Re: [Cake] [bpf-next RFC 2/3] flow_dissector: implements eBPF parser

[Daniel Borkmann <daniel@iogearbox.net>]

On 08/22/2018 11:25 AM, Toke Høiland-Jørgensen wrote:
> Pete Heist <pete@heistp.net> writes:
> 
>> The eBPF verifier seems fragile to me, where I’d be moving lines of
>> code around and getting different error messages in an alien tongue.
> 
> Well, it operates on the byte code and errs on the side of safety. I.e.,
> if it can't prove your program is safe it is going to reject it. Which
> can be less than helpful.
> 
> There's a mode where it can dump its state including the byte code it is
> operating at, which can be helpful in figuring out why you get an error.
> But it has a way to go yet compared with regular compiler error
> messages... :)

There's also llvm-objdump which can dump with annotated BPF C code and
it allows to match the verifier output line number with it. There's a
small example in the doc under LLVM section on how to get there:

https://cilium.readthedocs.io/en/latest/bpf/#llvm