1257c8855SAndrey Ignatov // SPDX-License-Identifier: GPL-2.0
2257c8855SAndrey Ignatov
3257c8855SAndrey Ignatov #include <test_progs.h>
4257c8855SAndrey Ignatov
5257c8855SAndrey Ignatov #include "cgroup_helpers.h"
6257c8855SAndrey Ignatov
7257c8855SAndrey Ignatov #define PING_CMD "ping -q -c1 -w1 127.0.0.1 > /dev/null"
8257c8855SAndrey Ignatov
9775a2be5SToke Høiland-Jørgensen static char bpf_log_buf[BPF_LOG_BUF_SIZE];
10257c8855SAndrey Ignatov
11257c8855SAndrey Ignatov static int map_fd = -1;
12257c8855SAndrey Ignatov
prog_load_cnt(int verdict,int val)13257c8855SAndrey Ignatov static int prog_load_cnt(int verdict, int val)
14257c8855SAndrey Ignatov {
15257c8855SAndrey Ignatov int cgroup_storage_fd, percpu_cgroup_storage_fd;
16257c8855SAndrey Ignatov
17257c8855SAndrey Ignatov if (map_fd < 0)
182fe256a4SAndrii Nakryiko map_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, NULL, 4, 8, 1, NULL);
19257c8855SAndrey Ignatov if (map_fd < 0) {
20257c8855SAndrey Ignatov printf("failed to create map '%s'\n", strerror(errno));
21257c8855SAndrey Ignatov return -1;
22257c8855SAndrey Ignatov }
23257c8855SAndrey Ignatov
242fe256a4SAndrii Nakryiko cgroup_storage_fd = bpf_map_create(BPF_MAP_TYPE_CGROUP_STORAGE, NULL,
252fe256a4SAndrii Nakryiko sizeof(struct bpf_cgroup_storage_key), 8, 0, NULL);
26257c8855SAndrey Ignatov if (cgroup_storage_fd < 0) {
27257c8855SAndrey Ignatov printf("failed to create map '%s'\n", strerror(errno));
28257c8855SAndrey Ignatov return -1;
29257c8855SAndrey Ignatov }
30257c8855SAndrey Ignatov
312fe256a4SAndrii Nakryiko percpu_cgroup_storage_fd = bpf_map_create(
322fe256a4SAndrii Nakryiko BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE, NULL,
332fe256a4SAndrii Nakryiko sizeof(struct bpf_cgroup_storage_key), 8, 0, NULL);
34257c8855SAndrey Ignatov if (percpu_cgroup_storage_fd < 0) {
35257c8855SAndrey Ignatov printf("failed to create map '%s'\n", strerror(errno));
36257c8855SAndrey Ignatov return -1;
37257c8855SAndrey Ignatov }
38257c8855SAndrey Ignatov
39257c8855SAndrey Ignatov struct bpf_insn prog[] = {
40257c8855SAndrey Ignatov BPF_MOV32_IMM(BPF_REG_0, 0),
41257c8855SAndrey Ignatov BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
42257c8855SAndrey Ignatov BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
43257c8855SAndrey Ignatov BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
44257c8855SAndrey Ignatov BPF_LD_MAP_FD(BPF_REG_1, map_fd),
45257c8855SAndrey Ignatov BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
46257c8855SAndrey Ignatov BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
47257c8855SAndrey Ignatov BPF_MOV64_IMM(BPF_REG_1, val), /* r1 = 1 */
4891c960b0SBrendan Jackman BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0),
49257c8855SAndrey Ignatov
