xref: /openbmc/linux/kernel/bpf/lpm_trie.c (revision 0be1511f)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Longest prefix match list implementation
4  *
5  * Copyright (c) 2016,2017 Daniel Mack
6  * Copyright (c) 2016 David Herrmann
7  */
8 
9 #include <linux/bpf.h>
10 #include <linux/btf.h>
11 #include <linux/err.h>
12 #include <linux/slab.h>
13 #include <linux/spinlock.h>
14 #include <linux/vmalloc.h>
15 #include <net/ipv6.h>
16 #include <uapi/linux/btf.h>
17 
18 /* Intermediate node */
19 #define LPM_TREE_NODE_FLAG_IM BIT(0)
20 
21 struct lpm_trie_node;
22 
23 struct lpm_trie_node {
24 	struct rcu_head rcu;
25 	struct lpm_trie_node __rcu	*child[2];
26 	u32				prefixlen;
27 	u32				flags;
28 	u8				data[];
29 };
30 
31 struct lpm_trie {
32 	struct bpf_map			map;
33 	struct lpm_trie_node __rcu	*root;
34 	size_t				n_entries;
35 	size_t				max_prefixlen;
36 	size_t				data_size;
37 	spinlock_t			lock;
38 };
39 
40 /* This trie implements a longest prefix match algorithm that can be used to
41  * match IP addresses to a stored set of ranges.
42  *
43  * Data stored in @data of struct bpf_lpm_key and struct lpm_trie_node is
44  * interpreted as big endian, so data[0] stores the most significant byte.
45  *
46  * Match ranges are internally stored in instances of struct lpm_trie_node
47  * which each contain their prefix length as well as two pointers that may
48  * lead to more nodes containing more specific matches. Each node also stores
49  * a value that is defined by and returned to userspace via the update_elem
50  * and lookup functions.
51  *
52  * For instance, let's start with a trie that was created with a prefix length
53  * of 32, so it can be used for IPv4 addresses, and one single element that
54  * matches 192.168.0.0/16. The data array would hence contain
55  * [0xc0, 0xa8, 0x00, 0x00] in big-endian notation. This documentation will
56  * stick to IP-address notation for readability though.
57  *
58  * As the trie is empty initially, the new node (1) will be places as root
59  * node, denoted as (R) in the example below. As there are no other node, both
60  * child pointers are %NULL.
61  *
62  *              +----------------+
63  *              |       (1)  (R) |
64  *              | 192.168.0.0/16 |
65  *              |    value: 1    |
66  *              |   [0]    [1]   |
67  *              +----------------+
68  *
69  * Next, let's add a new node (2) matching 192.168.0.0/24. As there is already
70  * a node with the same data and a smaller prefix (ie, a less specific one),
71  * node (2) will become a child of (1). In child index depends on the next bit
72  * that is outside of what (1) matches, and that bit is 0, so (2) will be
73  * child[0] of (1):
74  *
75  *              +----------------+
76  *              |       (1)  (R) |
77  *              | 192.168.0.0/16 |
78  *              |    value: 1    |
79  *              |   [0]    [1]   |
80  *              +----------------+
81  *                   |
82  *    +----------------+
83  *    |       (2)      |
84  *    | 192.168.0.0/24 |
85  *    |    value: 2    |
86  *    |   [0]    [1]   |
87  *    +----------------+
88  *
89  * The child[1] slot of (1) could be filled with another node which has bit #17
90  * (the next bit after the ones that (1) matches on) set to 1. For instance,
91  * 192.168.128.0/24:
92  *
93  *              +----------------+
94  *              |       (1)  (R) |
95  *              | 192.168.0.0/16 |
96  *              |    value: 1    |
97  *              |   [0]    [1]   |
98  *              +----------------+
99  *                   |      |
100  *    +----------------+  +------------------+
101  *    |       (2)      |  |        (3)       |
102  *    | 192.168.0.0/24 |  | 192.168.128.0/24 |
103  *    |    value: 2    |  |     value: 3     |
104  *    |   [0]    [1]   |  |    [0]    [1]    |
105  *    +----------------+  +------------------+
106  *
107  * Let's add another node (4) to the game for 192.168.1.0/24. In order to place
108  * it, node (1) is looked at first, and because (4) of the semantics laid out
109  * above (bit #17 is 0), it would normally be attached to (1) as child[0].
