2021-11-16 06:58:42 +08:00
|
|
|
.. SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
|
|
|
|
|
2017-10-05 11:10:05 +08:00
|
|
|
================
|
|
|
|
bpftool-prog
|
|
|
|
================
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
tool for inspection and simple manipulation of eBPF progs
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
|
|
|
|
:Manual section: 8
|
|
|
|
|
bpftool: Update doc (use susbtitutions) and test_bpftool_synctypes.py
test_bpftool_synctypes.py helps detecting inconsistencies in bpftool
between the different list of types and options scattered in the
sources, the documentation, and the bash completion. For options that
apply to all bpftool commands, the script had a hardcoded list of
values, and would use them to check whether the man pages are
up-to-date. When writing the script, it felt acceptable to have this
list in order to avoid to open and parse bpftool's main.h every time,
and because the list of global options in bpftool doesn't change so
often.
However, this is prone to omissions, and we recently added a new
-l|--legacy option which was described in common_options.rst, but not
listed in the options summary of each manual page. The script did not
complain, because it keeps comparing the hardcoded list to the (now)
outdated list in the header file.
To address the issue, this commit brings the following changes:
- Options that are common to all bpftool commands (--json, --pretty, and
--debug) are moved to a dedicated file, and used in the definition of
a RST substitution. This substitution is used in the sources of all
the man pages.
- This list of common options is updated, with the addition of the new
-l|--legacy option.
- The script test_bpftool_synctypes.py is updated to compare:
- Options specific to a command, found in C files, for the
interactive help messages, with the same specific options from the
relevant man page for that command.
- Common options, checked just once: the list in main.h is
compared with the new list in substitutions.rst.
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20211115225844.33943-3-quentin@isovalent.com
2021-11-16 06:58:43 +08:00
|
|
|
.. include:: substitutions.rst
|
|
|
|
|
2017-10-05 11:10:05 +08:00
|
|
|
SYNOPSIS
|
|
|
|
========
|
|
|
|
|
2017-10-24 00:24:16 +08:00
|
|
|
**bpftool** [*OPTIONS*] **prog** *COMMAND*
|
|
|
|
|
bpftool: Update doc (use susbtitutions) and test_bpftool_synctypes.py
test_bpftool_synctypes.py helps detecting inconsistencies in bpftool
between the different list of types and options scattered in the
sources, the documentation, and the bash completion. For options that
apply to all bpftool commands, the script had a hardcoded list of
values, and would use them to check whether the man pages are
up-to-date. When writing the script, it felt acceptable to have this
list in order to avoid to open and parse bpftool's main.h every time,
and because the list of global options in bpftool doesn't change so
often.
However, this is prone to omissions, and we recently added a new
-l|--legacy option which was described in common_options.rst, but not
listed in the options summary of each manual page. The script did not
complain, because it keeps comparing the hardcoded list to the (now)
outdated list in the header file.
To address the issue, this commit brings the following changes:
- Options that are common to all bpftool commands (--json, --pretty, and
--debug) are moved to a dedicated file, and used in the definition of
a RST substitution. This substitution is used in the sources of all
the man pages.
- This list of common options is updated, with the addition of the new
-l|--legacy option.
- The script test_bpftool_synctypes.py is updated to compare:
- Options specific to a command, found in C files, for the
interactive help messages, with the same specific options from the
relevant man page for that command.
- Common options, checked just once: the list in main.h is
compared with the new list in substitutions.rst.
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20211115225844.33943-3-quentin@isovalent.com
2021-11-16 06:58:43 +08:00
|
|
|
*OPTIONS* := { |COMMON_OPTIONS| |
|
2021-11-10 19:46:30 +08:00
|
|
|
{ **-f** | **--bpffs** } | { **-m** | **--mapcompat** } | { **-n** | **--nomount** } |
|
|
|
|
{ **-L** | **--use-loader** } }
|
2017-10-24 00:24:16 +08:00
|
|
|
|
|
|
|
*COMMANDS* :=
|
2021-11-10 19:46:30 +08:00
|
|
|
{ **show** | **list** | **dump xlated** | **dump jited** | **pin** | **load** |
|
|
|
|
**loadall** | **help** }
|
2017-10-24 00:24:16 +08:00
|
|
|
|
2019-02-06 09:47:23 +08:00
|
|
|
PROG COMMANDS
|
2017-10-24 00:24:16 +08:00
|
|
|
=============
|
|
|
|
|
2020-05-12 00:15:34 +08:00
|
|
|
| **bpftool** **prog** { **show** | **list** } [*PROG*]
|
bpf: libbpf: bpftool: Print bpf_line_info during prog dump
This patch adds print bpf_line_info function in 'prog dump jitted'
and 'prog dump xlated':
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv
[...]
int test_long_fname_2(struct dummy_tracepoint_args * arg):
bpf_prog_44a040bf25481309_test_long_fname_2:
; static int test_long_fname_2(struct dummy_tracepoint_args *arg)
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x30,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: xor %esi,%esi
; int key = 0;
27: mov %esi,-0x4(%rbp)
; if (!arg->sock)
2a: mov 0x8(%rdi),%rdi
; if (!arg->sock)
2e: cmp $0x0,%rdi
32: je 0x0000000000000070
34: mov %rbp,%rsi
; counts = bpf_map_lookup_elem(&btf_map, &key);
37: add $0xfffffffffffffffc,%rsi
3b: movabs $0xffff8881139d7480,%rdi
45: add $0x110,%rdi
4c: mov 0x0(%rsi),%eax
4f: cmp $0x4,%rax
53: jae 0x000000000000005e
55: shl $0x3,%rax
59: add %rdi,%rax
5c: jmp 0x0000000000000060
5e: xor %eax,%eax
; if (!counts)
60: cmp $0x0,%rax
64: je 0x0000000000000070
; counts->v6++;
66: mov 0x4(%rax),%edi
69: add $0x1,%rdi
6d: mov %edi,0x4(%rax)
70: mov 0x0(%rbp),%rbx
74: mov 0x8(%rbp),%r13
78: mov 0x10(%rbp),%r14
7c: mov 0x18(%rbp),%r15
80: add $0x28,%rbp
84: leaveq
85: retq
[...]
