bpftool: implement cgroup bpf operations (5ccda64d) · Commits · e / devices / android_kernel_teracube_emerald

tools/bpf/bpftool/Documentation/bpftool-cgroup.rst

0 → 100644

+118 −0

Original line number	Diff line number	Diff line
		================
		bpftool-cgroup
		================
		-------------------------------------------------------------------------------
		tool for inspection and simple manipulation of eBPF progs
		-------------------------------------------------------------------------------

		:Manual section: 8

		SYNOPSIS
		========

		bpftool [OPTIONS] cgroup COMMAND

		OPTIONS := { { -j \| --json } [{ -p \| --pretty }] \| { -f \| --bpffs } }

		COMMANDS :=
		{ list \| attach \| detach \| help }

		MAP COMMANDS
		=============

		\| bpftool cgroup list CGROUP
		\| bpftool cgroup attach CGROUP ATTACH_TYPE PROG [ATTACH_FLAGS]
		\| bpftool cgroup detach CGROUP ATTACH_TYPE PROG
		\| bpftool cgroup help
		\|
		\| PROG := { id PROG_ID \| pinned FILE \| tag PROG_TAG }
		\| ATTACH_TYPE := { ingress \| egress \| sock_create \| sock_ops \| device }
		\| ATTACH_FLAGS := { multi \| override }

		DESCRIPTION
		===========
		bpftool cgroup list CGROUP
		List all programs attached to the cgroup CGROUP.

		Output will start with program ID followed by attach type,
		attach flags and program name.

		bpftool cgroup attach CGROUP ATTACH_TYPE PROG [ATTACH_FLAGS]
		Attach program PROG to the cgroup CGROUP with attach type
		ATTACH_TYPE and optional ATTACH_FLAGS.

		ATTACH_FLAGS can be one of: override if a sub-cgroup installs
		some bpf program, the program in this cgroup yields to sub-cgroup
		program; multi if a sub-cgroup installs some bpf program,
		that cgroup program gets run in addition to the program in this
		cgroup.

		Only one program is allowed to be attached to a cgroup with
		no attach flags or the override flag. Attaching another
		program will release old program and attach the new one.

		Multiple programs are allowed to be attached to a cgroup with
		multi. They are executed in FIFO order (those that were
		attached first, run first).

		Non-default ATTACH_FLAGS are supported by kernel version 4.14
		and later.

		ATTACH_TYPE can be on of:
		ingress ingress path of the inet socket (since 4.10);
		egress egress path of the inet socket (since 4.10);
		sock_create opening of an inet socket (since 4.10);
		sock_ops various socket operations (since 4.12);
		device device access (since 4.15).

		bpftool cgroup detach CGROUP ATTACH_TYPE PROG
		Detach PROG from the cgroup CGROUP and attach type
		ATTACH_TYPE.

		bpftool prog help
		Print short help message.

		OPTIONS
		=======
		-h, --help
		Print short generic help message (similar to bpftool help).

		-v, --version
		Print version number (similar to bpftool version).

		-j, --json
		Generate JSON output. For commands that cannot produce JSON, this
		option has no effect.

		-p, --pretty
		Generate human-readable JSON output. Implies -j.

		-f, --bpffs
		Show file names of pinned programs.

		EXAMPLES
		========
		\|
		\| # mount -t bpf none /sys/fs/bpf/
		\| # mkdir /sys/fs/cgroup/test.slice
		\| # bpftool prog load ./device_cgroup.o /sys/fs/bpf/prog
		\| # bpftool cgroup attach /sys/fs/cgroup/test.slice/ device id 1 allow_multi

		# bpftool cgroup list /sys/fs/cgroup/test.slice/

		::

		ID AttachType AttachFlags Name
		1 device allow_multi bpf_prog1

		\|
		\| # bpftool cgroup detach /sys/fs/cgroup/test.slice/ device id 1
		\| # bpftool cgroup list /sys/fs/cgroup/test.slice/

