2017-10-05 11:10:04 +08:00
|
|
|
/*
|
2018-06-29 05:41:40 +08:00
|
|
|
* Copyright (C) 2017-2018 Netronome Systems, Inc.
|
2017-10-05 11:10:04 +08:00
|
|
|
*
|
|
|
|
* This software is dual licensed under the GNU General License Version 2,
|
|
|
|
* June 1991 as shown in the file COPYING in the top-level directory of this
|
|
|
|
* source tree or the BSD 2-Clause License provided below. You have the
|
|
|
|
* option to license this software under the complete terms of either license.
|
|
|
|
*
|
|
|
|
* The BSD 2-Clause License:
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or
|
|
|
|
* without modification, are permitted provided that the following
|
|
|
|
* conditions are met:
|
|
|
|
*
|
|
|
|
* 1. Redistributions of source code must retain the above
|
|
|
|
* copyright notice, this list of conditions and the following
|
|
|
|
* disclaimer.
|
|
|
|
*
|
|
|
|
* 2. Redistributions in binary form must reproduce the above
|
|
|
|
* copyright notice, this list of conditions and the following
|
|
|
|
* disclaimer in the documentation and/or other materials
|
|
|
|
* provided with the distribution.
|
|
|
|
*
|
|
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
|
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
|
|
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
|
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
|
|
|
|
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
|
|
|
|
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
|
|
|
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
|
|
* SOFTWARE.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <errno.h>
|
|
|
|
#include <fcntl.h>
|
2017-10-10 01:30:13 +08:00
|
|
|
#include <stdarg.h>
|
2017-10-05 11:10:04 +08:00
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <string.h>
|
|
|
|
#include <time.h>
|
|
|
|
#include <unistd.h>
|
|
|
|
#include <sys/types.h>
|
|
|
|
#include <sys/stat.h>
|
|
|
|
|
|
|
|
#include <bpf.h>
|
2017-12-13 23:18:53 +08:00
|
|
|
#include <libbpf.h>
|
2017-10-05 11:10:04 +08:00
|
|
|
|
2018-03-02 10:01:22 +08:00
|
|
|
#include "cfg.h"
|
2017-10-05 11:10:04 +08:00
|
|
|
#include "main.h"
|
2018-03-02 10:01:17 +08:00
|
|
|
#include "xlated_dumper.h"
|
2017-10-05 11:10:04 +08:00
|
|
|
|
|
|
|
static const char * const prog_type_name[] = {
|
|
|
|
[BPF_PROG_TYPE_UNSPEC] = "unspec",
|
|
|
|
[BPF_PROG_TYPE_SOCKET_FILTER] = "socket_filter",
|
|
|
|
[BPF_PROG_TYPE_KPROBE] = "kprobe",
|
|
|
|
[BPF_PROG_TYPE_SCHED_CLS] = "sched_cls",
|
|
|
|
[BPF_PROG_TYPE_SCHED_ACT] = "sched_act",
|
|
|
|
[BPF_PROG_TYPE_TRACEPOINT] = "tracepoint",
|
|
|
|
[BPF_PROG_TYPE_XDP] = "xdp",
|
|
|
|
[BPF_PROG_TYPE_PERF_EVENT] = "perf_event",
|
|
|
|
[BPF_PROG_TYPE_CGROUP_SKB] = "cgroup_skb",
|
|
|
|
[BPF_PROG_TYPE_CGROUP_SOCK] = "cgroup_sock",
|
|
|
|
[BPF_PROG_TYPE_LWT_IN] = "lwt_in",
|
|
|
|
[BPF_PROG_TYPE_LWT_OUT] = "lwt_out",
|
|
|
|
[BPF_PROG_TYPE_LWT_XMIT] = "lwt_xmit",
|
|
|
|
[BPF_PROG_TYPE_SOCK_OPS] = "sock_ops",
|
|
|
|
[BPF_PROG_TYPE_SK_SKB] = "sk_skb",
|
2018-01-16 03:16:15 +08:00
|
|
|
[BPF_PROG_TYPE_CGROUP_DEVICE] = "cgroup_device",
|
2018-04-18 01:28:44 +08:00
|
|
|
[BPF_PROG_TYPE_SK_MSG] = "sk_msg",
|
|
|
|
[BPF_PROG_TYPE_RAW_TRACEPOINT] = "raw_tracepoint",
|
|
|
|
[BPF_PROG_TYPE_CGROUP_SOCK_ADDR] = "cgroup_sock_addr",
|
2018-05-27 19:24:10 +08:00
|
|
|
[BPF_PROG_TYPE_LIRC_MODE2] = "lirc_mode2",
|
2017-10-05 11:10:04 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
static void print_boot_time(__u64 nsecs, char *buf, unsigned int size)
|
|
|
|
{
|
|
|
|
struct timespec real_time_ts, boot_time_ts;
|
|
|
|
time_t wallclock_secs;
|
|
|
|
struct tm load_tm;
|
|
|
|
|
|
|
|
buf[--size] = '\0';
|
|
|
|
|
|
|
|
if (clock_gettime(CLOCK_REALTIME, &real_time_ts) ||
|
|
|
|
clock_gettime(CLOCK_BOOTTIME, &boot_time_ts)) {
|
|
|
|
perror("Can't read clocks");
|
|
|
|
snprintf(buf, size, "%llu", nsecs / 1000000000);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
wallclock_secs = (real_time_ts.tv_sec - boot_time_ts.tv_sec) +
|
2018-06-15 02:06:55 +08:00
|
|
|
(real_time_ts.tv_nsec - boot_time_ts.tv_nsec + nsecs) /
|
|
|
|
1000000000;
|
|
|
|
|
2017-10-05 11:10:04 +08:00
|
|
|
|
|
|
|
if (!localtime_r(&wallclock_secs, &load_tm)) {
|
|
|
|
snprintf(buf, size, "%llu", nsecs / 1000000000);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
tools: bpftool: change time format for program 'loaded at:' information
To make eBPF program load time easier to parse from "bpftool prog"
output for machines, change the time format used by the program. The
format now differs for plain and JSON version:
- Plain version uses a string formatted according to ISO 8601.
- JSON uses the number of seconds since the Epoch, wich is less friendly
for humans but even easier to process.
Example output:
# ./bpftool prog
41298: xdp tag a04f5eef06a7f555 dev foo
loaded_at 2018-04-18T17:19:47+0100 uid 0
xlated 16B not jited memlock 4096B
# ./bpftool prog -p
[{
"id": 41298,
"type": "xdp",
"tag": "a04f5eef06a7f555",
"gpl_compatible": false,
"dev": {
"ifindex": 14,
"ns_dev": 3,
"ns_inode": 4026531993,
"ifname": "foo"
},
"loaded_at": 1524068387,
"uid": 0,
"bytes_xlated": 16,
"jited": false,
"bytes_memlock": 4096
}
]
Previously, "Apr 18/17:19" would be used at both places.
