From 6999572c06303057dbdc16c04c523f407aec08bd Mon Sep 17 00:00:00 2001

From: Julia Kartseva <hex@fb.com>

Date: Wed, 16 Sep 2020 15:58:04 -0700

Subject: [PATCH 1/9] shared: add bpf-program helpers

Add helpers to:

- Create new BPFProgram instance from a path in bpf

filesystem and bpf attach type;

- Pin a program to bpf fs;

- Get BPF program ID by BPF program FD.

---

 src/shared/bpf-program.c | 80 ++++++++++++++++++++++++++++++++++++++++

 src/shared/bpf-program.h |  5 ++-

 2 files changed, 84 insertions(+), 1 deletion(-)

diff --git a/src/shared/bpf-program.c b/src/shared/bpf-program.c

index 10239142af..d67ada23b0 100644

--- a/src/shared/bpf-program.c

+++ b/src/shared/bpf-program.c

@@ -12,6 +12,26 @@

 #include "missing_syscall.h"

 #include "path-util.h"

+ /* struct bpf_prog_info info must be initialized since its value is both input and output

+  * for BPF_OBJ_GET_INFO_BY_FD syscall. */

+static int bpf_program_get_info_by_fd(int prog_fd, struct bpf_prog_info *info, uint32_t info_len) {

+        union bpf_attr attr;

+

+        /* Explicitly memset to zero since some compilers may produce non-zero-initialized padding when

+         * structured initialization is used.

+         * Refer to https://github.com/systemd/systemd/issues/18164

+         */

+        zero(attr);

+        attr.info.bpf_fd = prog_fd;

+        attr.info.info_len = info_len;

+        attr.info.info = PTR_TO_UINT64(info);

+

+        if (bpf(BPF_OBJ_GET_INFO_BY_FD, &attr, sizeof(attr)) < 0)

+                return -errno;

+

+        return 0;

+}

+

 int bpf_program_new(uint32_t prog_type, BPFProgram **ret) {

         _cleanup_(bpf_program_unrefp) BPFProgram *p = NULL;

@@ -28,6 +48,38 @@ int bpf_program_new(uint32_t prog_type, BPFProgram **ret) {

         return 0;

 }

+int bpf_program_new_from_bpffs_path(const char *path, BPFProgram **ret) {

+        _cleanup_(bpf_program_unrefp) BPFProgram *p = NULL;

+        struct bpf_prog_info info = {};

+        int r;

+

+        assert(path);

+        assert(ret);

+

+        p = new(BPFProgram, 1);

+        if (!p)

+                return -ENOMEM;

+

+        *p = (BPFProgram) {

+                .prog_type = BPF_PROG_TYPE_UNSPEC,

+                .n_ref = 1,

+                .kernel_fd = -1,

+        };

+

+        r = bpf_program_load_from_bpf_fs(p, path);

+        if (r < 0)

+                return r;

+

+        r = bpf_program_get_info_by_fd(p->kernel_fd, &info, sizeof(info));

+        if (r < 0)

+                return r;

+

+        p->prog_type = info.type;

+        *ret = TAKE_PTR(p);

+

+        return 0;

+}

+

 static BPFProgram *bpf_program_free(BPFProgram *p) {

         assert(p);

@@ -254,3 +306,31 @@ int bpf_map_lookup_element(int fd, const void *key, void *value) {

         return 0;

 }

+

+int bpf_program_pin(int prog_fd, const char *bpffs_path) {

+        union bpf_attr attr;

+

+        zero(attr);

+        attr.pathname = PTR_TO_UINT64((void *) bpffs_path);

+        attr.bpf_fd = prog_fd;

+

+        if (bpf(BPF_OBJ_PIN, &attr, sizeof(attr)) < 0)

+                return -errno;

+

+        return 0;

+}

+

+int bpf_program_get_id_by_fd(int prog_fd, uint32_t *ret_id) {

+        struct bpf_prog_info info = {};

+        int r;

+

+        assert(ret_id);

+

+        r = bpf_program_get_info_by_fd(prog_fd, &info, sizeof(info));