With linum:
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv linum
int _dummy_tracepoint(struct dummy_tracepoint_args * arg):
bpf_prog_b07ccb89267cf242__dummy_tracepoint:
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:9]
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x28,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: callq 0x000000000000851e
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:2]
2a: xor %eax,%eax
2c: mov 0x0(%rbp),%rbx
30: mov 0x8(%rbp),%r13
34: mov 0x10(%rbp),%r14
38: mov 0x18(%rbp),%r15
3c: add $0x28,%rbp
40: leaveq
41: retq
[...]
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-12-08 08:42:32 +08:00
|
|
|
| **bpftool** **prog dump xlated** *PROG* [{**file** *FILE* | **opcodes** | **visual** | **linum**}]
|
|
|
|
| **bpftool** **prog dump jited** *PROG* [{**file** *FILE* | **opcodes** | **linum**}]
|
2017-10-24 00:24:15 +08:00
|
|
|
| **bpftool** **prog pin** *PROG* *FILE*
|
2022-10-14 16:31:14 +08:00
|
|
|
| **bpftool** **prog** { **load** | **loadall** } *OBJ* *PATH* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] [**pinmaps** *MAP_DIR*] [**autoattach**]
|
2018-12-05 18:28:24 +08:00
|
|
|
| **bpftool** **prog attach** *PROG* *ATTACH_TYPE* [*MAP*]
|
|
|
|
| **bpftool** **prog detach** *PROG* *ATTACH_TYPE* [*MAP*]
|
|
|
|
| **bpftool** **prog tracelog**
|
2019-07-06 01:54:33 +08:00
|
|
|
| **bpftool** **prog run** *PROG* **data_in** *FILE* [**data_out** *FILE* [**data_size_out** *L*]] [**ctx_in** *FILE* [**ctx_out** *FILE* [**ctx_size_out** *M*]]] [**repeat** *N*]
|
2020-03-10 01:32:16 +08:00
|
|
|
| **bpftool** **prog profile** *PROG* [**duration** *DURATION*] *METRICs*
|
2017-10-24 00:24:15 +08:00
|
|
|
| **bpftool** **prog help**
|
2017-10-05 11:10:05 +08:00
|
|
|
|
|
2018-07-11 05:43:07 +08:00
|
|
|
| *MAP* := { **id** *MAP_ID* | **pinned** *FILE* }
|
2019-12-14 03:10:17 +08:00
|
|
|
| *PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* | **name** *PROG_NAME* }
|
2018-07-11 05:43:00 +08:00
|
|
|
| *TYPE* := {
|
|
|
|
| **socket** | **kprobe** | **kretprobe** | **classifier** | **action** |
|
|
|
|
| **tracepoint** | **raw_tracepoint** | **xdp** | **perf_event** | **cgroup/skb** |
|
|
|
|
| **cgroup/sock** | **cgroup/dev** | **lwt_in** | **lwt_out** | **lwt_xmit** |
|
|
|
|
| **lwt_seg6local** | **sockops** | **sk_skb** | **sk_msg** | **lirc_mode2** |
|
|
|
|
| **cgroup/bind4** | **cgroup/bind6** | **cgroup/post_bind4** | **cgroup/post_bind6** |
|
2020-05-19 06:45:47 +08:00
|
|
|
| **cgroup/connect4** | **cgroup/connect6** | **cgroup/getpeername4** | **cgroup/getpeername6** |
|
|
|
|
| **cgroup/getsockname4** | **cgroup/getsockname6** | **cgroup/sendmsg4** | **cgroup/sendmsg6** |
|
2019-06-28 04:38:55 +08:00
|
|
|
| **cgroup/recvmsg4** | **cgroup/recvmsg6** | **cgroup/sysctl** |
|
2021-05-25 09:41:39 +08:00
|
|
|
| **cgroup/getsockopt** | **cgroup/setsockopt** | **cgroup/sock_release** |
|
2020-07-17 18:35:34 +08:00
|
|
|
| **struct_ops** | **fentry** | **fexit** | **freplace** | **sk_lookup**
|
2018-07-11 05:43:00 +08:00
|
|
|
| }
|
bpftool: Use libbpf_bpf_attach_type_str
This change switches bpftool over to using the recently introduced
libbpf_bpf_attach_type_str function instead of maintaining its own
string representation for the bpf_attach_type enum.
Note that contrary to other enum types, the variant names that bpftool
maps bpf_attach_type to do not adhere a simple to follow rule. With
bpf_prog_type, for example, the textual representation can easily be
inferred by stripping the BPF_PROG_TYPE_ prefix and lowercasing the
remaining string. bpf_attach_type violates this rule for various
variants.
We decided to fix up this deficiency with this change, meaning that
bpftool uses the same textual representations as libbpf. Supporting
tests, completion scripts, and man pages have been adjusted accordingly.
