[PATCH] bpftool: fix line info in multi-function CFG dumps

[PATCH] bpftool: fix line info in multi-function CFG dumps

[Eduard Zateev]

The CFG dumper computes BTF line-info offsets relative to each function, but bpf_prog_linfo__lfind() expects offsets from the start of the whole program. As a result, line annotations in later functions can resolve to source lines from the first function.

Pass the program instruction base to the graph dumper and use the global instruction offset for line-info lookup and display. Keep function-info matching relative to the function as before.

Add a selftest with a BPF-to-BPF call that checks the second function source line in visual output.

Link: https://github.com/libbpf/bpftool/issues/178
Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>
---
 tools/bpf/bpftool/cfg.c                       | 19 +++++----
 tools/bpf/bpftool/xlated_dumper.c             | 10 +++--
 tools/bpf/bpftool/xlated_dumper.h             |  3 +-
 .../selftests/bpf/prog_tests/bpftool_cfg.c    | 41 +++++++++++++++++++
 .../testing/selftests/bpf/progs/bpftool_cfg.c | 16 ++++++++
 5 files changed, 75 insertions(+), 14 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/bpftool_cfg.c
 create mode 100644 tools/testing/selftests/bpf/progs/bpftool_cfg.c

diff --git a/tools/bpf/bpftool/cfg.c b/tools/bpf/bpftool/cfg.c
index e3785f9a6..65ec45469 100644
--- a/tools/bpf/bpftool/cfg.c
+++ b/tools/bpf/bpftool/cfg.c
@@ -383,7 +383,7 @@ static void cfg_destroy(struct cfg *cfg)
 
 static void
 draw_bb_node(struct func_node *func, struct bb_node *bb, struct dump_data *dd,
-	     bool opcodes, bool linum)
+	     struct bpf_insn *prog_start, bool opcodes, bool linum)
 {
 	const char *shape;
 
@@ -400,11 +400,11 @@ draw_bb_node(struct func_node *func, struct bb_node *bb, struct dump_data *dd,
 	} else if (bb->idx == EXIT_BLOCK_INDEX) {
 		printf("EXIT");
 	} else {
-		unsigned int start_idx;
+		unsigned int start_idx = bb->head - func->start;
+
 		printf("{\\\n");
-		start_idx = bb->head - func->start;
 		dump_xlated_for_graph(dd, bb->head, bb->tail, start_idx,
-				      opcodes, linum);
+				      prog_start, opcodes, linum);
 		printf("}");
 	}
 
@@ -432,12 +432,12 @@ static void draw_bb_succ_edges(struct func_node *func, struct bb_node *bb)
 
 static void
 func_output_bb_def(struct func_node *func, struct dump_data *dd,
-		   bool opcodes, bool linum)
+		   struct bpf_insn *prog_start, bool opcodes, bool linum)
 {
 	struct bb_node *bb;
 
 	list_for_each_entry(bb, &func->bbs, l) {
-		draw_bb_node(func, bb, dd, opcodes, linum);
+		draw_bb_node(func, bb, dd, prog_start, opcodes, linum);
 	}
 }
 
@@ -458,7 +458,8 @@ static void func_output_edges(struct func_node *func)
 }
 
 static void
-cfg_dump(struct cfg *cfg, struct dump_data *dd, bool opcodes, bool linum)
+cfg_dump(struct cfg *cfg, struct dump_data *dd, struct bpf_insn *prog_start,
+	 bool opcodes, bool linum)
 {
 	struct func_node *func;
 
@@ -466,7 +467,7 @@ cfg_dump(struct cfg *cfg, struct dump_data *dd, bool opcodes, bool linum)
 	list_for_each_entry(func, &cfg->funcs, l) {
 		printf("subgraph \"cluster_%d\" {\n\tstyle=\"dashed\";\n\tcolor=\"black\";\n\tlabel=\"func_%d ()\";\n",
 		       func->idx, func->idx);
-		func_output_bb_def(func, dd, opcodes, linum);
+		func_output_bb_def(func, dd, prog_start, opcodes, linum);
 		func_output_edges(func);
 		printf("}\n");
 	}
@@ -483,7 +484,7 @@ void dump_xlated_cfg(struct dump_data *dd, void *buf, unsigned int len,
 	if (cfg_build(&cfg, insn, len))
 		return;
 