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Quentin Monnet <quentin.monnet@netronome.com>
Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-05-02 04:18:38 +08:00
|
|
|
if (json_output)
|
|
|
|
strftime(buf, size, "%s", &load_tm);
|
|
|
|
else
|
|
|
|
strftime(buf, size, "%FT%T%z", &load_tm);
|
2017-10-05 11:10:04 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static int prog_fd_by_tag(unsigned char *tag)
|
|
|
|
{
|
|
|
|
struct bpf_prog_info info = {};
|
|
|
|
__u32 len = sizeof(info);
|
|
|
|
unsigned int id = 0;
|
|
|
|
int err;
|
|
|
|
int fd;
|
|
|
|
|
|
|
|
while (true) {
|
|
|
|
err = bpf_prog_get_next_id(id, &id);
|
|
|
|
if (err) {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("%s", strerror(errno));
|
2017-10-05 11:10:04 +08:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
fd = bpf_prog_get_fd_by_id(id);
|
|
|
|
if (fd < 0) {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("can't get prog by id (%u): %s",
|
|
|
|
id, strerror(errno));
|
2017-10-05 11:10:04 +08:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
err = bpf_obj_get_info_by_fd(fd, &info, &len);
|
|
|
|
if (err) {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("can't get prog info (%u): %s",
|
|
|
|
id, strerror(errno));
|
2017-10-05 11:10:04 +08:00
|
|
|
close(fd);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!memcmp(tag, info.tag, BPF_TAG_SIZE))
|
|
|
|
return fd;
|
|
|
|
|
|
|
|
close(fd);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
int prog_parse_fd(int *argc, char ***argv)
|
|
|
|
{
|
|
|
|
int fd;
|
|
|
|
|
|
|
|
if (is_prefix(**argv, "id")) {
|
|
|
|
unsigned int id;
|
|
|
|
char *endptr;
|
|
|
|
|
|
|
|
NEXT_ARGP();
|
|
|
|
|
|
|
|
id = strtoul(**argv, &endptr, 0);
|
|
|
|
if (*endptr) {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("can't parse %s as ID", **argv);
|
2017-10-05 11:10:04 +08:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
NEXT_ARGP();
|
|
|
|
|
|
|
|
fd = bpf_prog_get_fd_by_id(id);
|
|
|
|
if (fd < 0)
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("get by id (%u): %s", id, strerror(errno));
|
2017-10-05 11:10:04 +08:00
|
|
|
return fd;
|
|
|
|
} else if (is_prefix(**argv, "tag")) {
|
|
|
|
unsigned char tag[BPF_TAG_SIZE];
|
|
|
|
|
|
|
|
NEXT_ARGP();
|
|
|
|
|
|
|
|
if (sscanf(**argv, BPF_TAG_FMT, tag, tag + 1, tag + 2,
|
|
|
|
tag + 3, tag + 4, tag + 5, tag + 6, tag + 7)
|
|
|
|
!= BPF_TAG_SIZE) {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("can't parse tag");
|
2017-10-05 11:10:04 +08:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
NEXT_ARGP();
|
|
|
|
|
|
|
|
return prog_fd_by_tag(tag);
|
|
|
|
} else if (is_prefix(**argv, "pinned")) {
|
|
|
|
char *path;
|
|
|
|
|
|
|
|
NEXT_ARGP();
|
|
|
|
|
|
|
|
path = **argv;
|
|
|
|
NEXT_ARGP();
|
|
|
|
|
|
|
|
return open_obj_pinned_any(path, BPF_OBJ_PROG);
|
|
|
|
}
|
|
|
|
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("expected 'id', 'tag' or 'pinned', got: '%s'?", **argv);
|
2017-10-05 11:10:04 +08:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void show_prog_maps(int fd, u32 num_maps)
|
|
|
|
{
|
|
|
|
struct bpf_prog_info info = {};
|
|
|
|
__u32 len = sizeof(info);
|
|
|
|
__u32 map_ids[num_maps];
|
|
|
|
unsigned int i;
|
|
|
|
int err;
|
|
|
|
|
|
|
|
info.nr_map_ids = num_maps;
|
|
|
|
info.map_ids = ptr_to_u64(map_ids);
|
|
|
|
|
|
|
|
err = bpf_obj_get_info_by_fd(fd, &info, &len);
|
|
|
|
if (err || !info.nr_map_ids)
|
|
|
|
return;
|
|
|
|
|
2017-10-24 00:24:08 +08:00
|
|
|
if (json_output) {
|
|
|
|
jsonw_name(json_wtr, "map_ids");
|
|
|
|
jsonw_start_array(json_wtr);
|
|
|
|
for (i = 0; i < info.nr_map_ids; i++)
|
|
|
|
jsonw_uint(json_wtr, map_ids[i]);
|
|
|
|
jsonw_end_array(json_wtr);
|
|
|
|
} else {
|
|
|
|
printf(" map_ids ");
|
|
|
|
for (i = 0; i < info.nr_map_ids; i++)
|
|
|
|
printf("%u%s", map_ids[i],
|
|
|
|
i == info.nr_map_ids - 1 ? "" : ",");
|
|
|
|
}
|
2017-10-05 11:10:04 +08:00
|
|
|
}
|
|
|
|
|
2017-10-24 00:24:08 +08:00
|
|
|
static void print_prog_json(struct bpf_prog_info *info, int fd)
|
2017-10-05 11:10:04 +08:00
|
|
|
{
|
|
|
|
char *memlock;
|
|
|
|
|
2017-10-24 00:24:08 +08:00
|
|
|
jsonw_start_object(json_wtr);
|
|
|
|
jsonw_uint_field(json_wtr, "id", info->id);
|
|
|
|
if (info->type < ARRAY_SIZE(prog_type_name))
|
|
|
|
jsonw_string_field(json_wtr, "type",
|
|
|
|
prog_type_name[info->type]);
|
|
|
|
else
|
|
|
|
jsonw_uint_field(json_wtr, "type", info->type);
|
|
|
|
|
|
|
|
if (*info->name)
|
|
|
|
jsonw_string_field(json_wtr, "name", info->name);
|
|
|
|
|
|
|
|
jsonw_name(json_wtr, "tag");
|
|
|
|
jsonw_printf(json_wtr, "\"" BPF_TAG_FMT "\"",
|
|
|
|
info->tag[0], info->tag[1], info->tag[2], info->tag[3],
|
|
|
|
info->tag[4], info->tag[5], info->tag[6], info->tag[7]);
|
|
|
|
|
tools, bpftool: Display license GPL compatible in prog show/list
Display the license "gpl" string in bpftool prog command, like:
# bpftool prog list
5: tracepoint name func tag 57cd311f2e27366b gpl
loaded_at Apr 26/09:37 uid 0
xlated 16B not jited memlock 4096B
# bpftool --json --pretty prog show
[{
"id": 5,
"type": "tracepoint",
"name": "func",
"tag": "57cd311f2e27366b",
"gpl_compatible": true,
"loaded_at": "Apr 26/09:37",
"uid": 0,
"bytes_xlated": 16,
"jited": false,
"bytes_memlock": 4096
}
]
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-04-26 16:18:01 +08:00
|
|
|
jsonw_bool_field(json_wtr, "gpl_compatible", info->gpl_compatible);
|
|
|
|
|
2017-12-28 10:39:10 +08:00
|
|
|
print_dev_json(info->ifindex, info->netns_dev, info->netns_ino);
|
|
|
|
|
2017-10-24 00:24:08 +08:00
|
|
|
if (info->load_time) {
|
|
|
|
char buf[32];
|
|
|
|
|
|
|
|
print_boot_time(info->load_time, buf, sizeof(buf));
|
|
|
|
|
|
|
|
/* Piggy back on load_time, since 0 uid is a valid one */
|
tools: bpftool: change time format for program 'loaded at:' information
To make eBPF program load time easier to parse from "bpftool prog"
output for machines, change the time format used by the program. The
format now differs for plain and JSON version:
- Plain version uses a string formatted according to ISO 8601.
- JSON uses the number of seconds since the Epoch, wich is less friendly
for humans but even easier to process.
Example output:
# ./bpftool prog
41298: xdp tag a04f5eef06a7f555 dev foo
loaded_at 2018-04-18T17:19:47+0100 uid 0
xlated 16B not jited memlock 4096B
# ./bpftool prog -p
[{
"id": 41298,
"type": "xdp",
"tag": "a04f5eef06a7f555",
"gpl_compatible": false,
"dev": {
"ifindex": 14,
"ns_dev": 3,
"ns_inode": 4026531993,
"ifname": "foo"
},
"loaded_at": 1524068387,
"uid": 0,
"bytes_xlated": 16,
"jited": false,
"bytes_memlock": 4096
}
]
Previously, "Apr 18/17:19" would be used at both places.
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Quentin Monnet <quentin.monnet@netronome.com>
Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-05-02 04:18:38 +08:00
|
|
|
jsonw_name(json_wtr, "loaded_at");
|
|
|
|
jsonw_printf(json_wtr, "%s", buf);
|
2017-10-24 00:24:08 +08:00
|
|
|
jsonw_uint_field(json_wtr, "uid", info->created_by_uid);
|
|
|
|
}
|
|
|
|
|
|
|
|
jsonw_uint_field(json_wtr, "bytes_xlated", info->xlated_prog_len);
|
|
|
|
|
|
|
|
if (info->jited_prog_len) {
|
|
|
|
jsonw_bool_field(json_wtr, "jited", true);
|
|
|
|
jsonw_uint_field(json_wtr, "bytes_jited", info->jited_prog_len);
|
|
|
|
} else {
|
|
|
|
jsonw_bool_field(json_wtr, "jited", false);
|
2017-10-05 11:10:04 +08:00
|
|
|
}
|
|
|
|
|
2017-10-24 00:24:08 +08:00
|
|
|
memlock = get_fdinfo(fd, "memlock");
|
|
|
|
if (memlock)
|
|
|
|
jsonw_int_field(json_wtr, "bytes_memlock", atoi(memlock));
|
|
|
|
free(memlock);
|
|
|
|
|
|
|
|
if (info->nr_map_ids)
|
|
|
|
show_prog_maps(fd, info->nr_map_ids);
|
|
|
|
|
tools: bpftool: show filenames of pinned objects
Added support to show filenames of pinned objects.