However, we did add support for accepting (the now undocumented)
original attach type names when they are provided by users.
For the test (test_bpftool_synctypes.py), I have removed the enum
representation checks, because we no longer mirror the various enum
variant names in bpftool source code. For the man page, help text, and
completion script checks we are now using enum definitions from
uapi/linux/bpf.h as the source of truth directly.
Signed-off-by: Daniel Müller <deso@posteo.net>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Quentin Monnet <quentin@isovalent.com>
Link: https://lore.kernel.org/bpf/20220523230428.3077108-10-deso@posteo.net
2022-05-24 07:04:25 +08:00
|
|
|
| *ATTACH_TYPE* := {
|
|
|
|
| **sk_msg_verdict** | **sk_skb_verdict** | **sk_skb_stream_verdict** |
|
|
|
|
| **sk_skb_stream_parser** | **flow_dissector**
|
2018-11-10 00:21:46 +08:00
|
|
|
| }
|
2020-05-12 00:15:34 +08:00
|
|
|
| *METRICs* := {
|
2021-07-31 05:54:35 +08:00
|
|
|
| **cycles** | **instructions** | **l1d_loads** | **llc_misses** |
|
|
|
|
| **itlb_misses** | **dtlb_misses**
|
2020-03-10 01:32:16 +08:00
|
|
|
| }
|
2018-07-11 05:43:00 +08:00
|
|
|
|
2017-10-05 11:10:05 +08:00
|
|
|
|
|
|
|
DESCRIPTION
|
|
|
|
===========
|
2018-01-03 06:48:36 +08:00
|
|
|
**bpftool prog { show | list }** [*PROG*]
|
2017-10-05 11:10:05 +08:00
|
|
|
Show information about loaded programs. If *PROG* is
|
2019-12-14 03:10:04 +08:00
|
|
|
specified show information only about given programs,
|
|
|
|
otherwise list all programs currently loaded on the system.
|
2019-12-14 03:10:17 +08:00
|
|
|
In case of **tag** or **name**, *PROG* may match several
|
|
|
|
programs which will all be shown.
|
2017-10-05 11:10:05 +08:00
|
|
|
|
|
|
|
Output will start with program ID followed by program type and
|
|
|
|
zero or more named attributes (depending on kernel version).
|
|
|
|
|
2019-04-12 21:29:38 +08:00
|
|
|
Since Linux 5.1 the kernel can collect statistics on BPF
|
|
|
|
programs (such as the total time spent running the program,
|
|
|
|
and the number of times it was run). If available, bpftool
|
|
|
|
shows such statistics. However, the kernel does not collect
|
|
|
|
them by defaults, as it slightly impacts performance on each
|
|
|
|
program run. Activation or deactivation of the feature is
|
|
|
|
performed via the **kernel.bpf_stats_enabled** sysctl knob.
|
|
|
|
|
2020-06-20 07:17:03 +08:00
|
|
|
Since Linux 5.8 bpftool is able to discover information about
|
|
|
|
processes that hold open file descriptors (FDs) against BPF
|
|
|
|
programs. On such kernels bpftool will automatically emit this
|
|
|
|
information as well.
|
|
|
|
|
bpf: libbpf: bpftool: Print bpf_line_info during prog dump
This patch adds print bpf_line_info function in 'prog dump jitted'
and 'prog dump xlated':
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv
[...]
int test_long_fname_2(struct dummy_tracepoint_args * arg):
bpf_prog_44a040bf25481309_test_long_fname_2:
; static int test_long_fname_2(struct dummy_tracepoint_args *arg)
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x30,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: xor %esi,%esi
; int key = 0;
27: mov %esi,-0x4(%rbp)
; if (!arg->sock)
2a: mov 0x8(%rdi),%rdi
; if (!arg->sock)
2e: cmp $0x0,%rdi
32: je 0x0000000000000070
34: mov %rbp,%rsi
; counts = bpf_map_lookup_elem(&btf_map, &key);
37: add $0xfffffffffffffffc,%rsi
3b: movabs $0xffff8881139d7480,%rdi
45: add $0x110,%rdi
4c: mov 0x0(%rsi),%eax
4f: cmp $0x4,%rax
53: jae 0x000000000000005e
55: shl $0x3,%rax
59: add %rdi,%rax
5c: jmp 0x0000000000000060
5e: xor %eax,%eax
; if (!counts)
60: cmp $0x0,%rax
64: je 0x0000000000000070
; counts->v6++;
66: mov 0x4(%rax),%edi
69: add $0x1,%rdi
6d: mov %edi,0x4(%rax)
70: mov 0x0(%rbp),%rbx
74: mov 0x8(%rbp),%r13
78: mov 0x10(%rbp),%r14
7c: mov 0x18(%rbp),%r15
80: add $0x28,%rbp
84: leaveq
85: retq
[...]
With linum:
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv linum
int _dummy_tracepoint(struct dummy_tracepoint_args * arg):
bpf_prog_b07ccb89267cf242__dummy_tracepoint:
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:9]
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x28,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: callq 0x000000000000851e
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:2]
2a: xor %eax,%eax
2c: mov 0x0(%rbp),%rbx
30: mov 0x8(%rbp),%r13
34: mov 0x10(%rbp),%r14
38: mov 0x18(%rbp),%r15
3c: add $0x28,%rbp
40: leaveq
41: retq
[...]