50257c8855SAndrey Ignatov BPF_LD_MAP_FD(BPF_REG_1, cgroup_storage_fd),
51257c8855SAndrey Ignatov BPF_MOV64_IMM(BPF_REG_2, 0),
52257c8855SAndrey Ignatov BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
53257c8855SAndrey Ignatov BPF_MOV64_IMM(BPF_REG_1, val),
5491c960b0SBrendan Jackman BPF_ATOMIC_OP(BPF_W, BPF_ADD, BPF_REG_0, BPF_REG_1, 0),
55257c8855SAndrey Ignatov
56257c8855SAndrey Ignatov BPF_LD_MAP_FD(BPF_REG_1, percpu_cgroup_storage_fd),
57257c8855SAndrey Ignatov BPF_MOV64_IMM(BPF_REG_2, 0),
58257c8855SAndrey Ignatov BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
59257c8855SAndrey Ignatov BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
60257c8855SAndrey Ignatov BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 0x1),
61257c8855SAndrey Ignatov BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
62257c8855SAndrey Ignatov
63257c8855SAndrey Ignatov BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */
64257c8855SAndrey Ignatov BPF_EXIT_INSN(),
65257c8855SAndrey Ignatov };
66*f98d6dd1SGuo Zhengkui size_t insns_cnt = ARRAY_SIZE(prog);
67257c8855SAndrey Ignatov int ret;
68257c8855SAndrey Ignatov
69f19ddfe0SAndrii Nakryiko ret = bpf_test_load_program(BPF_PROG_TYPE_CGROUP_SKB,
70257c8855SAndrey Ignatov prog, insns_cnt, "GPL", 0,
71257c8855SAndrey Ignatov bpf_log_buf, BPF_LOG_BUF_SIZE);
72257c8855SAndrey Ignatov
73257c8855SAndrey Ignatov close(cgroup_storage_fd);
74257c8855SAndrey Ignatov return ret;
75257c8855SAndrey Ignatov }
76257c8855SAndrey Ignatov
serial_test_cgroup_attach_multi(void)77d3f7b166SYucong Sun void serial_test_cgroup_attach_multi(void)
78257c8855SAndrey Ignatov {
79257c8855SAndrey Ignatov __u32 prog_ids[4], prog_cnt = 0, attach_flags, saved_prog_id;
80257c8855SAndrey Ignatov int cg1 = 0, cg2 = 0, cg3 = 0, cg4 = 0, cg5 = 0, key = 0;
8106ac0186SAndrey Ignatov DECLARE_LIBBPF_OPTS(bpf_prog_attach_opts, attach_opts);
8206ac0186SAndrey Ignatov int allow_prog[7] = {-1};
83257c8855SAndrey Ignatov unsigned long long value;
84257c8855SAndrey Ignatov __u32 duration = 0;
85257c8855SAndrey Ignatov int i = 0;
86257c8855SAndrey Ignatov
87257c8855SAndrey Ignatov for (i = 0; i < ARRAY_SIZE(allow_prog); i++) {
88257c8855SAndrey Ignatov allow_prog[i] = prog_load_cnt(1, 1 << i);
89257c8855SAndrey Ignatov if (CHECK(allow_prog[i] < 0, "prog_load",
90257c8855SAndrey Ignatov "verifier output:\n%s\n-------\n", bpf_log_buf))
91257c8855SAndrey Ignatov goto err;
92257c8855SAndrey Ignatov }
93257c8855SAndrey Ignatov
94257c8855SAndrey Ignatov if (CHECK_FAIL(setup_cgroup_environment()))
95257c8855SAndrey Ignatov goto err;
96257c8855SAndrey Ignatov
97257c8855SAndrey Ignatov cg1 = create_and_get_cgroup("/cg1");
98257c8855SAndrey Ignatov if (CHECK_FAIL(cg1 < 0))
99257c8855SAndrey Ignatov goto err;
100257c8855SAndrey Ignatov cg2 = create_and_get_cgroup("/cg1/cg2");
