Commit a98bf573 authored by Jakub Kicinski's avatar Jakub Kicinski Committed by Alexei Starovoitov
Browse files

tools: bpftool: add support for reporting the effective cgroup progs 



Takshak said in the original submission:

With different bpf attach_flags available to attach bpf programs specially
with BPF_F_ALLOW_OVERRIDE and BPF_F_ALLOW_MULTI, the list of effective
bpf-programs available to any sub-cgroups really needs to be available for
easy debugging.

Using BPF_F_QUERY_EFFECTIVE flag, one can get the list of not only attached
bpf-programs to a cgroup but also the inherited ones from parent cgroup.

So a new option is introduced to use BPF_F_QUERY_EFFECTIVE query flag here
to list all the effective bpf-programs available for execution at a specified
cgroup.

Reused modified test program test_cgroup_attach from tools/testing/selftests/bpf:
  # ./test_cgroup_attach

With old bpftool:

 # bpftool cgroup show /sys/fs/cgroup/cgroup-test-work-dir/cg1/
  ID       AttachType      AttachFlags     Name
  271      egress          multi           pkt_cntr_1
  272      egress          multi           pkt_cntr_2

Attached new program pkt_cntr_4 in cg2 gives following:

 # bpftool cgroup show /sys/fs/cgroup/cgroup-test-work-dir/cg1/cg2
  ID       AttachType      AttachFlags     Name
  273      egress          override        pkt_cntr_4

And with new "effective" option it shows all effective programs for cg2:

 # bpftool cgroup show /sys/fs/cgroup/cgroup-test-work-dir/cg1/cg2 effective
  ID       AttachType      AttachFlags     Name
  273      egress          override        pkt_cntr_4
  271      egress          override        pkt_cntr_1
  272      egress          override        pkt_cntr_2

Compared to original submission use a local flag instead of global
option.

We need to clear query_flags on every command, in case batch mode
wants to use varying settings.

v2: (Takshak)
 - forbid duplicated flags;
 - fix cgroup path freeing.

Signed-off-by: default avatarTakshak Chahande <ctakshak@fb.com>
Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: default avatarQuentin Monnet <quentin.monnet@netronome.com>
Reviewed-by: default avatarTakshak Chahande <ctakshak@fb.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent bf8ff0f8

tools/bpf/bpftool/Documentation/bpftool-cgroup.rst

+12 −4
Original line number Diff line number Diff line
@@ -20,8 +20,8 @@ SYNOPSIS 
CGROUP COMMANDS

===============



|	**bpftool** **cgroup { show | list }** *CGROUP*

|	**bpftool** **cgroup tree** [*CGROUP_ROOT*]

|	**bpftool** **cgroup { show | list }** *CGROUP* [**effective**]

|	**bpftool** **cgroup tree** [*CGROUP_ROOT*] [**effective**]

|	**bpftool** **cgroup attach** *CGROUP* *ATTACH_TYPE* *PROG* [*ATTACH_FLAGS*]

|	**bpftool** **cgroup detach** *CGROUP* *ATTACH_TYPE* *PROG*

|	**bpftool** **cgroup help**
@@ -35,13 +35,17 @@ CGROUP COMMANDS 


DESCRIPTION

===========

	**bpftool cgroup { show | list }** *CGROUP*

	**bpftool cgroup { show | list }** *CGROUP* [**effective**]

		  List all programs attached to the cgroup *CGROUP*.



		  Output will start with program ID followed by attach type,

		  attach flags and program name.



	**bpftool cgroup tree** [*CGROUP_ROOT*]

		  If **effective** is specified retrieve effective programs that

		  will execute for events within a cgroup. This includes

		  inherited along with attached ones.



	**bpftool cgroup tree** [*CGROUP_ROOT*] [**effective**]

		  Iterate over all cgroups in *CGROUP_ROOT* and list all

		  attached programs. If *CGROUP_ROOT* is not specified,

		  bpftool uses cgroup v2 mountpoint.
@@ -50,6 +54,10 @@ DESCRIPTION 
		  commands: it starts with absolute cgroup path, followed by

		  program ID, attach type, attach flags and program name.



		  If **effective** is specified retrieve effective programs that

		  will execute for events within a cgroup. This includes

		  inherited along with attached ones.