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-12-08 08:42:32 +08:00
|
|
|
**bpftool prog dump xlated** *PROG* [{ **file** *FILE* | **opcodes** | **visual** | **linum** }]
|
2019-12-14 03:10:04 +08:00
|
|
|
Dump eBPF instructions of the programs from the kernel. By
|
2018-03-02 10:01:22 +08:00
|
|
|
default, eBPF will be disassembled and printed to standard
|
|
|
|
output in human-readable format. In this case, **opcodes**
|
|
|
|
controls if raw opcodes should be printed as well.
|
2017-10-10 01:30:13 +08:00
|
|
|
|
2019-12-14 03:10:17 +08:00
|
|
|
In case of **tag** or **name**, *PROG* may match several
|
|
|
|
programs which will all be dumped. However, if **file** or
|
|
|
|
**visual** is specified, *PROG* must match a single program.
|
2019-12-14 03:10:04 +08:00
|
|
|
|
2018-03-02 10:01:22 +08:00
|
|
|
If **file** is specified, the binary image will instead be
|
|
|
|
written to *FILE*.
|
|
|
|
|
|
|
|
If **visual** is specified, control flow graph (CFG) will be
|
|
|
|
built instead, and eBPF instructions will be presented with
|
|
|
|
CFG in DOT format, on standard output.
|
2017-10-05 11:10:05 +08:00
|
|
|
|
2019-12-14 03:10:04 +08:00
|
|
|
If the programs have line_info available, the source line will
|
bpf: libbpf: bpftool: Print bpf_line_info during prog dump
This patch adds print bpf_line_info function in 'prog dump jitted'
and 'prog dump xlated':
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv
[...]
int test_long_fname_2(struct dummy_tracepoint_args * arg):
bpf_prog_44a040bf25481309_test_long_fname_2:
; static int test_long_fname_2(struct dummy_tracepoint_args *arg)
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x30,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: xor %esi,%esi
; int key = 0;
27: mov %esi,-0x4(%rbp)
; if (!arg->sock)
2a: mov 0x8(%rdi),%rdi
; if (!arg->sock)
2e: cmp $0x0,%rdi
32: je 0x0000000000000070
34: mov %rbp,%rsi
; counts = bpf_map_lookup_elem(&btf_map, &key);
37: add $0xfffffffffffffffc,%rsi
3b: movabs $0xffff8881139d7480,%rdi
45: add $0x110,%rdi
4c: mov 0x0(%rsi),%eax
4f: cmp $0x4,%rax
53: jae 0x000000000000005e
55: shl $0x3,%rax
59: add %rdi,%rax
5c: jmp 0x0000000000000060
5e: xor %eax,%eax
; if (!counts)
60: cmp $0x0,%rax
64: je 0x0000000000000070
; counts->v6++;
66: mov 0x4(%rax),%edi
69: add $0x1,%rdi
6d: mov %edi,0x4(%rax)
70: mov 0x0(%rbp),%rbx
74: mov 0x8(%rbp),%r13
78: mov 0x10(%rbp),%r14
7c: mov 0x18(%rbp),%r15
80: add $0x28,%rbp
84: leaveq
85: retq
[...]
With linum:
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv linum
int _dummy_tracepoint(struct dummy_tracepoint_args * arg):
bpf_prog_b07ccb89267cf242__dummy_tracepoint:
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:9]
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x28,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: callq 0x000000000000851e
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:2]
2a: xor %eax,%eax
2c: mov 0x0(%rbp),%rbx
30: mov 0x8(%rbp),%r13
34: mov 0x10(%rbp),%r14
38: mov 0x18(%rbp),%r15
3c: add $0x28,%rbp
40: leaveq
41: retq
[...]
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-12-08 08:42:32 +08:00
|
|
|
be displayed by default. If **linum** is specified,
|
|
|
|
the filename, line number and line column will also be
|
|
|
|
displayed on top of the source line.
|
2018-12-11 02:53:24 +08:00
|
|
|
|
bpf: libbpf: bpftool: Print bpf_line_info during prog dump
This patch adds print bpf_line_info function in 'prog dump jitted'
and 'prog dump xlated':
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv
[...]
int test_long_fname_2(struct dummy_tracepoint_args * arg):
bpf_prog_44a040bf25481309_test_long_fname_2:
; static int test_long_fname_2(struct dummy_tracepoint_args *arg)
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x30,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: xor %esi,%esi
; int key = 0;
27: mov %esi,-0x4(%rbp)
; if (!arg->sock)
2a: mov 0x8(%rdi),%rdi
; if (!arg->sock)
2e: cmp $0x0,%rdi
32: je 0x0000000000000070
34: mov %rbp,%rsi
; counts = bpf_map_lookup_elem(&btf_map, &key);
37: add $0xfffffffffffffffc,%rsi
3b: movabs $0xffff8881139d7480,%rdi
45: add $0x110,%rdi
4c: mov 0x0(%rsi),%eax
4f: cmp $0x4,%rax
53: jae 0x000000000000005e
55: shl $0x3,%rax
59: add %rdi,%rax
5c: jmp 0x0000000000000060
5e: xor %eax,%eax
; if (!counts)
60: cmp $0x0,%rax
64: je 0x0000000000000070
; counts->v6++;
66: mov 0x4(%rax),%edi
69: add $0x1,%rdi
6d: mov %edi,0x4(%rax)
70: mov 0x0(%rbp),%rbx
74: mov 0x8(%rbp),%r13
78: mov 0x10(%rbp),%r14
7c: mov 0x18(%rbp),%r15
80: add $0x28,%rbp
84: leaveq
85: retq
[...]