110  * However, that slot is already allocated, so a new node is needed in between.
111  * That node does not have a value attached to it and it will never be
112  * returned to users as result of a lookup. It is only there to differentiate
113  * the traversal further. It will get a prefix as wide as necessary to
114  * distinguish its two children:
115  *
116  *                      +----------------+
117  *                      |       (1)  (R) |
118  *                      | 192.168.0.0/16 |
119  *                      |    value: 1    |
120  *                      |   [0]    [1]   |
121  *                      +----------------+
122  *                           |      |
123  *            +----------------+  +------------------+
124  *            |       (4)  (I) |  |        (3)       |
125  *            | 192.168.0.0/23 |  | 192.168.128.0/24 |
126  *            |    value: ---  |  |     value: 3     |
127  *            |   [0]    [1]   |  |    [0]    [1]    |
128  *            +----------------+  +------------------+
129  *                 |      |
130  *  +----------------+  +----------------+
131  *  |       (2)      |  |       (5)      |
132  *  | 192.168.0.0/24 |  | 192.168.1.0/24 |
133  *  |    value: 2    |  |     value: 5   |
134  *  |   [0]    [1]   |  |   [0]    [1]   |
135  *  +----------------+  +----------------+
136  *
137  * 192.168.1.1/32 would be a child of (5) etc.
138  *
139  * An intermediate node will be turned into a 'real' node on demand. In the
140  * example above, (4) would be re-used if 192.168.0.0/23 is added to the trie.
141  *
142  * A fully populated trie would have a height of 32 nodes, as the trie was
143  * created with a prefix length of 32.
144  *
145  * The lookup starts at the root node. If the current node matches and if there
146  * is a child that can be used to become more specific, the trie is traversed
147  * downwards. The last node in the traversal that is a non-intermediate one is
148  * returned.
149  */
150 
151 static inline int extract_bit(const u8 *data, size_t index)
152 {
153 	return !!(data[index / 8] & (1 << (7 - (index % 8))));
154 }
155 
156 /**
157  * longest_prefix_match() - determine the longest prefix
158  * @trie:	The trie to get internal sizes from
159  * @node:	The node to operate on
160  * @key:	The key to compare to @node
161  *
162  * Determine the longest prefix of @node that matches the bits in @key.
163  */
164 static size_t longest_prefix_match(const struct lpm_trie *trie,
165 				   const struct lpm_trie_node *node,
166 				   const struct bpf_lpm_trie_key *key)
167 {
168 	u32 limit = min(node->prefixlen, key->prefixlen);
169 	u32 prefixlen = 0, i = 0;
170 
171 	BUILD_BUG_ON(offsetof(struct lpm_trie_node, data) % sizeof(u32));
172 	BUILD_BUG_ON(offsetof(struct bpf_lpm_trie_key, data) % sizeof(u32));
173 
174 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && defined(CONFIG_64BIT)
175 
176 	/* data_size >= 16 has very small probability.
177 	 * We do not use a loop for optimal code generation.
