| Message ID | 20190729213538.8960-1-jakub.kicinski@netronome.com |
|---|---|
| State | Changes Requested |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | [bpf-next] tools: bpftool: add support for reporting the effective cgroup progs | expand |
Jakub Kicinski <jakub.kicinski@netronome.com> wrote on Mon [2019-Jul-29 14:35:38 -0700]: > Takshak said in the original submission: > > With different bpf attach_flags available to attach bpf programs specially > with BPF_F_ALLOW_OVERRIDE and BPF_F_ALLOW_MULTI, the list of effective > bpf-programs available to any sub-cgroups really needs to be available for > easy debugging. > > Using BPF_F_QUERY_EFFECTIVE flag, one can get the list of not only attached > bpf-programs to a cgroup but also the inherited ones from parent cgroup. > > So a new option is introduced to use BPF_F_QUERY_EFFECTIVE query flag here > to list all the effective bpf-programs available for execution at a specified > cgroup. > > Reused modified test program test_cgroup_attach from tools/testing/selftests/bpf: > # ./test_cgroup_attach > > With old bpftool: > > # bpftool cgroup show /sys/fs/cgroup/cgroup-test-work-dir/cg1/ > ID AttachType AttachFlags Name > 271 egress multi pkt_cntr_1 > 272 egress multi pkt_cntr_2 > > Attached new program pkt_cntr_4 in cg2 gives following: > > # bpftool cgroup show /sys/fs/cgroup/cgroup-test-work-dir/cg1/cg2 > ID AttachType AttachFlags Name > 273 egress override pkt_cntr_4 > > And with new "effective" option it shows all effective programs for cg2: > > # bpftool cgroup show /sys/fs/cgroup/cgroup-test-work-dir/cg1/cg2 effective > ID AttachType AttachFlags Name > 273 egress override pkt_cntr_4 > 271 egress override pkt_cntr_1 > 272 egress override pkt_cntr_2 > > Compared to original submission use a local flag instead of global > option. > > We need to clear query_flags on every command, in case batch mode > wants to use varying settings. > > Signed-off-by: Takshak Chahande <ctakshak@fb.com> > Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> > Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com> > --- > .../bpftool/Documentation/bpftool-cgroup.rst | 16 +++-- > tools/bpf/bpftool/bash-completion/bpftool | 15 +++-- > tools/bpf/bpftool/cgroup.c | 65 ++++++++++++------- > 3 files changed, 63 insertions(+), 33 deletions(-) > > diff --git a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst > index 585f270c2d25..06a28b07787d 100644 > --- a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst > +++ b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst > @@ -20,8 +20,8 @@ SYNOPSIS > CGROUP COMMANDS > =============== > > -| **bpftool** **cgroup { show | list }** *CGROUP* > -| **bpftool** **cgroup tree** [*CGROUP_ROOT*] > +| **bpftool** **cgroup { show | list }** *CGROUP* [**effective**] > +| **bpftool** **cgroup tree** [*CGROUP_ROOT*] [**effective**] > | **bpftool** **cgroup attach** *CGROUP* *ATTACH_TYPE* *PROG* [*ATTACH_FLAGS*] > | **bpftool** **cgroup detach** *CGROUP* *ATTACH_TYPE* *PROG* > | **bpftool** **cgroup help** > @@ -35,13 +35,17 @@ CGROUP COMMANDS > > DESCRIPTION > =========== > - **bpftool cgroup { show | list }** *CGROUP* > + **bpftool cgroup { show | list }** *CGROUP* [**effective**] > List all programs attached to the cgroup *CGROUP*. > > Output will start with program ID followed by attach type, > attach flags and program name. > > - **bpftool cgroup tree** [*CGROUP_ROOT*] > + If **effective** is specified retrieve effective programs that > + will execute for events within a cgroup. This includes > + inherited along with attached ones. > + > + **bpftool cgroup tree** [*CGROUP_ROOT*] [**effective**] > Iterate over all cgroups in *CGROUP_ROOT* and list all > attached programs. If *CGROUP_ROOT* is not specified, > bpftool uses cgroup v2 mountpoint. > @@ -50,6 +54,10 @@ DESCRIPTION > commands: it starts with absolute cgroup path, followed by > program ID, attach type, attach flags and program name. > > + If **effective** is specified retrieve effective programs that > + will execute for events within a cgroup. This includes > + inherited along with attached ones. > + > **bpftool cgroup attach** *CGROUP* *ATTACH_TYPE* *PROG* [*ATTACH_FLAGS*] > Attach program *PROG* to the cgroup *CGROUP* with attach type > *ATTACH_TYPE* and optional *ATTACH_FLAGS*. > diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool > index 6b961a5ed100..df16c5415444 100644 > --- a/tools/bpf/bpftool/bash-completion/bpftool > +++ b/tools/bpf/bpftool/bash-completion/bpftool > @@ -710,12 +710,15 @@ _bpftool() > ;; > cgroup) > case $command in > - show|list) > - _filedir > - return 0 > - ;; > - tree) > - _filedir > + show|list|tree) > + case $cword in > + 3) > + _filedir > + ;; > + 4) > + COMPREPLY=( $( compgen -W 'effective' -- "$cur" ) ) > + ;; > + esac > return 0 > ;; > attach|detach) > diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c > index f3c05b08c68c..339c2c78b8e4 100644 > --- a/tools/bpf/bpftool/cgroup.c > +++ b/tools/bpf/bpftool/cgroup.c > @@ -29,6 +29,8 @@ > " recvmsg4 | recvmsg6 | sysctl |\n" \ > " getsockopt | setsockopt }" > > +static unsigned int query_flags; > + > static const char * const attach_type_strings[] = { > [BPF_CGROUP_INET_INGRESS] = "ingress", > [BPF_CGROUP_INET_EGRESS] = "egress", > @@ -107,7 +109,8 @@ static int count_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type) > __u32 prog_cnt = 0; > int ret; > > - ret = bpf_prog_query(cgroup_fd, type, 0, NULL, NULL, &prog_cnt); > + ret = bpf_prog_query(cgroup_fd, type, query_flags, NULL, > + NULL, &prog_cnt); > if (ret) > return -1; > > @@ -125,8 +128,8 @@ static int show_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type, > int ret; > > prog_cnt = ARRAY_SIZE(prog_ids); > - ret = bpf_prog_query(cgroup_fd, type, 0, &attach_flags, prog_ids, > - &prog_cnt); > + ret = bpf_prog_query(cgroup_fd, type, query_flags, &attach_flags, > + prog_ids, &prog_cnt); > if (ret) > return ret; > > @@ -158,20 +161,30 @@ static int show_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type, > static int do_show(int argc, char **argv) > { > enum bpf_attach_type type; > + const char *path; > int cgroup_fd; > int ret = -1; > > - if (argc < 1) { > - p_err("too few parameters for cgroup show"); > - goto exit; > - } else if (argc > 1) { > - p_err("too many parameters for cgroup show"); > - goto exit; > + query_flags = 0; > + > + if (!REQ_ARGS(1)) > + return -1; > + path = GET_ARG(); > + > + while (argc) { > + if (is_prefix(*argv, "effective")) { > + query_flags |= BPF_F_QUERY_EFFECTIVE; > + NEXT_ARG(); > + } else { > + p_err("expected no more arguments, 'effective', got: '%s'?", > + *argv); > + return -1; > + } > } This while loop will allow multiple 'effective' keywords in the argument unnecessarily. IMO, we should strictly restrict only for single occurance of 'effective' word. > > - cgroup_fd = open(argv[0], O_RDONLY); > + cgroup_fd = open(path, O_RDONLY); > if (cgroup_fd < 0) { > - p_err("can't open cgroup %s", argv[0]); > + p_err("can't open cgroup %s", path); > goto exit; > } > > @@ -297,23 +310,29 @@ static int do_show_tree(int argc, char **argv) > char *cgroup_root; > int ret; > > - switch (argc) { > - case 0: > + query_flags = 0; > + > + if (!argc) { > cgroup_root = find_cgroup_root(); > if (!cgroup_root) { > p_err("cgroup v2 isn't mounted"); > return -1; > } > - break; > - case 1: > - cgroup_root = argv[0]; > - break; > - default: > - p_err("too many parameters for cgroup tree"); > - return -1; > + } else { > + cgroup_root = GET_ARG(); > + > + while (argc) { > + if (is_prefix(*argv, "effective")) { > + query_flags |= BPF_F_QUERY_EFFECTIVE; > + NEXT_ARG(); NEXT_ARG() does update argc value; that means after this outer if/else we need to know how argc has become 0 (through which path) before freeing up `cgroup_root` allocated memory later at the end of this function. > + } else { > + p_err("expected no more arguments, 'effective', got: '%s'?", > + *argv); > + return -1; > + } > + } > } > > - > if (json_output) > jsonw_start_array(json_wtr); > else > @@ -459,8 +478,8 @@ static int do_help(int argc, char **argv) > } > > fprintf(stderr, > - "Usage: %s %s { show | list } CGROUP\n" > - " %s %s tree [CGROUP_ROOT]\n" > + "Usage: %s %s { show | list } CGROUP [**effective**]\n" > + " %s %s tree [CGROUP_ROOT] [**effective**]\n" > " %s %s attach CGROUP ATTACH_TYPE PROG [ATTACH_FLAGS]\n" > " %s %s detach CGROUP ATTACH_TYPE PROG\n" > " %s %s help\n" > -- > 2.21.0 > Thanks for the patch. Apart from above two issues, patch looks good.