With linum:
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv linum
int _dummy_tracepoint(struct dummy_tracepoint_args * arg):
bpf_prog_b07ccb89267cf242__dummy_tracepoint:
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:9]
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x28,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: callq 0x000000000000851e
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:2]
2a: xor %eax,%eax
2c: mov 0x0(%rbp),%rbx
30: mov 0x8(%rbp),%r13
34: mov 0x10(%rbp),%r14
38: mov 0x18(%rbp),%r15
3c: add $0x28,%rbp
40: leaveq
41: retq
[...]
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-12-08 08:42:32 +08:00
|
|
|
**bpftool prog dump jited** *PROG* [{ **file** *FILE* | **opcodes** | **linum** }]
|
2017-10-05 11:10:05 +08:00
|
|
|
Dump jited image (host machine code) of the program.
|
2019-12-14 03:10:04 +08:00
|
|
|
|
2017-10-05 11:10:05 +08:00
|
|
|
If *FILE* is specified image will be written to a file,
|
|
|
|
otherwise it will be disassembled and printed to stdout.
|
2019-12-14 03:10:04 +08:00
|
|
|
*PROG* must match a single program when **file** is specified.
|
2017-10-05 11:10:05 +08:00
|
|
|
|
|
|
|
**opcodes** controls if raw opcodes will be printed.
|
|
|
|
|
bpf: libbpf: bpftool: Print bpf_line_info during prog dump
This patch adds print bpf_line_info function in 'prog dump jitted'
and 'prog dump xlated':
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv
[...]
int test_long_fname_2(struct dummy_tracepoint_args * arg):
bpf_prog_44a040bf25481309_test_long_fname_2:
; static int test_long_fname_2(struct dummy_tracepoint_args *arg)
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x30,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: xor %esi,%esi
; int key = 0;
27: mov %esi,-0x4(%rbp)
; if (!arg->sock)
2a: mov 0x8(%rdi),%rdi
; if (!arg->sock)
2e: cmp $0x0,%rdi
32: je 0x0000000000000070
34: mov %rbp,%rsi
; counts = bpf_map_lookup_elem(&btf_map, &key);
37: add $0xfffffffffffffffc,%rsi
3b: movabs $0xffff8881139d7480,%rdi
45: add $0x110,%rdi
4c: mov 0x0(%rsi),%eax
4f: cmp $0x4,%rax
53: jae 0x000000000000005e
55: shl $0x3,%rax
59: add %rdi,%rax
5c: jmp 0x0000000000000060
5e: xor %eax,%eax
; if (!counts)
60: cmp $0x0,%rax
64: je 0x0000000000000070
; counts->v6++;
66: mov 0x4(%rax),%edi
69: add $0x1,%rdi
6d: mov %edi,0x4(%rax)
70: mov 0x0(%rbp),%rbx
74: mov 0x8(%rbp),%r13
78: mov 0x10(%rbp),%r14
7c: mov 0x18(%rbp),%r15
80: add $0x28,%rbp
84: leaveq
85: retq
[...]
With linum:
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv linum
int _dummy_tracepoint(struct dummy_tracepoint_args * arg):
bpf_prog_b07ccb89267cf242__dummy_tracepoint:
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:9]
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x28,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: callq 0x000000000000851e
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:2]
2a: xor %eax,%eax
2c: mov 0x0(%rbp),%rbx
30: mov 0x8(%rbp),%r13
34: mov 0x10(%rbp),%r14
38: mov 0x18(%rbp),%r15
3c: add $0x28,%rbp
40: leaveq
41: retq
[...]
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-12-08 08:42:32 +08:00
|
|
|
If the prog has line_info available, the source line will
|
|
|
|
be displayed by default. If **linum** is specified,
|
|
|
|
the filename, line number and line column will also be
|
|
|
|
displayed on top of the source line.
|
2018-12-11 02:53:24 +08:00
|
|
|
|
2017-10-05 11:10:05 +08:00
|
|
|
**bpftool prog pin** *PROG* *FILE*
|
|
|
|
Pin program *PROG* as *FILE*.
|
|
|
|
|
2018-10-21 06:01:48 +08:00
|
|
|
Note: *FILE* must be located in *bpffs* mount. It must not
|
|
|
|
contain a dot character ('.'), which is reserved for future
|
|
|
|
extensions of *bpffs*.
|
2017-10-05 11:10:05 +08:00
|
|
|
|
2022-10-14 16:31:14 +08:00
|
|
|
**bpftool prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] [**pinmaps** *MAP_DIR*] [**autoattach**]
|
2018-11-10 00:21:44 +08:00
|
|
|
Load bpf program(s) from binary *OBJ* and pin as *PATH*.
|
|
|
|
**bpftool prog load** pins only the first program from the
|
|
|
|
*OBJ* as *PATH*. **bpftool prog loadall** pins all programs
|
|
|
|
from the *OBJ* under *PATH* directory.
|
2018-07-11 05:43:00 +08:00
|
|
|
**type** is optional, if not specified program type will be
|
|
|
|
inferred from section names.
|
2018-07-11 05:43:07 +08:00
|
|
|
By default bpftool will create new maps as declared in the ELF
|
|
|
|
object being loaded. **map** parameter allows for the reuse
|
|
|
|
of existing maps. It can be specified multiple times, each
|
|
|
|
time for a different map. *IDX* refers to index of the map
|
|
|
|
to be replaced in the ELF file counting from 0, while *NAME*
|
|
|
|
allows to replace a map by name. *MAP* specifies the map to
|
|
|
|
use, referring to it by **id** or through a **pinned** file.
