libbpf: Add bpf_link__disconnect() API to preserve underlying BPF resource

There are cases in which BPF resource (program, map, etc) has to outlive
userspace program that "installed" it in the system in the first place.
When BPF program is attached, libbpf returns bpf_link object, which
is supposed to be destroyed after no longer necessary through
bpf_link__destroy() API. Currently, bpf_link destruction causes both automatic
detachment and frees up any resources allocated to for bpf_link in-memory
representation. This is inconvenient for the case described above because of
coupling of detachment and resource freeing.

This patch introduces bpf_link__disconnect() API call, which marks bpf_link as
disconnected from its underlying BPF resouces. This means that when bpf_link
is destroyed later, all its memory resources will be freed, but BPF resource
itself won't be detached.

This design allows to follow strict and resource-leak-free design by default,
while giving easy and straightforward way for user code to opt for keeping BPF
resource attached beyond lifetime of a bpf_link. For some BPF programs (i.e.,
FS-based tracepoints, kprobes, raw tracepoint, etc), user has to make sure to
pin BPF program to prevent kernel to automatically detach it on process exit.
This should typically be achived by pinning BPF program (or map in some cases)
in BPF FS.

Signed-off-by: Andrii Nakryiko <andriin@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20191218225039.2668205-1-andriin@fb.com

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 906bbbf7b2e4273b47ee844bf6ec7a59a46eb1bf..2a341a5b9f634dacabef407f84b87fbd65879860 100644 (file)
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -6245,17 +6245,37 @@ int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr,
 }
 
 struct bpf_link {
+       int (*detach)(struct bpf_link *link);
        int (*destroy)(struct bpf_link *link);
+       bool disconnected;
 };
 
+/* Release "ownership" of underlying BPF resource (typically, BPF program
+ * attached to some BPF hook, e.g., tracepoint, kprobe, etc). Disconnected
+ * link, when destructed through bpf_link__destroy() call won't attempt to
+ * detach/unregisted that BPF resource. This is useful in situations where,
+ * say, attached BPF program has to outlive userspace program that attached it
+ * in the system. Depending on type of BPF program, though, there might be
+ * additional steps (like pinning BPF program in BPF FS) necessary to ensure
+ * exit of userspace program doesn't trigger automatic detachment and clean up
+ * inside the kernel.
+ */
+void bpf_link__disconnect(struct bpf_link *link)
+{
+       link->disconnected = true;
+}
+
 int bpf_link__destroy(struct bpf_link *link)
 {
-       int err;
+       int err = 0;
 
        if (!link)
                return 0;
 
-       err = link->destroy(link);
+       if (!link->disconnected && link->detach)
+               err = link->detach(link);
+       if (link->destroy)
+               link->destroy(link);
        free(link);
 
        return err;
@@ -6266,7 +6286,7 @@ struct bpf_link_fd {
        int fd; /* hook FD */
 };
 
-static int bpf_link__destroy_perf_event(struct bpf_link *link)
+static int bpf_link__detach_perf_event(struct bpf_link *link)
 {
        struct bpf_link_fd *l = (void *)link;
        int err;
@@ -6298,10 +6318,10 @@ struct bpf_link *bpf_program__attach_perf_event(struct bpf_program *prog,
                return ERR_PTR(-EINVAL);
        }
 
-       link = malloc(sizeof(*link));
+       link = calloc(1, sizeof(*link));
        if (!link)
                return ERR_PTR(-ENOMEM);
-       link->link.destroy = &bpf_link__destroy_perf_event;
+       link->link.detach = &bpf_link__detach_perf_event;
        link->fd = pfd;
 
        if (ioctl(pfd, PERF_EVENT_IOC_SET_BPF, prog_fd) < 0) {
@@ -6608,7 +6628,7 @@ out:
        return link;
 }
 
-static int bpf_link__destroy_fd(struct bpf_link *link)
+static int bpf_link__detach_fd(struct bpf_link *link)
 {
        struct bpf_link_fd *l = (void *)link;
 
@@ -6629,10 +6649,10 @@ struct bpf_link *bpf_program__attach_raw_tracepoint(struct bpf_program *prog,
                return ERR_PTR(-EINVAL);
        }
 
-       link = malloc(sizeof(*link));
+       link = calloc(1, sizeof(*link));
        if (!link)
                return ERR_PTR(-ENOMEM);
-       link->link.destroy = &bpf_link__destroy_fd;
+       link->link.detach = &bpf_link__detach_fd;
 
        pfd = bpf_raw_tracepoint_open(tp_name, prog_fd);
        if (pfd < 0) {
@@ -6668,10 +6688,10 @@ struct bpf_link *bpf_program__attach_trace(struct bpf_program *prog)
                return ERR_PTR(-EINVAL);
        }
 
-       link = malloc(sizeof(*link));
+       link = calloc(1, sizeof(*link));
        if (!link)
                return ERR_PTR(-ENOMEM);
-       link->link.destroy = &bpf_link__destroy_fd;
+       link->link.detach = &bpf_link__detach_fd;
 
        pfd = bpf_raw_tracepoint_open(NULL, prog_fd);
        if (pfd < 0) {

diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
index f7084235bae955ef131b12134a9365d61dd3b261..ad8c1c12793340207bb4805a3eebf199fdc972df 100644 (file)
--- a/tools/lib/bpf/libbpf.h
+++ b/tools/lib/bpf/libbpf.h
@@ -215,6 +215,7 @@ LIBBPF_API void bpf_program__unload(struct bpf_program *prog);
 
 struct bpf_link;
 
+LIBBPF_API void bpf_link__disconnect(struct bpf_link *link);
 LIBBPF_API int bpf_link__destroy(struct bpf_link *link);
 
 LIBBPF_API struct bpf_link *

diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map
index 1376d992a703a358f11d89406db31a35a3ee3e50..e3a471f38a715698952b1e31fbf1c734ad2c39f6 100644 (file)
--- a/tools/lib/bpf/libbpf.map
+++ b/tools/lib/bpf/libbpf.map
@@ -212,6 +212,7 @@ LIBBPF_0.0.6 {
 LIBBPF_0.0.7 {
        global:
                btf_dump__emit_type_decl;
+               bpf_link__disconnect;
                bpf_object__find_program_by_name;
                bpf_object__attach_skeleton;
                bpf_object__destroy_skeleton;