+        if (r < 0)

+                return r;

+

+        *ret_id = info.id;

+

+        return 0;

+};

diff --git a/src/shared/bpf-program.h b/src/shared/bpf-program.h

index eef77f9d8e..243cef923f 100644

--- a/src/shared/bpf-program.h

+++ b/src/shared/bpf-program.h

@@ -26,8 +26,9 @@ struct BPFProgram {

 };

 int bpf_program_new(uint32_t prog_type, BPFProgram **ret);

-BPFProgram *bpf_program_unref(BPFProgram *p);

+int bpf_program_new_from_bpffs_path(const char *path, BPFProgram **ret);

 BPFProgram *bpf_program_ref(BPFProgram *p);

+BPFProgram *bpf_program_unref(BPFProgram *p);

 int bpf_program_add_instructions(BPFProgram *p, const struct bpf_insn *insn, size_t count);

 int bpf_program_load_kernel(BPFProgram *p, char *log_buf, size_t log_size);

@@ -35,6 +36,8 @@ int bpf_program_load_from_bpf_fs(BPFProgram *p, const char *path);

 int bpf_program_cgroup_attach(BPFProgram *p, int type, const char *path, uint32_t flags);

 int bpf_program_cgroup_detach(BPFProgram *p);

+int bpf_program_pin(int prog_fd, const char *bpffs_path);

+int bpf_program_get_id_by_fd(int prog_fd, uint32_t *ret_id);

 int bpf_map_new(enum bpf_map_type type, size_t key_size, size_t value_size, size_t max_entries, uint32_t flags);

 int bpf_map_update_element(int fd, const void *key, void *value);

-- 

2.30.2

From b04b09640c624df8f64944dead8d59faa0521d2e Mon Sep 17 00:00:00 2001

From: Julia Kartseva <hex@fb.com>

Date: Thu, 4 Feb 2021 00:02:07 -0800

Subject: [PATCH 2/9] shared: bpf_attach_type {from,to} string

Introduce bpf_cgroup_attach_type_table with accustomed attached type

names also used in bpftool.

Add bpf_cgroup_attach_type_{from|to}_string helpers to convert from|to

string representation of pinned bpf program, e.g.

"egress:/sys/fs/bpf/egress-hook" for

/sys/fs/bpf/egress-hook path and BPF_CGROUP_INET_EGRESS attach type.

---

 src/shared/bpf-program.c | 24 ++++++++++++++++++++++++

 src/shared/bpf-program.h |  3 +++

 2 files changed, 27 insertions(+)

diff --git a/src/shared/bpf-program.c b/src/shared/bpf-program.c

index d67ada23b0..a8a34521fd 100644

--- a/src/shared/bpf-program.c

+++ b/src/shared/bpf-program.c

@@ -11,6 +11,30 @@

 #include "memory-util.h"

 #include "missing_syscall.h"

 #include "path-util.h"

+#include "string-table.h"

+

+static const char *const bpf_cgroup_attach_type_table[__MAX_BPF_ATTACH_TYPE] = {

+        [BPF_CGROUP_INET_INGRESS] =     "ingress",

+        [BPF_CGROUP_INET_EGRESS] =      "egress",

+        [BPF_CGROUP_INET_SOCK_CREATE] = "sock_create",

+        [BPF_CGROUP_SOCK_OPS] =         "sock_ops",

+        [BPF_CGROUP_DEVICE] =           "device",

+        [BPF_CGROUP_INET4_BIND] =       "bind4",

+        [BPF_CGROUP_INET6_BIND] =       "bind6",

+        [BPF_CGROUP_INET4_CONNECT] =    "connect4",

+        [BPF_CGROUP_INET6_CONNECT] =    "connect6",

+        [BPF_CGROUP_INET4_POST_BIND] =  "post_bind4",

+        [BPF_CGROUP_INET6_POST_BIND] =  "post_bind6",

+        [BPF_CGROUP_UDP4_SENDMSG] =     "sendmsg4",

+        [BPF_CGROUP_UDP6_SENDMSG] =     "sendmsg6",

+        [BPF_CGROUP_SYSCTL] =           "sysctl",

+        [BPF_CGROUP_UDP4_RECVMSG] =     "recvmsg4",

+        [BPF_CGROUP_UDP6_RECVMSG] =     "recvmsg6",

+        [BPF_CGROUP_GETSOCKOPT] =       "getsockopt",

+        [BPF_CGROUP_SETSOCKOPT] =       "setsockopt",

+};

