From e3ecf048579afd7a673700d04893671627e85d57 Mon Sep 17 00:00:00 2001

From: Quentin Deslandes <qde@naccy.de>

Date: Wed, 21 Feb 2024 16:16:20 +0100

Subject: [PATCH] ss: pretty-print BPF socket-local storage

ss is able to print the map ID(s) for which a given socket has BPF

socket-local storage defined (using --bpf-maps or --bpf-map-id=). However,

the actual content of the map remains hidden.

This change aims to pretty-print the socket-local storage content following

the socket details, similar to what `bpftool map dump` would do. The exact

output format is inspired by drgn, while the BTF data processing is similar

to bpftool's.

ss will use libbpf's btf_dump__dump_type_data() to ease pretty-printing

of binary data. This requires out_bpf_sk_storage_print_fn() as a print

callback function used by btf_dump__dump_type_data(). vout() is also

introduced, which is similar to out() but accepts a va_list as

parameter.

ss' output remains unchanged unless --bpf-maps or --bpf-map-id= is used,

in which case each socket containing BPF local storage will be followed by

the content of the storage before the next socket's info is displayed.

Signed-off-by: Quentin Deslandes <qde@naccy.de>

Acked-by: Martin KaFai Lau <martin.lau@kernel.org>

Signed-off-by: David Ahern <dsahern@kernel.org>

---

 misc/ss.c | 148 ++++++++++++++++++++++++++++++++++++++++++++++++++----

 1 file changed, 137 insertions(+), 11 deletions(-)

diff --git a/misc/ss.c b/misc/ss.c

index 2c7e7c58..3ebac132 100644

--- a/misc/ss.c

+++ b/misc/ss.c

@@ -61,7 +61,9 @@

 #define ENABLE_BPF_SKSTORAGE_SUPPORT

 #include <bpf/bpf.h>

+#include <bpf/btf.h>

 #include <bpf/libbpf.h>

+#include <linux/btf.h>

 #if (LIBBPF_MAJOR_VERSION == 0) && (LIBBPF_MINOR_VERSION < 5)

 #warning "libbpf version 0.5 or later is required, disabling BPF socket-local storage support"

@@ -1053,11 +1055,10 @@ static int buf_update(int len)

 }

 /* Append content to buffer as part of the current field */

-__attribute__((format(printf, 1, 2)))

-static void out(const char *fmt, ...)

+static void vout(const char *fmt, va_list args)

 {

 	struct column *f = current_field;

-	va_list args;

+	va_list _args;

 	char *pos;

 	int len;

@@ -1068,18 +1069,27 @@ static void out(const char *fmt, ...)

 		buffer.head = buf_chunk_new();

 again:	/* Append to buffer: if we have a new chunk, print again */

+	va_copy(_args, args);

 	pos = buffer.cur->data + buffer.cur->len;

-	va_start(args, fmt);

 	/* Limit to tail room. If we hit the limit, buf_update() will tell us */

-	len = vsnprintf(pos, buf_chunk_avail(buffer.tail), fmt, args);

-	va_end(args);

+	len = vsnprintf(pos, buf_chunk_avail(buffer.tail), fmt, _args);

 	if (buf_update(len))

 		goto again;

 }

+__attribute__((format(printf, 1, 2)))

+static void out(const char *fmt, ...)

+{

+	va_list args;

+

+	va_start(args, fmt);

+	vout(fmt, args);

+	va_end(args);

+}

+

 static int print_left_spacing(struct column *f, int stored, int printed)

 {

 	int s;

@@ -3413,6 +3423,9 @@ static struct bpf_map_opts {

 	struct bpf_sk_storage_map_info {

 		unsigned int id;

 		int fd;

+		struct bpf_map_info info;

+		struct btf *btf;

+		struct btf_dump *dump;

 	} maps[MAX_NR_BPF_MAP_ID_OPTS];

 	bool show_all;

 } bpf_map_opts;

@@ -3423,10 +3436,36 @@ static void bpf_map_opts_mixed_error(void)

 		"ss: --bpf-maps and --bpf-map-id cannot be used together\n");

 }

+static int bpf_maps_opts_load_btf(struct bpf_map_info *info, struct btf **btf)

+{

+	if (info->btf_value_type_id) {

+		*btf = btf__load_from_kernel_by_id(info->btf_id);

+		if (!*btf) {

+			fprintf(stderr, "ss: failed to load BTF for map ID %u\n",

+				info->id);

+			return -1;

+		}

+	} else {

+		*btf = NULL;

+	}

+

+	return 0;

+}

+

+static void out_bpf_sk_storage_print_fn(void *ctx, const char *fmt, va_list args)

+{

+	vout(fmt, args);

+}

+

 static int bpf_map_opts_load_info(unsigned int map_id)

 {

+	struct btf_dump_opts dopts = {

+		.sz = sizeof(struct btf_dump_opts)

+	};

 	struct bpf_map_info info = {};

 	uint32_t len = sizeof(info);

+	struct btf_dump *dump;

+	struct btf *btf;

 	int fd;

 	int r;

@@ -3464,8 +3503,25 @@ static int bpf_map_opts_load_info(unsigned int map_id)

 		return -1;