	**bpftool cgroup attach** *CGROUP* *ATTACH_TYPE* *PROG* [*ATTACH_FLAGS*]

		  Attach program *PROG* to the cgroup *CGROUP* with attach type

		  *ATTACH_TYPE* and optional *ATTACH_FLAGS*.

tools/bpf/bpftool/bash-completion/bpftool

+9 −6
Original line number Diff line number Diff line
@@ -710,12 +710,15 @@ _bpftool() 
            ;;

        cgroup)

            case $command in

                show|list)

                show|list|tree)

                    case $cword in

                        3)

                            _filedir

                    return 0

                            ;;

                tree)

                    _filedir

                        4)

                            COMPREPLY=( $( compgen -W 'effective' -- "$cur" ) )

                            ;;

                    esac

                    return 0

                    ;;

                attach|detach)

tools/bpf/bpftool/cgroup.c

+55 −28
Original line number Diff line number Diff line
@@ -29,6 +29,8 @@ 
	"                        recvmsg4 | recvmsg6 | sysctl |\n"	       \

	"                        getsockopt | setsockopt }"



static unsigned int query_flags;



static const char * const attach_type_strings[] = {

	[BPF_CGROUP_INET_INGRESS] = "ingress",

	[BPF_CGROUP_INET_EGRESS] = "egress",
@@ -107,7 +109,8 @@ static int count_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type) 
	__u32 prog_cnt = 0;

	int ret;



	ret = bpf_prog_query(cgroup_fd, type, 0, NULL, NULL, &prog_cnt);

	ret = bpf_prog_query(cgroup_fd, type, query_flags, NULL,

			     NULL, &prog_cnt);

	if (ret)

		return -1;
@@ -125,8 +128,8 @@ static int show_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type, 
	int ret;



	prog_cnt = ARRAY_SIZE(prog_ids);

	ret = bpf_prog_query(cgroup_fd, type, 0, &attach_flags, prog_ids,

			     &prog_cnt);

	ret = bpf_prog_query(cgroup_fd, type, query_flags, &attach_flags,

			     prog_ids, &prog_cnt);

	if (ret)

		return ret;
@@ -158,20 +161,34 @@ static int show_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type, 
static int do_show(int argc, char **argv)

{

	enum bpf_attach_type type;

	const char *path;

	int cgroup_fd;

	int ret = -1;



	if (argc < 1) {

		p_err("too few parameters for cgroup show");

		goto exit;

	} else if (argc > 1) {

		p_err("too many parameters for cgroup show");

		goto exit;

	query_flags = 0;



	if (!REQ_ARGS(1))

		return -1;

	path = GET_ARG();



	while (argc) {

		if (is_prefix(*argv, "effective")) {

			if (query_flags & BPF_F_QUERY_EFFECTIVE) {

				p_err("duplicated argument: %s", *argv);

				return -1;

			}

			query_flags |= BPF_F_QUERY_EFFECTIVE;

			NEXT_ARG();

		} else {

			p_err("expected no more arguments, 'effective', got: '%s'?",

			      *argv);

			return -1;

		}

	}



	cgroup_fd = open(argv[0], O_RDONLY);

	cgroup_fd = open(path, O_RDONLY);

	if (cgroup_fd < 0) {

		p_err("can't open cgroup %s", argv[0]);

		p_err("can't open cgroup %s", path);

		goto exit;

	}
@@ -294,25 +311,36 @@ static char *find_cgroup_root(void) 


static int do_show_tree(int argc, char **argv)

{

	char *cgroup_root;

	char *cgroup_root, *cgroup_alloced = NULL;

	int ret;



	switch (argc) {

	case 0:

		cgroup_root = find_cgroup_root();

		if (!cgroup_root) {

	query_flags = 0;



	if (!argc) {

		cgroup_alloced = find_cgroup_root();

		if (!cgroup_alloced) {

			p_err("cgroup v2 isn't mounted");

			return -1;

		}

		break;

	case 1:

		cgroup_root = argv[0];

		break;

	default:

		p_err("too many parameters for cgroup tree");

		cgroup_root = cgroup_alloced;

	} else {

		cgroup_root = GET_ARG();



		while (argc) {

			if (is_prefix(*argv, "effective")) {

				if (query_flags & BPF_F_QUERY_EFFECTIVE) {

					p_err("duplicated argument: %s", *argv);

					return -1;

				}



				query_flags |= BPF_F_QUERY_EFFECTIVE;

				NEXT_ARG();

			} else {

				p_err("expected no more arguments, 'effective', got: '%s'?",

				      *argv);

				return -1;

			}

		}

	}



	if (json_output)

		jsonw_start_array(json_wtr);
@@ -338,8 +366,7 @@ static int do_show_tree(int argc, char **argv) 
	if (json_output)

		jsonw_end_array(json_wtr);



	if (argc == 0)

		free(cgroup_root);

	free(cgroup_alloced);



	return ret;

}
@@ -459,8 +486,8 @@ static int do_help(int argc, char **argv) 
	}



	fprintf(stderr,

		"Usage: %s %s { show | list } CGROUP\n"

		"       %s %s tree [CGROUP_ROOT]\n"

		"Usage: %s %s { show | list } CGROUP [**effective**]\n"

		"       %s %s tree [CGROUP_ROOT] [**effective**]\n"

		"       %s %s attach CGROUP ATTACH_TYPE PROG [ATTACH_FLAGS]\n"

		"       %s %s detach CGROUP ATTACH_TYPE PROG\n"

		"       %s %s help\n"

CRA Git | Maintained and supported by SUSTech CRA and CCSE