+

+DEFINE_STRING_TABLE_LOOKUP(bpf_cgroup_attach_type, int);

  /* struct bpf_prog_info info must be initialized since its value is both input and output

   * for BPF_OBJ_GET_INFO_BY_FD syscall. */

diff --git a/src/shared/bpf-program.h b/src/shared/bpf-program.h

index 243cef923f..86fd338c93 100644

--- a/src/shared/bpf-program.h

+++ b/src/shared/bpf-program.h

@@ -43,4 +43,7 @@ int bpf_map_new(enum bpf_map_type type, size_t key_size, size_t value_size, size

 int bpf_map_update_element(int fd, const void *key, void *value);

 int bpf_map_lookup_element(int fd, const void *key, void *value);

+int bpf_cgroup_attach_type_from_string(const char *str) _pure_;

+const char *bpf_cgroup_attach_type_to_string(int attach_type) _const_;

+

 DEFINE_TRIVIAL_CLEANUP_FUNC(BPFProgram*, bpf_program_unref);

-- 

2.30.2

From 2ab40fe0dc0f5ec83fe73bc750e9b3f5aabf1fb9 Mon Sep 17 00:00:00 2001

From: Julia Kartseva <hex@fb.com>

Date: Mon, 1 Mar 2021 16:56:04 -0800

Subject: [PATCH 3/9] cgroup: add foreign program to cgroup context

- Store foreign bpf programs in cgroup context. A program is considered

foreign if it was loaded to a kernel by an entity external to systemd,

so systemd is responsible only for attach and detach paths.

- Support the case of pinned bpf programs: pinning to bpffs so a program

is kept loaded to the kernel even when program fd is closed by a user

application is a common way to extend program's lifetime.

- Aadd linked list node struct with attach type and bpffs path

fields.

---

 src/core/cgroup.c | 45 +++++++++++++++++++++++++++++++++++++++++++++

 src/core/cgroup.h | 10 ++++++++++

 2 files changed, 55 insertions(+)

diff --git a/src/core/cgroup.c b/src/core/cgroup.c

index 3ed6ac09ff..a0af50518d 100644

--- a/src/core/cgroup.c

+++ b/src/core/cgroup.c

@@ -190,6 +190,15 @@ void cgroup_context_free_blockio_device_bandwidth(CGroupContext *c, CGroupBlockI

         free(b);

 }

+void cgroup_context_remove_bpf_foreign_program(CGroupContext *c, CGroupBPFForeignProgram *p) {

+        assert(c);

+        assert(p);

+

+        LIST_REMOVE(programs, c->bpf_foreign_programs, p);

+        free(p->bpffs_path);

+        free(p);

+}

+

 void cgroup_context_done(CGroupContext *c) {

         assert(c);

@@ -217,6 +226,9 @@ void cgroup_context_done(CGroupContext *c) {

         c->ip_filters_ingress = strv_free(c->ip_filters_ingress);

         c->ip_filters_egress = strv_free(c->ip_filters_egress);

+        while (c->bpf_foreign_programs)

+                cgroup_context_remove_bpf_foreign_program(c, c->bpf_foreign_programs);

+

         cpu_set_reset(&c->cpuset_cpus);

         cpu_set_reset(&c->cpuset_mems);

 }

@@ -360,6 +372,7 @@ void cgroup_context_dump(Unit *u, FILE* f, const char *prefix) {

         CGroupIODeviceLatency *l;

         CGroupBlockIODeviceBandwidth *b;

         CGroupBlockIODeviceWeight *w;

