From patchwork Mon Jul 6 20:51:18 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: YiFei Zhu X-Patchwork-Id: 1323961 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: incoming-bpf@patchwork.ozlabs.org Delivered-To: patchwork-incoming-bpf@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=bpf-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=gWJUlJvf; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 4B0yVF5sjYz9sRN for ; Tue, 7 Jul 2020 06:54:13 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726329AbgGFUyN (ORCPT ); Mon, 6 Jul 2020 16:54:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59082 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725942AbgGFUyM (ORCPT ); Mon, 6 Jul 2020 16:54:12 -0400 Received: from mail-il1-x143.google.com (mail-il1-x143.google.com [IPv6:2607:f8b0:4864:20::143]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CDE46C061755 for ; Mon, 6 Jul 2020 13:54:12 -0700 (PDT) Received: by mail-il1-x143.google.com with SMTP id x9so34168644ila.3 for ; Mon, 06 Jul 2020 13:54:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=TUx99SWlARm+H51ijmmtvg/ypf38m1B2QFZP9QwtTmU=; b=gWJUlJvfGa7PVAWaFXQ/b368VsbmveyhI5LA7A27Fs1uO2i4bcU9mPFMhq/K60rEtc WtZ9gdqLP78Ni16OTYoeDwXziP1IDRLzxufMmUaEpmdqJ3YvfOEDrzH8/m+3kfoBJV4B nfuVQBJ2Qs6nPeBWc4YwFBXqa+5rCpnxTUUSNEorQvhLJdR/FEM0PuTuHLccoz3DmeXX BykehBqj20iDsPIWLVi21EeDT/nDOnGmQwEypb7xuLTIXt8L+DD3psc2Ly51U7maZSrL LeIEGGRq0ahAI9bZXSF75z3JLYh8GKbJnAdLXzH0XW0mAH0RVax3czKtKajZ8wOaIVLV X0mQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=TUx99SWlARm+H51ijmmtvg/ypf38m1B2QFZP9QwtTmU=; b=gVmYgmleUQ1ddzABG9mLCJKu6frBAtln8bIZgx1E2Jf1uLRzS5zcJinOQCJo5d1pFI nOVkRe3p7dDNMpCVoZ76tehXW/89x3CW8VoFRECkAyYaCi9ZPhw6sYy+fffywqpSZNCC Wv79JsPod6vfARCTUB+7/BFnHxoZaQd4uqf8q9/RSJraPiYhDypyYrKOv0IhGNnwBlRw xAVTMWPuIZvmav8QlYACHsZ26l61nOuE+P5JvFlxlF2VlhODStkP/DjJqUqEOs118Mht RXB3Rb9bx4DV3B7iJsBMqYuiEK74OxUVCh1QfGULmEElwwI0wdjBc1izRLdIcVPLIWzd c2Xg== X-Gm-Message-State: AOAM5305BgbDaesJpuUMY6QKm9oNgojQazxA9VdOeOn6Ay3o+HIailoh nCWiP+O9l0ZMYIkuB1PbI7OagtqqHCo= X-Google-Smtp-Source: ABdhPJwcyRfXSLEsLfKdC/ZPidPqSydUum/gEMhrB22UykWquS834igaNOU2xQalJMvycn6Vl5ymbA== X-Received: by 2002:a92:794f:: with SMTP id u76mr29760697ilc.215.1594068851864; Mon, 06 Jul 2020 13:54:11 -0700 (PDT) Received: from localhost.localdomain (host-173-230-99-2.tnkngak.clients.pavlovmedia.com. [173.230.99.2]) by smtp.gmail.com with ESMTPSA id r124sm10744198iod.40.2020.07.06.13.54.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Jul 2020 13:54:11 -0700 (PDT) From: YiFei Zhu To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Stanislav Fomichev , Mahesh Bandewar , Roman Gushchin , YiFei Zhu Subject: [PATCH bpf-next 1/5] selftests/bpf: Add test for CGROUP_STORAGE map on multiple attaches Date: Mon, 6 Jul 2020 15:51:18 -0500 Message-Id: X-Mailer: git-send-email 2.27.0 In-Reply-To: References: MIME-Version: 1.0 Sender: bpf-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org From: YiFei Zhu This test creates a parent cgroup, and a child of that cgroup. It attaches a cgroup_skb/egress program that simply counts packets, to a global variable (ARRAY map), and to a CGROUP_STORAGE map. The program is first attached to the parent cgroup only, then to parent and child. The test cases sends a message within the child cgroup, and because the program is inherited across parent / child cgroups, it will trigger the egress program for both the parent and child, if they exist. The program, when looking up a CGROUP_STORAGE map, uses the cgroup and attach type of the attachment parameters; therefore, both attaches uses different cgroup storages. We assert that all packet counts returns what we expects. Signed-off-by: YiFei Zhu --- .../bpf/prog_tests/cg_storage_multi.c | 154 ++++++++++++++++++ .../bpf/progs/cg_storage_multi_egress_only.c | 30 ++++ 2 files changed, 184 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c create mode 100644 tools/testing/selftests/bpf/progs/cg_storage_multi_egress_only.c diff --git a/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c b/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c new file mode 100644 index 000000000000..fee34a0ef862 --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c @@ -0,0 +1,154 @@ +// SPDX-License-Identifier: GPL-2.0-only + +/* + * Copyright 2020 Google LLC. + */ + +#include +#include +#include + +#include "cg_storage_multi_egress_only.skel.h" + +#define PARENT_CGROUP "/cgroup_storage" +#define CHILD_CGROUP "/cgroup_storage/child" + +static bool assert_storage(struct bpf_map *map, const char *cgroup_path, + __u32 expected) +{ + struct bpf_cgroup_storage_key key = {0}; + __u32 value; + int map_fd; + + map_fd = bpf_map__fd(map); + + key.cgroup_inode_id = get_cgroup_id(cgroup_path); + key.attach_type = BPF_CGROUP_INET_EGRESS; + if (CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value) < 0)) + return true; + if (CHECK_FAIL(value != expected)) + return true; + + return false; +} + +static bool assert_storage_noexist(struct bpf_map *map, const char *cgroup_path) +{ + struct bpf_cgroup_storage_key key = {0}; + __u32 value; + int map_fd; + + map_fd = bpf_map__fd(map); + + key.cgroup_inode_id = get_cgroup_id(cgroup_path); + key.attach_type = BPF_CGROUP_INET_EGRESS; + if (CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value) == 0)) + return true; + if (CHECK_FAIL(errno != ENOENT)) + return true; + + return false; +} + +static bool connect_send(const char *cgroup_path) +{ + bool res = true; + int server_fd = -1, client_fd = -1; + + if (join_cgroup(cgroup_path)) + goto out_clean; + + server_fd = start_server(AF_INET, SOCK_DGRAM, NULL, 0, 0); + if (server_fd < 0) + goto out_clean; + + client_fd = connect_to_fd(server_fd, 0); + if (client_fd < 0) + goto out_clean; + + if (send(client_fd, "message", strlen("message"), 0) < 0) + goto out_clean; + + res = false; + +out_clean: + close(client_fd); + close(server_fd); + return res; +} + +static void test_egress_only(int parent_cgroup_fd, int child_cgroup_fd) +{ + struct cg_storage_multi_egress_only *obj; + int err; + + if (!test__start_subtest("egress_only")) + return; + + obj = cg_storage_multi_egress_only__open_and_load(); + if (CHECK_FAIL(!obj)) + return; + + /* Attach to parent cgroup, trigger packet from child. + * Assert that there is only one run and in that run the storage is + * parent cgroup's storage. + * Also assert that child cgroup's storage does not exist + */ + err = bpf_prog_attach(bpf_program__fd(obj->progs.egress), + parent_cgroup_fd, + BPF_CGROUP_INET_EGRESS, BPF_F_ALLOW_MULTI); + if (CHECK_FAIL(err)) + goto close_bpf_object; + err = connect_send(CHILD_CGROUP); + if (CHECK_FAIL(err)) + goto close_bpf_object; + if (CHECK_FAIL(obj->bss->invocations != 