How to use ebpf over dpdk without maps - dpdk

Question

I need to run an ebpf security app over dpdk but don't have maps to do it.
Without dpdk the ebpf app parses every incoming packet 5tuple and other params and compares them with an ebpf map containing ACLs. Packets matching the ACLs are dropped. The map is being dynamically updated with ACLs by a user space app.
However in the dpdk implementation of ebpf there are no maps.
Is there an alternative way to feed the ebpf app with a list of ACL rules and update them dynamically ?

Answer 1

There are no BPF maps in the DPDK implementation of eBPF and no other way to persist state between two runs of the BPF VM. So your best bet is indeed to encode that information into the program itself.

Answer 2

[EDIT-1] for the question Is there an alternative way to feed the ebpf app with a list of ACL rules and update them dynamically ?
[Answer] yes there is, please refer to option-1 below for running eBPF code in dpdk thread context to get access to tables, acl and other huge page cotnext.
There are 2 instances of EBPF in DPDK
running eBPF code in DPDK thread context
Running eBPF with AF_XDP to inject the packet to DPDK process
eBPF in DPDK thread context: is intended to allow user to create sandbox logic that run in DPDK threads or callback achieving goals like dynamic debug, debug counters, special rules etc.
eBPF in AF_XDP: is not part of DPDK logic, but part of kernel packet processing via XDP. Packets that are marked to be sent to DPDK can use AF_XDP sockets via BPF map to sent to DPDK application. The advantage with this approach the NIC interface need not bind with UIO drivers like uio_pci_generic, vfio-pci or igb_uio
Since it is not clear from the question I need to run an ebpf security app over dpdk, please find answers for both
Method-1 (eBPF context on DPDK threads): In this approach, you will rewrite and adopt the XDP ebpf to accept MBUF strcut data (or mtod of MBUF) to access ethernet + payload. EBPF 5 tuple maps need to be converted to lookup either with DPDK API or custom API to compare against packet 5 Tuple. To mimic the same behaviour as eBPF Maps updated via user application, you will need to make use DPDK multiple process (secondary application) to update 5 tuple table entries.
Method-2 (eBPF context in Kernel XDP hooks): using the existing eBPF security app built the binary. Using DPDK AF_XDP load the eBPF binary to the interface. Update the 5 tuple lookup table by BPF API (Python or C or GO) wrapper appropriately (as you are done previously).
Note:
If you are using method-1, To achieve native performance my recommendation is to rewrite the eBPF code DPDK API (since you want to use DPDK). One can leverage HW offloads, multiple queues, PTYPES, RTE_FLOW and there is no overhead to run the sandbox eBPF in the DPDK thread context.
If you are using method-2 Since the action for 5 tuple match is drop I have to assume in case of a match you would be injecting back to kernel. hence DPDK thread is not required. Unless you have specific packets to be processed by DPDK userspace.
The shared userspace can be created with rte_malloc which can be accessed by multiple DPDK process.