|
2018-07-11 05:42:58 +08:00
|
|
|
If **dev** *NAME* is specified program will be loaded onto
|
|
|
|
given networking device (offload).
|
2018-11-10 00:21:45 +08:00
|
|
|
Optional **pinmaps** argument can be provided to pin all
|
|
|
|
maps under *MAP_DIR* directory.
|
2017-12-13 23:18:53 +08:00
|
|
|
|
2022-10-14 16:31:14 +08:00
|
|
|
If **autoattach** is specified program will be attached
|
|
|
|
before pin. In that case, only the link (representing the
|
|
|
|
program attached to its hook) is pinned, not the program as
|
|
|
|
such, so the path won't show in **bpftool prog show -f**,
|
|
|
|
only show in **bpftool link show -f**. Also, this only works
|
|
|
|
when bpftool (libbpf) is able to infer all necessary
|
|
|
|
information from the object file, in particular, it's not
|
|
|
|
supported for all program types. If a program does not
|
|
|
|
support autoattach, bpftool falls back to regular pinning
|
|
|
|
for that program instead.
|
|
|
|
|
2018-11-10 00:21:44 +08:00
|
|
|
Note: *PATH* must be located in *bpffs* mount. It must not
|
2018-10-21 06:01:48 +08:00
|
|
|
contain a dot character ('.'), which is reserved for future
|
|
|
|
extensions of *bpffs*.
|
2017-12-13 23:18:53 +08:00
|
|
|
|
2018-11-10 00:21:46 +08:00
|
|
|
**bpftool prog attach** *PROG* *ATTACH_TYPE* [*MAP*]
|
|
|
|
Attach bpf program *PROG* (with type specified by
|
|
|
|
*ATTACH_TYPE*). Most *ATTACH_TYPEs* require a *MAP*
|
|
|
|
parameter, with the exception of *flow_dissector* which is
|
|
|
|
attached to current networking name space.
|
|
|
|
|
|
|
|
**bpftool prog detach** *PROG* *ATTACH_TYPE* [*MAP*]
|
|
|
|
Detach bpf program *PROG* (with type specified by
|
|
|
|
*ATTACH_TYPE*). Most *ATTACH_TYPEs* require a *MAP*
|
|
|
|
parameter, with the exception of *flow_dissector* which is
|
|
|
|
detached from the current networking name space.
|
2018-10-16 02:19:50 +08:00
|
|
|
|
2018-12-05 18:28:24 +08:00
|
|
|
**bpftool prog tracelog**
|
|
|
|
Dump the trace pipe of the system to the console (stdout).
|
|
|
|
Hit <Ctrl+C> to stop printing. BPF programs can write to this
|
2020-05-12 00:15:34 +08:00
|
|
|
trace pipe at runtime with the **bpf_trace_printk**\ () helper.
|
2018-12-05 18:28:24 +08:00
|
|
|
This should be used only for debugging purposes. For
|
|
|
|
streaming data from BPF programs to user space, one can use
|
|
|
|
perf events (see also **bpftool-map**\ (8)).
|
|
|
|
|
2019-07-06 01:54:33 +08:00
|
|
|
**bpftool prog run** *PROG* **data_in** *FILE* [**data_out** *FILE* [**data_size_out** *L*]] [**ctx_in** *FILE* [**ctx_out** *FILE* [**ctx_size_out** *M*]]] [**repeat** *N*]
|
|
|
|
Run BPF program *PROG* in the kernel testing infrastructure
|
|
|
|
for BPF, meaning that the program works on the data and
|
|
|
|
context provided by the user, and not on actual packets or
|
|
|
|
monitored functions etc. Return value and duration for the
|
|
|
|
test run are printed out to the console.
|
|
|
|
|
|
|
|
Input data is read from the *FILE* passed with **data_in**.
|
|
|
|
If this *FILE* is "**-**", input data is read from standard
|
|
|
|
input. Input context, if any, is read from *FILE* passed with
|
|
|
|
**ctx_in**. Again, "**-**" can be used to read from standard
|
|
|
|
input, but only if standard input is not already in use for
|
|
|
|
input data. If a *FILE* is passed with **data_out**, output
|
|
|
|
data is written to that file. Similarly, output context is
|
|
|
|
written to the *FILE* passed with **ctx_out**. For both
|
|
|
|
output flows, "**-**" can be used to print to the standard
|
|
|
|
output (as plain text, or JSON if relevant option was
|
|
|
|
passed). If output keywords are omitted, output data and
|
|
|
|
context are discarded. Keywords **data_size_out** and
|
|
|
|
**ctx_size_out** are used to pass the size (in bytes) for the
|
|
|
|
output buffers to the kernel, although the default of 32 kB
|
|
|
|
should be more than enough for most cases.
|
|
|
|
|
|
|
|
Keyword **repeat** is used to indicate the number of
|
|
|
|
consecutive runs to perform. Note that output data and
|
|
|
|
context printed to files correspond to the last of those
|
|
|
|
runs. The duration printed out at the end of the runs is an
|
|
|
|
average over all runs performed by the command.
|
|
|
|
|
|
|
|
Not all program types support test run. Among those which do,
|
|
|
|
not all of them can take the **ctx_in**/**ctx_out**
|
|
|
|
arguments. bpftool does not perform checks on program types.