1)) + goto close_bpf_object; + if (CHECK_FAIL(assert_storage(obj->maps.cgroup_storage, + PARENT_CGROUP, 1))) + goto close_bpf_object; + if (CHECK_FAIL(assert_storage_noexist(obj->maps.cgroup_storage, + CHILD_CGROUP))) + goto close_bpf_object; + + /* Attach to parent and child cgroup, trigger packet from child. + * Assert that there are two additional runs, one that run with parent + * cgroup's storage and one with child cgroup's storage. + */ + err = bpf_prog_attach(bpf_program__fd(obj->progs.egress), + child_cgroup_fd, + BPF_CGROUP_INET_EGRESS, BPF_F_ALLOW_MULTI); + if (CHECK_FAIL(err)) + goto close_bpf_object; + + err = connect_send(CHILD_CGROUP); + if (CHECK_FAIL(err)) + goto close_bpf_object; + if (CHECK_FAIL(obj->bss->invocations != 3)) + goto close_bpf_object; + if (CHECK_FAIL(assert_storage(obj->maps.cgroup_storage, + PARENT_CGROUP, 2))) + goto close_bpf_object; + if (CHECK_FAIL(assert_storage(obj->maps.cgroup_storage, + CHILD_CGROUP, 1))) + goto close_bpf_object; + +close_bpf_object: + cg_storage_multi_egress_only__destroy(obj); +} + +void test_cg_storage_multi(void) +{ + int parent_cgroup_fd, child_cgroup_fd; + + parent_cgroup_fd = test__join_cgroup(PARENT_CGROUP); + child_cgroup_fd = create_and_get_cgroup(CHILD_CGROUP); + if (CHECK_FAIL(parent_cgroup_fd < 0 || child_cgroup_fd < 0)) + goto close_cgroup_fd; + + test_egress_only(parent_cgroup_fd, child_cgroup_fd); + +close_cgroup_fd: + close(child_cgroup_fd); + close(parent_cgroup_fd); +} diff --git a/tools/testing/selftests/bpf/progs/cg_storage_multi_egress_only.c b/tools/testing/selftests/bpf/progs/cg_storage_multi_egress_only.c new file mode 100644 index 000000000000..ec0165d07105 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/cg_storage_multi_egress_only.c @@ -0,0 +1,30 @@ +// SPDX-License-Identifier: GPL-2.0-only + +/* + * Copyright 2020 Google LLC. + */ + +#include +#include +#include +#include +#include + +struct { + __uint(type, BPF_MAP_TYPE_CGROUP_STORAGE); + __type(key, struct bpf_cgroup_storage_key); + __type(value, __u32); +} cgroup_storage SEC(".maps"); + +__u32 invocations = 0; + +SEC("cgroup_skb/egress") +int egress(struct __sk_buff *skb) +{ + __u32 *ptr_cg_storage = bpf_get_local_storage(&cgroup_storage, 0); + + __sync_fetch_and_add(ptr_cg_storage, 1); + __sync_fetch_and_add(&invocations, 1); + + return 1; +} From patchwork Mon Jul 6 20:51:19 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: YiFei Zhu X-Patchwork-Id: 1323962 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: incoming-bpf@patchwork.ozlabs.org Delivered-To: patchwork-incoming-bpf@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=bpf-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=GDwtiiyj; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 4B0yVG4c5kz9sRK for ; Tue, 7 Jul 2020 06:54:14 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726491AbgGFUyO (ORCPT ); Mon, 6 Jul 2020 16:54:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59088 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725942AbgGFUyN (ORCPT ); Mon, 6 Jul 2020 16:54:13 -0400 Received: from mail-il1-x144.google.com (mail-il1-x144.google.com [IPv6:2607:f8b0:4864:20::144]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CDF7EC061755 for ; Mon, 6 Jul 2020 13:54:13 -0700 (PDT) Received: by mail-il1-x144.google.com with SMTP id a6so17399632ilq.13 for ; Mon, 06 Jul 2020 13:54:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=KSrlpH4HSsfJcVSLE4a6+tSmqYODYPfH33FwVBIhULk=; b=GDwtiiyjFwo1JHvylgf++TQcmtO3IuYultuZSYBQIY9fan4NPlkA8GHDhFvSDMUm2B EgJBaIGbYSkadlD99qr9T94qArC5OKkCiLepLB7kIcuNT5XG7BklEvJwK0aW4DwDaX/P Tq9UL1hQEa+oCiOQx9APap012lUoRVBoti/AxlY0kx+X2BjCxGdl6OyheMAxo+8GiN4e 6hEAKy7ZnEKRFecdXTK42MzJLGdvgiroj3GA0aTuP1oUn6VzH55Dtm+eMDacq1D5noci mBpI5mAg5jUKqHR3eFloqDsNmdpXDDJoy868GL4HLzbY+wiGgraxNdjksNdvO0hU3s4J 3NLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=KSrlpH4HSsfJcVSLE4a6+tSmqYODYPfH33FwVBIhULk=; b=Jlbn/qD8HH81psfKO3gfEm9bQTyMIsVM2tPFZiJXm3Q8onbgbqDGBaCbxNtz+QTwgp vbBwXtkeh7pdRb3RakPoXpqIE+3NxeF0svoWkS7YcYaKT7IOmZg2PHuGGUwUEFs1yrH6 Teqp7bHex7KgpcmQ6kAza8DjzfXIzUN4bC5Y3JceEeyQitV0G9Ig88r7w9jw6Z1jc3bk vu2yPihEuVVCkLqkqWRmkjYKax0gg84Iw5t36RVVh/Mac+B4Q22FrK4oHMV/YLCjetMf m2qRzdnKWB42rZq9EHJru8a9C2zMWNBRw6tXpe6Htnr6CzZWa204sRl2RkGuaUEcpot2 Fc4w== X-Gm-Message-State: AOAM533fC8OYT6FcyX9g9leSuv2fBpjJ2GrnvQWIoAqsjnM7NOJaSlAd tJGx428qNl6fRMvqwRbPW4d2nsL6rkQ= X-Google-Smtp-Source: ABdhPJytrolUtIZSW+CX+rlk3BWaLElcfrYyAj5pTp7OYqCEsbiH0nYz5v96hS8Hr42dLGGF7L1bJA== X-Received: by 2002:a05:6e02:4ce:: with SMTP id f14mr31695987ils.2.1594068852909; Mon, 06 Jul 2020 13:54:12 -0700 (PDT) Received: from localhost.localdomain (host-173-230-99-2.tnkngak.clients.pavlovmedia.com. [173.230.99.2]) by smtp.gmail.com with ESMTPSA id r124sm10744198iod.40.2020.07.06.13.54.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Jul 2020 13:54:12 -0700 (PDT) From: YiFei Zhu To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Stanislav Fomichev , Mahesh Bandewar , Roman Gushchin , YiFei Zhu Subject: [PATCH bpf-next 2/5] selftests/bpf: Test CGROUP_STORAGE map can't be used by multiple progs Date: Mon, 6 Jul 2020 15:51:19 -0500 Message-Id: <1ee7ac24911b161b048f1221ed35932126fe0e95.1594065127.git.zhuyifei@google.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: References: MIME-Version: 1.0 Sender: bpf-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org From: YiFei Zhu The current assumption is that the lifetime of a cgroup storage is tied to the program's attachment. The storage is created in cgroup_bpf_attach, and released upon cgroup_bpf_detach and cgroup_bpf_release. Because the current semantics is that each attachment gets a completely independent cgroup storage, and you can have multiple programs attached to the same (cgroup, attach type) pair, the key of the CGROUP_STORAGE map, looking up the map with this pair could yield multiple storages, and that is not permitted. Therefore, the kernel verifier checks that two programs cannot share the same CGROUP_STORAGE map, even if they have different expected attach types, considering that the actual attach type does not always have to be equal to the expected attach type. The test creates a CGROUP_STORAGE map and make it shared across two different programs, one cgroup_skb/egress and one /ingress. It asserts that the two programs cannot be both loaded, due to verifier failure from the above reason. Signed-off-by: YiFei Zhu --- .../bpf/prog_tests/cg_storage_multi.c | 37 ++++++++++++--- .../selftests/bpf/progs/cg_storage_multi.h | 13 ++++++ .../progs/cg_storage_multi_egress_ingress.c | 45 +++++++++++++++++++ .../bpf/progs/cg_storage_multi_egress_only.c | 9 ++-- 4 files changed, 94 insertions(+), 10 deletions(-) create mode 100644 