For example:
root@test# ./bpftool prog
3: tracepoint name tracepoint__irq tag f677a7dd722299a3
loaded_at Oct 26/11:39 uid 0
xlated 160B not jited memlock 4096B map_ids 4
pinned /sys/fs/bpf/softirq_prog
4: tracepoint name tracepoint__irq tag ea5dc530d00b92b6
loaded_at Oct 26/11:39 uid 0
xlated 392B not jited memlock 4096B map_ids 4,6
root@test# ./bpftool --json --pretty prog
[{
"id": 3,
"type": "tracepoint",
"name": "tracepoint__irq",
"tag": "f677a7dd722299a3",
"loaded_at": "Oct 26/11:39",
"uid": 0,
"bytes_xlated": 160,
"jited": false,
"bytes_memlock": 4096,
"map_ids": [4
],
"pinned": ["/sys/fs/bpf/softirq_prog"
]
},{
"id": 4,
"type": "tracepoint",
"name": "tracepoint__irq",
"tag": "ea5dc530d00b92b6",
"loaded_at": "Oct 26/11:39",
"uid": 0,
"bytes_xlated": 392,
"jited": false,
"bytes_memlock": 4096,
"map_ids": [4,6
],
"pinned": []
}
]
root@test# ./bpftool map
4: hash name start flags 0x0
key 4B value 16B max_entries 10240 memlock 1003520B
pinned /sys/fs/bpf/softirq_map1
5: hash name iptr flags 0x0
key 4B value 8B max_entries 10240 memlock 921600B
root@test# ./bpftool --json --pretty map
[{
"id": 4,
"type": "hash",
"name": "start",
"flags": 0,
"bytes_key": 4,
"bytes_value": 16,
"max_entries": 10240,
"bytes_memlock": 1003520,
"pinned": ["/sys/fs/bpf/softirq_map1"
]
},{
"id": 5,
"type": "hash",
"name": "iptr",
"flags": 0,
"bytes_key": 4,
"bytes_value": 8,
"max_entries": 10240,
"bytes_memlock": 921600,
"pinned": []
}
]
Signed-off-by: Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-11-08 12:55:48 +08:00
|
|
|
if (!hash_empty(prog_table.table)) {
|
|
|
|
struct pinned_obj *obj;
|
|
|
|
|
|
|
|
jsonw_name(json_wtr, "pinned");
|
|
|
|
jsonw_start_array(json_wtr);
|
|
|
|
hash_for_each_possible(prog_table.table, obj, hash, info->id) {
|
|
|
|
if (obj->id == info->id)
|
|
|
|
jsonw_string(json_wtr, obj->path);
|
|
|
|
}
|
|
|
|
jsonw_end_array(json_wtr);
|
|
|
|
}
|
|
|
|
|
2017-10-24 00:24:08 +08:00
|
|
|
jsonw_end_object(json_wtr);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void print_prog_plain(struct bpf_prog_info *info, int fd)
|
|
|
|
{
|
|
|
|
char *memlock;
|
|
|
|
|
|
|
|
printf("%u: ", info->id);
|
|
|
|
if (info->type < ARRAY_SIZE(prog_type_name))
|
|
|
|
printf("%s ", prog_type_name[info->type]);
|
2017-10-05 11:10:04 +08:00
|
|
|
else
|
2017-10-24 00:24:08 +08:00
|
|
|
printf("type %u ", info->type);
|
2017-10-05 11:10:04 +08:00
|
|
|
|
2017-10-24 00:24:08 +08:00
|
|
|
if (*info->name)
|
|
|
|
printf("name %s ", info->name);
|
2017-10-05 11:10:04 +08:00
|
|
|
|
|
|
|
printf("tag ");
|
2017-10-24 00:24:08 +08:00
|
|
|
fprint_hex(stdout, info->tag, BPF_TAG_SIZE, "");
|
2017-12-28 10:39:10 +08:00
|
|
|
print_dev_plain(info->ifindex, info->netns_dev, info->netns_ino);
|
tools, bpftool: Display license GPL compatible in prog show/list
Display the license "gpl" string in bpftool prog command, like:
# bpftool prog list
5: tracepoint name func tag 57cd311f2e27366b gpl
loaded_at Apr 26/09:37 uid 0
xlated 16B not jited memlock 4096B
# bpftool --json --pretty prog show
[{
"id": 5,
"type": "tracepoint",
"name": "func",
"tag": "57cd311f2e27366b",
"gpl_compatible": true,
"loaded_at": "Apr 26/09:37",
"uid": 0,
"bytes_xlated": 16,
"jited": false,
"bytes_memlock": 4096
}
]
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-04-26 16:18:01 +08:00
|
|
|
printf("%s", info->gpl_compatible ? " gpl" : "");
|
2017-10-05 11:10:04 +08:00
|
|
|
printf("\n");
|
|
|
|
|
2017-10-24 00:24:08 +08:00
|
|
|
if (info->load_time) {
|
2017-10-05 11:10:04 +08:00
|
|
|
char buf[32];
|
|
|
|
|
2017-10-24 00:24:08 +08:00
|
|
|
print_boot_time(info->load_time, buf, sizeof(buf));
|
2017-10-05 11:10:04 +08:00
|
|
|
|
|
|
|
/* Piggy back on load_time, since 0 uid is a valid one */
|
2017-10-24 00:24:08 +08:00
|
|
|
printf("\tloaded_at %s uid %u\n", buf, info->created_by_uid);
|
2017-10-05 11:10:04 +08:00
|
|
|
}
|
|
|
|
|
2017-10-24 00:24:08 +08:00
|
|
|
printf("\txlated %uB", info->xlated_prog_len);
|
2017-10-05 11:10:04 +08:00
|
|
|
|
2017-10-24 00:24:08 +08:00
|
|
|
if (info->jited_prog_len)
|
|
|
|
printf(" jited %uB", info->jited_prog_len);
|
2017-10-05 11:10:04 +08:00
|
|
|
else
|
|
|
|
printf(" not jited");
|
|
|
|
|
|
|
|
memlock = get_fdinfo(fd, "memlock");
|
|
|
|
if (memlock)
|
|
|
|
printf(" memlock %sB", memlock);
|
|
|
|
free(memlock);
|
|
|
|
|
2017-10-24 00:24:08 +08:00
|
|
|
if (info->nr_map_ids)
|
|
|
|
show_prog_maps(fd, info->nr_map_ids);
|
2017-10-05 11:10:04 +08:00
|
|
|
|
tools: bpftool: show filenames of pinned objects
Added support to show filenames of pinned objects.
For example:
root@test# ./bpftool prog
3: tracepoint name tracepoint__irq tag f677a7dd722299a3
loaded_at Oct 26/11:39 uid 0
xlated 160B not jited memlock 4096B map_ids 4
pinned /sys/fs/bpf/softirq_prog
4: tracepoint name tracepoint__irq tag ea5dc530d00b92b6
loaded_at Oct 26/11:39 uid 0
xlated 392B not jited memlock 4096B map_ids 4,6
root@test# ./bpftool --json --pretty prog
[{
"id": 3,
"type": "tracepoint",
"name": "tracepoint__irq",
"tag": "f677a7dd722299a3",
"loaded_at": "Oct 26/11:39",
"uid": 0,
"bytes_xlated": 160,
"jited": false,
"bytes_memlock": 4096,
"map_ids": [4
],
"pinned": ["/sys/fs/bpf/softirq_prog"
]
},{
"id": 4,
"type": "tracepoint",
"name": "tracepoint__irq",
"tag": "ea5dc530d00b92b6",
"loaded_at": "Oct 26/11:39",
"uid": 0,
"bytes_xlated": 392,
"jited": false,
"bytes_memlock": 4096,
"map_ids": [4,6
],
"pinned": []
}
]
root@test# ./bpftool map
4: hash name start flags 0x0
key 4B value 16B max_entries 10240 memlock 1003520B
pinned /sys/fs/bpf/softirq_map1
5: hash name iptr flags 0x0
key 4B value 8B max_entries 10240 memlock 921600B
root@test# ./bpftool --json --pretty map
[{
"id": 4,
"type": "hash",
"name": "start",
"flags": 0,
"bytes_key": 4,
"bytes_value": 16,
"max_entries": 10240,
"bytes_memlock": 1003520,
"pinned": ["/sys/fs/bpf/softirq_map1"
]
},{
"id": 5,
"type": "hash",
"name": "iptr",
"flags": 0,
"bytes_key": 4,
"bytes_value": 8,
"max_entries": 10240,
"bytes_memlock": 921600,
"pinned": []
}
]
Signed-off-by: Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-11-08 12:55:48 +08:00
|
|
|
if (!hash_empty(prog_table.table)) {
|
|
|
|
struct pinned_obj *obj;
|
|
|
|
|
|
|
|
printf("\n");
|
|
|
|
hash_for_each_possible(prog_table.table, obj, hash, info->id) {
|
|
|
|
if (obj->id == info->id)
|
|
|
|
printf("\tpinned %s\n", obj->path);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-10-05 11:10:04 +08:00
|
|
|
printf("\n");
|
2017-10-24 00:24:08 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static int show_prog(int fd)
|
|
|
|
{
|
|
|
|
struct bpf_prog_info info = {};
|
|
|
|
__u32 len = sizeof(info);
|
|
|
|
int err;
|
|
|
|
|
|
|
|
err = bpf_obj_get_info_by_fd(fd, &info, &len);
|
|
|
|
if (err) {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("can't get prog info: %s", strerror(errno));
|
2017-10-24 00:24:08 +08:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (json_output)
|
|
|
|
print_prog_json(&info, fd);
|
|
|
|
else
|
|
|
|
print_prog_plain(&info, fd);
|
2017-10-05 11:10:04 +08:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int do_show(int argc, char **argv)
|
2017-10-24 00:24:08 +08:00
|
|
|
{
|
|
|
|
__u32 id = 0;
|
2017-10-05 11:10:04 +08:00
|
|
|
int err;
|
|
|
|
int fd;
|
|
|
|
|
2017-11-08 12:55:49 +08:00
|
|
|
if (show_pinned)
|
|
|
|
build_pinned_obj_table(&prog_table, BPF_OBJ_PROG);
|
tools: bpftool: show filenames of pinned objects
Added support to show filenames of pinned objects.