178 	 */
179 	if (trie->data_size >= 8) {
180 		u64 diff = be64_to_cpu(*(__be64 *)node->data ^
181 				       *(__be64 *)key->data);
182 
183 		prefixlen = 64 - fls64(diff);
184 		if (prefixlen >= limit)
185 			return limit;
186 		if (diff)
187 			return prefixlen;
188 		i = 8;
189 	}
190 #endif
191 
192 	while (trie->data_size >= i + 4) {
193 		u32 diff = be32_to_cpu(*(__be32 *)&node->data[i] ^
194 				       *(__be32 *)&key->data[i]);
195 
196 		prefixlen += 32 - fls(diff);
197 		if (prefixlen >= limit)
198 			return limit;
199 		if (diff)
200 			return prefixlen;
201 		i += 4;
202 	}
203 
204 	if (trie->data_size >= i + 2) {
205 		u16 diff = be16_to_cpu(*(__be16 *)&node->data[i] ^
206 				       *(__be16 *)&key->data[i]);
207 
208 		prefixlen += 16 - fls(diff);
209 		if (prefixlen >= limit)
210 			return limit;
211 		if (diff)
212 			return prefixlen;
213 		i += 2;
214 	}
215 
216 	if (trie->data_size >= i + 1) {
217 		prefixlen += 8 - fls(node->data[i] ^ key->data[i]);
218 
219 		if (prefixlen >= limit)
220 			return limit;
221 	}
222 
223 	return prefixlen;
224 }
225 
226 /* Called from syscall or from eBPF program */
227 static void *trie_lookup_elem(struct bpf_map *map, void *_key)
228 {
229 	struct lpm_trie *trie = container_of(map, struct lpm_trie, map);
230 	struct lpm_trie_node *node, *found = NULL;
231 	struct bpf_lpm_trie_key *key = _key;
232 
233 	/* Start walking the trie from the root node ... */
234 
235 	for (node = rcu_dereference(trie->root); node;) {
236 		unsigned int next_bit;
237 		size_t matchlen;
238 
239 		/* Determine the longest prefix of @node that matches @key.
240 		 * If it's the maximum possible prefix for this trie, we have
241 		 * an exact match and can return it directly.
242 		 */
243 		matchlen = longest_prefix_match(trie, node, key);
244 		if (matchlen == trie->max_prefixlen) {
245 			found = node;
246 			break;
247 		}
248 
249 		/* If the number of bits that match is smaller than the prefix
250 		 * length of @node, bail out and return the node we have seen
251 		 * last in the traversal (ie, the parent).
252 		 */
253 		if (matchlen < node->prefixlen)
254 			break;
255 
256 		/* Consider this node as return candidate unless it is an
257 		 * artificially added intermediate one.
258 		 */
259 		if (!(node->flags & LPM_TREE_NODE_FLAG_IM))
260 			found = node;
261 
262 		/* If the node match is fully satisfied, let's see if we can
263 		 * become more specific. Determine the next bit in the key and
264 		 * traverse down.
265 		 */
266 		next_bit = extract_bit(key->data, node->prefixlen);
267 		node = rcu_dereference(node->child[next_bit]);
268 	}
269 
270 	if (!found)
271 		return NULL;
272 
273 	return found->data + trie->data_size;
274 }
275 
276 static struct lpm_trie_node *lpm_trie_node_alloc(const struct lpm_trie *trie,
277 						 const void *value)
278 {
279 	struct lpm_trie_node *node;
280 	size_t size = sizeof(struct lpm_trie_node) + trie->data_size;
281 
282 	if (value)
283 		size += trie->map.value_size;
284 
285 	node = bpf_map_kmalloc_node(&trie->map, size, GFP_ATOMIC | __GFP_NOWARN,
286 				    trie->map.numa_node);
287 	if (!node)
288 		return NULL;
289 
290 	node->flags = 0;
291 
292 	if (value)
293 		memcpy(node->data + trie->data_size, value,
294 		       trie->map.value_size);
295 
296 	return node;
297 }
298 
299 /* Called from syscall or from eBPF program */
300 static int trie_update_elem(struct bpf_map *map,
301 			    void *_key, void *value, u64 flags)
302 {
303 	struct lpm_trie *trie = container_of(map, struct lpm_trie, map);
304 	struct lpm_trie_node *node, *im_node = NULL, *new_node = NULL;
305 	struct lpm_trie_node __rcu **slot;
306 	struct bpf_lpm_trie_key *key = _key;
307 	unsigned long irq_flags;
308 	unsigned int next_bit;
309 	size_t matchlen = 0;
310 	int ret = 0;
311 
312 	if (unlikely(flags > BPF_EXIST))
313 		return -EINVAL;
314 
315 	if (key->prefixlen > trie->max_prefixlen)
316 		return -EINVAL;
317 
318 	spin_lock_irqsave(&trie->lock, irq_flags);
319 
320 	/* Allocate and fill a new node */
321 
322 	if (trie->n_entries == trie->map.max_entries) {
323 		ret = -ENOSPC;
324 		goto out;
325 	}
326 
327 	new_node = lpm_trie_node_alloc(trie, value);
328 	if (!new_node) {
329 		ret = -ENOMEM;
330 		goto out;
331 	}
332 
333 	trie->n_entries++;
334 
335 	new_node->prefixlen = key->prefixlen;
336 	RCU_INIT_POINTER(new_node->child[0], NULL);
337 	RCU_INIT_POINTER(new_node->child[1], NULL);
338 	memcpy(new_node->data, key->data, trie->data_size);
339 
340 	/* Now find a slot to attach the new node. To do that, walk the tree
341 	 * from the root and match as many bits as possible for each node until
342 	 * we either find an empty slot or a slot that needs to be replaced by
343 	 * an intermediate node.
