| Message ID | 1471442448-1248-3-git-send-email-daniel@zonque.org |
|---|---|
| State | RFC, archived |
| Delegated to: | David Miller |
| Headers | show |
Hello, On Wed, Aug 17, 2016 at 04:00:45PM +0200, Daniel Mack wrote: > @@ -5461,6 +5462,14 @@ static int cgroup_destroy_locked(struct cgroup *cgrp) > for_each_css(css, ssid, cgrp) > kill_css(css); > > +#ifdef CONFIG_CGROUP_BPF > + if (cgrp->bpf_ingress) > + bpf_prog_put(cgrp->bpf_ingress); > + > + if (cgrp->bpf_egress) > + bpf_prog_put(cgrp->bpf_egress); > +#endif This most likely isn't the right place as there still can be sockets associated with the cgroup and packets flowing. The cgroup release path in css_release_work_fn() probably is the right place. Thanks.
On Wed, Aug 17, 2016 at 04:00:45PM +0200, Daniel Mack wrote: > Add two pointers for eBPF programs to struct cgroup. These will be used > to store programs for ingress and egress for accounting and filtering. > > This new feature is guarded by CONFIG_CGROUP_BPF. ... > +#ifdef CONFIG_CGROUP_BPF > + /* used by the networking layer */ > + struct bpf_prog *bpf_ingress; > + struct bpf_prog *bpf_egress; > +#endif ... > +config CGROUP_BPF > + bool "Enable eBPF programs in cgroups" > + depends on BPF_SYSCALL > + help > + This options allows cgroups to accommodate eBPF programs that > + can be used for network traffic filtering and accounting. See > + Documentation/networking/filter.txt for more information. > + I think this extra config is unnecessary. It makes the code harder to follow. Anyone turning on bpf syscall and cgroups should be able to have this feature. Extra config is imo overkill.
Hello, On Wed, Aug 17, 2016 at 10:50:40AM -0700, Alexei Starovoitov wrote: > > +config CGROUP_BPF > > + bool "Enable eBPF programs in cgroups" > > + depends on BPF_SYSCALL > > + help > > + This options allows cgroups to accommodate eBPF programs that > > + can be used for network traffic filtering and accounting. See > > + Documentation/networking/filter.txt for more information. > > + > > I think this extra config is unnecessary. It makes the code harder to follow. > Anyone turning on bpf syscall and cgroups should be able to have this feature. > Extra config is imo overkill. Agreed, the added code is pretty small, especially in comparison to both cgroup and bpf, and the only memory overhead would be four pointers per cgroup, which shouldn't be noticeable at all. Thanks.
diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h index 5b17de6..cff3560 100644 --- a/include/linux/cgroup-defs.h +++ b/include/linux/cgroup-defs.h @@ -300,6 +300,12 @@ struct cgroup { /* used to schedule release agent */ struct work_struct release_agent_work; +#ifdef CONFIG_CGROUP_BPF + /* used by the networking layer */ + struct bpf_prog *bpf_ingress; + struct bpf_prog *bpf_egress; +#endif + /* ids of the ancestors at each level including self */ int ancestor_ids[]; }; diff --git a/init/Kconfig b/init/Kconfig index cac3f09..8bf2f3e 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1144,6 +1144,14 @@ config CGROUP_PERF Say N if unsure. +config CGROUP_BPF + bool "Enable eBPF programs in cgroups" + depends on BPF_SYSCALL + help + This options allows cgroups to accommodate eBPF programs that + can be used for network traffic filtering and accounting. See + Documentation/networking/filter.txt for more information. + config CGROUP_DEBUG bool "Example controller" default n diff --git a/kernel/cgroup.c b/kernel/cgroup.c index d1c51b7..65e5701 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -62,6 +62,7 @@ #include <linux/proc_ns.h> #include <linux/nsproxy.h> #include <linux/file.h> +#include <linux/bpf.h> #include <net/sock.h> /* @@ -5461,6 +5462,14 @@ static int cgroup_destroy_locked(struct cgroup *cgrp) for_each_css(css, ssid, cgrp) kill_css(css); +#ifdef CONFIG_CGROUP_BPF + if (cgrp->bpf_ingress) + bpf_prog_put(cgrp->bpf_ingress); + + if (cgrp->bpf_egress) + bpf_prog_put(cgrp->bpf_egress); +#endif + /* * Remove @cgrp directory along with the base files. @cgrp has an * extra ref on its kn.
Add two pointers for eBPF programs to struct cgroup. These will be used to store programs for ingress and egress for accounting and filtering. This new feature is guarded by CONFIG_CGROUP_BPF. Signed-off-by: Daniel Mack <daniel@zonque.org> --- include/linux/cgroup-defs.h | 6 ++++++ init/Kconfig | 8 ++++++++ kernel/cgroup.c | 9 +++++++++ 3 files changed, 23 insertions(+)