1. 05 Jun, 2023 1 commit
    • Dave Marchevsky's avatar
      bpf: Set kptr_struct_meta for node param to list and rbtree insert funcs · 2140a6e3
      Dave Marchevsky authored
      In verifier.c, fixup_kfunc_call uses struct bpf_insn_aux_data's
      kptr_struct_meta field to pass information about local kptr types to
      various helpers and kfuncs at runtime. The recent bpf_refcount series
      added a few functions to the set that need this information:
      
        * bpf_refcount_acquire
          * Needs to know where the refcount field is in order to increment
        * Graph collection insert kfuncs: bpf_rbtree_add, bpf_list_push_{front,back}
          * Were migrated to possibly fail by the bpf_refcount series. If
            insert fails, the input node is bpf_obj_drop'd. bpf_obj_drop needs
            the kptr_struct_meta in order to decr refcount and properly free
            special fields.
      
      Unfortunately the verifier handling of collection insert kfuncs was not
      modified to actually populate kptr_struct_meta. Accordingly, when the
      node input to those kfuncs is passed to bpf_obj_drop, it is done so
      without the information necessary to decr refcount.
      
      This patch fixes the issue by populating kptr_struct_meta for those
      kfuncs.
      
      Fixes: d2dcc67d ("bpf: Migrate bpf_rbtree_add and bpf_list_push_{front,back} to possibly fail")
      Signed-off-by: default avatarDave Marchevsky <davemarchevsky@fb.com>
      Link: https://lore.kernel.org/r/20230602022647.1571784-3-davemarchevsky@fb.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      2140a6e3
  2. 01 Jun, 2023 2 commits
    • Louis DeLosSantos's avatar
      selftests/bpf: Test table ID fib lookup BPF helper · d4ae3e58
      Louis DeLosSantos authored
      Add additional test cases to `fib_lookup.c` prog_test.
      
      These test cases add a new /24 network to the previously unused veth2
      device, removes the directly connected route from the main routing table
      and moves it to table 100.
      
      The first test case then confirms a fib lookup for a remote address in
      this directly connected network, using the main routing table fails.
      
      The second test case ensures the same fib lookup using table 100 succeeds.
      
      An additional pair of tests which function in the same manner are added
      for IPv6.
      Signed-off-by: default avatarLouis DeLosSantos <louis.delos.devel@gmail.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Link: https://lore.kernel.org/bpf/20230505-bpf-add-tbid-fib-lookup-v2-2-0a31c22c748c@gmail.com
      d4ae3e58
    • Louis DeLosSantos's avatar
      bpf: Add table ID to bpf_fib_lookup BPF helper · 8ad77e72
      Louis DeLosSantos authored
      Add ability to specify routing table ID to the `bpf_fib_lookup` BPF
      helper.
      
      A new field `tbid` is added to `struct bpf_fib_lookup` used as
      parameters to the `bpf_fib_lookup` BPF helper.
      
      When the helper is called with the `BPF_FIB_LOOKUP_DIRECT` and
      `BPF_FIB_LOOKUP_TBID` flags the `tbid` field in `struct bpf_fib_lookup`
      will be used as the table ID for the fib lookup.
      
      If the `tbid` does not exist the fib lookup will fail with
      `BPF_FIB_LKUP_RET_NOT_FWDED`.
      
      The `tbid` field becomes a union over the vlan related output fields
      in `struct bpf_fib_lookup` and will be zeroed immediately after usage.
      
      This functionality is useful in containerized environments.
      
      For instance, if a CNI wants to dictate the next-hop for traffic leaving
      a container it can create a container-specific routing table and perform
      a fib lookup against this table in a "host-net-namespace-side" TC program.
      
      This functionality also allows `ip rule` like functionality at the TC
      layer, allowing an eBPF program to pick a routing table based on some
      aspect of the sk_buff.
      
      As a concrete use case, this feature will be used in Cilium's SRv6 L3VPN
      datapath.
      
      When egress traffic leaves a Pod an eBPF program attached by Cilium will
      determine which VRF the egress traffic should target, and then perform a
      FIB lookup in a specific table representing this VRF's FIB.
      Signed-off-by: default avatarLouis DeLosSantos <louis.delos.devel@gmail.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Link: https://lore.kernel.org/bpf/20230505-bpf-add-tbid-fib-lookup-v2-1-0a31c22c748c@gmail.com
      8ad77e72
  3. 31 May, 2023 4 commits
  4. 30 May, 2023 33 commits