344 	 */
345 	slot = &trie->root;
346 
347 	while ((node = rcu_dereference_protected(*slot,
348 					lockdep_is_held(&trie->lock)))) {
349 		matchlen = longest_prefix_match(trie, node, key);
350 
351 		if (node->prefixlen != matchlen ||
352 		    node->prefixlen == key->prefixlen ||
353 		    node->prefixlen == trie->max_prefixlen)
354 			break;
355 
356 		next_bit = extract_bit(key->data, node->prefixlen);
357 		slot = &node->child[next_bit];
358 	}
359 
360 	/* If the slot is empty (a free child pointer or an empty root),
361 	 * simply assign the @new_node to that slot and be done.
362 	 */
363 	if (!node) {
364 		rcu_assign_pointer(*slot, new_node);
365 		goto out;
366 	}
367 
368 	/* If the slot we picked already exists, replace it with @new_node
369 	 * which already has the correct data array set.
370 	 */
371 	if (node->prefixlen == matchlen) {
372 		new_node->child[0] = node->child[0];
373 		new_node->child[1] = node->child[1];
374 
375 		if (!(node->flags & LPM_TREE_NODE_FLAG_IM))
376 			trie->n_entries--;
377 
378 		rcu_assign_pointer(*slot, new_node);
379 		kfree_rcu(node, rcu);
380 
381 		goto out;
382 	}
383 
384 	/* If the new node matches the prefix completely, it must be inserted
385 	 * as an ancestor. Simply insert it between @node and *@slot.
386 	 */
387 	if (matchlen == key->prefixlen) {
388 		next_bit = extract_bit(node->data, matchlen);
389 		rcu_assign_pointer(new_node->child[next_bit], node);
390 		rcu_assign_pointer(*slot, new_node);
391 		goto out;
392 	}
393 
394 	im_node = lpm_trie_node_alloc(trie, NULL);
395 	if (!im_node) {
396 		ret = -ENOMEM;
397 		goto out;
398 	}
399 
400 	im_node->prefixlen = matchlen;
401 	im_node->flags |= LPM_TREE_NODE_FLAG_IM;
402 	memcpy(im_node->data, node->data, trie->data_size);
403 
404 	/* Now determine which child to install in which slot */
405 	if (extract_bit(key->data, matchlen)) {
406 		rcu_assign_pointer(im_node->child[0], node);
407 		rcu_assign_pointer(im_node->child[1], new_node);
408 	} else {
409 		rcu_assign_pointer(im_node->child[0], new_node);
410 		rcu_assign_pointer(im_node->child[1], node);
411 	}
412 
413 	/* Finally, assign the intermediate node to the determined spot */
414 	rcu_assign_pointer(*slot, im_node);
415 
416 out:
417 	if (ret) {
418 		if (new_node)
419 			trie->n_entries--;
420 
421 		kfree(new_node);
422 		kfree(im_node);
423 	}
424 
425 	spin_unlock_irqrestore(&trie->lock, irq_flags);
426 
427 	return ret;
428 }
429 
430 /* Called from syscall or from eBPF program */
431 static int trie_delete_elem(struct bpf_map *map, void *_key)
432 {
433 	struct lpm_trie *trie = container_of(map, struct lpm_trie, map);
434 	struct bpf_lpm_trie_key *key = _key;
435 	struct lpm_trie_node __rcu **trim, **trim2;
436 	struct lpm_trie_node *node, *parent;
437 	unsigned long irq_flags;
438 	unsigned int next_bit;
439 	size_t matchlen = 0;
440 	int ret = 0;
441 
442 	if (key->prefixlen > trie->max_prefixlen)
443 		return -EINVAL;
444 
445 	spin_lock_irqsave(&trie->lock, irq_flags);
446 
447 	/* Walk the tree looking for an exact key/length match and keeping
448 	 * track of the path we traverse.  We will need to know the node
449 	 * we wish to delete, and the slot that points to the node we want
450 	 * to delete.  We may also need to know the nodes parent and the
451 	 * slot that contains it.