-	cfg_dump(&cfg, dd, opcodes, linum);
+	cfg_dump(&cfg, dd, insn, opcodes, linum);
 
 	cfg_destroy(&cfg);
 }
diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c
index 5579173a6..847241bbe 100644
--- a/tools/bpf/bpftool/xlated_dumper.c
+++ b/tools/bpf/bpftool/xlated_dumper.c
@@ -353,7 +353,7 @@ void dump_xlated_plain(struct dump_data *dd, void *buf, unsigned int len,
 }
 
 void dump_xlated_for_graph(struct dump_data *dd, void *buf_start, void *buf_end,
-			   unsigned int start_idx,
+			   unsigned int start_idx, struct bpf_insn *prog_start,
 			   bool opcodes, bool linum)
 {
 	const struct bpf_insn_cbs cbs = {
@@ -374,6 +374,7 @@ void dump_xlated_for_graph(struct dump_data *dd, void *buf_start, void *buf_end,
 
 	for (; cur <= insn_end; cur++) {
 		unsigned int insn_off;
+		unsigned int linfo_offset;
 
 		if (double_insn) {
 			double_insn = false;
@@ -381,7 +382,8 @@ void dump_xlated_for_graph(struct dump_data *dd, void *buf_start, void *buf_end,
 		}
 		double_insn = cur->code == (BPF_LD | BPF_IMM | BPF_DW);
 
-		insn_off = (unsigned int)(cur - insn_start + start_idx);
+		insn_off = (unsigned int)(cur - insn_start) + start_idx;
+		linfo_offset = (unsigned int)(cur - prog_start);
 		if (btf && record) {
 			if (record->insn_off == insn_off) {
 				btf_dumper_type_only(btf, record->type_id,
@@ -396,14 +398,14 @@ void dump_xlated_for_graph(struct dump_data *dd, void *buf_start, void *buf_end,
 		if (prog_linfo) {
 			const struct bpf_line_info *linfo;
 
-			linfo = bpf_prog_linfo__lfind(prog_linfo, insn_off, 0);
+			linfo = bpf_prog_linfo__lfind(prog_linfo, linfo_offset, 0);
 			if (linfo && linfo != last_linfo) {
 				btf_dump_linfo_dotlabel(btf, linfo, linum);
 				last_linfo = linfo;
 			}
 		}
 
-		printf("%u: ", insn_off);
+		printf("%u: ", linfo_offset);
 		print_bpf_insn(&cbs, cur, true);
 		printf("\\l\\\n");
 
diff --git a/tools/bpf/bpftool/xlated_dumper.h b/tools/bpf/bpftool/xlated_dumper.h
index db3ba0671..d2af7bd10 100644
--- a/tools/bpf/bpftool/xlated_dumper.h
+++ b/tools/bpf/bpftool/xlated_dumper.h
@@ -8,6 +8,7 @@
 #define MODULE_MAX_NAME	64
 
 struct bpf_prog_linfo;
+struct bpf_insn;
 
 struct kernel_sym {
 	unsigned long address;
@@ -36,7 +37,7 @@ void dump_xlated_json(struct dump_data *dd, void *buf, unsigned int len,
 void dump_xlated_plain(struct dump_data *dd, void *buf, unsigned int len,
 		       bool opcodes, bool linum);
 void dump_xlated_for_graph(struct dump_data *dd, void *buf, void *buf_end,
-			   unsigned int start_index,
+			   unsigned int start_idx, struct bpf_insn *prog_start,
 			   bool opcodes, bool linum);
 