tools/testing/selftests/bpf/progs/cg_storage_multi.h create mode 100644 tools/testing/selftests/bpf/progs/cg_storage_multi_egress_ingress.c diff --git a/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c b/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c index fee34a0ef862..6738b18835d5 100644 --- a/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c +++ b/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c @@ -8,16 +8,19 @@ #include #include +#include "progs/cg_storage_multi.h" + #include "cg_storage_multi_egress_only.skel.h" +#include "cg_storage_multi_egress_ingress.skel.h" #define PARENT_CGROUP "/cgroup_storage" #define CHILD_CGROUP "/cgroup_storage/child" static bool assert_storage(struct bpf_map *map, const char *cgroup_path, - __u32 expected) + struct cgroup_value *expected) { struct bpf_cgroup_storage_key key = {0}; - __u32 value; + struct cgroup_value value; int map_fd; map_fd = bpf_map__fd(map); @@ -26,7 +29,7 @@ static bool assert_storage(struct bpf_map *map, const char *cgroup_path, key.attach_type = BPF_CGROUP_INET_EGRESS; if (CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value) < 0)) return true; - if (CHECK_FAIL(value != expected)) + if (CHECK_FAIL(memcmp(&value, expected, sizeof(struct cgroup_value)))) return true; return false; @@ -35,7 +38,7 @@ static bool assert_storage(struct bpf_map *map, const char *cgroup_path, static bool assert_storage_noexist(struct bpf_map *map, const char *cgroup_path) { struct bpf_cgroup_storage_key key = {0}; - __u32 value; + struct cgroup_value value; int map_fd; map_fd = bpf_map__fd(map); @@ -80,6 +83,7 @@ static bool connect_send(const char *cgroup_path) static void test_egress_only(int parent_cgroup_fd, int child_cgroup_fd) { struct cg_storage_multi_egress_only *obj; + struct cgroup_value expected_cgroup_value; int err; if (!test__start_subtest("egress_only")) @@ -104,8 +108,9 @@ static void test_egress_only(int parent_cgroup_fd, int child_cgroup_fd) goto close_bpf_object; if (CHECK_FAIL(obj->bss->invocations != 1)) goto close_bpf_object; + expected_cgroup_value = (struct cgroup_value) { .egress_pkts = 1 }; if (CHECK_FAIL(assert_storage(obj->maps.cgroup_storage, - PARENT_CGROUP, 1))) + PARENT_CGROUP, &expected_cgroup_value))) goto close_bpf_object; if (CHECK_FAIL(assert_storage_noexist(obj->maps.cgroup_storage, CHILD_CGROUP))) @@ -126,17 +131,34 @@ static void test_egress_only(int parent_cgroup_fd, int child_cgroup_fd) goto close_bpf_object; if (CHECK_FAIL(obj->bss->invocations != 3)) goto close_bpf_object; + expected_cgroup_value = (struct cgroup_value) { .egress_pkts = 2 }; if (CHECK_FAIL(assert_storage(obj->maps.cgroup_storage, - PARENT_CGROUP, 2))) + PARENT_CGROUP, &expected_cgroup_value))) goto close_bpf_object; + expected_cgroup_value = (struct cgroup_value) { .egress_pkts = 1 }; if (CHECK_FAIL(assert_storage(obj->maps.cgroup_storage, - CHILD_CGROUP, 1))) + CHILD_CGROUP, &expected_cgroup_value))) goto close_bpf_object; close_bpf_object: cg_storage_multi_egress_only__destroy(obj); } +static void test_egress_ingress(int parent_cgroup_fd, int child_cgroup_fd) +{ + struct cg_storage_multi_egress_ingress *obj; + + if (!test__start_subtest("egress_ingress")) + return; + + /* Cannot load both programs due to verifier failure: + * "only one cgroup storage of each type is allowed" + */ + obj = cg_storage_multi_egress_ingress__open_and_load(); + if (CHECK_FAIL(obj || errno != EBUSY)) + return; +} + void test_cg_storage_multi(void) { int parent_cgroup_fd, child_cgroup_fd; @@ -147,6 +169,7 @@ void test_cg_storage_multi(void) goto close_cgroup_fd; test_egress_only(parent_cgroup_fd, child_cgroup_fd); + test_egress_ingress(parent_cgroup_fd, child_cgroup_fd); close_cgroup_fd: close(child_cgroup_fd); diff --git a/tools/testing/selftests/bpf/progs/cg_storage_multi.h b/tools/testing/selftests/bpf/progs/cg_storage_multi.h new file mode 100644 index 000000000000..a0778fe7857a --- /dev/null +++ b/tools/testing/selftests/bpf/progs/cg_storage_multi.h @@ -0,0 +1,13 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef __PROGS_CG_STORAGE_MULTI_H +#define __PROGS_CG_STORAGE_MULTI_H + +#include + +struct cgroup_value { + __u32 egress_pkts; + __u32 ingress_pkts; +}; + +#endif diff --git a/tools/testing/selftests/bpf/progs/cg_storage_multi_egress_ingress.c b/tools/testing/selftests/bpf/progs/cg_storage_multi_egress_ingress.c new file mode 100644 index 000000000000..9ce386899365 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/cg_storage_multi_egress_ingress.c @@ -0,0 +1,45 @@ +// SPDX-License-Identifier: GPL-2.0-only + +/* + * Copyright 2020 Google LLC. + */ + +#include +#include +#include +#include +#include + +#include "progs/cg_storage_multi.h" + +struct { + __uint(type, BPF_MAP_TYPE_CGROUP_STORAGE); + __type(key, struct bpf_cgroup_storage_key); + __type(value, struct cgroup_value); +} cgroup_storage SEC(".maps"); + +__u32 invocations = 0; + +SEC("cgroup_skb/egress") +int egress(struct __sk_buff *skb) +{ + struct cgroup_value *ptr_cg_storage = + bpf_get_local_storage(&cgroup_storage, 0); + + __sync_fetch_and_add(&ptr_cg_storage->egress_pkts, 1); + __sync_fetch_and_add(&invocations, 1); + + return 1; +} + +SEC("cgroup_skb/ingress") +int ingress(struct __sk_buff *skb) +{ + struct cgroup_value *ptr_cg_storage = + bpf_get_local_storage(&cgroup_storage, 0); + + __sync_fetch_and_add(&ptr_cg_storage->ingress_pkts, 1); + __sync_fetch_and_add(&invocations, 1); + + return 1; +} diff --git a/tools/testing/selftests/bpf/progs/cg_storage_multi_egress_only.c b/tools/testing/selftests/bpf/progs/cg_storage_multi_egress_only.c index ec0165d07105..44ad46b33539 100644 --- a/tools/testing/selftests/bpf/progs/cg_storage_multi_egress_only.c +++ b/tools/testing/selftests/bpf/progs/cg_storage_multi_egress_only.c @@ -10,10 +10,12 @@ #include #include +#include "progs/cg_storage_multi.h" + struct { __uint(type, BPF_MAP_TYPE_CGROUP_STORAGE); __type(key, struct bpf_cgroup_storage_key); - __type(value, __u32); + __type(value, struct cgroup_value); } cgroup_storage SEC(".maps"); __u32 invocations = 0; @@ -21,9 +23,10 @@ __u32 invocations = 0; SEC("cgroup_skb/egress") int egress(struct __sk_buff *skb) { - __u32 *ptr_cg_storage = bpf_get_local_storage(&cgroup_storage, 0); + struct cgroup_value *ptr_cg_storage = + bpf_get_local_storage(&cgroup_storage, 0); - __sync_fetch_and_add(ptr_cg_storage, 1); + __sync_fetch_and_add(&ptr_cg_storage->egress_pkts, 1); __sync_fetch_and_add(&invocations, 1); return 1; From patchwork Mon Jul 6 20:51:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: YiFei Zhu X-Patchwork-Id: 1323963 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: incoming-bpf@patchwork.ozlabs.org Delivered-To: patchwork-incoming-bpf@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=bpf-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=fMzeHECU; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 4B0yVL5Pbfz9sRK for ; Tue, 7 Jul 2020 06:54:18 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726542AbgGFUyS (ORCPT ); Mon, 6 Jul 2020 16:54:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59092 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725895AbgGFUyP (ORCPT ); Mon, 6 Jul 2020 16:54:15 -0400 Received: from mail-il1-x142.google.com (mail-il1-x142.google.com [IPv6:2607:f8b0:4864:20::142]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F2273C061755 for ; Mon, 6 Jul 2020 13:54:14 -0700 (PDT) Received: by mail-il1-x142.google.com with SMTP id h16so10798909ilj.11 for ; Mon, 06 Jul 2020 13:54:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=LLT65sKysswWN+G3pKOo56jdyDkLEZv2zW7hvN3IxJ8=; b=fMzeHECUj+Oxyta1Dv/HhiCxtnjSOchLlPtBecimnB+5v/s+O3xDCfckDQfeUMg0QA iqf/WYeSs3X92zt1Crm761FsoXbRLDmFjRnMisNo+zAgWPRplxV42rtfgszfv/LytKC6 gH1GsDOR5OM7f5BSmOTtW5st3CXq11pxSePYGaUBA0oBWh461rZM+am4m0kd+1JiEJtZ YWca1F2D+fW7SaJQu6LVkDcr1b00wmS42iSxx9RqacoegtWvZmUcj6x/9uRybJb0Bc5Y Z+kWSmneVx9euStasmKeiSUJQ2LVtqBMPM7QMg8vJ6qZdKarli05KILHP47s42OQqhw0 59lA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=LLT65sKysswWN+G3pKOo56jdyDkLEZv2zW7hvN3IxJ8=; b=ApO4K5Dopy4hub+LnlCHwlIrHUlgjOAYqHBQgnOvkAfxqTDcJbO60FrK542Z+kNTOa UWniX0RQahDUUAZAvdeIR/U3d3YvECMXgePfvqAbLSWhF6ePBa8IUgMGt9djrLprgWm9 t9uaUVoBTkK91WpKCZep97v9HaMgpNIUs0aeWQTiFzgDu4o4kuMsfpPCbbfJcYirESIV xAZTZ9qaoK1yy6HcdH+Kz7r5KWpjvOL05yTwXIj0j8VvpPl50w3gCno74H5kfLuf9iOV DTH1RXkiBN2GnzhvzBNzmSCtkFpV+96K8oV0tjd3ouOjdmHQa4WCIVNyZ2MgJVTU7JwI mMKA== X-Gm-Message-State: AOAM531n4gQ6A461CfIRMpU0I1g7HDSqT1DtOSUrGy7eyRkkWsTiQjYm t8Q58/e1V0s+8cWyLhTFTWfNiArXHcA= X-Google-Smtp-Source: ABdhPJw7h0y8Nmhhg2Uep9/Q5ak70dGw9uznji/Z8h9C0iBhPtU4uOh3EmGincuzLDQ25Ah77cBVDw== X-Received: by 2002:a92:cd04:: with SMTP id z4mr32790951iln.165.1594068853846; Mon, 06 Jul 2020 13:54:13 -0700 (PDT) Received: from localhost.localdomain (host-173-230-99-2.tnkngak.clients.pavlovmedia.com. [173.230.99.2]) by smtp.gmail.com with ESMTPSA id r124sm10744198iod.40.2020.07.06.13.54.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Jul 2020 13:54:13 -0700 (PDT) From: YiFei Zhu To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Stanislav Fomichev , Mahesh Bandewar , Roman Gushchin , YiFei Zhu Subject: [PATCH bpf-next 3/5] bpf: Make cgroup storages shared across attaches on the same cgroup Date: Mon, 6 Jul 2020 15:51:20 -0500 Message-Id: <115f1f4167b8a0d80b6a41d4c231979edd21aac7.1594065127.git.zhuyifei@google.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: References: MIME-Version: 1.0 Sender: bpf-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org From: YiFei Zhu This change comes in several parts: One, the restriction that the CGROUP_STORAGE map can only be used by one program is removed. This results in the removal of the field 'aux' in struct bpf_cgroup_storage_map, and removal of relevant code associated with the field, and removal of now-noop functions bpf_free_cgroup_storage and bpf_cgroup_storage_release. Second, because there could be multiple attach types to the same cgroup, the attach type is completely ignored on comparison in the map key. Newly added keys have it zeroed. The only value in the key that still matters is the cgroup inode. Third, because the storages are now shared, the storages cannot be unconditionally freed on program detach. There could be two ways to solve this issue: * A. Reference count the usage of the storages, and free when the last program is detached. * B. Free only when the storage is impossible to be referred to again, i.e. when either the cgroup_bpf it is attached to, or the map itself, is freed. Option A has the side effect that, when the user detach and reattach a program, whether the program gets a fresh storage depends on whether there is another program attached using that storage. This could trigger races if the user is multi-threaded, and since nondeterminism in data races is evil, go with option B. The both the map and the cgroup_bpf now tracks their associated storages, and the storage unlink and free are removed from cgroup_bpf_detach and added to cgroup_bpf_release and cgroup_storage_map_free. Storages are now always individually unlinked so the function bpf_cgroup_storages_unlink is now unused and removed. Fourth, on attach, we reuse the old storage if the key already exists in the map. Because the rbtree traversal holds the spinlock of the map, during which we can't allocate a new storage if we don't find an old storage, instead we preallocate the storage unconditionally, and free the preallocated storage if we find an old storage in the map. This results in a change of semantics in bpf_cgroup_storage{,s}_link, and rename cgroup_storage_insert to cgroup_storage_lookup_insert that does both lookup and conditionally insert or free. Signed-off-by: YiFei Zhu --- include/linux/bpf-cgroup.h | 15 +++---- include/uapi/linux/bpf.h | 2 +- kernel/bpf/cgroup.c | 42 ++++++++----------- kernel/bpf/core.c | 12 ------ kernel/bpf/local_storage.c | 77 +++++++++++++++------------------- tools/include/uapi/linux/bpf.h | 2 +- 6 files changed, 60 insertions(+), 90 deletions(-) diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h index c66c545e161a..fca58aae4851 100644 --- a/include/linux/bpf-cgroup.h +++ b/include/linux/bpf-cgroup.h @@ -46,7 +46,8 @@ struct bpf_cgroup_storage { }; struct bpf_cgroup_storage_map *map; struct bpf_cgroup_storage_key key; - struct list_head list; + struct list_head list_map; + struct list_head list_cg; struct rb_node node; struct rcu_head rcu; }; @@ -78,6 +79,9 @@ struct cgroup_bpf { struct list_head progs[MAX_BPF_ATTACH_TYPE]; u32 flags[MAX_BPF_ATTACH_TYPE]; + /* list of cgroup shared storages */ + struct list_head storages; + /* temp storage for effective prog array used by prog_attach/detach */ struct bpf_prog_array *inactive; @@ -164,12 +168,11 @@ static inline void bpf_cgroup_storage_set(struct bpf_cgroup_storage struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(struct bpf_prog *prog, enum bpf_cgroup_storage_type stype); void bpf_cgroup_storage_free(struct bpf_cgroup_storage *storage); -void bpf_cgroup_storage_link(struct bpf_cgroup_storage *storage, - struct cgroup *cgroup, - enum bpf_attach_type type); +struct bpf_cgroup_storage * +bpf_cgroup_storage_link(struct bpf_cgroup_storage *new_storage, + struct cgroup *cgroup); void bpf_cgroup_storage_unlink(struct bpf_cgroup_storage *storage); int bpf_cgroup_storage_assign(struct bpf_prog_aux *aux, struct bpf_map *map); -void bpf_cgroup_storage_release(struct bpf_prog_aux *aux, struct bpf_map *map); int