452 	 */
453 	trim = &trie->root;
454 	trim2 = trim;
455 	parent = NULL;
456 	while ((node = rcu_dereference_protected(
457 		       *trim, lockdep_is_held(&trie->lock)))) {
458 		matchlen = longest_prefix_match(trie, node, key);
459 
460 		if (node->prefixlen != matchlen ||
461 		    node->prefixlen == key->prefixlen)
462 			break;
463 
464 		parent = node;
465 		trim2 = trim;
466 		next_bit = extract_bit(key->data, node->prefixlen);
467 		trim = &node->child[next_bit];
468 	}
469 
470 	if (!node || node->prefixlen != key->prefixlen ||
471 	    node->prefixlen != matchlen ||
472 	    (node->flags & LPM_TREE_NODE_FLAG_IM)) {
473 		ret = -ENOENT;
474 		goto out;
475 	}
476 
477 	trie->n_entries--;
478 
479 	/* If the node we are removing has two children, simply mark it
480 	 * as intermediate and we are done.
481 	 */
482 	if (rcu_access_pointer(node->child[0]) &&
483 	    rcu_access_pointer(node->child[1])) {
484 		node->flags |= LPM_TREE_NODE_FLAG_IM;
485 		goto out;
486 	}
487 
488 	/* If the parent of the node we are about to delete is an intermediate
489 	 * node, and the deleted node doesn't have any children, we can delete
490 	 * the intermediate parent as well and promote its other child
491 	 * up the tree.  Doing this maintains the invariant that all
492 	 * intermediate nodes have exactly 2 children and that there are no
493 	 * unnecessary intermediate nodes in the tree.
494 	 */
495 	if (parent && (parent->flags & LPM_TREE_NODE_FLAG_IM) &&
496 	    !node->child[0] && !node->child[1]) {
497 		if (node == rcu_access_pointer(parent->child[0]))
498 			rcu_assign_pointer(
499 				*trim2, rcu_access_pointer(parent->child[1]));
500 		else
501 			rcu_assign_pointer(
502 				*trim2, rcu_access_pointer(parent->child[0]));
503 		kfree_rcu(parent, rcu);
504 		kfree_rcu(node, rcu);
505 		goto out;
506 	}
507 
508 	/* The node we are removing has either zero or one child. If there
509 	 * is a child, move it into the removed node's slot then delete
510 	 * the node.  Otherwise just clear the slot and delete the node.