 	}

+	r = bpf_maps_opts_load_btf(&info, &btf);

+	if (r) {

+		close(fd);

+		return -1;

+	}

+

+	dump = btf_dump__new(btf, out_bpf_sk_storage_print_fn, NULL, &dopts);

+	if (!dump) {

+		btf__free(btf);

+		close(fd);

+		fprintf(stderr, "Failed to create btf_dump object\n");

+		return -1;

+	}

+

 	bpf_map_opts.maps[bpf_map_opts.nr_maps].id = map_id;

-	bpf_map_opts.maps[bpf_map_opts.nr_maps++].fd = fd;

+	bpf_map_opts.maps[bpf_map_opts.nr_maps].fd = fd;

+	bpf_map_opts.maps[bpf_map_opts.nr_maps].info = info;

+	bpf_map_opts.maps[bpf_map_opts.nr_maps].btf = btf;

+	bpf_map_opts.maps[bpf_map_opts.nr_maps++].dump = dump;

 	return 0;

 }

@@ -3517,8 +3573,11 @@ static void bpf_map_opts_destroy(void)

 {

 	int i;

-	for (i = 0; i < bpf_map_opts.nr_maps; ++i)

+	for (i = 0; i < bpf_map_opts.nr_maps; ++i) {

+		btf_dump__free(bpf_map_opts.maps[i].dump);

+		btf__free(bpf_map_opts.maps[i].btf);

 		close(bpf_map_opts.maps[i].fd);

+	}

 }

 static struct rtattr *bpf_map_opts_alloc_rta(void)

@@ -3571,10 +3630,74 @@ static struct rtattr *bpf_map_opts_alloc_rta(void)

 	return stgs_rta;

 }

+static void out_bpf_sk_storage_oneline(struct bpf_sk_storage_map_info *info,

+	const void *data, size_t len)

+{

+	struct btf_dump_type_data_opts opts = {

+		.sz = sizeof(struct btf_dump_type_data_opts),

+		.emit_zeroes = 1,

+		.compact = 1

+	};

+	int r;

+

+	out(" map_id:%d", info->id);

+	r = btf_dump__dump_type_data(info->dump, info->info.btf_value_type_id,

+				     data, len, &opts);

+	if (r < 0)

+		out("failed to dump data: %d", r);

+}

+

+static void out_bpf_sk_storage_multiline(struct bpf_sk_storage_map_info *info,

+	const void *data, size_t len)

+{

+	struct btf_dump_type_data_opts opts = {

+		.sz = sizeof(struct btf_dump_type_data_opts),

+		.indent_level = 2,

+		.emit_zeroes = 1

+	};

+	int r;

+

+	out("\n\tmap_id:%d [\n", info->id);

+

+	r = btf_dump__dump_type_data(info->dump, info->info.btf_value_type_id,

+				     data, len, &opts);

+	if (r < 0)

+		out("\t\tfailed to dump data: %d", r);

+

+	out("\n\t]");

+}

+

+static void out_bpf_sk_storage(int map_id, const void *data, size_t len)

+{

+	struct bpf_sk_storage_map_info *map_info;

+

+	map_info = bpf_map_opts_get_info(map_id);

+	if (!map_info) {

+		/* The kernel might return a map we can't get info for, skip

+		 * it but print the other ones.

+		 */

+		out("\n\tmap_id: %d failed to fetch info, skipping\n", map_id);

+		return;

+	}

+

+	if (map_info->info.value_size != len) {

+		fprintf(stderr,

+			"map_id: %d: invalid value size, expecting %u, got %lu\n",

+			map_id, map_info->info.value_size, len);

+		return;

+	}

+

+	if (oneline)

+		out_bpf_sk_storage_oneline(map_info, data, len);

+	else

+		out_bpf_sk_storage_multiline(map_info, data, len);

+}

+

 static void show_sk_bpf_storages(struct rtattr *bpf_stgs)

 {

 	struct rtattr *tb[SK_DIAG_BPF_STORAGE_MAX + 1], *bpf_stg;

-	unsigned int rem;

+	unsigned int rem, map_id;

+	struct rtattr *value;

 	for (bpf_stg = RTA_DATA(bpf_stgs), rem = RTA_PAYLOAD(bpf_stgs);

 		RTA_OK(bpf_stg, rem); bpf_stg = RTA_NEXT(bpf_stg, rem)) {

@@ -3586,8 +3709,11 @@ static void show_sk_bpf_storages(struct rtattr *bpf_stgs)

 				    (struct rtattr *)bpf_stg);

 		if (tb[SK_DIAG_BPF_STORAGE_MAP_ID]) {

-			out(" map_id:%u",

-			    rta_getattr_u32(tb[SK_DIAG_BPF_STORAGE_MAP_ID]));

+			map_id = rta_getattr_u32(tb[SK_DIAG_BPF_STORAGE_MAP_ID]);

+			value = tb[SK_DIAG_BPF_STORAGE_MAP_VALUE];

+

+			out_bpf_sk_storage(map_id, RTA_DATA(value),

+					   RTA_PAYLOAD(value));

 		}

 	}

 }

-- 

2.41.0