xdp2skb_meta_kern.c 3.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105
  1. /* SPDX-License-Identifier: GPL-2.0
  2. * Copyright (c) 2018 Jesper Dangaard Brouer, Red Hat Inc.
  3. *
  4. * Example howto transfer info from XDP to SKB, e.g. skb->mark
  5. * -----------------------------------------------------------
  6. * This uses the XDP data_meta infrastructure, and is a cooperation
  7. * between two bpf-programs (1) XDP and (2) clsact at TC-ingress hook.
  8. *
  9. * Notice: This example does not use the BPF C-loader (bpf_load.c),
  10. * but instead rely on the iproute2 TC tool for loading BPF-objects.
  11. */
  12. #include <uapi/linux/bpf.h>
  13. #include <uapi/linux/pkt_cls.h>
  14. #include <bpf/bpf_helpers.h>
  15. /*
  16. * This struct is stored in the XDP 'data_meta' area, which is located
  17. * just in-front-of the raw packet payload data. The meaning is
  18. * specific to these two BPF programs that use it as a communication
  19. * channel. XDP adjust/increase the area via a bpf-helper, and TC use
  20. * boundary checks to see if data have been provided.
  21. *
  22. * The struct must be 4 byte aligned, which here is enforced by the
  23. * struct __attribute__((aligned(4))).
  24. */
  25. struct meta_info {
  26. __u32 mark;
  27. } __attribute__((aligned(4)));
  28. SEC("xdp_mark")
  29. int _xdp_mark(struct xdp_md *ctx)
  30. {
  31. struct meta_info *meta;
  32. void *data, *data_end;
  33. int ret;
  34. /* Reserve space in-front of data pointer for our meta info.
  35. * (Notice drivers not supporting data_meta will fail here!)
  36. */
  37. ret = bpf_xdp_adjust_meta(ctx, -(int)sizeof(*meta));
  38. if (ret < 0)
  39. return XDP_ABORTED;
  40. /* Notice: Kernel-side verifier requires that loading of
  41. * ctx->data MUST happen _after_ helper bpf_xdp_adjust_meta(),
  42. * as pkt-data pointers are invalidated. Helpers that require
  43. * this are determined/marked by bpf_helper_changes_pkt_data()
  44. */
  45. data = (void *)(unsigned long)ctx->data;
  46. /* Check data_meta have room for meta_info struct */
  47. meta = (void *)(unsigned long)ctx->data_meta;
  48. if (meta + 1 > data)
  49. return XDP_ABORTED;
  50. meta->mark = 42;
  51. return XDP_PASS;
  52. }
  53. SEC("tc_mark")
  54. int _tc_mark(struct __sk_buff *ctx)
  55. {
  56. void *data = (void *)(unsigned long)ctx->data;
  57. void *data_end = (void *)(unsigned long)ctx->data_end;
  58. void *data_meta = (void *)(unsigned long)ctx->data_meta;
  59. struct meta_info *meta = data_meta;
  60. /* Check XDP gave us some data_meta */
  61. if (meta + 1 > data) {
  62. ctx->mark = 41;
  63. /* Skip "accept" if no data_meta is avail */
  64. return TC_ACT_OK;
  65. }
  66. /* Hint: See func tc_cls_act_is_valid_access() for BPF_WRITE access */
  67. ctx->mark = meta->mark; /* Transfer XDP-mark to SKB-mark */
  68. return TC_ACT_OK;
  69. }
  70. /* Manually attaching these programs:
  71. export DEV=ixgbe2
  72. export FILE=xdp2skb_meta_kern.o
  73. # via TC command
  74. tc qdisc del dev $DEV clsact 2> /dev/null
  75. tc qdisc add dev $DEV clsact
  76. tc filter add dev $DEV ingress prio 1 handle 1 bpf da obj $FILE sec tc_mark
  77. tc filter show dev $DEV ingress
  78. # XDP via IP command:
  79. ip link set dev $DEV xdp off
  80. ip link set dev $DEV xdp obj $FILE sec xdp_mark
  81. # Use iptable to "see" if SKBs are marked
  82. iptables -I INPUT -p icmp -m mark --mark 41 # == 0x29
  83. iptables -I INPUT -p icmp -m mark --mark 42 # == 0x2a
  84. # Hint: catch XDP_ABORTED errors via
  85. perf record -e xdp:*
  86. perf script
  87. */