143448428SQuentin Monnet.. SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) 243448428SQuentin Monnet 3cb21ac58SAndrii Nakryiko================ 4cb21ac58SAndrii Nakryikobpftool-gen 5cb21ac58SAndrii Nakryiko================ 6cb21ac58SAndrii Nakryiko------------------------------------------------------------------------------- 7cb21ac58SAndrii Nakryikotool for BPF code-generation 8cb21ac58SAndrii Nakryiko------------------------------------------------------------------------------- 9cb21ac58SAndrii Nakryiko 10cb21ac58SAndrii Nakryiko:Manual section: 8 11cb21ac58SAndrii Nakryiko 12b6231815SQuentin Monnet.. include:: substitutions.rst 13b6231815SQuentin Monnet 14cb21ac58SAndrii NakryikoSYNOPSIS 15cb21ac58SAndrii Nakryiko======== 16cb21ac58SAndrii Nakryiko 17cb21ac58SAndrii Nakryiko **bpftool** [*OPTIONS*] **gen** *COMMAND* 18cb21ac58SAndrii Nakryiko 19b6231815SQuentin Monnet *OPTIONS* := { |COMMON_OPTIONS| | { **-L** | **--use-loader** } } 20cb21ac58SAndrii Nakryiko 21d80b2fcbSAndrii Nakryiko *COMMAND* := { **object** | **skeleton** | **help** } 22cb21ac58SAndrii Nakryiko 23cb21ac58SAndrii NakryikoGEN COMMANDS 24cb21ac58SAndrii Nakryiko============= 25cb21ac58SAndrii Nakryiko 26d80b2fcbSAndrii Nakryiko| **bpftool** **gen object** *OUTPUT_FILE* *INPUT_FILE* [*INPUT_FILE*...] 27c4122665SAndrii Nakryiko| **bpftool** **gen skeleton** *FILE* [**name** *OBJECT_NAME*] 2800389c58SDelyan Kratunov| **bpftool** **gen subskeleton** *FILE* [**name** *OBJECT_NAME*] 291d1ffbf7SRafael David Tinoco| **bpftool** **gen min_core_btf** *INPUT* *OUTPUT* *OBJECT* [*OBJECT*...] 30cb21ac58SAndrii Nakryiko| **bpftool** **gen help** 31cb21ac58SAndrii Nakryiko 32cb21ac58SAndrii NakryikoDESCRIPTION 33cb21ac58SAndrii Nakryiko=========== 34d80b2fcbSAndrii Nakryiko **bpftool gen object** *OUTPUT_FILE* *INPUT_FILE* [*INPUT_FILE*...] 35d80b2fcbSAndrii Nakryiko Statically link (combine) together one or more *INPUT_FILE*'s 36d80b2fcbSAndrii Nakryiko into a single resulting *OUTPUT_FILE*. All the files involved 37d80b2fcbSAndrii Nakryiko are BPF ELF object files. 38d80b2fcbSAndrii Nakryiko 39d80b2fcbSAndrii Nakryiko The rules of BPF static linking are mostly the same as for 40d80b2fcbSAndrii Nakryiko user-space object files, but in addition to combining data 41d80b2fcbSAndrii Nakryiko and instruction sections, .BTF and .BTF.ext (if present in 42d80b2fcbSAndrii Nakryiko any of the input files) data are combined together. .BTF 43d80b2fcbSAndrii Nakryiko data is deduplicated, so all the common types across 44d80b2fcbSAndrii Nakryiko *INPUT_FILE*'s will only be represented once in the resulting 45d80b2fcbSAndrii Nakryiko BTF information. 46d80b2fcbSAndrii Nakryiko 47d80b2fcbSAndrii Nakryiko BPF static linking allows to partition BPF source code into 48d80b2fcbSAndrii Nakryiko individually compiled files that are then linked into 49d80b2fcbSAndrii Nakryiko a single resulting BPF object file, which can be used to 50d80b2fcbSAndrii Nakryiko generated BPF skeleton (with **gen skeleton** command) or 51d80b2fcbSAndrii Nakryiko passed directly into **libbpf** (using **bpf_object__open()** 52d80b2fcbSAndrii Nakryiko family of APIs). 53d80b2fcbSAndrii Nakryiko 54cb21ac58SAndrii Nakryiko **bpftool gen skeleton** *FILE* 55cb21ac58SAndrii Nakryiko Generate BPF skeleton C header file for a given *FILE*. 