>>
>>>     if (p_hdr->xid == last_xid)
>>>         return XDP_DROP;
>>>     else
>>>         last_xid = p_hdr->xid;
>>>
>>>     return XDP_PASS;
>>> }
>>>
>>> At the moment I'm using kernel version 6.0.2 and iproute2-6.0.0.
>>> I also tried to load the the filter with xdp_loader (xdp_tools).
>>>
>>> Output from ip:
>>> $ ip link set dev eth0 xdpgeneric obj xdp_prog_kern.o sec
>>>  eks_filter
>>>
>>> Prog section 'eks_filter' rejected: Permission denied (13)!
>>>  - Type:         6
>>>  - Instructions: 48 (0 over limit)
>>>  - License:      GPL
>>>
>>> Verifier analysis:
>>>
>>> Error fetching program/map!
>>>
>>> Output from xdp_loader:
>>> $ ./xdp_loader -deth0 -A --filename xdp_prog_kern.o --pro
>>> gsec eks_filter
>>> libbpf: failed to guess program type based on ELF section name 'eks_filter'
>>> libbpf: supported section(type) names are: socket kprobe/ uprobe/ 
>>> kretprobe/ uretprobe/ classifier action tracepoint/ tp/ raw_tracepoint/ 
>>> raw_tp/ tp_btf/ xdp perf_event lwt_in lwt_out lwt_xmit lwt_seg6local 
>>> cgroup_skb/ingress cgroup_skb/egress cgroup/skb cgroup/sock 
>>> cgroup/post_bind4 cgroup/post_bind6 cgroup/dev sockops sk_skb/stream_parser 
>>> sk_skb/stream_verdict sk_skb sk_msg lirc_mode2 flow_dissector cgroup/bind4 
>>> cgroup/bind6 cgroup/connect4 cgroup/connect6 cgroup/sendmsg4 
>>> cgroup/sendmsg6 cgroup/recvmsg4 cgroup/recvmsg6 cgroup/sysctl 
>>> cgroup/getsockopt cgroup/setsockopt
>>> Success: Loaded BPF-object(xdp_prog_kern.o) and used section(eks_filter)
>>>  - XDP prog attached on device:eth0(ifindex:2)
>>>  - Pinning maps in /sys/fs/bpf/eth0/
>>> libbpf: failed to pin map: Operation not permitted
>>> ERR: pinning maps
>> This does not look like the output of the xdp-loader from xdp-tools; are
>> you using the code from the xdp-tutorial? Try using the one from
>> xdp-tools instead...
>>
>> Also, there's a hint here:
>>
>>> libbpf: failed to guess program type based on ELF section name 'eks_filter'
>> You should use SEC("xdp") for XDP programs instead of custom section
>> names, those are deprecated...
>>
>> -Toke
>
> thanks for your reply. I forget about one thing. I'm cross compiling the xdp-loader 
> for armv7. So far it looks good. I had a little fight with the xdp-loader but it 
> seems to work now. The hint with SEC was really good.
>
> It seems that not the xdp program was the problem, it was more the problem which 
> tool you use to load it. 
>
> xdp-loader no problem, while ip throws still this output.
>
> Anyways, it works. Thanks for your help.

Cool! You're welcome! :)

-Toke