+        CGroupBPFForeignProgram *p;

         CGroupDeviceAllow *a;

         CGroupContext *c;

         IPAddressAccessItem *iaai;

@@ -544,6 +557,10 @@ void cgroup_context_dump(Unit *u, FILE* f, const char *prefix) {

         STRV_FOREACH(path, c->ip_filters_egress)

                 fprintf(f, "%sIPEgressFilterPath: %s\n", prefix, *path);

+

+        LIST_FOREACH(programs, p, c->bpf_foreign_programs)

+                fprintf(f, "%sBPFProgram: %s:%s",

+                        prefix, bpf_cgroup_attach_type_to_string(p->attach_type), p->bpffs_path);

 }

 int cgroup_add_device_allow(CGroupContext *c, const char *dev, const char *mode) {

@@ -575,6 +592,34 @@ int cgroup_add_device_allow(CGroupContext *c, const char *dev, const char *mode)

         return 0;

 }

+int cgroup_add_bpf_foreign_program(CGroupContext *c, uint32_t attach_type, const char *bpffs_path) {

+        CGroupBPFForeignProgram *p;

+        _cleanup_free_ char *d = NULL;

+

+        assert(c);

+        assert(bpffs_path);

+

+        if (!path_is_normalized(bpffs_path) || !path_is_absolute(bpffs_path))

+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Path is not normalized: %m");

+

+        d = strdup(bpffs_path);

+        if (!d)

+                return log_oom();

+

+        p = new(CGroupBPFForeignProgram, 1);

+        if (!p)

+                return log_oom();

+

+        *p = (CGroupBPFForeignProgram) {

+                .attach_type = attach_type,

+                .bpffs_path = TAKE_PTR(d),

+        };

+

+        LIST_PREPEND(programs, c->bpf_foreign_programs, TAKE_PTR(p));

+

+        return 0;

+}

+

 #define UNIT_DEFINE_ANCESTOR_MEMORY_LOOKUP(entry)                       \

         uint64_t unit_get_ancestor_##entry(Unit *u) {                   \

                 CGroupContext *c;                                       \

diff --git a/src/core/cgroup.h b/src/core/cgroup.h

index fa79ba1523..be3060eba7 100644

--- a/src/core/cgroup.h

+++ b/src/core/cgroup.h

@@ -31,6 +31,7 @@ typedef struct CGroupIODeviceLimit CGroupIODeviceLimit;

 typedef struct CGroupIODeviceLatency CGroupIODeviceLatency;

 typedef struct CGroupBlockIODeviceWeight CGroupBlockIODeviceWeight;

 typedef struct CGroupBlockIODeviceBandwidth CGroupBlockIODeviceBandwidth;

+typedef struct CGroupBPFForeignProgram CGroupBPFForeignProgram;

 typedef enum CGroupDevicePolicy {

         /* When devices listed, will allow those, plus built-in ones, if none are listed will allow

@@ -94,6 +95,12 @@ struct CGroupBlockIODeviceBandwidth {

         uint64_t wbps;

 };

+struct CGroupBPFForeignProgram {

+        LIST_FIELDS(CGroupBPFForeignProgram, programs);

+        uint32_t attach_type;

+        char *bpffs_path;

+};

+

 struct CGroupContext {

         bool cpu_accounting;

         bool io_accounting;

@@ -142,6 +149,7 @@ struct CGroupContext {

         char **ip_filters_ingress;

         char **ip_filters_egress;

+        LIST_HEAD(CGroupBPFForeignProgram, bpf_foreign_programs);

         /* For legacy hierarchies */

         uint64_t cpu_shares;

@@ -202,8 +210,10 @@ void cgroup_context_free_io_device_limit(CGroupContext *c, CGroupIODeviceLimit *

 void cgroup_context_free_io_device_latency(CGroupContext *c, CGroupIODeviceLatency *l);

 void cgroup_context_free_blockio_device_weight(CGroupContext *c, CGroupBlockIODeviceWeight *w);

 void cgroup_context_free_blockio_device_bandwidth(CGroupContext *c, CGroupBlockIODeviceBandwidth *b);