56cb21ac58SAndrii Nakryiko 57cb21ac58SAndrii Nakryiko BPF skeleton is an alternative interface to existing libbpf 58cb21ac58SAndrii Nakryiko APIs for working with BPF objects. Skeleton code is intended 59cb21ac58SAndrii Nakryiko to significantly shorten and simplify code to load and work 60cb21ac58SAndrii Nakryiko with BPF programs from userspace side. Generated code is 61cb21ac58SAndrii Nakryiko tailored to specific input BPF object *FILE*, reflecting its 62cb21ac58SAndrii Nakryiko structure by listing out available maps, program, variables, 63cb21ac58SAndrii Nakryiko etc. Skeleton eliminates the need to lookup mentioned 64cb21ac58SAndrii Nakryiko components by name. Instead, if skeleton instantiation 65cb21ac58SAndrii Nakryiko succeeds, they are populated in skeleton structure as valid 66c8caa0bbSQuentin Monnet libbpf types (e.g., **struct bpf_map** pointer) and can be 67cb21ac58SAndrii Nakryiko passed to existing generic libbpf APIs. 68cb21ac58SAndrii Nakryiko 69cb21ac58SAndrii Nakryiko In addition to simple and reliable access to maps and 70c8caa0bbSQuentin Monnet programs, skeleton provides a storage for BPF links (**struct 71c8caa0bbSQuentin Monnet bpf_link**) for each BPF program within BPF object. When 72cb21ac58SAndrii Nakryiko requested, supported BPF programs will be automatically 73cb21ac58SAndrii Nakryiko attached and resulting BPF links stored for further use by 74cb21ac58SAndrii Nakryiko user in pre-allocated fields in skeleton struct. For BPF 75cb21ac58SAndrii Nakryiko programs that can't be automatically attached by libbpf, 76cb21ac58SAndrii Nakryiko user can attach them manually, but store resulting BPF link 77cb21ac58SAndrii Nakryiko in per-program link field. All such set up links will be 78cb21ac58SAndrii Nakryiko automatically destroyed on BPF skeleton destruction. This 79cb21ac58SAndrii Nakryiko eliminates the need for users to manage links manually and 80cb21ac58SAndrii Nakryiko rely on libbpf support to detach programs and free up 81cb21ac58SAndrii Nakryiko resources. 82cb21ac58SAndrii Nakryiko 83cb21ac58SAndrii Nakryiko Another facility provided by BPF skeleton is an interface to 84cb21ac58SAndrii Nakryiko global variables of all supported kinds: mutable, read-only, 85cb21ac58SAndrii Nakryiko as well as extern ones. This interface allows to pre-setup 86cb21ac58SAndrii Nakryiko initial values of variables before BPF object is loaded and 87cb21ac58SAndrii Nakryiko verified by kernel. For non-read-only variables, the same 88cb21ac58SAndrii Nakryiko interface can be used to fetch values of global variables on 89cb21ac58SAndrii Nakryiko userspace side, even if they are modified by BPF code. 90cb21ac58SAndrii Nakryiko 91cb21ac58SAndrii Nakryiko During skeleton generation, contents of source BPF object 92cb21ac58SAndrii Nakryiko *FILE* is embedded within generated code and is thus not 93cb21ac58SAndrii Nakryiko necessary to keep around. This ensures skeleton and BPF 94cb21ac58SAndrii Nakryiko object file are matching 1-to-1 and always stay in sync. 95cb21ac58SAndrii Nakryiko Generated code is dual-licensed under LGPL-2.1 and 96cb21ac58SAndrii Nakryiko BSD-2-Clause licenses. 97cb21ac58SAndrii Nakryiko 98cb21ac58SAndrii Nakryiko It is a design goal and guarantee that skeleton interfaces 99cb21ac58SAndrii Nakryiko are interoperable with generic libbpf APIs. User should 100cb21ac58SAndrii Nakryiko always be able to use skeleton API to create and load BPF 101cb21ac58SAndrii Nakryiko object, and later use libbpf APIs to keep working with 102cb21ac58SAndrii Nakryiko specific maps, programs, etc. 103cb21ac58SAndrii Nakryiko 104cb21ac58SAndrii Nakryiko As part of skeleton, few custom functions are generated. 