101257c8855SAndrey Ignatov if (CHECK_FAIL(cg2 < 0))
102257c8855SAndrey Ignatov goto err;
103257c8855SAndrey Ignatov cg3 = create_and_get_cgroup("/cg1/cg2/cg3");
104257c8855SAndrey Ignatov if (CHECK_FAIL(cg3 < 0))
105257c8855SAndrey Ignatov goto err;
106257c8855SAndrey Ignatov cg4 = create_and_get_cgroup("/cg1/cg2/cg3/cg4");
107257c8855SAndrey Ignatov if (CHECK_FAIL(cg4 < 0))
108257c8855SAndrey Ignatov goto err;
109257c8855SAndrey Ignatov cg5 = create_and_get_cgroup("/cg1/cg2/cg3/cg4/cg5");
110257c8855SAndrey Ignatov if (CHECK_FAIL(cg5 < 0))
111257c8855SAndrey Ignatov goto err;
112257c8855SAndrey Ignatov
113257c8855SAndrey Ignatov if (CHECK_FAIL(join_cgroup("/cg1/cg2/cg3/cg4/cg5")))
114257c8855SAndrey Ignatov goto err;
115257c8855SAndrey Ignatov
116257c8855SAndrey Ignatov if (CHECK(bpf_prog_attach(allow_prog[0], cg1, BPF_CGROUP_INET_EGRESS,
117257c8855SAndrey Ignatov BPF_F_ALLOW_MULTI),
118257c8855SAndrey Ignatov "prog0_attach_to_cg1_multi", "errno=%d\n", errno))
119257c8855SAndrey Ignatov goto err;
120257c8855SAndrey Ignatov
121257c8855SAndrey Ignatov if (CHECK(!bpf_prog_attach(allow_prog[0], cg1, BPF_CGROUP_INET_EGRESS,
122257c8855SAndrey Ignatov BPF_F_ALLOW_MULTI),
123257c8855SAndrey Ignatov "fail_same_prog_attach_to_cg1", "unexpected success\n"))
124257c8855SAndrey Ignatov goto err;
125257c8855SAndrey Ignatov
126257c8855SAndrey Ignatov if (CHECK(bpf_prog_attach(allow_prog[1], cg1, BPF_CGROUP_INET_EGRESS,
127257c8855SAndrey Ignatov BPF_F_ALLOW_MULTI),
128257c8855SAndrey Ignatov "prog1_attach_to_cg1_multi", "errno=%d\n", errno))
129257c8855SAndrey Ignatov goto err;
130257c8855SAndrey Ignatov
131257c8855SAndrey Ignatov if (CHECK(bpf_prog_attach(allow_prog[2], cg2, BPF_CGROUP_INET_EGRESS,
132257c8855SAndrey Ignatov BPF_F_ALLOW_OVERRIDE),
133257c8855SAndrey Ignatov "prog2_attach_to_cg2_override", "errno=%d\n", errno))
134257c8855SAndrey Ignatov goto err;
135257c8855SAndrey Ignatov
136257c8855SAndrey Ignatov if (CHECK(bpf_prog_attach(allow_prog[3], cg3, BPF_CGROUP_INET_EGRESS,
137257c8855SAndrey Ignatov BPF_F_ALLOW_MULTI),
138257c8855SAndrey Ignatov "prog3_attach_to_cg3_multi", "errno=%d\n", errno))
139257c8855SAndrey Ignatov goto err;
140257c8855SAndrey Ignatov
141257c8855SAndrey Ignatov if (CHECK(bpf_prog_attach(allow_prog[4], cg4, BPF_CGROUP_INET_EGRESS,
142257c8855SAndrey Ignatov BPF_F_ALLOW_OVERRIDE),
143257c8855SAndrey Ignatov "prog4_attach_to_cg4_override", "errno=%d\n", errno))
144257c8855SAndrey Ignatov goto err;
145257c8855SAndrey Ignatov
146257c8855SAndrey Ignatov if (CHECK(bpf_prog_attach(allow_prog[5], cg5, BPF_CGROUP_INET_EGRESS, 0),
147257c8855SAndrey Ignatov "prog5_attach_to_cg5_none", "errno=%d\n", errno))
148257c8855SAndrey Ignatov goto err;
149257c8855SAndrey Ignatov
150257c8855SAndrey Ignatov CHECK_FAIL(system(PING_CMD));