511 	 */
512 	if (node->child[0])
513 		rcu_assign_pointer(*trim, rcu_access_pointer(node->child[0]));
514 	else if (node->child[1])
515 		rcu_assign_pointer(*trim, rcu_access_pointer(node->child[1]));
516 	else
517 		RCU_INIT_POINTER(*trim, NULL);
518 	kfree_rcu(node, rcu);
519 
520 out:
521 	spin_unlock_irqrestore(&trie->lock, irq_flags);
522 
523 	return ret;
524 }
525 
526 #define LPM_DATA_SIZE_MAX	256
527 #define LPM_DATA_SIZE_MIN	1
528 
529 #define LPM_VAL_SIZE_MAX	(KMALLOC_MAX_SIZE - LPM_DATA_SIZE_MAX - \
530 				 sizeof(struct lpm_trie_node))
531 #define LPM_VAL_SIZE_MIN	1
532 
533 #define LPM_KEY_SIZE(X)		(sizeof(struct bpf_lpm_trie_key) + (X))
534 #define LPM_KEY_SIZE_MAX	LPM_KEY_SIZE(LPM_DATA_SIZE_MAX)
535 #define LPM_KEY_SIZE_MIN	LPM_KEY_SIZE(LPM_DATA_SIZE_MIN)
536 
537 #define LPM_CREATE_FLAG_MASK	(BPF_F_NO_PREALLOC | BPF_F_NUMA_NODE |	\
538 				 BPF_F_ACCESS_MASK)
539 
540 static struct bpf_map *trie_alloc(union bpf_attr *attr)
541 {
542 	struct lpm_trie *trie;
543 
544 	if (!bpf_capable())
545 		return ERR_PTR(-EPERM);
546 
547 	/* check sanity of attributes */
548 	if (attr->max_entries == 0 ||
549 	    !(attr->map_flags & BPF_F_NO_PREALLOC) ||
550 	    attr->map_flags & ~LPM_CREATE_FLAG_MASK ||
551 	    !bpf_map_flags_access_ok(attr->map_flags) ||
552 	    attr->key_size < LPM_KEY_SIZE_MIN ||
553 	    attr->key_size > LPM_KEY_SIZE_MAX ||
554 	    attr->value_size < LPM_VAL_SIZE_MIN ||
555 	    attr->value_size > LPM_VAL_SIZE_MAX)
556 		return ERR_PTR(-EINVAL);
557 
558 	trie = kzalloc(sizeof(*trie), GFP_USER | __GFP_NOWARN | __GFP_ACCOUNT);
559 	if (!trie)
560 		return ERR_PTR(-ENOMEM);
561 
562 	/* copy mandatory map attributes */
563 	bpf_map_init_from_attr(&trie->map, attr);
564 	trie->data_size = attr->key_size -
565 			  offsetof(struct bpf_lpm_trie_key, data);
566 	trie->max_prefixlen = trie->data_size * 8;
567 
568 	spin_lock_init(&trie->lock);
569 
570 	return &trie->map;
571 }
572 
573 static void trie_free(struct bpf_map *map)
574 {
575 	struct lpm_trie *trie = container_of(map, struct lpm_trie, map);
576 	struct lpm_trie_node __rcu **slot;
577 	struct lpm_trie_node *node;
578 
579 	/* Always start at the root and walk down to a node that has no
580 	 * children. Then free that node, nullify its reference in the parent
581 	 * and start over.
582 	 */
583 
584 	for (;;) {
585 		slot = &trie->root;
586 
587 		for (;;) {
588 			node = rcu_dereference_protected(*slot, 1);
589 			if (!node)
590 				goto out;
591 
592 			if (rcu_access_pointer(node->child[0])) {
593 				slot = &node->child[0];
594 				continue;
595 			}
596 
597 			if (rcu_access_pointer(node->child[1])) {
598 				slot = &node->child[1];
599 				continue;
600 			}
601 
602 			kfree(node);
603 			RCU_INIT_POINTER(*slot, NULL);
604 			break;
605 		}
606 	}
607 
608 out:
609 	kfree(trie);
610 }
611 
612 static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key)
613 {
614 	struct lpm_trie_node *node, *next_node = NULL, *parent, *search_root;
615 	struct lpm_trie *trie = container_of(map, struct lpm_trie, map);
616 	struct bpf_lpm_trie_key *key = _key, *next_key = _next_key;
617 	struct lpm_trie_node **node_stack = NULL;
618 	int err = 0, stack_ptr = -1;
619 	unsigned int next_bit;
620 	size_t matchlen;
621 
622 	/* The get_next_key follows postorder. For the 4 node example in
623 	 * the top of this file, the trie_get_next_key() returns the following
624 	 * one after another:
625 	 *   192.168.0.0/24
626 	 *   192.168.1.0/24
627 	 *   192.168.128.0/24
628 	 *   192.168.0.0/16
629 	 *
630 	 * The idea is to return more specific keys before less specific ones.