bpf_percpu_cgroup_storage_copy(struct bpf_map *map, void *key, void *value); int bpf_percpu_cgroup_storage_update(struct bpf_map *map, void *key, @@ -380,8 +383,6 @@ static inline void bpf_cgroup_storage_set( struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE]) {} static inline int bpf_cgroup_storage_assign(struct bpf_prog_aux *aux, struct bpf_map *map) { return 0; } -static inline void bpf_cgroup_storage_release(struct bpf_prog_aux *aux, - struct bpf_map *map) {} static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc( struct bpf_prog *prog, enum bpf_cgroup_storage_type stype) { return NULL; } static inline void bpf_cgroup_storage_free( diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index da9bf35a26f8..af8f8817b9f7 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -78,7 +78,7 @@ struct bpf_lpm_trie_key { struct bpf_cgroup_storage_key { __u64 cgroup_inode_id; /* cgroup inode id */ - __u32 attach_type; /* program attach type */ + __u32 attach_type; /* program attach type, unused */ }; /* BPF syscall commands, see bpf(2) man-page for details. */ diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index ac53102e244a..06dcaf7d4901 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -63,21 +63,13 @@ static void bpf_cgroup_storages_assign(struct bpf_cgroup_storage *dst[], } static void bpf_cgroup_storages_link(struct bpf_cgroup_storage *storages[], - struct cgroup* cgrp, - enum bpf_attach_type attach_type) + struct cgroup *cgrp) { enum bpf_cgroup_storage_type stype; for_each_cgroup_storage_type(stype) - bpf_cgroup_storage_link(storages[stype], cgrp, attach_type); -} - -static void bpf_cgroup_storages_unlink(struct bpf_cgroup_storage *storages[]) -{ - enum bpf_cgroup_storage_type stype; - - for_each_cgroup_storage_type(stype) - bpf_cgroup_storage_unlink(storages[stype]); + storages[stype] = + bpf_cgroup_storage_link(storages[stype], cgrp); } /* Called when bpf_cgroup_link is auto-detached from dying cgroup. @@ -101,22 +93,23 @@ static void cgroup_bpf_release(struct work_struct *work) struct cgroup *p, *cgrp = container_of(work, struct cgroup, bpf.release_work); struct bpf_prog_array *old_array; + struct list_head *storages = &cgrp->bpf.storages; + struct bpf_cgroup_storage *storage, *stmp; + unsigned int type; mutex_lock(&cgroup_mutex); for (type = 0; type < ARRAY_SIZE(cgrp->bpf.progs); type++) { struct list_head *progs = &cgrp->bpf.progs[type]; - struct bpf_prog_list *pl, *tmp; + struct bpf_prog_list *pl, *pltmp; - list_for_each_entry_safe(pl, tmp, progs, node) { + list_for_each_entry_safe(pl, pltmp, progs, node) { list_del(&pl->node); if (pl->prog) bpf_prog_put(pl->prog); if (pl->link) bpf_cgroup_link_auto_detach(pl->link); - bpf_cgroup_storages_unlink(pl->storage); - bpf_cgroup_storages_free(pl->storage); kfree(pl); static_branch_dec(&cgroup_bpf_enabled_key); } @@ -126,6 +119,11 @@ static void cgroup_bpf_release(struct work_struct *work) bpf_prog_array_free(old_array); } + list_for_each_entry_safe(storage, stmp, storages, list_cg) { + bpf_cgroup_storage_unlink(storage); + bpf_cgroup_storage_free(storage); + } + mutex_unlock(&cgroup_mutex); for (p = cgroup_parent(cgrp); p; p = cgroup_parent(p)) @@ -290,6 +288,8 @@ int cgroup_bpf_inherit(struct cgroup *cgrp) for (i = 0; i < NR; i++) INIT_LIST_HEAD(&cgrp->bpf.progs[i]); + INIT_LIST_HEAD(&cgrp->bpf.storages); + for (i = 0; i < NR; i++) if (compute_effective_progs(cgrp, i, &arrays[i])) goto cleanup; @@ -422,7 +422,6 @@ int __cgroup_bpf_attach(struct cgroup *cgrp, struct list_head *progs = &cgrp->bpf.progs[type]; struct bpf_prog *old_prog = NULL; struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {}; - struct bpf_cgroup_storage *old_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {}; struct bpf_prog_list *pl; int err; @@ -458,10 +457,10 @@ int __cgroup_bpf_attach(struct cgroup *cgrp, if (bpf_cgroup_storages_alloc(storage, prog ? : link->link.prog)) return -ENOMEM; + bpf_cgroup_storages_link(storage, cgrp); + if (pl) { old_prog = pl->prog; - bpf_cgroup_storages_unlink(pl->storage); - bpf_cgroup_storages_assign(old_storage, pl->storage); } else { pl = kmalloc(sizeof(*pl), GFP_KERNEL); if (!pl) { @@ -480,12 +479,10 @@ int __cgroup_bpf_attach(struct cgroup *cgrp, if (err) goto cleanup; - bpf_cgroup_storages_free(old_storage); if (old_prog) bpf_prog_put(old_prog); else static_branch_inc(&cgroup_bpf_enabled_key); - bpf_cgroup_storages_link(pl->storage, cgrp, type); return 0; cleanup: @@ -493,9 +490,6 @@ int __cgroup_bpf_attach(struct cgroup *cgrp, pl->prog = old_prog; pl->link = NULL; } - bpf_cgroup_storages_free(pl->storage); - bpf_cgroup_storages_assign(pl->storage, old_storage); - bpf_cgroup_storages_link(pl->storage, cgrp, type); if (!old_prog) { list_del(&pl->node); kfree(pl); @@ -679,8 +673,6 @@ int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog, /* now can actually delete it from this cgroup list */ list_del(&pl->node); - bpf_cgroup_storages_unlink(pl->storage); - bpf_cgroup_storages_free(pl->storage); kfree(pl); if (list_empty(progs)) /* last program was detached, reset flags to zero */ diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 9df4cc9a2907..f367fe7422ea 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2042,24 +2042,12 @@ int bpf_prog_array_copy_info(struct bpf_prog_array *array, : 0; } -static void bpf_free_cgroup_storage(struct bpf_prog_aux *aux) -{ - enum bpf_cgroup_storage_type stype; - - for_each_cgroup_storage_type(stype) { - if (!aux->cgroup_storage[stype]) - continue; - bpf_cgroup_storage_release(aux, aux->cgroup_storage[stype]); - } -} - void __bpf_free_used_maps(struct bpf_prog_aux *aux, struct bpf_map **used_maps, u32 len) { struct bpf_map *map; u32 i; - bpf_free_cgroup_storage(aux); for (i = 0; i < len; i++) { map = used_maps[i]; if (map->ops->map_poke_untrack) diff --git a/kernel/bpf/local_storage.c b/kernel/bpf/local_storage.c index 51bd5a8cb01b..3baac07bc65c 100644 --- a/kernel/bpf/local_storage.c +++ b/kernel/bpf/local_storage.c @@ -20,7 +20,6 @@ struct bpf_cgroup_storage_map { struct bpf_map map; spinlock_t lock; - struct bpf_prog_aux *aux; struct rb_root root; struct list_head list; }; @@ -38,10 +37,6 @@ static int bpf_cgroup_storage_key_cmp( return -1; else if (key1->cgroup_inode_id > key2->cgroup_inode_id) return 1; - else if (key1->attach_type < key2->attach_type) - return -1; - else if (key1->attach_type > key2->attach_type) - return 1; return 0; } @@ -81,8 +76,9 @@ static struct bpf_cgroup_storage *cgroup_storage_lookup( return NULL; } -static int cgroup_storage_insert(struct bpf_cgroup_storage_map *map, - struct bpf_cgroup_storage *storage) +static struct bpf_cgroup_storage * +cgroup_storage_lookup_insert(struct bpf_cgroup_storage_map *map, + struct bpf_cgroup_storage *storage) { struct rb_root *root = &map->root; struct rb_node **new = &(root->rb_node), *parent = NULL; @@ -101,14 +97,15 @@ static int cgroup_storage_insert(struct bpf_cgroup_storage_map *map, new = &((*new)->rb_right); break; default: - return -EEXIST; + bpf_cgroup_storage_free(storage); + return this; } } rb_link_node(&storage->node, parent, new); rb_insert_color(&storage->node, root); - return 0; + return NULL; } static void *cgroup_storage_lookup_elem(struct bpf_map *_map, void *_key) @@ -131,10 +128,7 @@ static int cgroup_storage_update_elem(struct bpf_map *map, void *_key, struct bpf_cgroup_storage *storage; struct bpf_storage_buffer *new; - if (unlikely(flags & ~(BPF_F_LOCK | BPF_EXIST | BPF_NOEXIST))) - return -EINVAL; - - if (unlikely(flags & BPF_NOEXIST)) + if (unlikely(flags & ~(BPF_F_LOCK | BPF_EXIST))) return -EINVAL; if (unlikely((flags & BPF_F_LOCK) && @@ -250,16 +244,15 @@ static int cgroup_storage_get_next_key(struct bpf_map *_map, void *_key, if (!storage) goto enoent; - storage = list_next_entry(storage, list); + storage = list_next_entry(storage, list_map); if (!storage) goto enoent; } else { storage = list_first_entry(&map->list, - struct bpf_cgroup_storage, list); + struct bpf_cgroup_storage, list_map); } spin_unlock_bh(&map->lock); - next->attach_type = storage->key.attach_type; next->cgroup_inode_id = storage->key.cgroup_inode_id; return 0; @@ -318,6 +311,13 @@ static struct bpf_map *cgroup_storage_map_alloc(union bpf_attr *attr) static void cgroup_storage_map_free(struct bpf_map *_map) { struct bpf_cgroup_storage_map *map = map_to_storage(_map); + struct list_head *storages = &map->list; + struct bpf_cgroup_storage *storage, *stmp; + + list_for_each_entry_safe(storage, stmp, storages, list_map) { + bpf_cgroup_storage_unlink(storage); + bpf_cgroup_storage_free(storage); + } WARN_ON(!RB_EMPTY_ROOT(&map->root)); WARN_ON(!list_empty(&map->list)); @@ -431,13 +431,10 @@ int bpf_cgroup_storage_assign(struct bpf_prog_aux *aux, struct bpf_map *_map) spin_lock_bh(&map->lock); - if (map->aux && map->aux != aux) - goto unlock; if (aux->cgroup_storage[stype] && aux->cgroup_storage[stype] != _map) goto unlock; - map->aux = aux; aux->cgroup_storage[stype] = _map; ret = 0; unlock: @@ -446,20 +443,6 @@ int bpf_cgroup_storage_assign(struct bpf_prog_aux *aux, struct bpf_map *_map) return ret; } -void bpf_cgroup_storage_release(struct bpf_prog_aux *aux, struct bpf_map *_map) -{ - enum bpf_cgroup_storage_type stype = cgroup_storage_type(_map); - struct bpf_cgroup_storage_map *map = map_to_storage(_map); - - spin_lock_bh(&map->lock); - if (map->aux == aux) { - WARN_ON(aux->cgroup_storage[stype] != _map); - map->aux = NULL; - aux->cgroup_storage[stype] = NULL; - } - spin_unlock_bh(&map->lock); -} - static size_t bpf_cgroup_storage_calculate_size(struct bpf_map *map, u32 *pages) { size_t size; @@ -562,24 +545,29 @@ void bpf_cgroup_storage_free(struct bpf_cgroup_storage *storage) call_rcu(&storage->rcu, free_percpu_cgroup_storage_rcu); } -void bpf_cgroup_storage_link(struct bpf_cgroup_storage *storage, - struct cgroup *cgroup, - enum bpf_attach_type type) +struct bpf_cgroup_storage * +bpf_cgroup_storage_link(struct bpf_cgroup_storage *new_storage, + struct cgroup *cgroup) { struct bpf_cgroup_storage_map *map; + struct bpf_cgroup_storage *old_storage; - if (!storage) - return; + if (!new_storage) + return NULL; - storage->key.attach_type = type; - storage->key.cgroup_inode_id = cgroup_id(cgroup); + new_storage->key.cgroup_inode_id = cgroup_id(cgroup); - map = storage->map; + map = new_storage->map; spin_lock_bh(&map->lock); - WARN_ON(cgroup_storage_insert(map, storage)); - list_add(&storage->list, &map->list); + old_storage = cgroup_storage_lookup_insert(map, new_storage); + if (!old_storage) { + list_add(&new_storage->list_map, &map->list); + list_add(&new_storage->list_cg, &cgroup->bpf.storages); + } spin_unlock_bh(&map->lock); + + return old_storage ? : new_storage; } void bpf_cgroup_storage_unlink(struct bpf_cgroup_storage *storage) @@ -596,7 +584,8 @@ void bpf_cgroup_storage_unlink(struct bpf_cgroup_storage *storage) root = &map->root; rb_erase(&storage->node, root); - list_del(&storage->list); + list_del(&storage->list_map); + list_del(&storage->list_cg); spin_unlock_bh(&map->lock); } diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index da9bf35a26f8..af8f8817b9f7 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -78,7 +78,7 @@ struct bpf_lpm_trie_key { struct bpf_cgroup_storage_key { __u64 cgroup_inode_id; /* cgroup inode id */ - __u32 attach_type; /* program attach type */ + __u32 attach_type; /* program attach type, unused */ }; /* BPF syscall commands, see bpf(2) man-page for details. */ From patchwork Mon Jul 6 20:51:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: YiFei Zhu X-Patchwork-Id: 1323964 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: incoming-bpf@patchwork.ozlabs.org Delivered-To: patchwork-incoming-bpf@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=bpf-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=R8ReUeJg; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 4B0yVM2lC1z9sRN for ; Tue, 7 Jul 2020 06:54:19 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725895AbgGFUyS (ORCPT ); Mon, 6 Jul 2020 16:54:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59094 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725942AbgGFUyP (ORCPT ); Mon, 6 Jul 2020 16:54:15 -0400 Received: from mail-il1-x144.google.com (mail-il1-x144.google.com [IPv6:2607:f8b0:4864:20::144]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8B2F4C061794 for ; Mon, 6 Jul 2020 13:54:15 -0700 (PDT) Received: by mail-il1-x144.google.com with SMTP id r12so26925282ilh.4 for ; Mon, 06 Jul 2020 13:54:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=rojhnEPQhTCu/0boOncEU/iB2GL3sfTwVGQ87+2hOJ8=; b=R8ReUeJgWN//Na5afWrzzCSmA0QA34PoDHi8FhQiU6yUp2x6IUcC7l6IX5TDAP5lOv VjWCIJPxz7FFc5RYmprjJNitsA3SNBgFmAp6JHkVws9ofAWC5BkHBp4Ps3kPYhLn2WU7 +spRmDGO7tGx27BlKR+xRkRb/zwI7uwn2bTrDi45+STvRwMYw82IIT8cKzx6G3v5oztT mS1JHmbgi/hERazLMp2zFJMLov356laiBosEGtoKsE9a0B5WaNnJW8eu18aLpG1BeBtA JwAX6eoWIbNK/OBsXblMjOqUsO2DRNJvvboOY9F+aALJTHq2RR6YmkMnoDj8Yu7c8DSZ /Pkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=rojhnEPQhTCu/0boOncEU/iB2GL3sfTwVGQ87+2hOJ8=; b=boMhmcVQsrG5zniJZkqliBmgA+NIZp9nl6XeA8LqPq1ne/vpR2z0NVydast1SwSwTd RuHgzZSXkXdr+mBiDWxYgUIoEGNJCTnublK/wNabGvxB3vexrra1V9yCorwxrYerquh7 y9hFJlyz2688dpFCcQEO/hjrqCBvyR1UpELa6u4pIG3SUZ+sZrz8HDzftHArWmfjQkSc TyxEVhovs4YEkd8N3BFRHOyC8/iEEsvBPyGrBfUyZq0HvCDjgat60loeIrbIgLsDI+F6 oCkAAo1FGwJCn5oYZktezAdL206HhknEEBLhaWMmRdVcznhJMGqy5FLbqkAovATKqY9G hkTg== X-Gm-Message-State: AOAM532CZ6ixECbBawoZyzfuSZp4rFAatcmDRVajyw+plnU4JGrhcXvj VMWmhFko4oaZ1LA9rippo43D7vsI90A= X-Google-Smtp-Source: ABdhPJzMywMgfyVfS7hMikvV/q+jb5Z9ohiyQen71MJzb6JaG9ajqLjcYFDjUvEwhYPg3YHOMtF+Yg== X-Received: by 2002:a05:6e02:8b4:: with SMTP id a20mr31963413ilt.254.1594068854653; Mon, 06 Jul 2020 13:54:14 -0700 (PDT) Received: from localhost.localdomain (host-173-230-99-2.tnkngak.clients.pavlovmedia.com. [173.230.99.2]) by smtp.gmail.com with ESMTPSA id r124sm10744198iod.40.2020.07.06.13.54.