151257c8855SAndrey Ignatov CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
152257c8855SAndrey Ignatov CHECK_FAIL(value != 1 + 2 + 8 + 32);
153257c8855SAndrey Ignatov
154257c8855SAndrey Ignatov /* query the number of effective progs in cg5 */
155257c8855SAndrey Ignatov CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS,
156257c8855SAndrey Ignatov BPF_F_QUERY_EFFECTIVE, NULL, NULL, &prog_cnt));
157257c8855SAndrey Ignatov CHECK_FAIL(prog_cnt != 4);
158257c8855SAndrey Ignatov /* retrieve prog_ids of effective progs in cg5 */
159257c8855SAndrey Ignatov CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS,
160257c8855SAndrey Ignatov BPF_F_QUERY_EFFECTIVE, &attach_flags,
161257c8855SAndrey Ignatov prog_ids, &prog_cnt));
162257c8855SAndrey Ignatov CHECK_FAIL(prog_cnt != 4);
163257c8855SAndrey Ignatov CHECK_FAIL(attach_flags != 0);
164257c8855SAndrey Ignatov saved_prog_id = prog_ids[0];
165257c8855SAndrey Ignatov /* check enospc handling */
166257c8855SAndrey Ignatov prog_ids[0] = 0;
167257c8855SAndrey Ignatov prog_cnt = 2;
168257c8855SAndrey Ignatov CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS,
169257c8855SAndrey Ignatov BPF_F_QUERY_EFFECTIVE, &attach_flags,
170bad2e478SAndrii Nakryiko prog_ids, &prog_cnt) >= 0);
171257c8855SAndrey Ignatov CHECK_FAIL(errno != ENOSPC);
172257c8855SAndrey Ignatov CHECK_FAIL(prog_cnt != 4);
173257c8855SAndrey Ignatov /* check that prog_ids are returned even when buffer is too small */
174257c8855SAndrey Ignatov CHECK_FAIL(prog_ids[0] != saved_prog_id);
175257c8855SAndrey Ignatov /* retrieve prog_id of single attached prog in cg5 */
176257c8855SAndrey Ignatov prog_ids[0] = 0;
177257c8855SAndrey Ignatov CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS, 0, NULL,
178257c8855SAndrey Ignatov prog_ids, &prog_cnt));
179257c8855SAndrey Ignatov CHECK_FAIL(prog_cnt != 1);
180257c8855SAndrey Ignatov CHECK_FAIL(prog_ids[0] != saved_prog_id);
181257c8855SAndrey Ignatov
182257c8855SAndrey Ignatov /* detach bottom program and ping again */
183257c8855SAndrey Ignatov if (CHECK(bpf_prog_detach2(-1, cg5, BPF_CGROUP_INET_EGRESS),
184257c8855SAndrey Ignatov "prog_detach_from_cg5", "errno=%d\n", errno))
185257c8855SAndrey Ignatov goto err;
186257c8855SAndrey Ignatov
187257c8855SAndrey Ignatov value = 0;
188257c8855SAndrey Ignatov CHECK_FAIL(bpf_map_update_elem(map_fd, &key, &value, 0));
189257c8855SAndrey Ignatov CHECK_FAIL(system(PING_CMD));
190257c8855SAndrey Ignatov CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
191257c8855SAndrey Ignatov CHECK_FAIL(value != 1 + 2 + 8 + 16);
192257c8855SAndrey Ignatov
19306ac0186SAndrey Ignatov /* test replace */
19406ac0186SAndrey Ignatov
19506ac0186SAndrey Ignatov attach_opts.flags = BPF_F_ALLOW_OVERRIDE | BPF_F_REPLACE;