+void cgroup_context_remove_bpf_foreign_program(CGroupContext *c, CGroupBPFForeignProgram *p);

 int cgroup_add_device_allow(CGroupContext *c, const char *dev, const char *mode);

+int cgroup_add_bpf_foreign_program(CGroupContext *c, uint32_t attach_type, const char *path);

 void cgroup_oomd_xattr_apply(Unit *u, const char *cgroup_path);

-- 

2.30.2

From 42b3c33e312d70fec24b5daa455ab4abdcab81b4 Mon Sep 17 00:00:00 2001

From: Julia Kartseva <hex@fb.com>

Date: Wed, 16 Sep 2020 15:58:04 -0700

Subject: [PATCH 4/9] core: add bpf-foreign unit helpers

- Introduce support of cgroup-bpf programs managed (i.e. compiled,

loaded to and unloaded from kernel) externally. Systemd is only

responsible for attaching programs to unit cgroup hence the name

'foreign'.

Foreign BPF programs are identified by bpf program ID and attach type.

systemd:

- Gets kernel FD of BPF program;

- Makes a unique identifier of BPF program from BPF attach type and

program ID. Same program IDs mean the same program, i.e the same

chunk of kernel memory. Even if the same program is passed multiple

times, identical (program_id, attach_type) instances are collapsed

into one;

- Attaches programs to unit cgroup.

---

 src/core/bpf-foreign.c | 151 +++++++++++++++++++++++++++++++++++++++++

 src/core/bpf-foreign.h |  12 ++++

 src/core/meson.build   |   2 +

 src/core/unit.c        |   3 +

 src/core/unit.h        |   4 ++

 5 files changed, 172 insertions(+)

 create mode 100644 src/core/bpf-foreign.c

 create mode 100644 src/core/bpf-foreign.h

diff --git a/src/core/bpf-foreign.c b/src/core/bpf-foreign.c

new file mode 100644

index 0000000000..98655bda3c

--- /dev/null

+++ b/src/core/bpf-foreign.c

@@ -0,0 +1,151 @@

+/* SPDX-License-Identifier: LGPL-2.1+ */

+

+#include "bpf-foreign.h"

+#include "bpf-program.h"

+#include "cgroup.h"

+#include "memory-util.h"

+#include "mountpoint-util.h"

+#include "set.h"

+

+typedef struct BPFForeignKey BPFForeignKey;

+struct BPFForeignKey {

+        uint32_t prog_id;

+        uint32_t attach_type;

+};

+

+static int bpf_foreign_key_new(uint32_t prog_id,

+                enum bpf_attach_type attach_type,

+                BPFForeignKey **ret) {

+        _cleanup_free_ BPFForeignKey *p = NULL;

+

+        assert(ret);

+

+        p = new(BPFForeignKey, 1);

+        if (!p)

+                return log_oom();

+

+        *p = (BPFForeignKey) {

+                .prog_id = prog_id,

+                .attach_type = attach_type,

+        };

+

+        *ret = TAKE_PTR(p);

+

+        return 0;

+}

+

+static int bpf_foreign_key_compare_func(const BPFForeignKey *a, const BPFForeignKey *b) {

+        int r = CMP(a->prog_id, b->prog_id);

+        if (r != 0)

+                return r;

+

+        return CMP(a->attach_type, b->attach_type);

+}

+

+static void bpf_foreign_key_hash_func(const BPFForeignKey *p, struct siphash *h) {

+        siphash24_compress(&p->prog_id, sizeof(p->prog_id), h);

+        siphash24_compress(&p->attach_type, sizeof(p->attach_type), h);

+}

+

+DEFINE_PRIVATE_HASH_OPS_FULL(bpf_foreign_by_key_hash_ops,

+                BPFForeignKey, bpf_foreign_key_hash_func, bpf_foreign_key_compare_func, free,

+                BPFProgram, bpf_program_unref);

+

+static int attach_programs(Unit *u, const char *path, Hashmap* foreign_by_key, uint32_t attach_flags) {