For example:
root@test# ./bpftool prog
3: tracepoint name tracepoint__irq tag f677a7dd722299a3
loaded_at Oct 26/11:39 uid 0
xlated 160B not jited memlock 4096B map_ids 4
pinned /sys/fs/bpf/softirq_prog
4: tracepoint name tracepoint__irq tag ea5dc530d00b92b6
loaded_at Oct 26/11:39 uid 0
xlated 392B not jited memlock 4096B map_ids 4,6
root@test# ./bpftool --json --pretty prog
[{
"id": 3,
"type": "tracepoint",
"name": "tracepoint__irq",
"tag": "f677a7dd722299a3",
"loaded_at": "Oct 26/11:39",
"uid": 0,
"bytes_xlated": 160,
"jited": false,
"bytes_memlock": 4096,
"map_ids": [4
],
"pinned": ["/sys/fs/bpf/softirq_prog"
]
},{
"id": 4,
"type": "tracepoint",
"name": "tracepoint__irq",
"tag": "ea5dc530d00b92b6",
"loaded_at": "Oct 26/11:39",
"uid": 0,
"bytes_xlated": 392,
"jited": false,
"bytes_memlock": 4096,
"map_ids": [4,6
],
"pinned": []
}
]
root@test# ./bpftool map
4: hash name start flags 0x0
key 4B value 16B max_entries 10240 memlock 1003520B
pinned /sys/fs/bpf/softirq_map1
5: hash name iptr flags 0x0
key 4B value 8B max_entries 10240 memlock 921600B
root@test# ./bpftool --json --pretty map
[{
"id": 4,
"type": "hash",
"name": "start",
"flags": 0,
"bytes_key": 4,
"bytes_value": 16,
"max_entries": 10240,
"bytes_memlock": 1003520,
"pinned": ["/sys/fs/bpf/softirq_map1"
]
},{
"id": 5,
"type": "hash",
"name": "iptr",
"flags": 0,
"bytes_key": 4,
"bytes_value": 8,
"max_entries": 10240,
"bytes_memlock": 921600,
"pinned": []
}
]
Signed-off-by: Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-11-08 12:55:48 +08:00
|
|
|
|
2017-10-05 11:10:04 +08:00
|
|
|
if (argc == 2) {
|
|
|
|
fd = prog_parse_fd(&argc, &argv);
|
|
|
|
if (fd < 0)
|
|
|
|
return -1;
|
|
|
|
|
|
|
|
return show_prog(fd);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (argc)
|
|
|
|
return BAD_ARG();
|
|
|
|
|
2017-10-24 00:24:08 +08:00
|
|
|
if (json_output)
|
|
|
|
jsonw_start_array(json_wtr);
|
2017-10-05 11:10:04 +08:00
|
|
|
while (true) {
|
|
|
|
err = bpf_prog_get_next_id(id, &id);
|
|
|
|
if (err) {
|
2017-10-20 06:46:20 +08:00
|
|
|
if (errno == ENOENT) {
|
|
|
|
err = 0;
|
2017-10-05 11:10:04 +08:00
|
|
|
break;
|
2017-10-20 06:46:20 +08:00
|
|
|
}
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("can't get next program: %s%s", strerror(errno),
|
|
|
|
errno == EINVAL ? " -- kernel too old?" : "");
|
2017-10-24 00:24:08 +08:00
|
|
|
err = -1;
|
|
|
|
break;
|
2017-10-05 11:10:04 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
fd = bpf_prog_get_fd_by_id(id);
|
|
|
|
if (fd < 0) {
|
2017-12-23 03:36:06 +08:00
|
|
|
if (errno == ENOENT)
|
|
|
|
continue;
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("can't get prog by id (%u): %s",
|
|
|
|
id, strerror(errno));
|
2017-10-24 00:24:08 +08:00
|
|
|
err = -1;
|
|
|
|
break;
|
2017-10-05 11:10:04 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
err = show_prog(fd);
|
|
|
|
close(fd);
|
|
|
|
if (err)
|
2017-10-24 00:24:08 +08:00
|
|
|
break;
|
2017-10-05 11:10:04 +08:00
|
|
|
}
|
|
|
|
|
2017-10-24 00:24:08 +08:00
|
|
|
if (json_output)
|
|
|
|
jsonw_end_array(json_wtr);
|
|
|
|
|
|
|
|
return err;
|
2017-10-05 11:10:04 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static int do_dump(int argc, char **argv)
|
|
|
|
{
|
2018-05-24 14:56:50 +08:00
|
|
|
unsigned long *func_ksyms = NULL;
|
2017-10-05 11:10:04 +08:00
|
|
|
struct bpf_prog_info info = {};
|
tools: bpftool: add delimiters to multi-function JITed dumps
This splits up the contiguous JITed dump obtained via the bpf
system call into more relatable chunks for each function in
the program. If the kernel symbols corresponding to these are
known, they are printed in the header for each JIT image dump
otherwise the masked start address is printed.
Before applying this patch:
# bpftool prog dump jited id 1
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
72: push %rbp
73: mov %rsp,%rbp
...
dd: leaveq
de: retq
# bpftool -p prog dump jited id 1
[{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
},{
"pc": "0x72",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0xde",
"operation": "retq",
"operands": [null
]
}
]
After applying this patch:
# echo 0 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
0xffffffffc02c7000:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
0xffffffffc02cf000:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "0xffffffffc02c7000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "0xffffffffc02cf000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
# echo 1 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
bpf_prog_b811aab41a39ad3d_foo:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
bpf_prog_cf418ac8b67bebd9_F:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "bpf_prog_b811aab41a39ad3d_foo",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "bpf_prog_cf418ac8b67bebd9_F",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-05-24 14:56:54 +08:00
|
|
|
unsigned int *func_lens = NULL;
|
2018-05-24 14:56:50 +08:00
|
|
|
unsigned int nr_func_ksyms;
|
tools: bpftool: add delimiters to multi-function JITed dumps
This splits up the contiguous JITed dump obtained via the bpf
system call into more relatable chunks for each function in
the program. If the kernel symbols corresponding to these are
known, they are printed in the header for each JIT image dump
otherwise the masked start address is printed.
Before applying this patch:
# bpftool prog dump jited id 1
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
72: push %rbp
73: mov %rsp,%rbp
...
dd: leaveq
de: retq
# bpftool -p prog dump jited id 1
[{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
},{
"pc": "0x72",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0xde",
"operation": "retq",
"operands": [null
]
}
]
After applying this patch:
# echo 0 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
0xffffffffc02c7000:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
0xffffffffc02cf000:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "0xffffffffc02c7000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "0xffffffffc02cf000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
# echo 1 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
bpf_prog_b811aab41a39ad3d_foo:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
bpf_prog_cf418ac8b67bebd9_F:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "bpf_prog_b811aab41a39ad3d_foo",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "bpf_prog_cf418ac8b67bebd9_F",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-05-24 14:56:54 +08:00
|
|
|
unsigned int nr_func_lens;
|
bpf: allow for correlation of maps and helpers in dump
Currently a dump of an xlated prog (post verifier stage) doesn't
correlate used helpers as well as maps. The prog info lists
involved map ids, however there's no correlation of where in the
program they are used as of today. Likewise, bpftool does not
correlate helper calls with the target functions.
The latter can be done w/o any kernel changes through kallsyms,
and also has the advantage that this works with inlined helpers
and BPF calls.
Example, via interpreter:
# tc filter show dev foo ingress
filter protocol all pref 49152 bpf chain 0
filter protocol all pref 49152 bpf chain 0 handle 0x1 foo.o:[ingress] \
direct-action not_in_hw id 1 tag c74773051b364165 <-- prog id:1
* Output before patch (calls/maps remain unclear):
# bpftool prog dump xlated id 1 <-- dump prog id:1
0: (b7) r1 = 2
1: (63) *(u32 *)(r10 -4) = r1
2: (bf) r2 = r10
3: (07) r2 += -4
4: (18) r1 = 0xffff95c47a8d4800
6: (85) call unknown#73040
7: (15) if r0 == 0x0 goto pc+18
8: (bf) r2 = r10
9: (07) r2 += -4
10: (bf) r1 = r0
11: (85) call unknown#73040
12: (15) if r0 == 0x0 goto pc+23
[...]
* Output after patch:
# bpftool prog dump xlated id 1
0: (b7) r1 = 2
1: (63) *(u32 *)(r10 -4) = r1
2: (bf) r2 = r10
3: (07) r2 += -4
4: (18) r1 = map[id:2] <-- map id:2
6: (85) call bpf_map_lookup_elem#73424 <-- helper call
7: (15) if r0 == 0x0 goto pc+18
8: (bf) r2 = r10
9: (07) r2 += -4
10: (bf) r1 = r0
11: (85) call bpf_map_lookup_elem#73424
12: (15) if r0 == 0x0 goto pc+23
[...]