|
|
|
|
|
2020-03-10 01:32:16 +08:00
|
|
|
**bpftool prog profile** *PROG* [**duration** *DURATION*] *METRICs*
|
|
|
|
Profile *METRICs* for bpf program *PROG* for *DURATION*
|
2020-05-12 00:15:34 +08:00
|
|
|
seconds or until user hits <Ctrl+C>. *DURATION* is optional.
|
2020-03-10 01:32:16 +08:00
|
|
|
If *DURATION* is not specified, the profiling will run up to
|
2020-05-12 00:15:34 +08:00
|
|
|
**UINT_MAX** seconds.
|
2020-03-10 01:32:16 +08:00
|
|
|
|
2017-10-05 11:10:05 +08:00
|
|
|
**bpftool prog help**
|
|
|
|
Print short help message.
|
|
|
|
|
2017-10-24 00:24:06 +08:00
|
|
|
OPTIONS
|
|
|
|
=======
|
2020-09-10 00:24:59 +08:00
|
|
|
.. include:: common_options.rst
|
2017-10-24 00:24:16 +08:00
|
|
|
|
2017-11-08 12:55:49 +08:00
|
|
|
-f, --bpffs
|
2018-11-08 19:52:26 +08:00
|
|
|
When showing BPF programs, show file names of pinned
|
|
|
|
programs.
|
2017-11-08 12:55:49 +08:00
|
|
|
|
2018-12-14 21:55:57 +08:00
|
|
|
-m, --mapcompat
|
|
|
|
Allow loading maps with unknown map definitions.
|
|
|
|
|
2018-12-18 18:13:19 +08:00
|
|
|
-n, --nomount
|
|
|
|
Do not automatically attempt to mount any virtual file system
|
|
|
|
(such as tracefs or BPF virtual file system) when necessary.
|
|
|
|
|
2021-07-31 05:54:34 +08:00
|
|
|
-L, --use-loader
|
|
|
|
Load program as a "loader" program. This is useful to debug
|
|
|
|
the generation of such programs. When this option is in
|
|
|
|
use, bpftool attempts to load the programs from the object
|
|
|
|
file into the kernel, but does not pin them (therefore, the
|
|
|
|
*PATH* must not be provided).
|
|
|
|
|
|
|
|
When combined with the **-d**\ \|\ **--debug** option,
|
|
|
|
additional debug messages are generated, and the execution
|
|
|
|
of the loader program will use the **bpf_trace_printk**\ ()
|
|
|
|
helper to log each step of loading BTF, creating the maps,
|
|
|
|
and loading the programs (see **bpftool prog tracelog** as
|
|
|
|
a way to dump those messages).
|
|
|
|
|
2017-10-05 11:10:05 +08:00
|
|
|
EXAMPLES
|
|
|
|
========
|
|
|
|
**# bpftool prog show**
|
2018-12-14 21:55:58 +08:00
|
|
|
|
2017-10-05 11:10:05 +08:00
|
|
|
::
|
|
|
|
|
tools/bpftool: recognize bpf_prog_info run_time_ns and run_cnt
$ bpftool p s
1: kprobe tag a56587d488d216c9 gpl run_time_ns 79786 run_cnt 8
loaded_at 2019-02-22T12:22:51-0800 uid 0
xlated 352B not jited memlock 4096B
$ bpftool --json --pretty p s
[{
"id": 1,
"type": "kprobe",
"tag": "a56587d488d216c9",
"gpl_compatible": true,
"run_time_ns": 79786,
"run_cnt": 8,
"loaded_at": 1550866971,
"uid": 0,
"bytes_xlated": 352,
"jited": false,
"bytes_memlock": 4096
}
]
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-02-26 06:28:42 +08:00
|
|
|
10: xdp name some_prog tag 005a3d2123620c8b gpl run_time_ns 81632 run_cnt 10
|
2018-12-14 21:55:58 +08:00
|
|
|
loaded_at 2017-09-29T20:11:00+0000 uid 0
|
|
|
|
xlated 528B jited 370B memlock 4096B map_ids 10
|
2020-06-20 07:17:03 +08:00
|
|
|
pids systemd(1)
|
2017-10-05 11:10:05 +08:00
|
|
|
|
2017-10-24 00:24:16 +08:00
|
|
|
**# bpftool --json --pretty prog show**
|
|
|
|
|
|
|
|
::
|
|
|
|
|
2018-12-14 21:55:58 +08:00
|
|
|
[{
|
|
|
|
"id": 10,
|
|
|
|
"type": "xdp",
|
|
|
|
"tag": "005a3d2123620c8b",
|
|
|
|
"gpl_compatible": true,
|
tools/bpftool: recognize bpf_prog_info run_time_ns and run_cnt
$ bpftool p s
1: kprobe tag a56587d488d216c9 gpl run_time_ns 79786 run_cnt 8
loaded_at 2019-02-22T12:22:51-0800 uid 0
xlated 352B not jited memlock 4096B
$ bpftool --json --pretty p s
[{
"id": 1,
"type": "kprobe",
"tag": "a56587d488d216c9",
"gpl_compatible": true,
"run_time_ns": 79786,
"run_cnt": 8,
"loaded_at": 1550866971,
"uid": 0,
"bytes_xlated": 352,