+        const BPFForeignKey *key;

+        BPFProgram *prog;

+        int r;

+

+        assert(u);

+

+        HASHMAP_FOREACH_KEY(prog, key, foreign_by_key) {

+                r = bpf_program_cgroup_attach(prog, key->attach_type, path, attach_flags);

+                if (r < 0)

+                        return log_unit_error_errno(u, r, "Attaching foreign BPF program to cgroup %s failed: %m", path);

+        }

+

+        return 0;

+}

+

+/*

+ * Prepare foreign BPF program for installation:

+ * - Load the program from BPF filesystem to the kernel;

+ * - Store program FD identified by program ID and attach type in the unit.

+ */

+static int bpf_foreign_prepare(

+                Unit *u,

+                enum bpf_attach_type attach_type,

+                const char *bpffs_path) {

+        _cleanup_(bpf_program_unrefp) BPFProgram *prog = NULL;

+        _cleanup_free_ BPFForeignKey *key = NULL;

+        uint32_t prog_id;

+        int r;

+

+        assert(u);

+        assert(bpffs_path);

+

+        r = bpf_program_new_from_bpffs_path(bpffs_path, &prog;;

+        if (r < 0)

+                return log_unit_error_errno(u, r, "Failed to create foreign BPFProgram: %m");

+

+        r = bpf_program_get_id_by_fd(prog->kernel_fd, &prog_id);

+        if (r < 0)

+                return log_unit_error_errno(u, r, "Failed to get BPF program id by fd: %m");

+

+        r = bpf_foreign_key_new(prog_id, attach_type, &key);

+        if (r < 0)

+                return log_unit_error_errno(u, r,

+                                "Failed to create foreign BPF program key from path '%s': %m", bpffs_path);

+

+        r = hashmap_ensure_put(&u->bpf_foreign_by_key, &bpf_foreign_by_key_hash_ops, key, prog);

+        if (r == -EEXIST) {

+                log_unit_warning_errno(u, r, "Foreign BPF program already exists, ignoring: %m");

+                return 0;

+        }

+        if (r < 0)

+                return log_unit_error_errno(u, r, "Failed to put foreign BPFProgram into map: %m");

+

+        TAKE_PTR(key);

+        TAKE_PTR(prog);

+

+        return 0;

+}

+

+int bpf_foreign_supported(void) {

+        int r;

+

+        r = cg_all_unified();

+        if (r <= 0)

+                return r;

+

+        return path_is_mount_point("/sys/fs/bpf", NULL, 0);

+}

+

+int bpf_foreign_install(Unit *u) {

+        _cleanup_free_ char *cgroup_path = NULL;

+        CGroupBPFForeignProgram *p;

+        CGroupContext *cc;

+        int r;

+

+        assert(u);

+

+        cc = unit_get_cgroup_context(u);

+        if (!cc)

+                return 0;

+

+        r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, NULL, &cgroup_path);

+        if (r < 0)

+                return log_unit_error_errno(u, r, "Failed to get cgroup path: %m");

+

+        LIST_FOREACH(programs, p, cc->bpf_foreign_programs) {

+                r = bpf_foreign_prepare(u, p->attach_type, p->bpffs_path);

+                if (r < 0)

+                        return log_unit_error_errno(u, r, "Failed to prepare foreign BPF hashmap: %m");

+        }

+

+        r = attach_programs(u, cgroup_path, u->bpf_foreign_by_key, BPF_F_ALLOW_MULTI);

+        if (r < 0)

+                  return log_unit_error_errno(u, r, "Failed to install foreign BPF programs: %m");

+

+        return 0;

+}

diff --git a/src/core/bpf-foreign.h b/src/core/bpf-foreign.h

new file mode 100644

index 0000000000..7704986e3e

--- /dev/null

+++ b/src/core/bpf-foreign.h

@@ -0,0 +1,12 @@

+/* SPDX-License-Identifier: LGPL-2.1+ */

+

+#pragma once

+

+#include "unit.h"

+

+int bpf_foreign_supported(void);

+/*

+ * Attach cgroup-bpf programs foreign to systemd, i.e. loaded to the kernel by an entity

+ * external to systemd.

