^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) /* SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) * Copyright (c) 2018 Jesper Dangaard Brouer, Red Hat Inc.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * Example howto transfer info from XDP to SKB, e.g. skb->mark
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * -----------------------------------------------------------
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * This uses the XDP data_meta infrastructure, and is a cooperation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * between two bpf-programs (1) XDP and (2) clsact at TC-ingress hook.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) * Notice: This example does not use the BPF C-loader (bpf_load.c),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) * but instead rely on the iproute2 TC tool for loading BPF-objects.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <uapi/linux/bpf.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <uapi/linux/pkt_cls.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <bpf/bpf_helpers.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) * This struct is stored in the XDP 'data_meta' area, which is located
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) * just in-front-of the raw packet payload data. The meaning is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) * specific to these two BPF programs that use it as a communication
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) * channel. XDP adjust/increase the area via a bpf-helper, and TC use
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) * boundary checks to see if data have been provided.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) * The struct must be 4 byte aligned, which here is enforced by the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) * struct __attribute__((aligned(4))).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) struct meta_info {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) __u32 mark;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) } __attribute__((aligned(4)));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) SEC("xdp_mark")
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) int _xdp_mark(struct xdp_md *ctx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) struct meta_info *meta;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) void *data, *data_end;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) /* Reserve space in-front of data pointer for our meta info.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) * (Notice drivers not supporting data_meta will fail here!)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) ret = bpf_xdp_adjust_meta(ctx, -(int)sizeof(*meta));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) if (ret < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) return XDP_ABORTED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) /* Notice: Kernel-side verifier requires that loading of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) * ctx->data MUST happen _after_ helper bpf_xdp_adjust_meta(),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) * as pkt-data pointers are invalidated. Helpers that require
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) * this are determined/marked by bpf_helper_changes_pkt_data()
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) data = (void *)(unsigned long)ctx->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) /* Check data_meta have room for meta_info struct */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) meta = (void *)(unsigned long)ctx->data_meta;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) if (meta + 1 > data)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) return XDP_ABORTED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) meta->mark = 42;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) return XDP_PASS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) SEC("tc_mark")
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) int _tc_mark(struct __sk_buff *ctx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) void *data = (void *)(unsigned long)ctx->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) void *data_end = (void *)(unsigned long)ctx->data_end;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) void *data_meta = (void *)(unsigned long)ctx->data_meta;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) struct meta_info *meta = data_meta;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) /* Check XDP gave us some data_meta */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) if (meta + 1 > data) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) ctx->mark = 41;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) /* Skip "accept" if no data_meta is avail */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) return TC_ACT_OK;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) /* Hint: See func tc_cls_act_is_valid_access() for BPF_WRITE access */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) ctx->mark = meta->mark; /* Transfer XDP-mark to SKB-mark */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) return TC_ACT_OK;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) /* Manually attaching these programs:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) export DEV=ixgbe2
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) export FILE=xdp2skb_meta_kern.o
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) # via TC command
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) tc qdisc del dev $DEV clsact 2> /dev/null
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) tc qdisc add dev $DEV clsact
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) tc filter add dev $DEV ingress prio 1 handle 1 bpf da obj $FILE sec tc_mark
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) tc filter show dev $DEV ingress
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) # XDP via IP command:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) ip link set dev $DEV xdp off
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) ip link set dev $DEV xdp obj $FILE sec xdp_mark
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) # Use iptable to "see" if SKBs are marked
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) iptables -I INPUT -p icmp -m mark --mark 41 # == 0x29
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) iptables -I INPUT -p icmp -m mark --mark 42 # == 0x2a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) # Hint: catch XDP_ABORTED errors via
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) perf record -e xdp:*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) perf script
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) */
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags