1*4882a593Smuzhiyun /* SPDX-License-Identifier: GPL-2.0
2*4882a593Smuzhiyun * Copyright (c) 2018 Jesper Dangaard Brouer, Red Hat Inc.
3*4882a593Smuzhiyun *
4*4882a593Smuzhiyun * Example howto transfer info from XDP to SKB, e.g. skb->mark
5*4882a593Smuzhiyun * -----------------------------------------------------------
6*4882a593Smuzhiyun * This uses the XDP data_meta infrastructure, and is a cooperation
7*4882a593Smuzhiyun * between two bpf-programs (1) XDP and (2) clsact at TC-ingress hook.
8*4882a593Smuzhiyun *
9*4882a593Smuzhiyun * Notice: This example does not use the BPF C-loader (bpf_load.c),
10*4882a593Smuzhiyun * but instead rely on the iproute2 TC tool for loading BPF-objects.
11*4882a593Smuzhiyun */
12*4882a593Smuzhiyun #include <uapi/linux/bpf.h>
13*4882a593Smuzhiyun #include <uapi/linux/pkt_cls.h>
14*4882a593Smuzhiyun
15*4882a593Smuzhiyun #include <bpf/bpf_helpers.h>
16*4882a593Smuzhiyun
17*4882a593Smuzhiyun /*
18*4882a593Smuzhiyun * This struct is stored in the XDP 'data_meta' area, which is located
19*4882a593Smuzhiyun * just in-front-of the raw packet payload data. The meaning is
20*4882a593Smuzhiyun * specific to these two BPF programs that use it as a communication
21*4882a593Smuzhiyun * channel. XDP adjust/increase the area via a bpf-helper, and TC use
22*4882a593Smuzhiyun * boundary checks to see if data have been provided.
23*4882a593Smuzhiyun *
24*4882a593Smuzhiyun * The struct must be 4 byte aligned, which here is enforced by the
25*4882a593Smuzhiyun * struct __attribute__((aligned(4))).
26*4882a593Smuzhiyun */
27*4882a593Smuzhiyun struct meta_info {
28*4882a593Smuzhiyun __u32 mark;
29*4882a593Smuzhiyun } __attribute__((aligned(4)));
30*4882a593Smuzhiyun
31*4882a593Smuzhiyun SEC("xdp_mark")
_xdp_mark(struct xdp_md * ctx)32*4882a593Smuzhiyun int _xdp_mark(struct xdp_md *ctx)
33*4882a593Smuzhiyun {
34*4882a593Smuzhiyun struct meta_info *meta;
35*4882a593Smuzhiyun void *data, *data_end;
36*4882a593Smuzhiyun int ret;
37*4882a593Smuzhiyun
38*4882a593Smuzhiyun /* Reserve space in-front of data pointer for our meta info.
39*4882a593Smuzhiyun * (Notice drivers not supporting data_meta will fail here!)
40*4882a593Smuzhiyun */
41*4882a593Smuzhiyun ret = bpf_xdp_adjust_meta(ctx, -(int)sizeof(*meta));
42*4882a593Smuzhiyun if (ret < 0)
43*4882a593Smuzhiyun return XDP_ABORTED;
44*4882a593Smuzhiyun
45*4882a593Smuzhiyun /* Notice: Kernel-side verifier requires that loading of
46*4882a593Smuzhiyun * ctx->data MUST happen _after_ helper bpf_xdp_adjust_meta(),
47*4882a593Smuzhiyun * as pkt-data pointers are invalidated. Helpers that require
48*4882a593Smuzhiyun * this are determined/marked by bpf_helper_changes_pkt_data()
49*4882a593Smuzhiyun */
50*4882a593Smuzhiyun data = (void *)(unsigned long)ctx->data;
51*4882a593Smuzhiyun
52*4882a593Smuzhiyun /* Check data_meta have room for meta_info struct */
53*4882a593Smuzhiyun meta = (void *)(unsigned long)ctx->data_meta;
54*4882a593Smuzhiyun if (meta + 1 > data)
55*4882a593Smuzhiyun return XDP_ABORTED;
56*4882a593Smuzhiyun
57*4882a593Smuzhiyun meta->mark = 42;
58*4882a593Smuzhiyun
59*4882a593Smuzhiyun return XDP_PASS;
60*4882a593Smuzhiyun }
61*4882a593Smuzhiyun
62*4882a593Smuzhiyun SEC("tc_mark")
_tc_mark(struct __sk_buff * ctx)63*4882a593Smuzhiyun int _tc_mark(struct __sk_buff *ctx)
64*4882a593Smuzhiyun {
65*4882a593Smuzhiyun void *data = (void *)(unsigned long)ctx->data;
66*4882a593Smuzhiyun void *data_end = (void *)(unsigned long)ctx->data_end;
67*4882a593Smuzhiyun void *data_meta = (void *)(unsigned long)ctx->data_meta;
68*4882a593Smuzhiyun struct meta_info *meta = data_meta;
69*4882a593Smuzhiyun
70*4882a593Smuzhiyun /* Check XDP gave us some data_meta */
71*4882a593Smuzhiyun if (meta + 1 > data) {
72*4882a593Smuzhiyun ctx->mark = 41;
73*4882a593Smuzhiyun /* Skip "accept" if no data_meta is avail */
74*4882a593Smuzhiyun return TC_ACT_OK;
75*4882a593Smuzhiyun }
76*4882a593Smuzhiyun
77*4882a593Smuzhiyun /* Hint: See func tc_cls_act_is_valid_access() for BPF_WRITE access */
78*4882a593Smuzhiyun ctx->mark = meta->mark; /* Transfer XDP-mark to SKB-mark */
79*4882a593Smuzhiyun
80*4882a593Smuzhiyun return TC_ACT_OK;
81*4882a593Smuzhiyun }
82*4882a593Smuzhiyun
83*4882a593Smuzhiyun /* Manually attaching these programs:
84*4882a593Smuzhiyun export DEV=ixgbe2
85*4882a593Smuzhiyun export FILE=xdp2skb_meta_kern.o
86*4882a593Smuzhiyun
87*4882a593Smuzhiyun # via TC command
88*4882a593Smuzhiyun tc qdisc del dev $DEV clsact 2> /dev/null
89*4882a593Smuzhiyun tc qdisc add dev $DEV clsact
90*4882a593Smuzhiyun tc filter add dev $DEV ingress prio 1 handle 1 bpf da obj $FILE sec tc_mark
91*4882a593Smuzhiyun tc filter show dev $DEV ingress
92*4882a593Smuzhiyun
93*4882a593Smuzhiyun # XDP via IP command:
94*4882a593Smuzhiyun ip link set dev $DEV xdp off
95*4882a593Smuzhiyun ip link set dev $DEV xdp obj $FILE sec xdp_mark
96*4882a593Smuzhiyun
97*4882a593Smuzhiyun # Use iptable to "see" if SKBs are marked
98*4882a593Smuzhiyun iptables -I INPUT -p icmp -m mark --mark 41 # == 0x29
99*4882a593Smuzhiyun iptables -I INPUT -p icmp -m mark --mark 42 # == 0x2a
100*4882a593Smuzhiyun
101*4882a593Smuzhiyun # Hint: catch XDP_ABORTED errors via
102*4882a593Smuzhiyun perf record -e xdp:*
103*4882a593Smuzhiyun perf script
104*4882a593Smuzhiyun
105*4882a593Smuzhiyun */
106