On Tue, 30 Jul 2019 18:04:53 +0000, Takshak Chahande wrote: > Jakub Kicinski <jakub.kicinski@netronome.com> wrote on Mon [2019-Jul-29 14:35:38 -0700]: > > @@ -158,20 +161,30 @@ static int show_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type, > > static int do_show(int argc, char **argv) > > { > > enum bpf_attach_type type; > > + const char *path; > > int cgroup_fd; > > int ret = -1; > > > > - if (argc < 1) { > > - p_err("too few parameters for cgroup show"); > > - goto exit; > > - } else if (argc > 1) { > > - p_err("too many parameters for cgroup show"); > > - goto exit; > > + query_flags = 0; > > + > > + if (!REQ_ARGS(1)) > > + return -1; > > + path = GET_ARG(); > > + > > + while (argc) { > > + if (is_prefix(*argv, "effective")) { > > + query_flags |= BPF_F_QUERY_EFFECTIVE; > > + NEXT_ARG(); > > + } else { > > + p_err("expected no more arguments, 'effective', got: '%s'?", > > + *argv); > > + return -1; > > + } > > } > This while loop will allow multiple 'effective' keywords in the argument > unnecessarily. IMO, we should strictly restrict only for single > occurance of 'effective' word. It's kind of the way all bpftool works to date :( But perhaps not checking is worse than inconsistency? Okay, let's fix this up. > > - cgroup_fd = open(argv[0], O_RDONLY); > > + cgroup_fd = open(path, O_RDONLY); > > if (cgroup_fd < 0) { > > - p_err("can't open cgroup %s", argv[0]); > > + p_err("can't open cgroup %s", path); > > goto exit; > > } > > > > @@ -297,23 +310,29 @@ static int do_show_tree(int argc, char **argv) > > char *cgroup_root; > > int ret; > > > > - switch (argc) { > > - case 0: > > + query_flags = 0; > > + > > + if (!argc) { > > cgroup_root = find_cgroup_root(); > > if (!cgroup_root) { > > p_err("cgroup v2 isn't mounted"); > > return -1; > > } > > - break; > > - case 1: > > - cgroup_root = argv[0]; > > - break; > > - default: > > - p_err("too many parameters for cgroup tree"); > > - return -1; > > + } else { > > + cgroup_root = GET_ARG(); > > + > > + while (argc) { > > + if (is_prefix(*argv, "effective")) { > > + query_flags |= BPF_F_QUERY_EFFECTIVE; > > + NEXT_ARG(); > > NEXT_ARG() does update argc value; that means after this outer if/else we need > to know how argc has become 0 (through which path) before freeing up `cgroup_root` allocated > memory later at the end of this function. Good catch! > > + } else { > > + p_err("expected no more arguments, 'effective', got: '%s'?", > > + *argv); > > + return -1; > > + } > > + } > > } > Thanks for the patch. Apart from above two issues, patch looks good. Thanks for the review.
diff --git a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst index 585f270c2d25..06a28b07787d 100644 --- a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst +++ b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst @@ -20,8 +20,8 @@ SYNOPSIS CGROUP COMMANDS =============== -| **bpftool** **cgroup { show | list }** *CGROUP* -| **bpftool** **cgroup tree** [*CGROUP_ROOT*] +| **bpftool** **cgroup { show | list }** *CGROUP* [**effective**] +| **bpftool** **cgroup tree** [*CGROUP_ROOT*] [**effective**] | **bpftool** **cgroup attach** *CGROUP* *ATTACH_TYPE* *PROG* [*ATTACH_FLAGS*] | **bpftool** **cgroup detach** *CGROUP* *ATTACH_TYPE* *PROG* | **bpftool** **cgroup help** @@ -35,13 +35,17 @@ CGROUP COMMANDS DESCRIPTION =========== - **bpftool cgroup { show | list }** *CGROUP* + **bpftool cgroup { show | list }** *CGROUP* [**effective**] List all programs attached to the cgroup *CGROUP*. Output will start with program ID followed by attach type, attach flags and program name. - **bpftool cgroup tree** [*CGROUP_ROOT*] + If **effective** is specified retrieve effective programs that + will execute for events within a cgroup. This includes + inherited along with attached ones. + + **bpftool cgroup tree** [*CGROUP_ROOT*] [**effective**] Iterate over all cgroups in *CGROUP_ROOT* and list all attached programs. If *CGROUP_ROOT* is not specified, bpftool