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Jul 2020 13:54:14 -0700 (PDT) From: YiFei Zhu To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Stanislav Fomichev , Mahesh Bandewar , Roman Gushchin , YiFei Zhu Subject: [PATCH bpf-next 4/5] selftests/bpf: Test CGROUP_STORAGE behavior on shared egress + ingress Date: Mon, 6 Jul 2020 15:51:21 -0500 Message-Id: <78ebd486140d06d70e64a23bc5d30d2e9a02a997.1594065127.git.zhuyifei@google.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: References: MIME-Version: 1.0 Sender: bpf-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org From: YiFei Zhu This mirrors the original egress-only test. The cgroup_storage is now extended to have two packet counters, one for egress and one for ingress. The behavior of the counters are exactly the same as the original egress-only test, only that the total number of invocations doubles from having both egress and ingress being counted. The field attach_type in the map key is ignored in the kernel; however, keeping it is pointless here and we are demonstrating the expected usage of the map, so it is removed. That said, keeping the field will not fail the test, for backwards compatibility reasons. In other words, the original egress-only test is not affected by the change in CGROUP_STORAGE behavior and will pass in both cases. Signed-off-by: YiFei Zhu --- .../bpf/prog_tests/cg_storage_multi.c | 77 +++++++++++++++++-- 1 file changed, 71 insertions(+), 6 deletions(-) diff --git a/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c b/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c index 6738b18835d5..1b973ac56357 100644 --- a/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c +++ b/tools/testing/selftests/bpf/prog_tests/cg_storage_multi.c @@ -26,7 +26,6 @@ static bool assert_storage(struct bpf_map *map, const char *cgroup_path, map_fd = bpf_map__fd(map); key.cgroup_inode_id = get_cgroup_id(cgroup_path); - key.attach_type = BPF_CGROUP_INET_EGRESS; if (CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value) < 0)) return true; if (CHECK_FAIL(memcmp(&value, expected, sizeof(struct cgroup_value)))) @@ -44,7 +43,6 @@ static bool assert_storage_noexist(struct bpf_map *map, const char *cgroup_path) map_fd = bpf_map__fd(map); key.cgroup_inode_id = get_cgroup_id(cgroup_path); - key.attach_type = BPF_CGROUP_INET_EGRESS; if (CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value) == 0)) return true; if (CHECK_FAIL(errno != ENOENT)) @@ -147,16 +145,83 @@ static void test_egress_only(int parent_cgroup_fd, int child_cgroup_fd) static void test_egress_ingress(int parent_cgroup_fd, int child_cgroup_fd) { struct cg_storage_multi_egress_ingress *obj; + struct cgroup_value expected_cgroup_value; + int err; if (!test__start_subtest("egress_ingress")) return; - /* Cannot load both programs due to verifier failure: - * "only one cgroup storage of each type is allowed" - */ obj = cg_storage_multi_egress_ingress__open_and_load(); - if (CHECK_FAIL(obj || errno != EBUSY)) + if (CHECK_FAIL(!obj)) return; + + /* Attach to parent cgroup, trigger packet from child. + * Assert that there is two runs, one with parent cgroup egress and + * one with parent cgroup ingress. + * Also assert that child cgroup's storage does not exist + */ + err = bpf_prog_attach(bpf_program__fd(obj->progs.egress), + parent_cgroup_fd, + BPF_CGROUP_INET_EGRESS, BPF_F_ALLOW_MULTI); + if (CHECK_FAIL(err)) + goto close_bpf_object; + err = bpf_prog_attach(bpf_program__fd(obj->progs.ingress), + parent_cgroup_fd, + BPF_CGROUP_INET_INGRESS, BPF_F_ALLOW_MULTI); + if (CHECK_FAIL(err)) + goto close_bpf_object; + err = connect_send(CHILD_CGROUP); + if (CHECK_FAIL(err)) + goto close_bpf_object; + if (CHECK_FAIL(obj->bss->invocations != 2)) + goto close_bpf_object; + expected_cgroup_value = (struct cgroup_value) { + .egress_pkts = 1, + .ingress_pkts = 1, + }; + if (CHECK_FAIL(assert_storage(obj->maps.cgroup_storage, + PARENT_CGROUP, &expected_cgroup_value))) + goto close_bpf_object; + if (CHECK_FAIL(assert_storage_noexist(obj->maps.cgroup_storage, + CHILD_CGROUP))) + goto close_bpf_object; + + /* Attach to parent and child cgroup, trigger packet from child. + * Assert that there is four additional runs, parent cgroup egress and + * ingress, child cgroup egress and ingress. + */ + err = bpf_prog_attach(bpf_program__fd(obj->progs.egress), + child_cgroup_fd, + BPF_CGROUP_INET_EGRESS, BPF_F_ALLOW_MULTI); + if (CHECK_FAIL(err)) + goto close_bpf_object; + err = bpf_prog_attach(bpf_program__fd(obj->progs.ingress), + child_cgroup_fd, + BPF_CGROUP_INET_INGRESS, BPF_F_ALLOW_MULTI); + if (CHECK_FAIL(err)) + goto close_bpf_object; + err = connect_send(CHILD_CGROUP); + if (CHECK_FAIL(err)) + goto close_bpf_object; + if (CHECK_FAIL(obj->bss->invocations != 6)) + goto close_bpf_object; + expected_cgroup_value = (struct cgroup_value) { + .egress_pkts = 2, + .ingress_pkts = 2, + }; + if (CHECK_FAIL(assert_storage(obj->maps.cgroup_storage, + PARENT_CGROUP, &expected_cgroup_value))) + goto close_bpf_object; + expected_cgroup_value = (struct cgroup_value) { + .egress_pkts = 1, + .ingress_pkts = 1, + }; + if (CHECK_FAIL(assert_storage(obj->maps.cgroup_storage, + CHILD_CGROUP, &expected_cgroup_value))) + goto close_bpf_object; + +close_bpf_object: + cg_storage_multi_egress_ingress__destroy(obj); } void test_cg_storage_multi(void) From patchwork Mon Jul 6 20:51:22 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: YiFei Zhu X-Patchwork-Id: 1323965 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: incoming-bpf@patchwork.ozlabs.org Delivered-To: patchwork-incoming-bpf@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=bpf-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=fkZoe5d/; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 4B0yVM5PC2z9sRR for ; Tue, 7 Jul 2020 06:54:19 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725942AbgGFUyS (ORCPT ); Mon, 6 Jul 2020 16:54:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59100 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726497AbgGFUyQ (ORCPT ); Mon, 6 Jul 2020 16:54:16 -0400 Received: from mail-il1-x144.google.com (mail-il1-x144.google.com [IPv6:2607:f8b0:4864:20::144]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7C894C08C5DF for ; Mon, 6 Jul 2020 13:54:16 -0700 (PDT) Received: by