19606ac0186SAndrey Ignatov attach_opts.replace_prog_fd = allow_prog[0];
197ce787547SChristy Lee if (CHECK(!bpf_prog_attach_opts(allow_prog[6], cg1,
19806ac0186SAndrey Ignatov BPF_CGROUP_INET_EGRESS, &attach_opts),
19906ac0186SAndrey Ignatov "fail_prog_replace_override", "unexpected success\n"))
20006ac0186SAndrey Ignatov goto err;
20106ac0186SAndrey Ignatov CHECK_FAIL(errno != EINVAL);
20206ac0186SAndrey Ignatov
20306ac0186SAndrey Ignatov attach_opts.flags = BPF_F_REPLACE;
204ce787547SChristy Lee if (CHECK(!bpf_prog_attach_opts(allow_prog[6], cg1,
20506ac0186SAndrey Ignatov BPF_CGROUP_INET_EGRESS, &attach_opts),
20606ac0186SAndrey Ignatov "fail_prog_replace_no_multi", "unexpected success\n"))
20706ac0186SAndrey Ignatov goto err;
20806ac0186SAndrey Ignatov CHECK_FAIL(errno != EINVAL);
20906ac0186SAndrey Ignatov
21006ac0186SAndrey Ignatov attach_opts.flags = BPF_F_ALLOW_MULTI | BPF_F_REPLACE;
21106ac0186SAndrey Ignatov attach_opts.replace_prog_fd = -1;
212ce787547SChristy Lee if (CHECK(!bpf_prog_attach_opts(allow_prog[6], cg1,
21306ac0186SAndrey Ignatov BPF_CGROUP_INET_EGRESS, &attach_opts),
21406ac0186SAndrey Ignatov "fail_prog_replace_bad_fd", "unexpected success\n"))
21506ac0186SAndrey Ignatov goto err;
21606ac0186SAndrey Ignatov CHECK_FAIL(errno != EBADF);
21706ac0186SAndrey Ignatov
21806ac0186SAndrey Ignatov /* replacing a program that is not attached to cgroup should fail */
21906ac0186SAndrey Ignatov attach_opts.replace_prog_fd = allow_prog[3];
220ce787547SChristy Lee if (CHECK(!bpf_prog_attach_opts(allow_prog[6], cg1,
22106ac0186SAndrey Ignatov BPF_CGROUP_INET_EGRESS, &attach_opts),
22206ac0186SAndrey Ignatov "fail_prog_replace_no_ent", "unexpected success\n"))
22306ac0186SAndrey Ignatov goto err;
22406ac0186SAndrey Ignatov CHECK_FAIL(errno != ENOENT);
22506ac0186SAndrey Ignatov
22606ac0186SAndrey Ignatov /* replace 1st from the top program */
22706ac0186SAndrey Ignatov attach_opts.replace_prog_fd = allow_prog[0];
228ce787547SChristy Lee if (CHECK(bpf_prog_attach_opts(allow_prog[6], cg1,
22906ac0186SAndrey Ignatov BPF_CGROUP_INET_EGRESS, &attach_opts),
23006ac0186SAndrey Ignatov "prog_replace", "errno=%d\n", errno))
23106ac0186SAndrey Ignatov goto err;
23206ac0186SAndrey Ignatov
233248e00acSLorenz Bauer /* replace program with itself */
234248e00acSLorenz Bauer attach_opts.replace_prog_fd = allow_prog[6];
235ce787547SChristy Lee if (CHECK(bpf_prog_attach_opts(allow_prog[6], cg1,
236248e00acSLorenz Bauer BPF_CGROUP_INET_EGRESS, &attach_opts),
237248e00acSLorenz Bauer "prog_replace", "errno=%d\n", errno))
238248e00acSLorenz Bauer goto err;
239248e00acSLorenz Bauer
24006ac0186SAndrey Ignatov value = 0;
24106ac0186SAndrey Ignatov CHECK_FAIL(bpf_map_update_elem(map_fd, &key, &value, 0));
24206ac0186SAndrey Ignatov CHECK_FAIL(system(PING_CMD));