# bpftool map show id 2 <-- show/dump/etc map id:2
2: hash_of_maps flags 0x0
key 4B value 4B max_entries 3 memlock 4096B
Example, JITed, same prog:
# tc filter show dev foo ingress
filter protocol all pref 49152 bpf chain 0
filter protocol all pref 49152 bpf chain 0 handle 0x1 foo.o:[ingress] \
direct-action not_in_hw id 3 tag c74773051b364165 jited
# bpftool prog show id 3
3: sched_cls tag c74773051b364165
loaded_at Dec 19/13:48 uid 0
xlated 384B jited 257B memlock 4096B map_ids 2
# bpftool prog dump xlated id 3
0: (b7) r1 = 2
1: (63) *(u32 *)(r10 -4) = r1
2: (bf) r2 = r10
3: (07) r2 += -4
4: (18) r1 = map[id:2] <-- map id:2
6: (85) call __htab_map_lookup_elem#77408 <-+ inlined rewrite
7: (15) if r0 == 0x0 goto pc+2 |
8: (07) r0 += 56 |
9: (79) r0 = *(u64 *)(r0 +0) <-+
10: (15) if r0 == 0x0 goto pc+24
11: (bf) r2 = r10
12: (07) r2 += -4
[...]
Example, same prog, but kallsyms disabled (in that case we are
also not allowed to pass any relative offsets, etc, so prog
becomes pointer sanitized on dump):
# sysctl kernel.kptr_restrict=2
kernel.kptr_restrict = 2
# bpftool prog dump xlated id 3
0: (b7) r1 = 2
1: (63) *(u32 *)(r10 -4) = r1
2: (bf) r2 = r10
3: (07) r2 += -4
4: (18) r1 = map[id:2]
6: (85) call bpf_unspec#0
7: (15) if r0 == 0x0 goto pc+2
[...]
Example, BPF calls via interpreter:
# bpftool prog dump xlated id 1
0: (85) call pc+2#__bpf_prog_run_args32
1: (b7) r0 = 1
2: (95) exit
3: (b7) r0 = 2
4: (95) exit
Example, BPF calls via JIT:
# sysctl net.core.bpf_jit_enable=1
net.core.bpf_jit_enable = 1
# sysctl net.core.bpf_jit_kallsyms=1
net.core.bpf_jit_kallsyms = 1
# bpftool prog dump xlated id 1
0: (85) call pc+2#bpf_prog_3b185187f1855c4c_F
1: (b7) r0 = 1
2: (95) exit
3: (b7) r0 = 2
4: (95) exit
And finally, an example for tail calls that is now working
as well wrt correlation:
# bpftool prog dump xlated id 2
[...]
10: (b7) r2 = 8
11: (85) call bpf_trace_printk#-41312
12: (bf) r1 = r6
13: (18) r2 = map[id:1]
15: (b7) r3 = 0
16: (85) call bpf_tail_call#12
17: (b7) r1 = 42
18: (6b) *(u16 *)(r6 +46) = r1
19: (b7) r0 = 0
20: (95) exit
# bpftool map show id 1
1: prog_array flags 0x0
key 4B value 4B max_entries 1 memlock 4096B
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2017-12-20 20:42:57 +08:00
|
|
|
struct dump_data dd = {};
|
2017-10-05 11:10:04 +08:00
|
|
|
__u32 len = sizeof(info);
|
|
|
|
unsigned int buf_size;
|
|
|
|
char *filepath = NULL;
|
|
|
|
bool opcodes = false;
|
2018-03-02 10:01:22 +08:00
|
|
|
bool visual = false;
|
2017-10-05 11:10:04 +08:00
|
|
|
unsigned char *buf;
|
|
|
|
__u32 *member_len;
|
|
|
|
__u64 *member_ptr;
|
|
|
|
ssize_t n;
|
|
|
|
int err;
|
|
|
|
int fd;
|
|
|
|
|
|
|
|
if (is_prefix(*argv, "jited")) {
|
|
|
|
member_len = &info.jited_prog_len;
|
|
|
|
member_ptr = &info.jited_prog_insns;
|
|
|
|
} else if (is_prefix(*argv, "xlated")) {
|
|
|
|
member_len = &info.xlated_prog_len;
|
|
|
|
member_ptr = &info.xlated_prog_insns;
|
|
|
|
} else {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("expected 'xlated' or 'jited', got: %s", *argv);
|
2017-10-05 11:10:04 +08:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
NEXT_ARG();
|
|
|
|
|
|
|
|
if (argc < 2)
|
|
|
|
usage();
|
|
|
|
|
|
|
|
fd = prog_parse_fd(&argc, &argv);
|
|
|
|
if (fd < 0)
|
|
|
|
return -1;
|
|
|
|
|
|
|
|
if (is_prefix(*argv, "file")) {
|
|
|
|
NEXT_ARG();
|
|
|
|
if (!argc) {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("expected file path");
|
2017-10-05 11:10:04 +08:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
filepath = *argv;
|
|
|
|
NEXT_ARG();
|
|
|
|
} else if (is_prefix(*argv, "opcodes")) {
|
|
|
|
opcodes = true;
|
|
|
|
NEXT_ARG();
|
2018-03-02 10:01:22 +08:00
|
|
|
} else if (is_prefix(*argv, "visual")) {
|
|
|
|
visual = true;
|
|
|
|
NEXT_ARG();
|
2017-10-05 11:10:04 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
if (argc) {
|
|
|
|
usage();
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
err = bpf_obj_get_info_by_fd(fd, &info, &len);
|
|
|
|
if (err) {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("can't get prog info: %s", strerror(errno));
|
2017-10-05 11:10:04 +08:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!*member_len) {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_info("no instructions returned");
|
2017-10-05 11:10:04 +08:00
|
|
|
close(fd);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
buf_size = *member_len;
|
|
|
|
|
|
|
|
buf = malloc(buf_size);
|
|
|
|
if (!buf) {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("mem alloc failed");
|
2017-10-05 11:10:04 +08:00
|
|
|
close(fd);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2018-05-24 14:56:50 +08:00
|
|
|
nr_func_ksyms = info.nr_jited_ksyms;
|
|
|
|
if (nr_func_ksyms) {
|
|
|
|
func_ksyms = malloc(nr_func_ksyms * sizeof(__u64));
|
|
|
|
if (!func_ksyms) {
|
|
|
|
p_err("mem alloc failed");
|
|
|
|
close(fd);
|
|
|
|
goto err_free;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
tools: bpftool: add delimiters to multi-function JITed dumps
This splits up the contiguous JITed dump obtained via the bpf
system call into more relatable chunks for each function in
the program. If the kernel symbols corresponding to these are
known, they are printed in the header for each JIT image dump
otherwise the masked start address is printed.
Before applying this patch:
# bpftool prog dump jited id 1
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
72: push %rbp
73: mov %rsp,%rbp
...
dd: leaveq
de: retq
# bpftool -p prog dump jited id 1
[{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
},{
"pc": "0x72",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0xde",
"operation": "retq",
"operands": [null
]
}
]
After applying this patch:
# echo 0 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
0xffffffffc02c7000:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
0xffffffffc02cf000:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "0xffffffffc02c7000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "0xffffffffc02cf000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
# echo 1 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
bpf_prog_b811aab41a39ad3d_foo:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
bpf_prog_cf418ac8b67bebd9_F:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "bpf_prog_b811aab41a39ad3d_foo",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "bpf_prog_cf418ac8b67bebd9_F",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-05-24 14:56:54 +08:00
|
|
|
nr_func_lens = info.nr_jited_func_lens;
|
|
|
|
if (nr_func_lens) {
|
|
|
|
func_lens = malloc(nr_func_lens * sizeof(__u32));
|
|
|
|
if (!func_lens) {
|
|
|
|
p_err("mem alloc failed");
|
|
|
|
close(fd);
|
|
|
|
goto err_free;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-10-05 11:10:04 +08:00
|
|
|
memset(&info, 0, sizeof(info));
|
|
|
|
|
|
|
|
*member_ptr = ptr_to_u64(buf);
|
|
|
|
*member_len = buf_size;
|
2018-05-24 14:56:50 +08:00
|
|
|
info.jited_ksyms = ptr_to_u64(func_ksyms);
|
|
|
|
info.nr_jited_ksyms = nr_func_ksyms;
|
tools: bpftool: add delimiters to multi-function JITed dumps
This splits up the contiguous JITed dump obtained via the bpf
system call into more relatable chunks for each function in
the program. If the kernel symbols corresponding to these are
known, they are printed in the header for each JIT image dump
otherwise the masked start address is printed.