"jited": false,
"bytes_memlock": 4096
}
]
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-02-26 06:28:42 +08:00
|
|
|
"run_time_ns": 81632,
|
|
|
|
"run_cnt": 10,
|
2018-12-14 21:55:58 +08:00
|
|
|
"loaded_at": 1506715860,
|
|
|
|
"uid": 0,
|
|
|
|
"bytes_xlated": 528,
|
|
|
|
"jited": true,
|
|
|
|
"bytes_jited": 370,
|
|
|
|
"bytes_memlock": 4096,
|
|
|
|
"map_ids": [10
|
2020-06-20 07:17:03 +08:00
|
|
|
],
|
|
|
|
"pids": [{
|
|
|
|
"pid": 1,
|
|
|
|
"comm": "systemd"
|
|
|
|
}
|
2018-12-14 21:55:58 +08:00
|
|
|
]
|
|
|
|
}
|
|
|
|
]
|
2017-10-24 00:24:16 +08:00
|
|
|
|
2017-10-05 11:10:05 +08:00
|
|
|
|
|
|
|
|
| **# bpftool prog dump xlated id 10 file /tmp/t**
|
2020-05-12 00:15:34 +08:00
|
|
|
| **$ ls -l /tmp/t**
|
2017-10-05 11:10:05 +08:00
|
|
|
|
2018-12-14 21:55:58 +08:00
|
|
|
::
|
|
|
|
|
|
|
|
-rw------- 1 root root 560 Jul 22 01:42 /tmp/t
|
|
|
|
|
|
|
|
**# bpftool prog dump jited tag 005a3d2123620c8b**
|
2017-10-05 11:10:05 +08:00
|
|
|
|
|
|
|
::
|
|
|
|
|
2018-12-14 21:55:58 +08:00
|
|
|
0: push %rbp
|
|
|
|
1: mov %rsp,%rbp
|
|
|
|
2: sub $0x228,%rsp
|
|
|
|
3: sub $0x28,%rbp
|
|
|
|
4: mov %rbx,0x0(%rbp)
|
2017-10-05 11:10:05 +08:00
|
|
|
|
2017-10-24 00:24:16 +08:00
|
|
|
|
|
|
|
|
| **# mount -t bpf none /sys/fs/bpf/**
|
|
|
|
| **# bpftool prog pin id 10 /sys/fs/bpf/prog**
|
2017-12-13 23:18:53 +08:00
|
|
|
| **# bpftool prog load ./my_prog.o /sys/fs/bpf/prog2**
|
2017-10-24 00:24:16 +08:00
|
|
|
| **# ls -l /sys/fs/bpf/**
|
|
|
|
|
2018-12-14 21:55:58 +08:00
|
|
|
::
|
|
|
|
|
|
|
|
-rw------- 1 root root 0 Jul 22 01:43 prog
|
|
|
|
-rw------- 1 root root 0 Jul 22 01:44 prog2
|
|
|
|
|
|
|
|
**# bpftool prog dump jited pinned /sys/fs/bpf/prog opcodes**
|
2017-10-24 00:24:16 +08:00
|
|
|
|
|
|
|
::
|
|
|
|
|
2018-12-14 21:55:58 +08:00
|
|
|
0: push %rbp
|
|
|
|
55
|
|
|
|
1: mov %rsp,%rbp
|
|
|
|
48 89 e5
|
|
|
|
4: sub $0x228,%rsp
|
|
|
|
48 81 ec 28 02 00 00
|
|
|
|
b: sub $0x28,%rbp
|
|
|
|
48 83 ed 28
|
|
|
|
f: mov %rbx,0x0(%rbp)
|
|
|
|
48 89 5d 00
|
2017-10-05 11:10:05 +08:00
|
|
|
|
2018-07-11 05:43:07 +08:00
|
|
|
|
|
|
|
|
| **# bpftool prog load xdp1_kern.o /sys/fs/bpf/xdp1 type xdp map name rxcnt id 7**
|
|
|
|
| **# bpftool prog show pinned /sys/fs/bpf/xdp1**
|
2018-12-14 21:55:58 +08:00
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
9: xdp name xdp_prog1 tag 539ec6ce11b52f98 gpl
|
|
|
|
loaded_at 2018-06-25T16:17:31-0700 uid 0
|
|
|
|
xlated 488B jited 336B memlock 4096B map_ids 7
|
|
|
|
|
|
|
|
**# rm /sys/fs/bpf/xdp1**
|
2017-10-05 11:10:05 +08:00
|
|
|
|
2020-03-10 01:32:16 +08:00
|
|
|
|
|
|
|
|
| **# bpftool prog profile id 337 duration 10 cycles instructions llc_misses**
|
|
|
|
|
|
|
|
::
|
2020-05-12 00:15:34 +08:00
|
|
|
|
2020-03-10 01:32:16 +08:00
|
|
|
51397 run_cnt
|
|
|
|
40176203 cycles (83.05%)
|
|
|
|
42518139 instructions # 1.06 insns per cycle (83.39%)
|
|
|
|
123 llc_misses # 2.89 LLC misses per million insns (83.15%)
|
2021-07-31 05:54:34 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
| Output below is for the trace logs.
|
|
|
|
| Run in separate terminals:
|
|
|
|
| **# bpftool prog tracelog**
|
|
|
|
| **# bpftool prog load -L -d file.o**
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
bpftool-620059 [004] d... 2634685.517903: bpf_trace_printk: btf_load size 665 r=5
|
|
|
|
bpftool-620059 [004] d... 2634685.517912: bpf_trace_printk: map_create sample_map idx 0 type 2 value_size 4 value_btf_id 0 r=6
|
|
|
|
bpftool-620059 [004] d... 2634685.517997: bpf_trace_printk: prog_load sample insn_cnt 13 r=7
|
|
|
|
bpftool-620059 [004] d... 2634685.517999: bpf_trace_printk: close(5) = 0
|