 #endif
diff --git a/tools/testing/selftests/bpf/prog_tests/bpftool_cfg.c b/tools/testing/selftests/bpf/prog_tests/bpftool_cfg.c
new file mode 100644
index 000000000..7d5b80927
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/bpftool_cfg.c
@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <bpftool_helpers.h>
+#include <test_progs.h>
+#include <linux/bpf.h>
+#include "bpftool_cfg.skel.h"
+
+#define MAX_BPFTOOL_OUTPUT_LEN (64 * 1024)
+
+void test_bpftool_cfg(void)
+{
+	struct bpftool_cfg *skel = NULL;
+	struct bpf_prog_info info = {};
+	__u32 info_len = sizeof(info);
+	char output[MAX_BPFTOOL_OUTPUT_LEN];
+	char cmd[MAX_BPFTOOL_CMD_LEN];
+	const char *expected = "return\\ bpf_ktime_get_ns()\\ ?\\ skb->len\\ :\\ 0;";
+	int err;
+
+	skel = bpftool_cfg__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "bpftool_cfg__open_and_load"))
+		return;
+
+	err = bpf_obj_get_info_by_fd(bpf_program__fd(skel->progs.bpftool_cfg),
+				     &info, &info_len);
+	if (!ASSERT_OK(err, "bpf_obj_get_info_by_fd"))
+		goto cleanup;
+
+	err = snprintf(cmd, sizeof(cmd), "prog dump xlated id %u visual linum",
+		       info.id);
+	if (!ASSERT_GT(err, 0, "format bpftool command"))
+		goto cleanup;
+
+	err = get_bpftool_command_output(cmd, output, sizeof(output));
+	if (ASSERT_OK(err, "dump program CFG")) {
+		ASSERT_HAS_SUBSTR(output, "cluster_1", "second function in CFG");
+		ASSERT_HAS_SUBSTR(output, expected, "second function line info");
+	}
+
+cleanup:
+	bpftool_cfg__destroy(skel);
+}
diff --git a/tools/testing/selftests/bpf/progs/bpftool_cfg.c b/tools/testing/selftests/bpf/progs/bpftool_cfg.c
new file mode 100644
index 000000000..db01f20c8
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/bpftool_cfg.c
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+
+static __noinline int helper(struct __sk_buff *skb)
+{
+	return bpf_ktime_get_ns() ? skb->len : 0;
+}
+
+SEC("socket")
+int bpftool_cfg(struct __sk_buff *skb)
+{
+	return helper(skb);
+}
+
+char _license[] SEC("license") = "GPL";
-- 
2.55.0

Re: [PATCH] bpftool: fix line info in multi-function CFG dumps

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 3172 bytes --]

> bpftool: fix line info in multi-function CFG dumps

TL;DR:
- Selftest's expected string likely never matches: it doesn't escape '>' in
  "skb->len", unlike the DOT output
- Even if fixed, the check may not distinguish fixed from old code

> diff --git a/tools/testing/selftests/bpf/prog_tests/bpftool_cfg.c b/tools/testing/selftests/bpf/prog_tests/bpftool_cfg.c
> new file mode 100644
> index 000000000000..7d5b80927b65
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/bpftool_cfg.c
> @@ -0,0 +1,41 @@

[ ... ]

> +void test_bpftool_cfg(void)
> +{
> +	struct bpftool_cfg *skel = NULL;
> +	struct bpf_prog_info info = {};
> +	__u32 info_len = sizeof(info);
> +	char output[MAX_BPFTOOL_OUTPUT_LEN];
> +	char cmd[MAX_BPFTOOL_CMD_LEN];
> +	const char *expected = "return\\ bpf_ktime_get_ns()\\ ?\\ skb->len\\ :\\ 0;";
> +	int err;

Can this expected string ever match the bpftool output?

The DOT output prints source lines through btf_dump_linfo_dotlabel() ->
dotlabel_puts(), which escapes '>' as well as ' ':

    static void dotlabel_puts(const char *s)
    {
        for (; *s; ++s) {
            switch (*s) {
            ...
            case '<':
            case '>':
            case '|':
            case ' ':
                putchar('\\');

So the line "return bpf_ktime_get_ns() ? skb->len : 0;" is printed as:

    return\ bpf_ktime_get_ns()\ ?\ skb-\>len\ :\ 0;

The expected string escapes the spaces but not the '>', so it contains
"skb->len" where the output has "skb-\>len".  Would the string need to be
"skb-\\>len" for the strstr() in ASSERT_HAS_SUBSTR() to find it?

As far as I can tell, no other part of the visual output contains this source
text unescaped, since print_insn_for_graph() escapes '>' as well.

[ ... ]

> +	err = get_bpftool_command_output(cmd, output, sizeof(output));
> +	if (ASSERT_OK(err, "dump program CFG")) {
> +		ASSERT_HAS_SUBSTR(output, "cluster_1", "second function in CFG");
> +		ASSERT_HAS_SUBSTR(output, expected, "second function line info");

Even with the escaping corrected, can this check tell the fixed code from the
old code?

In this program the main function is only two instructions (call; exit) and
helper() is longer.  With the old function-relative lookup, the basic blocks
of helper() at relative index 2 or higher already resolve to helper()'s own
line info records, because their global insn_off is also 2 or higher, and
those records all point at this same source line:

    return bpf_ktime_get_ns() ? skb->len : 0;

So that line probably appears in cluster_1 before the fix as well.

The commit message says the selftest "checks the second function source line
in visual output".  Would it discriminate better to check that the main
function's line, "return\ helper(skb);", does not appear in cluster_1, or that
the helper() line comes right before the first instruction of the cluster?

> +	}
> +
> +cleanup:
> +	bpftool_cfg__destroy(skel);
> +}


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/40071369261