tools: bpftool: add support for reporting the effective cgroup progs

Takshak said in the original submission:

With different bpf attach_flags available to attach bpf programs specially
with BPF_F_ALLOW_OVERRIDE and BPF_F_ALLOW_MULTI, the list of effective
bpf-programs available to any sub-cgroups really needs to be available for
easy debugging.

Using BPF_F_QUERY_EFFECTIVE flag, one can get the list of not only attached
bpf-programs to a cgroup but also the inherited ones from parent cgroup.

So a new option is introduced to use BPF_F_QUERY_EFFECTIVE query flag here
to list all the effective bpf-programs available for execution at a specified
cgroup.

Reused modified test program test_cgroup_attach from tools/testing/selftests/bpf:
  # ./test_cgroup_attach

With old bpftool:

 # bpftool cgroup show /sys/fs/cgroup/cgroup-test-work-dir/cg1/
  ID       AttachType      AttachFlags     Name
  271      egress          multi           pkt_cntr_1
  272      egress          multi           pkt_cntr_2

Attached new program pkt_cntr_4 in cg2 gives following:

 # bpftool cgroup show /sys/fs/cgroup/cgroup-test-work-dir/cg1/cg2
  ID       AttachType      AttachFlags     Name
  273      egress          override        pkt_cntr_4

And with new "effective" option it shows all effective programs for cg2:

 # bpftool cgroup show /sys/fs/cgroup/cgroup-test-work-dir/cg1/cg2 effective
  ID       AttachType      AttachFlags     Name
  273      egress          override        pkt_cntr_4
  271      egress          override        pkt_cntr_1
  272      egress          override        pkt_cntr_2

Compared to original submission use a local flag instead of global
option.

We need to clear query_flags on every command, in case batch mode
wants to use varying settings.

v2: (Takshak)
 - forbid duplicated flags;
 - fix cgroup path freeing.

Signed-off-by: Takshak Chahande <ctakshak@fb.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
Reviewed-by: Takshak Chahande <ctakshak@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst
index 585f270c2d25db90fceb0ab6d815e3fdf5c65585..06a28b07787dcdc45f5806a4bdb41a785eced3c9 100644 (file)
--- a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst
@@ -20,8 +20,8 @@ SYNOPSIS
 CGROUP COMMANDS
 ===============
 
-|      **bpftool** **cgroup { show | list }** *CGROUP*
-|      **bpftool** **cgroup tree** [*CGROUP_ROOT*]
+|      **bpftool** **cgroup { show | list }** *CGROUP* [**effective**]
+|      **bpftool** **cgroup tree** [*CGROUP_ROOT*] [**effective**]
 |      **bpftool** **cgroup attach** *CGROUP* *ATTACH_TYPE* *PROG* [*ATTACH_FLAGS*]
 |      **bpftool** **cgroup detach** *CGROUP* *ATTACH_TYPE* *PROG*
 |      **bpftool** **cgroup help**
@@ -35,13 +35,17 @@ CGROUP COMMANDS
 
 DESCRIPTION
 ===========
-       **bpftool cgroup { show | list }** *CGROUP*
+       **bpftool cgroup { show | list }** *CGROUP* [**effective**]
                  List all programs attached to the cgroup *CGROUP*.
 
                  Output will start with program ID followed by attach type,
                  attach flags and program name.
 
-       **bpftool cgroup tree** [*CGROUP_ROOT*]
+                 If **effective** is specified retrieve effective programs that
+                 will execute for events within a cgroup. This includes
+                 inherited along with attached ones.
+
+       **bpftool cgroup tree** [*CGROUP_ROOT*] [**effective**]
                  Iterate over all cgroups in *CGROUP_ROOT* and list all
                  attached programs. If *CGROUP_ROOT* is not specified,
                  bpftool uses cgroup v2 mountpoint.
@@ -50,6 +54,10 @@ DESCRIPTION
                  commands: it starts with absolute cgroup path, followed by
                  program ID, attach type, attach flags and program name.
 
+                 If **effective** is specified retrieve effective programs that
+                 will execute for events within a cgroup. This includes
+                 inherited along with attached ones.
+
        **bpftool cgroup attach** *CGROUP* *ATTACH_TYPE* *PROG* [*ATTACH_FLAGS*]
                  Attach program *PROG* to the cgroup *CGROUP* with attach type
                  *ATTACH_TYPE* and optional *ATTACH_FLAGS*.

diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool
index 6b961a5ed10067a9078fbf696c9f23172a72b0d8..df16c54154442e87830963755c557ff89f7410eb 100644 (file)
--- a/tools/bpf/bpftool/bash-completion/bpftool
+++ b/tools/bpf/bpftool/bash-completion/bpftool
@@ -710,12 +710,15 @@ _bpftool()
             ;;
         cgroup)
             case $command in
-                show|list)
-                    _filedir
-                    return 0
-                    ;;
-                tree)
-                    _filedir
+                show|list|tree)
+                    case $cword in
+                        3)
+                            _filedir
+                            ;;
+                        4)
+                            COMPREPLY=( $( compgen -W 'effective' -- "$cur" ) )
+                            ;;
+                    esac
                     return 0
                     ;;
                 attach|detach)

diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c
index f3c05b08c68cb06e6e92801629125f214daed523..44352b5aca8507467e42710c13c19c1083dfb08c 100644 (file)
--- a/tools/bpf/bpftool/cgroup.c
+++ b/tools/bpf/bpftool/cgroup.c
@@ -29,6 +29,8 @@
        "                        recvmsg4 | recvmsg6 | sysctl |\n"             \
        "                        getsockopt | setsockopt }"
 