+ */

+int bpf_foreign_install(Unit *u);

diff --git a/src/core/meson.build b/src/core/meson.build

index a389c906b3..a1294f3a72 100644

--- a/src/core/meson.build

+++ b/src/core/meson.build

@@ -11,6 +11,8 @@ libcore_sources = '''

         bpf-devices.h

         bpf-firewall.c

         bpf-firewall.h

+        bpf-foreign.c

+        bpf-foreign.h

         cgroup.c

         cgroup.h

         core-varlink.c

diff --git a/src/core/unit.c b/src/core/unit.c

index c212f1043d..b7141b29af 100644

--- a/src/core/unit.c

+++ b/src/core/unit.c

@@ -11,6 +11,7 @@

 #include "all-units.h"

 #include "alloc-util.h"

 #include "bpf-firewall.h"

+#include "bpf-foreign.h"

 #include "bus-common-errors.h"

 #include "bus-util.h"

 #include "cgroup-setup.h"

@@ -723,6 +724,8 @@ Unit* unit_free(Unit *u) {

         set_free(u->ip_bpf_custom_ingress_installed);

         set_free(u->ip_bpf_custom_egress_installed);

+        hashmap_free(u->bpf_foreign_by_key);

+

         bpf_program_unref(u->bpf_device_control_installed);

         condition_free_list(u->conditions);

diff --git a/src/core/unit.h b/src/core/unit.h

index 264431d04d..6de529af92 100644

--- a/src/core/unit.h

+++ b/src/core/unit.h

@@ -305,6 +305,10 @@ typedef struct Unit {

         Set *ip_bpf_custom_egress;

         Set *ip_bpf_custom_egress_installed;

+        /* BPF programs managed (e.g. loaded to kernel) by an entity external to systemd,

+         * attached to unit cgroup by provided program fd and attach type. */

+        Hashmap *bpf_foreign_by_key;

+

         uint64_t ip_accounting_extra[_CGROUP_IP_ACCOUNTING_METRIC_MAX];

         /* Low-priority event source which is used to remove watched PIDs that have gone away, and subscribe to any new

-- 

2.30.2

From 4d84c1af52683f7272e021fb4c6e68148d64e33b Mon Sep 17 00:00:00 2001

From: Julia Kartseva <hex@fb.com>

Date: Thu, 4 Feb 2021 00:03:08 -0800

Subject: [PATCH 5/9] core: add bpf-foreign cgroup mask and harness

Add CGROUP_MASK_BPF_FOREIGN to CGROUP_MASK_BPF and standard cgroup

context harness.

---

 src/basic/cgroup-util.c     |  1 +

 src/basic/cgroup-util.h     |  4 +++-

 src/core/cgroup.c           | 29 +++++++++++++++++++++++++++++

 src/test/test-cgroup-mask.c |  2 +-

 4 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/src/basic/cgroup-util.c b/src/basic/cgroup-util.c

index 8dd3f8cd95..743fb0afe1 100644

--- a/src/basic/cgroup-util.c

+++ b/src/basic/cgroup-util.c

@@ -2162,6 +2162,7 @@ static const char *const cgroup_controller_table[_CGROUP_CONTROLLER_MAX] = {

         [CGROUP_CONTROLLER_PIDS] = "pids",

         [CGROUP_CONTROLLER_BPF_FIREWALL] = "bpf-firewall",

         [CGROUP_CONTROLLER_BPF_DEVICES] = "bpf-devices",

+        [CGROUP_CONTROLLER_BPF_FOREIGN] = "bpf-foreign",

 };