mail-il1-x144.google.com with SMTP id h16so10798971ilj.11 for ; Mon, 06 Jul 2020 13:54:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=of9+3qI/MyRMYwvrISkr1vjZMf+9lj7qYnhFd6xNdRY=; b=fkZoe5d/m0c2LeXelBCmU/VHs/BXpH+6MBlgCpXckmE/9oDVwGKNDYovz1EFXcO+uy z60fz9pERVrMDP+320YxNAJ2fh1YuUXfxJh8/H9W9CdFk4nrInbL8Wjl2xvmEr+eVXw3 h1Ti4AWk5ewb/LT7sVg0siCaAFqDJNT5BZVqMxycRVBVnCGHqTTDWu+kuEGFYMHUjtrR w0LGOvv0inE322nGXnZ2YD0EUMqL1Vf5CLKKKhXzvCV5arTxMjTBqLn0fuOf8oAMWzwY e6OHkrbjFI7nWDZMuSY973n/QeQ/7GMjl6WWYU45pnCdgHTcLHb/sYW+9qbWvCFdLhbJ 4D6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=of9+3qI/MyRMYwvrISkr1vjZMf+9lj7qYnhFd6xNdRY=; b=ed62C29bXXkEllmvctT5dlK2/BM3COQNXpwzDASXOb57dvndtHiLiK+GnXfjgUet2f 3Aqkhv5U+fZjLkzdXUpoIjPH/FdoI7DLS2YGE9OvBytYqLcwyxyMLzmHsrAg+MmYalwa xrA/Vlqh72VL2vYzT/oIkp+ZSwyqsdPpgSbs16vaHAvlORmiLj20i39u0spSYP7eLgAW PzJBlN0Q4Gh3CycDAk7lNbVo6cG7d5McDHHtf6me4X2rIL47u/q6bp5LmajqL4e2Z1t6 Qk7zDm4cQAmQyBhlNd/0v6k0g9zZTPvWeneHClgcrFsHcuDTXaNfsIS5c+AxYacLExj5 lnCg== X-Gm-Message-State: AOAM531qQMlUiv8KsjNckgNQz3B8+zYtHlPnpQZRDhauMn5zKAC+qlOF 0wv9SQOvv427W0R5OHSpMJIqkkvM55g= X-Google-Smtp-Source: ABdhPJzPlpDYUGKr6TgJekcHRkvbWTdDmBAK/qxV+GbqfePxknvne9iBydButqC0Mc0F9zKJERsK5A== X-Received: by 2002:a92:dc4a:: with SMTP id x10mr32479545ilq.111.1594068855600; Mon, 06 Jul 2020 13:54:15 -0700 (PDT) Received: from localhost.localdomain (host-173-230-99-2.tnkngak.clients.pavlovmedia.com. [173.230.99.2]) by smtp.gmail.com with ESMTPSA id r124sm10744198iod.40.2020.07.06.13.54.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Jul 2020 13:54:14 -0700 (PDT) From: YiFei Zhu To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Stanislav Fomichev , Mahesh Bandewar , Roman Gushchin , YiFei Zhu Subject: [PATCH bpf-next 5/5] Documentation/bpf: Document CGROUP_STORAGE map type Date: Mon, 6 Jul 2020 15:51:22 -0500 Message-Id: X-Mailer: git-send-email 2.27.0 In-Reply-To: References: MIME-Version: 1.0 Sender: bpf-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org From: YiFei Zhu The machanics and usage are not very straightforward. Given the changes it's better to document how it works and how to use it, rather than having to rely on the examples and implementation to infer what is going on. Signed-off-by: YiFei Zhu --- Documentation/bpf/index.rst | 9 +++ Documentation/bpf/map_cgroup_storage.rst | 95 ++++++++++++++++++++++++ 2 files changed, 104 insertions(+) create mode 100644 Documentation/bpf/map_cgroup_storage.rst diff --git a/Documentation/bpf/index.rst b/Documentation/bpf/index.rst index 38b4db8be7a2..26f4bb3107fc 100644 --- a/Documentation/bpf/index.rst +++ b/Documentation/bpf/index.rst @@ -48,6 +48,15 @@ Program types bpf_lsm +Map types +========= + +.. toctree:: + :maxdepth: 1 + + map_cgroup_storage + + Testing and debugging BPF ========================= diff --git a/Documentation/bpf/map_cgroup_storage.rst b/Documentation/bpf/map_cgroup_storage.rst new file mode 100644 index 000000000000..b7210cb3f294 --- /dev/null +++ b/Documentation/bpf/map_cgroup_storage.rst @@ -0,0 +1,95 @@ +.. SPDX-License-Identifier: GPL-2.0-only +.. Copyright (C) 2020 Google LLC. + +=========================== +BPF_MAP_TYPE_CGROUP_STORAGE +=========================== + +The ``BPF_MAP_TYPE_CGROUP_STORAGE`` map type represents a local fix-sized +storage. It is only available with ``CONFIG_CGROUP_BPF``, and to programs that +attach to cgroups; the programs are made available by the same config. The +storage is identified by the cgroup the program is attached to. + +This document describes the usage and semantics of the +``BPF_MAP_TYPE_CGROUP_STORAGE`` map type. Some of its behaviors was changed in +Linux 5.9 and this document will describe the differences. + +Usage +===== + +The map uses key of type ``struct bpf_cgroup_storage_key``, declared in +``linux/bpf.h``:: + + struct bpf_cgroup_storage_key { + __u64 cgroup_inode_id; + __u32 attach_type; + }; + +``cgroup_inode_id`` is the inode id of the cgroup directory. +``attach_type`` was the the program's attach type prior to Linux 5.9, since 5.9 +it is ignored and kept for backwards compatibility. + +To access the storage in a program, use ``bpf_get_local_storage``:: + + void *bpf_get_local_storage(void *map, u64 flags) + +``flags`` is reserved for future use and must be 0. + +There is no implicit synchronization. Storages of ``BPF_MAP_TYPE_CGROUP_STORAGE`` +can be accessed by multiple programs across different CPUs, and user should +take care of synchronization by themselves. + +Example usage:: + + #include + + struct { + __uint(type, BPF_MAP_TYPE_CGROUP_STORAGE); + __type(key, struct bpf_cgroup_storage_key); + __type(value, __u32); + } cgroup_storage SEC(".maps"); + + int program(struct __sk_buff *skb) + { + __u32 *ptr = bpf_get_local_storage(&cgroup_storage, 0); + __sync_fetch_and_add(ptr_cg_storage-, 1); + + return 0; + } + +Semantics +========= + +``BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE`` is a variant of this map type. This +per-CPU variant will have different memory regions for each CPU for each +storage. The non-per-CPU will have the same memory region for each storage. + +Prior to Linux 5.9, the lifetime of a storage is precisely per-attachment, and +for a single ``CGROUP_STORAGE`` map, there can be at most one program loaded +that uses the map. A program may be attached to multiple cgroups or have +multiple attach types, and each attach creates a fresh zeroed storage. The +storage is freed upon detach. + +Userspace may use the the attach parameters of cgroup and attach type pair +in ``struct bpf_cgroup_storage_key`` as the key to the BPF map APIs to read or +update the storage for a given attachment. + +Since Linux 5.9, storage can be shared by multiple programs, and attach type +is ignored. When a program is attached to a cgroup, the kernel would create a +new storage only if the map does not already contain an entry for the cgroup, +or else the old storage is reused for the new attachment. Storage is freed +only when either the map or the cgroup attached to is being freed. Detaching +will not directly free the storage, but it may cause the reference to the map +to reach zero and indirectly freeing all storage in the map. + +Userspace may use the the attach parameters of cgroup only in +``struct bpf_cgroup_storage_key`` as the key to the BPF map APIs to read or +update the storage for a given attachment. The struct also contains an +``attach_type`` field; this field is ignored. + +In all versions, the storage is bound at attach time. Even if the program is +attached to parent and triggers in child, the storage still belongs to the +parent. + +Userspace cannot create a new entry in the map or delete an existing entry. +Program test runs always use a temporary storage.