uses cgroup v2 mountpoint. @@ -50,6 +54,10 @@ DESCRIPTION commands: it starts with absolute cgroup path, followed by program ID, attach type, attach flags and program name. + If **effective** is specified retrieve effective programs that + will execute for events within a cgroup. This includes + inherited along with attached ones. + **bpftool cgroup attach** *CGROUP* *ATTACH_TYPE* *PROG* [*ATTACH_FLAGS*] Attach program *PROG* to the cgroup *CGROUP* with attach type *ATTACH_TYPE* and optional *ATTACH_FLAGS*. diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool index 6b961a5ed100..df16c5415444 100644 --- a/tools/bpf/bpftool/bash-completion/bpftool +++ b/tools/bpf/bpftool/bash-completion/bpftool @@ -710,12 +710,15 @@ _bpftool() ;; cgroup) case $command in - show|list) - _filedir - return 0 - ;; - tree) - _filedir + show|list|tree) + case $cword in + 3) + _filedir + ;; + 4) + COMPREPLY=( $( compgen -W 'effective' -- "$cur" ) ) + ;; + esac return 0 ;; attach|detach) diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c index f3c05b08c68c..339c2c78b8e4 100644 --- a/tools/bpf/bpftool/cgroup.c +++ b/tools/bpf/bpftool/cgroup.c @@ -29,6 +29,8 @@ " recvmsg4 | recvmsg6 | sysctl |\n" \ " getsockopt | setsockopt }" +static unsigned int query_flags; + static const char * const attach_type_strings[] = { [BPF_CGROUP_INET_INGRESS] = "ingress", [BPF_CGROUP_INET_EGRESS] = "egress", @@ -107,7 +109,8 @@ static int count_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type) __u32 prog_cnt = 0; int ret; - ret = bpf_prog_query(cgroup_fd, type, 0, NULL, NULL, &prog_cnt); + ret = bpf_prog_query(cgroup_fd, type, query_flags, NULL, + NULL, &prog_cnt); if (ret) return -1; @@ -125,8 +128,8 @@ static int show_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type, int ret; prog_cnt = ARRAY_SIZE(prog_ids); - ret = bpf_prog_query(cgroup_fd, type, 0, &attach_flags, prog_ids, - &prog_cnt); + ret = bpf_prog_query(cgroup_fd, type, query_flags, &attach_flags, + prog_ids, &prog_cnt); if (ret) return ret; @@ -158,20 +161,30 @@ static int show_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type, static int do_show(int argc, char **argv) { enum bpf_attach_type type; + const char *path; int cgroup_fd; int ret = -1; - if (argc < 1) { - p_err("too few parameters for cgroup show"); - goto exit; - } else if (argc > 1) { - p_err("too many parameters for cgroup show"); - goto exit; + query_flags = 0; + + if (!REQ_ARGS(1)) + return -1; + path = GET_ARG(); + + while (argc) { + if (is_prefix(*argv, "effective")) { + query_flags |= BPF_F_QUERY_EFFECTIVE; + NEXT_ARG(); + } else { + p_err("expected no more arguments, 'effective', got: '%s'?", + *argv); + return -1; + } } - cgroup_fd = open(argv[0], O_RDONLY); + cgroup_fd = open(path, O_RDONLY); if (cgroup_fd < 0) { - p_err("can't open cgroup %s", argv[0]); + p_err("can't open cgroup %s", path); goto exit; } @@ -297,23 +310,29 @@ static int do_show_tree(int argc, char **argv) char *cgroup_root; int ret; - switch (argc) { - case 0: + query_flags = 0; + + if (!argc) { cgroup_root = find_cgroup_root(); if (!cgroup_root) { p_err("cgroup v2 isn't mounted"); return -1; } - break; - case 1: - cgroup_root = argv[0]; - break; - default: - p_err("too many parameters for cgroup tree"); - return -1; + } else { + cgroup_root = GET_ARG(); + + while (argc) { + if (is_prefix(*argv, "effective")) { + query_flags |= BPF_F_QUERY_EFFECTIVE; + NEXT_ARG(); + } else { + p_err("expected no more arguments, 'effective', got: '%s'?", + *argv); + return -1; + } + } } - if (json_output) jsonw_start_array(json_wtr); else @@ -459,8 +478,8 @@ static int do_help(int argc, char **argv) } fprintf(stderr, - "Usage: %s %s { show | list } CGROUP\n" - " %s %s tree [CGROUP_ROOT]\n" + "Usage: %s %s { show | list } CGROUP [**effective**]\n" + " %s %s tree [CGROUP_ROOT] [**effective**]\n" " %s %s attach CGROUP ATTACH_TYPE PROG [ATTACH_FLAGS]\n" " %s %s detach CGROUP ATTACH_TYPE PROG\n" " %s %s help\n"