24306ac0186SAndrey Ignatov CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
24406ac0186SAndrey Ignatov CHECK_FAIL(value != 64 + 2 + 8 + 16);
24506ac0186SAndrey Ignatov
246257c8855SAndrey Ignatov /* detach 3rd from bottom program and ping again */
247257c8855SAndrey Ignatov if (CHECK(!bpf_prog_detach2(0, cg3, BPF_CGROUP_INET_EGRESS),
248257c8855SAndrey Ignatov "fail_prog_detach_from_cg3", "unexpected success\n"))
249257c8855SAndrey Ignatov goto err;
250257c8855SAndrey Ignatov
251257c8855SAndrey Ignatov if (CHECK(bpf_prog_detach2(allow_prog[3], cg3, BPF_CGROUP_INET_EGRESS),
252257c8855SAndrey Ignatov "prog3_detach_from_cg3", "errno=%d\n", errno))
253257c8855SAndrey Ignatov goto err;
254257c8855SAndrey Ignatov
255257c8855SAndrey Ignatov value = 0;
256257c8855SAndrey Ignatov CHECK_FAIL(bpf_map_update_elem(map_fd, &key, &value, 0));
257257c8855SAndrey Ignatov CHECK_FAIL(system(PING_CMD));
258257c8855SAndrey Ignatov CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
25906ac0186SAndrey Ignatov CHECK_FAIL(value != 64 + 2 + 16);
260257c8855SAndrey Ignatov
261257c8855SAndrey Ignatov /* detach 2nd from bottom program and ping again */
262257c8855SAndrey Ignatov if (CHECK(bpf_prog_detach2(-1, cg4, BPF_CGROUP_INET_EGRESS),
263257c8855SAndrey Ignatov "prog_detach_from_cg4", "errno=%d\n", errno))
264257c8855SAndrey Ignatov goto err;
265257c8855SAndrey Ignatov
266257c8855SAndrey Ignatov value = 0;
267257c8855SAndrey Ignatov CHECK_FAIL(bpf_map_update_elem(map_fd, &key, &value, 0));
268257c8855SAndrey Ignatov CHECK_FAIL(system(PING_CMD));
269257c8855SAndrey Ignatov CHECK_FAIL(bpf_map_lookup_elem(map_fd, &key, &value));
27006ac0186SAndrey Ignatov CHECK_FAIL(value != 64 + 2 + 4);
271257c8855SAndrey Ignatov
272257c8855SAndrey Ignatov prog_cnt = 4;
273257c8855SAndrey Ignatov CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS,
274257c8855SAndrey Ignatov BPF_F_QUERY_EFFECTIVE, &attach_flags,
275257c8855SAndrey Ignatov prog_ids, &prog_cnt));
276257c8855SAndrey Ignatov CHECK_FAIL(prog_cnt != 3);
277257c8855SAndrey Ignatov CHECK_FAIL(attach_flags != 0);
278257c8855SAndrey Ignatov CHECK_FAIL(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS, 0, NULL,
279257c8855SAndrey Ignatov prog_ids, &prog_cnt));
280257c8855SAndrey Ignatov CHECK_FAIL(prog_cnt != 0);
281257c8855SAndrey Ignatov
282257c8855SAndrey Ignatov err:
283257c8855SAndrey Ignatov for (i = 0; i < ARRAY_SIZE(allow_prog); i++)
284257c8855SAndrey Ignatov if (allow_prog[i] >= 0)
285257c8855SAndrey Ignatov close(allow_prog[i]);
286257c8855SAndrey Ignatov close(cg1);
287257c8855SAndrey Ignatov close(cg2);
288257c8855SAndrey Ignatov close(cg3);
289257c8855SAndrey Ignatov close(cg4);
290257c8855SAndrey Ignatov close(cg5);
291257c8855SAndrey Ignatov cleanup_cgroup_environment();
292257c8855SAndrey Ignatov }
293