105c4122665SAndrii Nakryiko Each of them is prefixed with object name. Object name can 106c4122665SAndrii Nakryiko either be derived from object file name, i.e., if BPF object 107c4122665SAndrii Nakryiko file name is **example.o**, BPF object name will be 108c4122665SAndrii Nakryiko **example**. Object name can be also specified explicitly 109c4122665SAndrii Nakryiko through **name** *OBJECT_NAME* parameter. The following 110c4122665SAndrii Nakryiko custom functions are provided (assuming **example** as 111c4122665SAndrii Nakryiko the object name): 112cb21ac58SAndrii Nakryiko 113cb21ac58SAndrii Nakryiko - **example__open** and **example__open_opts**. 114cb21ac58SAndrii Nakryiko These functions are used to instantiate skeleton. It 115c8caa0bbSQuentin Monnet corresponds to libbpf's **bpf_object__open**\ () API. 116cb21ac58SAndrii Nakryiko **_opts** variants accepts extra **bpf_object_open_opts** 117cb21ac58SAndrii Nakryiko options. 118cb21ac58SAndrii Nakryiko 119cb21ac58SAndrii Nakryiko - **example__load**. 120cb21ac58SAndrii Nakryiko This function creates maps, loads and verifies BPF 121cb21ac58SAndrii Nakryiko programs, initializes global data maps. It corresponds to 122c8caa0bbSQuentin Monnet libppf's **bpf_object__load**\ () API. 123cb21ac58SAndrii Nakryiko 124cb21ac58SAndrii Nakryiko - **example__open_and_load** combines **example__open** and 125cb21ac58SAndrii Nakryiko **example__load** invocations in one commonly used 126cb21ac58SAndrii Nakryiko operation. 127cb21ac58SAndrii Nakryiko 128cb21ac58SAndrii Nakryiko - **example__attach** and **example__detach** 129cb21ac58SAndrii Nakryiko This pair of functions allow to attach and detach, 130cb21ac58SAndrii Nakryiko correspondingly, already loaded BPF object. Only BPF 131cb21ac58SAndrii Nakryiko programs of types supported by libbpf for auto-attachment 132cb21ac58SAndrii Nakryiko will be auto-attached and their corresponding BPF links 133cb21ac58SAndrii Nakryiko instantiated. For other BPF programs, user can manually 134cb21ac58SAndrii Nakryiko create a BPF link and assign it to corresponding fields in 135cb21ac58SAndrii Nakryiko skeleton struct. **example__detach** will detach both 136cb21ac58SAndrii Nakryiko links created automatically, as well as those populated by 137cb21ac58SAndrii Nakryiko user manually. 138cb21ac58SAndrii Nakryiko 139cb21ac58SAndrii Nakryiko - **example__destroy** 140cb21ac58SAndrii Nakryiko Detach and unload BPF programs, free up all the resources 141cb21ac58SAndrii Nakryiko used by skeleton and BPF object. 142cb21ac58SAndrii Nakryiko 143cb21ac58SAndrii Nakryiko If BPF object has global variables, corresponding structs 144cb21ac58SAndrii Nakryiko with memory layout corresponding to global data data section 145dacce641SAndrii Nakryiko layout will be created. Currently supported ones are: *.data*, 146dacce641SAndrii Nakryiko *.bss*, *.rodata*, and *.kconfig* structs/data sections. 147dacce641SAndrii Nakryiko These data sections/structs can be used to set up initial 148dacce641SAndrii Nakryiko values of variables, if set before **example__load**. 149dacce641SAndrii Nakryiko Afterwards, if target kernel supports memory-mapped BPF 150dacce641SAndrii Nakryiko arrays, same structs can be used to fetch and update 151dacce641SAndrii Nakryiko (non-read-only) data from userspace, with same simplicity 152dacce641SAndrii Nakryiko as for BPF side. 153cb21ac58SAndrii Nakryiko 15400389c58SDelyan Kratunov **bpftool gen subskeleton** *FILE* 15500389c58SDelyan Kratunov Generate BPF subskeleton C header file for a given *FILE*. 