Before applying this patch:
# bpftool prog dump jited id 1
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
72: push %rbp
73: mov %rsp,%rbp
...
dd: leaveq
de: retq
# bpftool -p prog dump jited id 1
[{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
},{
"pc": "0x72",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0xde",
"operation": "retq",
"operands": [null
]
}
]
After applying this patch:
# echo 0 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
0xffffffffc02c7000:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
0xffffffffc02cf000:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "0xffffffffc02c7000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "0xffffffffc02cf000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
# echo 1 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
bpf_prog_b811aab41a39ad3d_foo:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
bpf_prog_cf418ac8b67bebd9_F:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "bpf_prog_b811aab41a39ad3d_foo",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "bpf_prog_cf418ac8b67bebd9_F",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-05-24 14:56:54 +08:00
|
|
|
info.jited_func_lens = ptr_to_u64(func_lens);
|
|
|
|
info.nr_jited_func_lens = nr_func_lens;
|
2017-10-05 11:10:04 +08:00
|
|
|
|
|
|
|
err = bpf_obj_get_info_by_fd(fd, &info, &len);
|
|
|
|
close(fd);
|
|
|
|
if (err) {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("can't get prog info: %s", strerror(errno));
|
2017-10-05 11:10:04 +08:00
|
|
|
goto err_free;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (*member_len > buf_size) {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("too many instructions returned");
|
2017-10-05 11:10:04 +08:00
|
|
|
goto err_free;
|
|
|
|
}
|
|
|
|
|
2018-05-24 14:56:50 +08:00
|
|
|
if (info.nr_jited_ksyms > nr_func_ksyms) {
|
|
|
|
p_err("too many addresses returned");
|
|
|
|
goto err_free;
|
|
|
|
}
|
|
|
|
|
tools: bpftool: add delimiters to multi-function JITed dumps
This splits up the contiguous JITed dump obtained via the bpf
system call into more relatable chunks for each function in
the program. If the kernel symbols corresponding to these are
known, they are printed in the header for each JIT image dump
otherwise the masked start address is printed.
Before applying this patch:
# bpftool prog dump jited id 1
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
72: push %rbp
73: mov %rsp,%rbp
...
dd: leaveq
de: retq
# bpftool -p prog dump jited id 1
[{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
},{
"pc": "0x72",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0xde",
"operation": "retq",
"operands": [null
]
}
]
After applying this patch:
# echo 0 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
0xffffffffc02c7000:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
0xffffffffc02cf000:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "0xffffffffc02c7000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "0xffffffffc02cf000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
# echo 1 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
bpf_prog_b811aab41a39ad3d_foo:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
bpf_prog_cf418ac8b67bebd9_F:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "bpf_prog_b811aab41a39ad3d_foo",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "bpf_prog_cf418ac8b67bebd9_F",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-05-24 14:56:54 +08:00
|
|
|
if (info.nr_jited_func_lens > nr_func_lens) {
|
|
|
|
p_err("too many values returned");
|
|
|
|
goto err_free;
|
|
|
|
}
|
|
|
|
|
bpf: allow for correlation of maps and helpers in dump
Currently a dump of an xlated prog (post verifier stage) doesn't
correlate used helpers as well as maps. The prog info lists
involved map ids, however there's no correlation of where in the
program they are used as of today. Likewise, bpftool does not
correlate helper calls with the target functions.
The latter can be done w/o any kernel changes through kallsyms,
and also has the advantage that this works with inlined helpers
and BPF calls.
Example, via interpreter:
# tc filter show dev foo ingress
filter protocol all pref 49152 bpf chain 0
filter protocol all pref 49152 bpf chain 0 handle 0x1 foo.o:[ingress] \
direct-action not_in_hw id 1 tag c74773051b364165 <-- prog id:1
* Output before patch (calls/maps remain unclear):
# bpftool prog dump xlated id 1 <-- dump prog id:1
0: (b7) r1 = 2
1: (63) *(u32 *)(r10 -4) = r1
2: (bf) r2 = r10
3: (07) r2 += -4
4: (18) r1 = 0xffff95c47a8d4800
6: (85) call unknown#73040
7: (15) if r0 == 0x0 goto pc+18
8: (bf) r2 = r10
9: (07) r2 += -4
10: (bf) r1 = r0
11: (85) call unknown#73040
12: (15) if r0 == 0x0 goto pc+23
[...]
* Output after patch:
# bpftool prog dump xlated id 1
0: (b7) r1 = 2
1: (63) *(u32 *)(r10 -4) = r1
2: (bf) r2 = r10
3: (07) r2 += -4
4: (18) r1 = map[id:2] <-- map id:2
6: (85) call bpf_map_lookup_elem#73424 <-- helper call
7: (15) if r0 == 0x0 goto pc+18
8: (bf) r2 = r10
9: (07) r2 += -4
10: (bf) r1 = r0
11: (85) call bpf_map_lookup_elem#73424
12: (15) if r0 == 0x0 goto pc+23
[...]
# bpftool map show id 2 <-- show/dump/etc map id:2
2: hash_of_maps flags 0x0
key 4B value 4B max_entries 3 memlock 4096B
Example, JITed, same prog:
# tc filter show dev foo ingress
filter protocol all pref 49152 bpf chain 0
filter protocol all pref 49152 bpf chain 0 handle 0x1 foo.o:[ingress] \
direct-action not_in_hw id 3 tag c74773051b364165 jited
# bpftool prog show id 3
3: sched_cls tag c74773051b364165
loaded_at Dec 19/13:48 uid 0
xlated 384B jited 257B memlock 4096B map_ids 2
# bpftool prog dump xlated id 3
0: (b7) r1 = 2
1: (63) *(u32 *)(r10 -4) = r1
2: (bf) r2 = r10
3: (07) r2 += -4
4: (18) r1 = map[id:2] <-- map id:2
6: (85) call __htab_map_lookup_elem#77408 <-+ inlined rewrite
7: (15) if r0 == 0x0 goto pc+2 |
8: (07) r0 += 56 |
9: (79) r0 = *(u64 *)(r0 +0) <-+
10: (15) if r0 == 0x0 goto pc+24
11: (bf) r2 = r10
12: (07) r2 += -4
[...]
Example, same prog, but kallsyms disabled (in that case we are
also not allowed to pass any relative offsets, etc, so prog
becomes pointer sanitized on dump):
# sysctl kernel.kptr_restrict=2
kernel.kptr_restrict = 2
# bpftool prog dump xlated id 3
0: (b7) r1 = 2
1: (63) *(u32 *)(r10 -4) = r1
2: (bf) r2 = r10
3: (07) r2 += -4
4: (18) r1 = map[id:2]
6: (85) call bpf_unspec#0
7: (15) if r0 == 0x0 goto pc+2
[...]
Example, BPF calls via interpreter:
# bpftool prog dump xlated id 1
0: (85) call pc+2#__bpf_prog_run_args32
1: (b7) r0 = 1
2: (95) exit
3: (b7) r0 = 2
4: (95) exit
Example, BPF calls via JIT:
# sysctl net.core.bpf_jit_enable=1
net.core.bpf_jit_enable = 1
# sysctl net.core.bpf_jit_kallsyms=1
net.core.bpf_jit_kallsyms = 1
# bpftool prog dump xlated id 1
0: (85) call pc+2#bpf_prog_3b185187f1855c4c_F
1: (b7) r0 = 1
2: (95) exit
3: (b7) r0 = 2
4: (95) exit
And finally, an example for tail calls that is now working
as well wrt correlation:
# bpftool prog dump xlated id 2
[...]
10: (b7) r2 = 8
11: (85) call bpf_trace_printk#-41312
12: (bf) r1 = r6
13: (18) r2 = map[id:1]
15: (b7) r3 = 0
16: (85) call bpf_tail_call#12
17: (b7) r1 = 42
18: (6b) *(u16 *)(r6 +46) = r1
19: (b7) r0 = 0
20: (95) exit
# bpftool map show id 1
1: prog_array flags 0x0
key 4B value 4B max_entries 1 memlock 4096B
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2017-12-20 20:42:57 +08:00
|
|
|
if ((member_len == &info.jited_prog_len &&
|
|
|
|
info.jited_prog_insns == 0) ||
|
|
|
|
(member_len == &info.xlated_prog_len &&
|
|
|
|
info.xlated_prog_insns == 0)) {
|
|
|
|
p_err("error retrieving insn dump: kernel.kptr_restrict set?");
|
|
|
|
goto err_free;
|
|
|
|
}
|
|
|
|
|
2017-10-05 11:10:04 +08:00
|
|
|
if (filepath) {
|
|
|
|
fd = open(filepath, O_WRONLY | O_CREAT | O_TRUNC, 0600);
|
|
|
|
if (fd < 0) {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("can't open file %s: %s", filepath,
|
|
|
|
strerror(errno));
|
2017-10-05 11:10:04 +08:00
|
|
|
goto err_free;
|
|
|
|
}
|
|
|
|
|
|
|
|
n = write(fd, buf, *member_len);
|
|
|
|
close(fd);
|
|
|
|
if (n != *member_len) {
|
2017-10-24 00:24:13 +08:00
|
|
|
p_err("error writing output file: %s",
|
|
|
|
n < 0 ? strerror(errno) : "short write");
|
2017-10-05 11:10:04 +08:00
|
|
|
goto err_free;
|
|
|
|
}
|
2018-02-15 14:42:54 +08:00
|
|
|
|
|
|
|
if (json_output)
|
|
|
|
jsonw_null(json_wtr);
|
2018-03-02 10:01:16 +08:00
|
|
|
} else if (member_len == &info.jited_prog_len) {
|
|
|
|
const char *name = NULL;
|
|
|
|
|
|
|
|
if (info.ifindex) {
|
|
|
|
name = ifindex_to_bfd_name_ns(info.ifindex,
|
|
|
|
info.netns_dev,
|
|
|
|
info.netns_ino);
|
|
|
|
if (!name)
|
|
|
|
goto err_free;
|
bpf: allow for correlation of maps and helpers in dump
Currently a dump of an xlated prog (post verifier stage) doesn't
correlate used helpers as well as maps. The prog info lists
involved map ids, however there's no correlation of where in the
program they are used as of today. Likewise, bpftool does not
correlate helper calls with the target functions.