 DEFINE_STRING_TABLE_LOOKUP(cgroup_controller, CGroupController);

diff --git a/src/basic/cgroup-util.h b/src/basic/cgroup-util.h

index f79e384147..8894fd9b0a 100644

--- a/src/basic/cgroup-util.h

+++ b/src/basic/cgroup-util.h

@@ -30,6 +30,7 @@ typedef enum CGroupController {

         /* BPF-based pseudo-controllers, v2 only */

         CGROUP_CONTROLLER_BPF_FIREWALL,

         CGROUP_CONTROLLER_BPF_DEVICES,

+        CGROUP_CONTROLLER_BPF_FOREIGN,

         _CGROUP_CONTROLLER_MAX,

         _CGROUP_CONTROLLER_INVALID = -EINVAL,

@@ -49,6 +50,7 @@ typedef enum CGroupMask {

         CGROUP_MASK_PIDS = CGROUP_CONTROLLER_TO_MASK(CGROUP_CONTROLLER_PIDS),

         CGROUP_MASK_BPF_FIREWALL = CGROUP_CONTROLLER_TO_MASK(CGROUP_CONTROLLER_BPF_FIREWALL),

         CGROUP_MASK_BPF_DEVICES = CGROUP_CONTROLLER_TO_MASK(CGROUP_CONTROLLER_BPF_DEVICES),

+        CGROUP_MASK_BPF_FOREIGN = CGROUP_CONTROLLER_TO_MASK(CGROUP_CONTROLLER_BPF_FOREIGN),

         /* All real cgroup v1 controllers */

         CGROUP_MASK_V1 = CGROUP_MASK_CPU|CGROUP_MASK_CPUACCT|CGROUP_MASK_BLKIO|CGROUP_MASK_MEMORY|CGROUP_MASK_DEVICES|CGROUP_MASK_PIDS,

@@ -57,7 +59,7 @@ typedef enum CGroupMask {

         CGROUP_MASK_V2 = CGROUP_MASK_CPU|CGROUP_MASK_CPUSET|CGROUP_MASK_IO|CGROUP_MASK_MEMORY|CGROUP_MASK_PIDS,

         /* All cgroup v2 BPF pseudo-controllers */

-        CGROUP_MASK_BPF = CGROUP_MASK_BPF_FIREWALL|CGROUP_MASK_BPF_DEVICES,

+        CGROUP_MASK_BPF = CGROUP_MASK_BPF_FIREWALL|CGROUP_MASK_BPF_DEVICES|CGROUP_MASK_BPF_FOREIGN,

         _CGROUP_MASK_ALL = CGROUP_CONTROLLER_TO_MASK(_CGROUP_CONTROLLER_MAX) - 1

 } CGroupMask;

diff --git a/src/core/cgroup.c b/src/core/cgroup.c

index a0af50518d..f3d5d89339 100644

--- a/src/core/cgroup.c

+++ b/src/core/cgroup.c

@@ -8,6 +8,7 @@

 #include "blockdev-util.h"

 #include "bpf-devices.h"

 #include "bpf-firewall.h"

+#include "bpf-foreign.h"

 #include "btrfs-util.h"

 #include "bus-error.h"

 #include "cgroup-setup.h"

@@ -1160,6 +1161,12 @@ static void set_io_weight(Unit *u, const char *controller, uint64_t weight) {

         (void) set_attribute_and_warn(u, controller, p, buf);

 }

+static void cgroup_apply_bpf_foreign_program(Unit *u) {

+        assert(u);

+

+        (void) bpf_foreign_install(u);

+}

+

 static void cgroup_context_apply(

                 Unit *u,

                 CGroupMask apply_mask,

@@ -1473,6 +1480,9 @@ static void cgroup_context_apply(

         if (apply_mask & CGROUP_MASK_BPF_FIREWALL)

                 cgroup_apply_firewall(u);

+

+        if (apply_mask & CGROUP_MASK_BPF_FOREIGN)

+                cgroup_apply_bpf_foreign_program(u);

 }

 static bool unit_get_needs_bpf_firewall(Unit *u) {

@@ -1505,6 +1515,17 @@ static bool unit_get_needs_bpf_firewall(Unit *u) {

         return false;

 }

+static bool unit_get_needs_bpf_foreign_program(Unit *u) {

+        CGroupContext *c;

+        assert(u);

+