Re: [PATCH v2] bpftool: Query only cgroup-related attach types

[Quentin Monnet <qmo@kernel.org>]

2024-06-07 11:21 UTC+0100 ~ Kenta Tada <tadakentaso@gmail.com>
> When CONFIG_NETKIT=y,
> bpftool-cgroup shows error even if the cgroup's path is correct:
> 
> $ bpftool cgroup tree /sys/fs/cgroup
> CgroupPath
> ID       AttachType      AttachFlags     Name
> Error: can't query bpf programs attached to /sys/fs/cgroup: No such device or address
> 
> From strace and kernel tracing, I found netkit returned ENXIO and this command failed.
> I think this AttachType(BPF_NETKIT_PRIMARY) is not relevant to cgroup.
> 
> bpftool-cgroup should query just only cgroup-related attach types.
> 
> v1->v2:
>   - used an array of cgroup attach types
> 
> Signed-off-by: Kenta Tada <tadakentaso@gmail.com>
> ---
>  tools/bpf/bpftool/cgroup.c | 38 +++++++++++++++++++++++++++++++++++---
>  1 file changed, 35 insertions(+), 3 deletions(-)
> 
> diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c
> index af6898c0f388..afab728468bf 100644
> --- a/tools/bpf/bpftool/cgroup.c
> +++ b/tools/bpf/bpftool/cgroup.c
> @@ -19,6 +19,38 @@
>  
>  #include "main.h"
>  
> +static const int cgroup_attach_types[] = {
> +	BPF_CGROUP_INET_INGRESS,
> +	BPF_CGROUP_INET_EGRESS,
> +	BPF_CGROUP_INET_SOCK_CREATE,
> +	BPF_CGROUP_INET_SOCK_RELEASE,
> +	BPF_CGROUP_INET4_BIND,
> +	BPF_CGROUP_INET6_BIND,
> +	BPF_CGROUP_INET4_POST_BIND,
> +	BPF_CGROUP_INET6_POST_BIND,
> +	BPF_CGROUP_INET4_CONNECT,
> +	BPF_CGROUP_INET6_CONNECT,
> +	BPF_CGROUP_UNIX_CONNECT,
> +	BPF_CGROUP_INET4_GETPEERNAME,
> +	BPF_CGROUP_INET6_GETPEERNAME,
> +	BPF_CGROUP_UNIX_GETPEERNAME,
> +	BPF_CGROUP_INET4_GETSOCKNAME,
> +	BPF_CGROUP_INET6_GETSOCKNAME,
> +	BPF_CGROUP_UNIX_GETSOCKNAME,
> +	BPF_CGROUP_UDP4_SENDMSG,
> +	BPF_CGROUP_UDP6_SENDMSG,
> +	BPF_CGROUP_UNIX_SENDMSG,
> +	BPF_CGROUP_UDP4_RECVMSG,
> +	BPF_CGROUP_UDP6_RECVMSG,
> +	BPF_CGROUP_UNIX_RECVMSG,
> +	BPF_CGROUP_SOCK_OPS,
> +	BPF_CGROUP_DEVICE,
> +	BPF_CGROUP_SYSCTL,
> +	BPF_CGROUP_GETSOCKOPT,
> +	BPF_CGROUP_SETSOCKOPT,
> +	BPF_LSM_CGROUP
> +};
> +
>  #define HELP_SPEC_ATTACH_FLAGS						\
>  	"ATTACH_FLAGS := { multi | override }"
>  
> @@ -183,11 +215,11 @@ static int count_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type)
>  
>  static int cgroup_has_attached_progs(int cgroup_fd)
>  {
> -	enum bpf_attach_type type;
> +	unsigned int i = 0;
>  	bool no_prog = true;
>  
> -	for (type = 0; type < __MAX_BPF_ATTACH_TYPE; type++) {
> -		int count = count_attached_bpf_progs(cgroup_fd, type);
> +	for (i = 0; i < ARRAY_SIZE(cgroup_attach_types); i++) {


Thanks, it looks better that way.


> +		int count = count_attached_bpf_progs(cgroup_fd, cgroup_attach_types[i]);
>  
>  		if (count < 0 && errno != EINVAL)


I think the "errno != EINVAL" exception was here to allow iterating over
unsupported attach types for the queries. Now that we only do supported
types, we can probably remove it and return if "(count < 0)".


>  			return -1;