The latter can be done w/o any kernel changes through kallsyms,
and also has the advantage that this works with inlined helpers
and BPF calls.
Example, via interpreter:
# tc filter show dev foo ingress
filter protocol all pref 49152 bpf chain 0
filter protocol all pref 49152 bpf chain 0 handle 0x1 foo.o:[ingress] \
direct-action not_in_hw id 1 tag c74773051b364165 <-- prog id:1
* Output before patch (calls/maps remain unclear):
# bpftool prog dump xlated id 1 <-- dump prog id:1
0: (b7) r1 = 2
1: (63) *(u32 *)(r10 -4) = r1
2: (bf) r2 = r10
3: (07) r2 += -4
4: (18) r1 = 0xffff95c47a8d4800
6: (85) call unknown#73040
7: (15) if r0 == 0x0 goto pc+18
8: (bf) r2 = r10
9: (07) r2 += -4
10: (bf) r1 = r0
11: (85) call unknown#73040
12: (15) if r0 == 0x0 goto pc+23
[...]
* Output after patch:
# bpftool prog dump xlated id 1
0: (b7) r1 = 2
1: (63) *(u32 *)(r10 -4) = r1
2: (bf) r2 = r10
3: (07) r2 += -4
4: (18) r1 = map[id:2] <-- map id:2
6: (85) call bpf_map_lookup_elem#73424 <-- helper call
7: (15) if r0 == 0x0 goto pc+18
8: (bf) r2 = r10
9: (07) r2 += -4
10: (bf) r1 = r0
11: (85) call bpf_map_lookup_elem#73424
12: (15) if r0 == 0x0 goto pc+23
[...]
# bpftool map show id 2 <-- show/dump/etc map id:2
2: hash_of_maps flags 0x0
key 4B value 4B max_entries 3 memlock 4096B
Example, JITed, same prog:
# tc filter show dev foo ingress
filter protocol all pref 49152 bpf chain 0
filter protocol all pref 49152 bpf chain 0 handle 0x1 foo.o:[ingress] \
direct-action not_in_hw id 3 tag c74773051b364165 jited
# bpftool prog show id 3
3: sched_cls tag c74773051b364165
loaded_at Dec 19/13:48 uid 0
xlated 384B jited 257B memlock 4096B map_ids 2
# bpftool prog dump xlated id 3
0: (b7) r1 = 2
1: (63) *(u32 *)(r10 -4) = r1
2: (bf) r2 = r10
3: (07) r2 += -4
4: (18) r1 = map[id:2] <-- map id:2
6: (85) call __htab_map_lookup_elem#77408 <-+ inlined rewrite
7: (15) if r0 == 0x0 goto pc+2 |
8: (07) r0 += 56 |
9: (79) r0 = *(u64 *)(r0 +0) <-+
10: (15) if r0 == 0x0 goto pc+24
11: (bf) r2 = r10
12: (07) r2 += -4
[...]
Example, same prog, but kallsyms disabled (in that case we are
also not allowed to pass any relative offsets, etc, so prog
becomes pointer sanitized on dump):
# sysctl kernel.kptr_restrict=2
kernel.kptr_restrict = 2
# bpftool prog dump xlated id 3
0: (b7) r1 = 2
1: (63) *(u32 *)(r10 -4) = r1
2: (bf) r2 = r10
3: (07) r2 += -4
4: (18) r1 = map[id:2]
6: (85) call bpf_unspec#0
7: (15) if r0 == 0x0 goto pc+2
[...]
Example, BPF calls via interpreter:
# bpftool prog dump xlated id 1
0: (85) call pc+2#__bpf_prog_run_args32
1: (b7) r0 = 1
2: (95) exit
3: (b7) r0 = 2
4: (95) exit
Example, BPF calls via JIT:
# sysctl net.core.bpf_jit_enable=1
net.core.bpf_jit_enable = 1
# sysctl net.core.bpf_jit_kallsyms=1
net.core.bpf_jit_kallsyms = 1
# bpftool prog dump xlated id 1
0: (85) call pc+2#bpf_prog_3b185187f1855c4c_F
1: (b7) r0 = 1
2: (95) exit
3: (b7) r0 = 2
4: (95) exit
And finally, an example for tail calls that is now working
as well wrt correlation:
# bpftool prog dump xlated id 2
[...]
10: (b7) r2 = 8
11: (85) call bpf_trace_printk#-41312
12: (bf) r1 = r6
13: (18) r2 = map[id:1]
15: (b7) r3 = 0
16: (85) call bpf_tail_call#12
17: (b7) r1 = 42
18: (6b) *(u16 *)(r6 +46) = r1
19: (b7) r0 = 0
20: (95) exit
# bpftool map show id 1
1: prog_array flags 0x0
key 4B value 4B max_entries 1 memlock 4096B
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2017-12-20 20:42:57 +08:00
|
|
|
}
|
2018-03-02 10:01:16 +08:00
|
|
|
|
tools: bpftool: add delimiters to multi-function JITed dumps
This splits up the contiguous JITed dump obtained via the bpf
system call into more relatable chunks for each function in
the program. If the kernel symbols corresponding to these are
known, they are printed in the header for each JIT image dump
otherwise the masked start address is printed.
Before applying this patch:
# bpftool prog dump jited id 1
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
72: push %rbp
73: mov %rsp,%rbp
...
dd: leaveq
de: retq
# bpftool -p prog dump jited id 1
[{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
},{
"pc": "0x72",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0xde",
"operation": "retq",
"operands": [null
]
}
]
After applying this patch:
# echo 0 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
0xffffffffc02c7000:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
0xffffffffc02cf000:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "0xffffffffc02c7000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "0xffffffffc02cf000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
# echo 1 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
bpf_prog_b811aab41a39ad3d_foo:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
bpf_prog_cf418ac8b67bebd9_F:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "bpf_prog_b811aab41a39ad3d_foo",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "bpf_prog_cf418ac8b67bebd9_F",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-05-24 14:56:54 +08:00
|
|
|
if (info.nr_jited_func_lens && info.jited_func_lens) {
|
|
|
|
struct kernel_sym *sym = NULL;
|
|
|
|
char sym_name[SYM_MAX_NAME];
|
|
|
|
unsigned char *img = buf;
|
|
|
|
__u64 *ksyms = NULL;
|
|
|
|
__u32 *lens;
|
|
|
|
__u32 i;
|
|
|
|
|
|
|
|
if (info.nr_jited_ksyms) {
|
|
|
|
kernel_syms_load(&dd);
|
|
|
|
ksyms = (__u64 *) info.jited_ksyms;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (json_output)
|
|
|
|
jsonw_start_array(json_wtr);
|
|
|
|
|
|
|
|
lens = (__u32 *) info.jited_func_lens;
|
|
|
|
for (i = 0; i < info.nr_jited_func_lens; i++) {
|
|
|
|
if (ksyms) {
|
|
|
|
sym = kernel_syms_search(&dd, ksyms[i]);
|
|
|
|
if (sym)
|
|
|
|
sprintf(sym_name, "%s", sym->name);
|
|
|
|
else
|
|
|
|
sprintf(sym_name, "0x%016llx", ksyms[i]);
|
|
|
|
} else {
|
|
|
|
strcpy(sym_name, "unknown");
|
|
|
|
}
|
|
|
|
|
|
|
|
if (json_output) {
|
|
|
|
jsonw_start_object(json_wtr);
|
|
|
|
jsonw_name(json_wtr, "name");
|
|
|
|
jsonw_string(json_wtr, sym_name);
|
|
|
|
jsonw_name(json_wtr, "insns");
|
|
|
|
} else {
|
|
|
|
printf("%s:\n", sym_name);
|
|
|
|
}
|
|
|
|
|
|
|
|
disasm_print_insn(img, lens[i], opcodes, name);
|
|
|
|
img += lens[i];
|
|
|
|
|
|
|
|
if (json_output)
|
|
|
|
jsonw_end_object(json_wtr);
|
|
|
|
else
|
|
|
|
printf("\n");
|
|
|
|
}
|
|
|
|
|
|
|
|
if (json_output)
|
|
|
|
jsonw_end_array(json_wtr);
|
|
|
|
} else {
|
|
|
|
disasm_print_insn(buf, *member_len, opcodes, name);
|
|
|
|
}
|
2018-03-02 10:01:22 +08:00
|
|
|
} else if (visual) {
|
|
|
|
if (json_output)
|
|
|
|
jsonw_null(json_wtr);
|
|
|
|
else
|
|
|
|
dump_xlated_cfg(buf, *member_len);
|
2018-03-02 10:01:16 +08:00
|
|
|
} else {
|
|
|
|
kernel_syms_load(&dd);
|
2018-05-24 14:56:50 +08:00
|
|
|
dd.nr_jited_ksyms = info.nr_jited_ksyms;
|
|
|
|
dd.jited_ksyms = (__u64 *) info.jited_ksyms;
|
|
|
|
|
2018-03-02 10:01:16 +08:00
|
|
|
if (json_output)
|
|
|
|
dump_xlated_json(&dd, buf, *member_len, opcodes);
|
|
|
|
else
|
|
|
|
dump_xlated_plain(&dd, buf, *member_len, opcodes);
|
|
|
|
kernel_syms_destroy(&dd);
|
2017-10-05 11:10:04 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
free(buf);
|
2018-05-24 14:56:50 +08:00
|
|
|
free(func_ksyms);
|
tools: bpftool: add delimiters to multi-function JITed dumps
This splits up the contiguous JITed dump obtained via the bpf
system call into more relatable chunks for each function in
the program. If the kernel symbols corresponding to these are
known, they are printed in the header for each JIT image dump
otherwise the masked start address is printed.
