xdp2skb_meta_kern.c

  1/* SPDX-License-Identifier: GPL-2.0
  2 * Copyright (c) 2018 Jesper Dangaard Brouer, Red Hat Inc.
  3 *
  4 * Example howto transfer info from XDP to SKB, e.g. skb->mark
  5 * -----------------------------------------------------------
  6 * This uses the XDP data_meta infrastructure, and is a cooperation
  7 * between two bpf-programs (1) XDP and (2) clsact at TC-ingress hook.
  8 *
  9 * Notice: This example does not use the BPF C-loader,
 10 * but instead rely on the iproute2 TC tool for loading BPF-objects.
 11 */
 12#include <uapi/linux/bpf.h>
 13#include <uapi/linux/pkt_cls.h>
 14
 15#include <bpf/bpf_helpers.h>
 16
 17/*
 18 * This struct is stored in the XDP 'data_meta' area, which is located
 19 * just in-front-of the raw packet payload data.  The meaning is
 20 * specific to these two BPF programs that use it as a communication
 21 * channel.  XDP adjust/increase the area via a bpf-helper, and TC use
 22 * boundary checks to see if data have been provided.
 23 *
 24 * The struct must be 4 byte aligned, which here is enforced by the
 25 * struct __attribute__((aligned(4))).
 26 */
 27struct meta_info {
 28	__u32 mark;
 29} __attribute__((aligned(4)));
 30
 31SEC("xdp_mark")
 32int _xdp_mark(struct xdp_md *ctx)
 33{
 34	struct meta_info *meta;
 35	void *data;
 36	int ret;
 37
 38	/* Reserve space in-front of data pointer for our meta info.
 39	 * (Notice drivers not supporting data_meta will fail here!)
 40	 */
 41	ret = bpf_xdp_adjust_meta(ctx, -(int)sizeof(*meta));
 42	if (ret < 0)
 43		return XDP_ABORTED;
 44
 45	/* Notice: Kernel-side verifier requires that loading of
 46	 * ctx->data MUST happen _after_ helper bpf_xdp_adjust_meta(),
 47	 * as pkt-data pointers are invalidated.  Helpers that require
 48	 * this are determined/marked by bpf_helper_changes_pkt_data()
 49	 */
 50	data = (void *)(unsigned long)ctx->data;
 51
 52	/* Check data_meta have room for meta_info struct */
 53	meta = (void *)(unsigned long)ctx->data_meta;
 54	if (meta + 1 > data)
 55		return XDP_ABORTED;
 56
 57	meta->mark = 42;
 58
 59	return XDP_PASS;
 60}
 61
 62SEC("tc_mark")
 63int _tc_mark(struct __sk_buff *ctx)
 64{
 65	void *data      = (void *)(unsigned long)ctx->data;
 66	void *data_meta = (void *)(unsigned long)ctx->data_meta;
 67	struct meta_info *meta = data_meta;
 68
 69	/* Check XDP gave us some data_meta */
 70	if (meta + 1 > data) {
 71		ctx->mark = 41;
 72		 /* Skip "accept" if no data_meta is avail */
 73		return TC_ACT_OK;
 74	}
 75
 76	/* Hint: See func tc_cls_act_is_valid_access() for BPF_WRITE access */
 77	ctx->mark = meta->mark; /* Transfer XDP-mark to SKB-mark */
 78
 79	return TC_ACT_OK;
 80}
 81
 82/* Manually attaching these programs:
 83export DEV=ixgbe2
 84export FILE=xdp2skb_meta_kern.o
 85
 86# via TC command
 87tc qdisc del dev $DEV clsact 2> /dev/null
 88tc qdisc add dev $DEV clsact
 89tc filter  add dev $DEV ingress prio 1 handle 1 bpf da obj $FILE sec tc_mark
 90tc filter show dev $DEV ingress
 91
 92# XDP via IP command:
 93ip link set dev $DEV xdp off
 94ip link set dev $DEV xdp obj $FILE sec xdp_mark
 95
 96# Use iptable to "see" if SKBs are marked
 97iptables -I INPUT -p icmp -m mark --mark 41  # == 0x29
 98iptables -I INPUT -p icmp -m mark --mark 42  # == 0x2a
 99
100# Hint: catch XDP_ABORTED errors via
101perf record -e xdp:*
102perf script
103
104*/