631 	 */
632 
633 	/* Empty trie */
634 	search_root = rcu_dereference(trie->root);
635 	if (!search_root)
636 		return -ENOENT;
637 
638 	/* For invalid key, find the leftmost node in the trie */
639 	if (!key || key->prefixlen > trie->max_prefixlen)
640 		goto find_leftmost;
641 
642 	node_stack = kmalloc_array(trie->max_prefixlen,
643 				   sizeof(struct lpm_trie_node *),
644 				   GFP_ATOMIC | __GFP_NOWARN);
645 	if (!node_stack)
646 		return -ENOMEM;
647 
648 	/* Try to find the exact node for the given key */
649 	for (node = search_root; node;) {
650 		node_stack[++stack_ptr] = node;
651 		matchlen = longest_prefix_match(trie, node, key);
652 		if (node->prefixlen != matchlen ||
653 		    node->prefixlen == key->prefixlen)
654 			break;
655 
656 		next_bit = extract_bit(key->data, node->prefixlen);
657 		node = rcu_dereference(node->child[next_bit]);
658 	}
659 	if (!node || node->prefixlen != key->prefixlen ||
660 	    (node->flags & LPM_TREE_NODE_FLAG_IM))
661 		goto find_leftmost;
662 
663 	/* The node with the exactly-matching key has been found,
664 	 * find the first node in postorder after the matched node.
665 	 */
666 	node = node_stack[stack_ptr];
667 	while (stack_ptr > 0) {
668 		parent = node_stack[stack_ptr - 1];
669 		if (rcu_dereference(parent->child[0]) == node) {
670 			search_root = rcu_dereference(parent->child[1]);
671 			if (search_root)
672 				goto find_leftmost;
673 		}
674 		if (!(parent->flags & LPM_TREE_NODE_FLAG_IM)) {
675 			next_node = parent;
676 			goto do_copy;
677 		}
678 
679 		node = parent;
680 		stack_ptr--;
681 	}
682 
683 	/* did not find anything */
684 	err = -ENOENT;
685 	goto free_stack;
686 
687 find_leftmost:
688 	/* Find the leftmost non-intermediate node, all intermediate nodes
689 	 * have exact two children, so this function will never return NULL.
690 	 */
691 	for (node = search_root; node;) {
692 		if (node->flags & LPM_TREE_NODE_FLAG_IM) {
693 			node = rcu_dereference(node->child[0]);
694 		} else {
695 			next_node = node;
696 			node = rcu_dereference(node->child[0]);
697 			if (!node)
698 				node = rcu_dereference(next_node->child[1]);
699 		}
700 	}
701 do_copy:
702 	next_key->prefixlen = next_node->prefixlen;
703 	memcpy((void *)next_key + offsetof(struct bpf_lpm_trie_key, data),
704 	       next_node->data, trie->data_size);
705 free_stack:
706 	kfree(node_stack);
707 	return err;
708 }
709 
710 static int trie_check_btf(const struct bpf_map *map,
711 			  const struct btf *btf,
712 			  const struct btf_type *key_type,
713 			  const struct btf_type *value_type)
714 {
715 	/* Keys must have struct bpf_lpm_trie_key embedded. */
716 	return BTF_INFO_KIND(key_type->info) != BTF_KIND_STRUCT ?
717 	       -EINVAL : 0;
718 }
719 
720 static int trie_map_btf_id;
721 const struct bpf_map_ops trie_map_ops = {
722 	.map_meta_equal = bpf_map_meta_equal,
723 	.map_alloc = trie_alloc,
724 	.map_free = trie_free,
725 	.map_get_next_key = trie_get_next_key,
726 	.map_lookup_elem = trie_lookup_elem,
727 	.map_update_elem = trie_update_elem,
728 	.map_delete_elem = trie_delete_elem,
729 	.map_check_btf = trie_check_btf,
730 	.map_btf_name = "lpm_trie",
731 	.map_btf_id = &trie_map_btf_id,
732 };
733