+static unsigned int query_flags;
+
 static const char * const attach_type_strings[] = {
        [BPF_CGROUP_INET_INGRESS] = "ingress",
        [BPF_CGROUP_INET_EGRESS] = "egress",
@@ -107,7 +109,8 @@ static int count_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type)
        __u32 prog_cnt = 0;
        int ret;
 
-       ret = bpf_prog_query(cgroup_fd, type, 0, NULL, NULL, &prog_cnt);
+       ret = bpf_prog_query(cgroup_fd, type, query_flags, NULL,
+                            NULL, &prog_cnt);
        if (ret)
                return -1;
 
@@ -125,8 +128,8 @@ static int show_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type,
        int ret;
 
        prog_cnt = ARRAY_SIZE(prog_ids);
-       ret = bpf_prog_query(cgroup_fd, type, 0, &attach_flags, prog_ids,
-                            &prog_cnt);
+       ret = bpf_prog_query(cgroup_fd, type, query_flags, &attach_flags,
+                            prog_ids, &prog_cnt);
        if (ret)
                return ret;
 
@@ -158,20 +161,34 @@ static int show_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type,
 static int do_show(int argc, char **argv)
 {
        enum bpf_attach_type type;
+       const char *path;
        int cgroup_fd;
        int ret = -1;
 
-       if (argc < 1) {
-               p_err("too few parameters for cgroup show");
-               goto exit;
-       } else if (argc > 1) {
-               p_err("too many parameters for cgroup show");
-               goto exit;
+       query_flags = 0;
+
+       if (!REQ_ARGS(1))
+               return -1;
+       path = GET_ARG();
+
+       while (argc) {
+               if (is_prefix(*argv, "effective")) {
+                       if (query_flags & BPF_F_QUERY_EFFECTIVE) {
+                               p_err("duplicated argument: %s", *argv);
+                               return -1;
+                       }
+                       query_flags |= BPF_F_QUERY_EFFECTIVE;
+                       NEXT_ARG();
+               } else {
+                       p_err("expected no more arguments, 'effective', got: '%s'?",
+                             *argv);
+                       return -1;
+               }
        }
 
-       cgroup_fd = open(argv[0], O_RDONLY);
+       cgroup_fd = open(path, O_RDONLY);
        if (cgroup_fd < 0) {
-               p_err("can't open cgroup %s", argv[0]);
+               p_err("can't open cgroup %s", path);
                goto exit;
        }
 
@@ -294,26 +311,37 @@ static char *find_cgroup_root(void)
 
 static int do_show_tree(int argc, char **argv)
 {
-       char *cgroup_root;
+       char *cgroup_root, *cgroup_alloced = NULL;
        int ret;
 
-       switch (argc) {
-       case 0:
-               cgroup_root = find_cgroup_root();
-               if (!cgroup_root) {
+       query_flags = 0;
+
+       if (!argc) {
+               cgroup_alloced = find_cgroup_root();
+               if (!cgroup_alloced) {
                        p_err("cgroup v2 isn't mounted");
                        return -1;
                }
-               break;
-       case 1:
-               cgroup_root = argv[0];
-               break;
-       default:
-               p_err("too many parameters for cgroup tree");
-               return -1;
+               cgroup_root = cgroup_alloced;
+       } else {
+               cgroup_root = GET_ARG();
+
+               while (argc) {
+                       if (is_prefix(*argv, "effective")) {
+                               if (query_flags & BPF_F_QUERY_EFFECTIVE) {
+                                       p_err("duplicated argument: %s", *argv);
+                                       return -1;
+                               }
+                               query_flags |= BPF_F_QUERY_EFFECTIVE;
+                               NEXT_ARG();
+                       } else {
+                               p_err("expected no more arguments, 'effective', got: '%s'?",
+                                     *argv);
+                               return -1;
+                       }
+               }
        }
 
-
        if (json_output)
                jsonw_start_array(json_wtr);
        else
@@ -338,8 +366,7 @@ static int do_show_tree(int argc, char **argv)
        if (json_output)
                jsonw_end_array(json_wtr);
 
-       if (argc == 0)
-               free(cgroup_root);
+       free(cgroup_alloced);
 
        return ret;
 }
@@ -459,8 +486,8 @@ static int do_help(int argc, char **argv)
        }
 
        fprintf(stderr,
-               "Usage: %s %s { show | list } CGROUP\n"
-               "       %s %s tree [CGROUP_ROOT]\n"
+               "Usage: %s %s { show | list } CGROUP [**effective**]\n"
+               "       %s %s tree [CGROUP_ROOT] [**effective**]\n"
                "       %s %s attach CGROUP ATTACH_TYPE PROG [ATTACH_FLAGS]\n"
                "       %s %s detach CGROUP ATTACH_TYPE PROG\n"
                "       %s %s help\n"