Before applying this patch:
# bpftool prog dump jited id 1
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
72: push %rbp
73: mov %rsp,%rbp
...
dd: leaveq
de: retq
# bpftool -p prog dump jited id 1
[{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
},{
"pc": "0x72",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0xde",
"operation": "retq",
"operands": [null
]
}
]
After applying this patch:
# echo 0 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
0xffffffffc02c7000:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
0xffffffffc02cf000:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "0xffffffffc02c7000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "0xffffffffc02cf000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
# echo 1 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
bpf_prog_b811aab41a39ad3d_foo:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
bpf_prog_cf418ac8b67bebd9_F:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "bpf_prog_b811aab41a39ad3d_foo",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "bpf_prog_cf418ac8b67bebd9_F",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-05-24 14:56:54 +08:00
|
|
|
free(func_lens);
|
2017-10-05 11:10:04 +08:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
err_free:
|
|
|
|
free(buf);
|
2018-05-24 14:56:50 +08:00
|
|
|
free(func_ksyms);
|
tools: bpftool: add delimiters to multi-function JITed dumps
This splits up the contiguous JITed dump obtained via the bpf
system call into more relatable chunks for each function in
the program. If the kernel symbols corresponding to these are
known, they are printed in the header for each JIT image dump
otherwise the masked start address is printed.
Before applying this patch:
# bpftool prog dump jited id 1
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
72: push %rbp
73: mov %rsp,%rbp
...
dd: leaveq
de: retq
# bpftool -p prog dump jited id 1
[{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
},{
"pc": "0x72",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0xde",
"operation": "retq",
"operands": [null
]
}
]
After applying this patch:
# echo 0 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
0xffffffffc02c7000:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
0xffffffffc02cf000:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "0xffffffffc02c7000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "0xffffffffc02cf000",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
# echo 1 > /proc/sys/net/core/bpf_jit_kallsyms
# bpftool prog dump jited id 1
bpf_prog_b811aab41a39ad3d_foo:
0: push %rbp
1: mov %rsp,%rbp
...
70: leaveq
71: retq
bpf_prog_cf418ac8b67bebd9_F:
0: push %rbp
1: mov %rsp,%rbp
...
6b: leaveq
6c: retq
# bpftool -p prog dump jited id 1
[{
"name": "bpf_prog_b811aab41a39ad3d_foo",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x71",
"operation": "retq",
"operands": [null
]
}
]
},{
"name": "bpf_prog_cf418ac8b67bebd9_F",
"insns": [{
"pc": "0x0",
"operation": "push",
"operands": ["%rbp"
]
},{
...
},{
"pc": "0x6c",
"operation": "retq",
"operands": [null
]
}
]
}
]
Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-05-24 14:56:54 +08:00
|
|
|
free(func_lens);
|
2017-10-05 11:10:04 +08:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int do_pin(int argc, char **argv)
|
|
|
|
{
|
2017-10-24 00:24:14 +08:00
|
|
|
int err;
|
|
|
|
|
|
|
|
err = do_pin_any(argc, argv, bpf_prog_get_fd_by_id);
|
|
|
|
if (!err && json_output)
|
|
|
|
jsonw_null(json_wtr);
|
|
|
|
return err;
|
2017-10-05 11:10:04 +08:00
|
|
|
}
|
|
|
|
|
2017-12-13 23:18:53 +08:00
|
|
|
static int do_load(int argc, char **argv)
|
|
|
|
{
|
2018-07-11 05:42:57 +08:00
|
|
|
const char *objfile, *pinfile;
|
2017-12-13 23:18:53 +08:00
|
|
|
struct bpf_object *obj;
|
|
|
|
int prog_fd;
|
|
|
|
|
2018-07-11 05:42:57 +08:00
|
|
|
if (!REQ_ARGS(2))
|
|
|
|
return -1;
|
|
|
|
objfile = GET_ARG();
|
|
|
|
pinfile = GET_ARG();
|
2017-12-13 23:18:53 +08:00
|
|
|
|
2018-07-11 05:42:57 +08:00
|
|
|
if (bpf_prog_load(objfile, BPF_PROG_TYPE_UNSPEC, &obj, &prog_fd)) {
|
2018-01-03 06:48:37 +08:00
|
|
|
p_err("failed to load program");
|
2017-12-13 23:18:53 +08:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2018-07-11 05:42:57 +08:00
|
|
|
if (do_pin_fd(prog_fd, pinfile))
|
2018-06-21 02:42:46 +08:00
|
|
|
goto err_close_obj;
|
2017-12-13 23:18:53 +08:00
|
|
|
|
|
|
|
if (json_output)
|
|
|
|
jsonw_null(json_wtr);
|
|
|
|
|
2018-06-21 02:42:46 +08:00
|
|
|
bpf_object__close(obj);
|
|
|
|
|
2017-12-13 23:18:53 +08:00
|
|
|
return 0;
|
2018-06-21 02:42:46 +08:00
|
|
|
|
|
|
|
err_close_obj:
|
|
|
|
bpf_object__close(obj);
|
|
|
|
return -1;
|
2017-12-13 23:18:53 +08:00
|
|
|
}
|
|
|
|
|
2017-10-05 11:10:04 +08:00
|
|
|
static int do_help(int argc, char **argv)
|
|
|
|
{
|
2017-10-24 00:24:14 +08:00
|
|
|
if (json_output) {
|
|
|
|
jsonw_null(json_wtr);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2017-10-05 11:10:04 +08:00
|
|
|
fprintf(stderr,
|
2018-01-03 06:48:36 +08:00
|
|
|
"Usage: %s %s { show | list } [PROG]\n"
|
2018-03-02 10:01:22 +08:00
|
|
|
" %s %s dump xlated PROG [{ file FILE | opcodes | visual }]\n"
|
2017-10-20 06:46:25 +08:00
|
|
|
" %s %s dump jited PROG [{ file FILE | opcodes }]\n"
|
2017-10-05 11:10:04 +08:00
|
|
|
" %s %s pin PROG FILE\n"
|
2017-12-13 23:18:53 +08:00
|
|
|
" %s %s load OBJ FILE\n"
|
2017-10-05 11:10:04 +08:00
|
|
|
" %s %s help\n"
|
|
|
|
"\n"
|
|
|
|
" " HELP_SPEC_PROGRAM "\n"
|
2017-10-24 00:24:16 +08:00
|
|
|
" " HELP_SPEC_OPTIONS "\n"
|
2017-10-05 11:10:04 +08:00
|
|
|
"",
|
|
|
|
bin_name, argv[-2], bin_name, argv[-2], bin_name, argv[-2],
|
2017-12-13 23:18:53 +08:00
|
|
|
bin_name, argv[-2], bin_name, argv[-2], bin_name, argv[-2]);
|
2017-10-05 11:10:04 +08:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static const struct cmd cmds[] = {
|
|
|
|
{ "show", do_show },
|
2018-01-03 06:48:36 +08:00
|
|
|
{ "list", do_show },
|
2017-10-20 06:46:22 +08:00
|
|
|
{ "help", do_help },
|
2017-10-05 11:10:04 +08:00
|
|
|
{ "dump", do_dump },
|
|
|
|
{ "pin", do_pin },
|
2017-12-13 23:18:53 +08:00
|
|
|
{ "load", do_load },
|
2017-10-05 11:10:04 +08:00
|
|
|
{ 0 }
|
|
|
|
};
|
|
|
|
|
|
|
|
int do_prog(int argc, char **argv)
|
|
|
|
{
|
|
|
|
return cmd_select(cmds, argc, argv, do_help);
|
|
|
|
}
|