		::

		ID AttachType AttachFlags Name

		SEE ALSO
		========
		bpftool\ (8), bpftool-prog\ (8), bpftool-map\ (8)

tools/bpf/bpftool/Documentation/bpftool-map.rst

+1 −1

Original line number	Diff line number	Diff line
		@@ -128,4 +128,4 @@ EXAMPLES

		SEE ALSO
		========
		bpftool\ (8), bpftool-prog\ (8)
		bpftool\ (8), bpftool-prog\ (8), bpftool-cgroup\ (8)

tools/bpf/bpftool/Documentation/bpftool-prog.rst

+1 −1

Original line number	Diff line number	Diff line
		@@ -155,4 +155,4 @@ EXAMPLES

		SEE ALSO
		========
		bpftool\ (8), bpftool-map\ (8)
		bpftool\ (8), bpftool-map\ (8), bpftool-cgroup\ (8)

tools/bpf/bpftool/Documentation/bpftool.rst

+4 −2

Original line number	Diff line number	Diff line
		@@ -16,7 +16,7 @@ SYNOPSIS

		bpftool version

		OBJECT := { map \| program }
		OBJECT := { map \| program \| cgroup }

		OPTIONS := { { -V \| --version } \| { -h \| --help }
		\| { -j \| --json } [{ -p \| --pretty }] }
		@@ -28,6 +28,8 @@ SYNOPSIS
		PROG-COMMANDS := { show \| dump jited \| dump xlated \| pin
		\| load \| help }

		CGROUP-COMMANDS := { list \| attach \| detach \| help }

		DESCRIPTION
		===========
		bpftool allows for inspection and simple modification of BPF objects
		@@ -53,4 +55,4 @@ OPTIONS

		SEE ALSO
		========
		bpftool-map\ (8), bpftool-prog\ (8)
		bpftool-map\ (8), bpftool-prog\ (8), bpftool-cgroup\ (8)

tools/bpf/bpftool/cgroup.c

0 → 100644

+307 −0

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0+
		// Copyright (C) 2017 Facebook
		// Author: Roman Gushchin <guro@fb.com>

		#include <fcntl.h>
		#include <stdlib.h>
		#include <string.h>
		#include <sys/stat.h>
		#include <sys/types.h>
		#include <unistd.h>

		#include <bpf.h>

		#include "main.h"

		#define HELP_SPEC_ATTACH_FLAGS \
		"ATTACH_FLAGS := { multi \| override }"

		#define HELP_SPEC_ATTACH_TYPES \
		"ATTACH_TYPE := { ingress \| egress \| sock_create \| sock_ops \| device }"

		static const char * const attach_type_strings[] = {
		[BPF_CGROUP_INET_INGRESS] = "ingress",
		[BPF_CGROUP_INET_EGRESS] = "egress",
		[BPF_CGROUP_INET_SOCK_CREATE] = "sock_create",
		[BPF_CGROUP_SOCK_OPS] = "sock_ops",
		[BPF_CGROUP_DEVICE] = "device",
		[__MAX_BPF_ATTACH_TYPE] = NULL,
		};

		static enum bpf_attach_type parse_attach_type(const char *str)
		{
		enum bpf_attach_type type;

		for (type = 0; type < __MAX_BPF_ATTACH_TYPE; type++) {
		if (attach_type_strings[type] &&
		is_prefix(str, attach_type_strings[type]))
		return type;
		}

		return __MAX_BPF_ATTACH_TYPE;
		}

		static int list_bpf_prog(int id, const char *attach_type_str,
		const char *attach_flags_str)
		{
		struct bpf_prog_info info = {};
		__u32 info_len = sizeof(info);
		int prog_fd;

		prog_fd = bpf_prog_get_fd_by_id(id);
		if (prog_fd < 0)
		return -1;

		if (bpf_obj_get_info_by_fd(prog_fd, &info, &info_len)) {
		close(prog_fd);
		return -1;
		}

