jkbs

Fair point, though gauging what is the knowledge-level of your audience is hard. Gotta pick what to include and what to omit if you want to keep it concise.

Any pointers? What would you change?

Xfig, naturally... just kidding ;-) They have been drawn with draw.io.

Glad you liked it. We will keep on writing, if you keep on reading ;-)

Try resubmitting to netfilter mailing list:

http://vger.kernel.org/vger-lists.html#netfilter-devel

The MMIO restrictions make sense. Thanks for the explanation!

If you have the Linux kernel eBPF verifier in mind, it actually has a quite comprehensive test suite:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

Tests for the corner case that has caused the problem have been added shortly after it was fixed:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

Cool idea. I played around with it.

As majke mentioned we need optimizations or the backend compiler will complain:

  $ clang -O0 -target bpf filter_alu32.c -emit-llvm -S -c -o filter_alu32.ll
  $ llc -march=bpf -mattr=+alu32 -filetype=obj filter_alu32.ll
  LLVM ERROR: Unsupported relocation: try to compile with -O2 or above, or check your static variable usage

The code has to be non-trivial to hit the error. I think its the use of eBPF maps that triggers it.

What if we turned off the optimizations in the frontend and ran just the backend optimizer, though? I had some success with this approach:

  $ clang -O0 -target bpf filter_alu32.c -emit-llvm -S -c -o filter_alu32.ll
  $ opt -O2 filter_alu32.ll | llc -march=bpf -mattr=+alu32 -filetype=obj -o filter_alu32.o
  $ llvm-objdump -S filter_alu32.o | grep -e -=
        45:       1c 21 00 00 00 00 00 00         w1 -= w2
        53:       1c 21 00 00 00 00 00 00         w1 -= w2
        65:       1c 21 00 00 00 00 00 00         w1 -= w2

You end up with more eBPF instructions if you don't use the frontend optimizer but the code doesn't need any hacks. Perhaps it can be tweaked further by applying frontend optimizations selectively?

So thanks for the suggestion. It's another working solution.

You can find the code for this experiment here: https://github.com/jsitnicki/cloudflare-blog/commit/acf28b69...