Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20220521075736.1225397-1-zenczykowski@gmail.com>
 <CAADnVQJcDvyeQ3y=uVDj-7JfqtxE+nJk+d5oVQrBhhQpicYk6A@mail.gmail.com>
 <CANP3RGcn6ta7uZH7onuRwOzx_2UmizEtgOTMKvbMOL8FER0MXQ@mail.gmail.com> <CAADnVQKWxzwAbZFAfOB2hxwOVP1mCfwpx30rcdRkCO-4DMxsZw@mail.gmail.com>
In-Reply-To: <CAADnVQKWxzwAbZFAfOB2hxwOVP1mCfwpx30rcdRkCO-4DMxsZw@mail.gmail.com>
From:   =?UTF-8?Q?Maciej_=C5=BBenczykowski?= <zenczykowski@gmail.com>
Date:   Wed, 25 May 2022 09:14:20 -0700
Message-ID: <CAHo-Oow9u0QGwGuB4u4Uusv_2N70HbWZT6-cM_av8pqwychT9g@mail.gmail.com>
Subject: Re: [PATCH bpf-next] bpf: print a little more info about maps via cat /sys/fs/bpf/pinned_name
To:     Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc:     Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Linux Network Development Mailing List 
        <netdev@vger.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        BPF Mailing List <bpf@vger.kernel.org>,
        "David S . Miller" <davem@davemloft.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Mon, May 23, 2022 at 1:21 PM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Mon, May 23, 2022 at 1:14 PM Maciej =C5=BBenczykowski
> <zenczykowski@gmail.com> wrote:
> >
> > On Mon, May 23, 2022 at 12:32 PM Alexei Starovoitov
> > <alexei.starovoitov@gmail.com> wrote:
> > >
> > > On Sat, May 21, 2022 at 12:57 AM Maciej =C5=BBenczykowski
> > > <zenczykowski@gmail.com> wrote:
> > > >
> > > > From: Maciej =C5=BBenczykowski <maze@google.com>
> > > >
> > > > While this information can be fetched via bpftool,
> > > > the cli tool itself isn't always available on more limited systems.
> > > >
> > > > From the information printed particularly the 'id' is useful since
> > > > when combined with /proc/pid/fd/X and /proc/pid/fdinfo/X it allows
> > > > tracking down which bpf maps a process has open (which can be
> > > > useful for tracking down fd leaks).
> > > >
> > > > Signed-off-by: Maciej =C5=BBenczykowski <maze@google.com>
> > > > ---
> > > >  kernel/bpf/inode.c | 3 +++
> > > >  1 file changed, 3 insertions(+)
> > > >
> > > > diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
> > > > index 4f841e16779e..784266e258fe 100644
> > > > --- a/kernel/bpf/inode.c
> > > > +++ b/kernel/bpf/inode.c
> > > > @@ -257,6 +257,9 @@ static int map_seq_show(struct seq_file *m, voi=
d *v)
> > > >         if (unlikely(v =3D=3D SEQ_START_TOKEN)) {
> > > >                 seq_puts(m, "# WARNING!! The output is for debug pu=
rpose only\n");
> > > >                 seq_puts(m, "# WARNING!! The output format will cha=
nge\n");
> > > > +               seq_printf(m, "# type: %d, key_size: %d, value_size=
: %d, max_entries: %d, id: %d\n",
> > > > +                          map->map_type, map->key_size, map->value=
_size, map->max_entries,
> > > > +                          map->id);
> > >
> > > Maybe use cat /sys/fs/bpf/maps.debug instead?
> > > It prints map id.
> >
> > Is this something that was very recently added?
> > I'm not seeing it on my 5.16 machine with bpffs mounted at /sys/fs/bpf.
>
> It was there since 2020.
> Make sure you have CONFIG_BPF_PRELOAD.

Hmm.  This seems very annoying to use in practice.

* it seems to default to disabled, and as such is disabled on:
- my Debian laptop and desktop (well google's corp Linux distro, but
it should be close enough to Debian here)
- my latest Fedora 36 Desktop and VMs
- our production (server) kernels
- all current Android Common Kernel / Generic Kernel Image / Pixel kernel t=
rees
- Android UML test image kernel build scripts
* enabling it on our server kernels results in a compilation failure
(probably some missing backports, they're backported up the wazoo)
* enabling it on ACK 5.10 tree results in a very different build failure
* enabling it on ACK 5.15 successfully builds, but doesn't seem to work:

# uname -r
5.15.41-04342-g39bba8f6b9fe

# zcat /proc/config.gz  | egrep BPF_PRELOAD
CONFIG_BPF_PRELOAD=3Dy
CONFIG_BPF_PRELOAD_UMD=3Dy

# cat /proc/mounts | egrep sys
none /sys sysfs rw,relatime 0 0
none /sys/fs/bpf bpf rw,relatime 0 0

# cd /sys/fs/bpf
root@uml-x86-64:/sys/fs/bpf# ls -al
total 0
drwxrwxrwt 2 root root 0 May 25 15:13 .
drwxr-xr-x 6 root root 0 May 25 15:13 ..

Perhaps a limitation of UML, or something funky in the build process,
or the files don't show up until maps/progs are pinned?
Hard to say - this is after running our bpf (python) test suite
(though it might not use pinned maps/programs)...

* finally.. I think it increases kernel size by a lot since I see:
120K ./kernel/bpf/preload/bpf_preload_kern.o
and in a different tree:
232K ./kernel/bpf/preload/bpf_preload.ko

I did get it to work by building a net next tree with the option
manually enabled and installing it on some dev servers.
Those by default have some pinned progs/maps, and I do see the debug files.

When it works it's really nice... but I don't think I'm willing to pay
the complexity/memory costs.