		if (json_output) {
		jsonw_start_object(json_wtr);
		jsonw_uint_field(json_wtr, "id", info.id);
		jsonw_string_field(json_wtr, "attach_type",
		attach_type_str);
		jsonw_string_field(json_wtr, "attach_flags",
		attach_flags_str);
		jsonw_string_field(json_wtr, "name", info.name);
		jsonw_end_object(json_wtr);
		} else {
		printf("%-8u %-15s %-15s %-15s\n", info.id,
		attach_type_str,
		attach_flags_str,
		info.name);
		}

		close(prog_fd);
		return 0;
		}

		static int list_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type)
		{
		__u32 prog_ids[1024] = {0};
		char *attach_flags_str;
		__u32 prog_cnt, iter;
		__u32 attach_flags;
		char buf[32];
		int ret;

		prog_cnt = ARRAY_SIZE(prog_ids);
		ret = bpf_prog_query(cgroup_fd, type, 0, &attach_flags, prog_ids,
		&prog_cnt);
		if (ret)
		return ret;

		if (prog_cnt == 0)
		return 0;

		switch (attach_flags) {
		case BPF_F_ALLOW_MULTI:
		attach_flags_str = "multi";
		break;
		case BPF_F_ALLOW_OVERRIDE:
		attach_flags_str = "override";
		break;
		case 0:
		attach_flags_str = "";
		break;
		default:
		snprintf(buf, sizeof(buf), "unknown(%x)", attach_flags);
		attach_flags_str = buf;
		}

		for (iter = 0; iter < prog_cnt; iter++)
		list_bpf_prog(prog_ids[iter], attach_type_strings[type],
		attach_flags_str);

		return 0;
		}

		static int do_list(int argc, char **argv)
		{
		enum bpf_attach_type type;
		int cgroup_fd;
		int ret = -1;

		if (argc < 1) {
		p_err("too few parameters for cgroup list\n");
		goto exit;
		} else if (argc > 1) {
		p_err("too many parameters for cgroup list\n");
		goto exit;
		}

		cgroup_fd = open(argv[0], O_RDONLY);
		if (cgroup_fd < 0) {
		p_err("can't open cgroup %s\n", argv[1]);
		goto exit;
		}

		if (json_output)
		jsonw_start_array(json_wtr);
		else
		printf("%-8s %-15s %-15s %-15s\n", "ID", "AttachType",
		"AttachFlags", "Name");

		for (type = 0; type < __MAX_BPF_ATTACH_TYPE; type++) {
		/*
		* Not all attach types may be supported, so it's expected,
		* that some requests will fail.
		* If we were able to get the list for at least one
		* attach type, let's return 0.
		*/
		if (list_attached_bpf_progs(cgroup_fd, type) == 0)
		ret = 0;
		}

		if (json_output)
		jsonw_end_array(json_wtr);

		close(cgroup_fd);
		exit:
		return ret;
		}

		static int do_attach(int argc, char **argv)
		{
		enum bpf_attach_type attach_type;
		int cgroup_fd, prog_fd;
		int attach_flags = 0;
		int ret = -1;
		int i;

		if (argc < 4) {
		p_err("too few parameters for cgroup attach\n");
		goto exit;
		}

		cgroup_fd = open(argv[0], O_RDONLY);
		if (cgroup_fd < 0) {
		p_err("can't open cgroup %s\n", argv[1]);
		goto exit;
		}

		attach_type = parse_attach_type(argv[1]);
		if (attach_type == __MAX_BPF_ATTACH_TYPE) {
		p_err("invalid attach type\n");
		goto exit_cgroup;
		}

		argc -= 2;
		argv = &argv[2];
		prog_fd = prog_parse_fd(&argc, &argv);
		if (prog_fd < 0)
		goto exit_cgroup;

		for (i = 0; i < argc; i++) {
		if (is_prefix(argv[i], "multi")) {
		attach_flags \|= BPF_F_ALLOW_MULTI;
		} else if (is_prefix(argv[i], "override")) {
		attach_flags \|= BPF_F_ALLOW_OVERRIDE;
		} else {
		p_err("unknown option: %s\n", argv[i]);
		goto exit_cgroup;
		}
		}

		if (bpf_prog_attach(prog_fd, cgroup_fd, attach_type, attach_flags)) {
		p_err("failed to attach program");
		goto exit_prog;
		}

		if (json_output)
		jsonw_null(json_wtr);

		ret = 0;

		exit_prog:
		close(prog_fd);
		exit_cgroup:
		close(cgroup_fd);
		exit:
		return ret;
		}

		static int do_detach(int argc, char **argv)
		{
		enum bpf_attach_type attach_type;
		int prog_fd, cgroup_fd;
		int ret = -1;

		if (argc < 4) {
		p_err("too few parameters for cgroup detach\n");
		goto exit;
		}

		cgroup_fd = open(argv[0], O_RDONLY);
		if (cgroup_fd < 0) {
		p_err("can't open cgroup %s\n", argv[1]);
		goto exit;
		}

		attach_type = parse_attach_type(argv[1]);
		if (attach_type == __MAX_BPF_ATTACH_TYPE) {
		p_err("invalid attach type");
		goto exit_cgroup;
		}

		argc -= 2;
		argv = &argv[2];
		prog_fd = prog_parse_fd(&argc, &argv);
		if (prog_fd < 0)
		goto exit_cgroup;

		if (bpf_prog_detach2(prog_fd, cgroup_fd, attach_type)) {
		p_err("failed to detach program");
		goto exit_prog;
		}

		if (json_output)
		jsonw_null(json_wtr);

		ret = 0;

		exit_prog:
		close(prog_fd);
		exit_cgroup:
		close(cgroup_fd);
		exit:
		return ret;
		}

		static int do_help(int argc, char **argv)
		{
		if (json_output) {
		jsonw_null(json_wtr);
		return 0;
		}

		fprintf(stderr,
		"Usage: %s %s list CGROUP\n"
		" %s %s attach CGROUP ATTACH_TYPE PROG [ATTACH_FLAGS]\n"
		" %s %s detach CGROUP ATTACH_TYPE PROG\n"
		" %s %s help\n"
		"\n"
		" " HELP_SPEC_ATTACH_TYPES "\n"
		" " HELP_SPEC_ATTACH_FLAGS "\n"
		" " HELP_SPEC_PROGRAM "\n"
		" " HELP_SPEC_OPTIONS "\n"
		"",
		bin_name, argv[-2], bin_name, argv[-2],
		bin_name, argv[-2], bin_name, argv[-2]);

		return 0;
		}

		static const struct cmd cmds[] = {
		{ "list", do_list },
		{ "attach", do_attach },
		{ "detach", do_detach },
		{ "help", do_help },
		{ 0 }
		};

		int do_cgroup(int argc, char **argv)
		{
		return cmd_select(cmds, argc, argv, do_help);
		}

Original line number	Diff line number	Diff line
		@@ -16,7 +16,7 @@ SYNOPSIS

		bpftool version

		OBJECT := { map \| program }
		OBJECT := { map \| program \| cgroup }

		OPTIONS := { { -V \| --version } \| { -h \| --help }
		\| { -j \| --json } [{ -p \| --pretty }] }
		@@ -28,6 +28,8 @@ SYNOPSIS
		PROG-COMMANDS := { show \| dump jited \| dump xlated \| pin
		\| load \| help }

		CGROUP-COMMANDS := { list \| attach \| detach \| help }

		DESCRIPTION
		===========
		bpftool allows for inspection and simple modification of BPF objects
		@@ -53,4 +55,4 @@ OPTIONS

		SEE ALSO
		========
		bpftool-map\ (8), bpftool-prog\ (8)
		bpftool-map\ (8), bpftool-prog\ (8), bpftool-cgroup\ (8)