15600389c58SDelyan Kratunov 15700389c58SDelyan Kratunov Subskeletons are similar to skeletons, except they do not own 15800389c58SDelyan Kratunov the corresponding maps, programs, or global variables. They 15900389c58SDelyan Kratunov require that the object file used to generate them is already 16000389c58SDelyan Kratunov loaded into a *bpf_object* by some other means. 16100389c58SDelyan Kratunov 16200389c58SDelyan Kratunov This functionality is useful when a library is included into a 16300389c58SDelyan Kratunov larger BPF program. A subskeleton for the library would have 16400389c58SDelyan Kratunov access to all objects and globals defined in it, without 16500389c58SDelyan Kratunov having to know about the larger program. 16600389c58SDelyan Kratunov 16700389c58SDelyan Kratunov Consequently, there are only two functions defined 16800389c58SDelyan Kratunov for subskeletons: 16900389c58SDelyan Kratunov 17000389c58SDelyan Kratunov - **example__open(bpf_object\*)** 17100389c58SDelyan Kratunov Instantiates a subskeleton from an already opened (but not 17200389c58SDelyan Kratunov necessarily loaded) **bpf_object**. 17300389c58SDelyan Kratunov 17400389c58SDelyan Kratunov - **example__destroy()** 17500389c58SDelyan Kratunov Frees the storage for the subskeleton but *does not* unload 17600389c58SDelyan Kratunov any BPF programs or maps. 17700389c58SDelyan Kratunov 1781d1ffbf7SRafael David Tinoco **bpftool** **gen min_core_btf** *INPUT* *OUTPUT* *OBJECT* [*OBJECT*...] 1791d1ffbf7SRafael David Tinoco Generate a minimum BTF file as *OUTPUT*, derived from a given 1801d1ffbf7SRafael David Tinoco *INPUT* BTF file, containing all needed BTF types so one, or 1811d1ffbf7SRafael David Tinoco more, given eBPF objects CO-RE relocations may be satisfied. 1821d1ffbf7SRafael David Tinoco 1831d1ffbf7SRafael David Tinoco When kernels aren't compiled with CONFIG_DEBUG_INFO_BTF, 1841d1ffbf7SRafael David Tinoco libbpf, when loading an eBPF object, has to rely on external 1851d1ffbf7SRafael David Tinoco BTF files to be able to calculate CO-RE relocations. 1861d1ffbf7SRafael David Tinoco 1871d1ffbf7SRafael David Tinoco Usually, an external BTF file is built from existing kernel 1881d1ffbf7SRafael David Tinoco DWARF data using pahole. It contains all the types used by 1891d1ffbf7SRafael David Tinoco its respective kernel image and, because of that, is big. 1901d1ffbf7SRafael David Tinoco 1911d1ffbf7SRafael David Tinoco The min_core_btf feature builds smaller BTF files, customized 1921d1ffbf7SRafael David Tinoco to one or multiple eBPF objects, so they can be distributed 1931d1ffbf7SRafael David Tinoco together with an eBPF CO-RE based application, turning the 1941d1ffbf7SRafael David Tinoco application portable to different kernel versions. 1951d1ffbf7SRafael David Tinoco 1961d1ffbf7SRafael David Tinoco Check examples bellow for more information how to use it. 1971d1ffbf7SRafael David Tinoco 198cb21ac58SAndrii Nakryiko **bpftool gen help** 199cb21ac58SAndrii Nakryiko Print short help message. 200cb21ac58SAndrii Nakryiko 201cb21ac58SAndrii NakryikoOPTIONS 202cb21ac58SAndrii Nakryiko======= 203f28ef96dSQuentin Monnet .. include:: common_options.rst 204cb21ac58SAndrii Nakryiko 2058cc8c635SQuentin Monnet -L, --use-loader 2068cc8c635SQuentin Monnet For skeletons, generate a "light" skeleton (also known as "loader" 2078cc8c635SQuentin Monnet skeleton). A light skeleton contains a loader eBPF program. It does 2088cc8c635SQuentin Monnet not use the majority of the libbpf infrastructure, and does not need 2098cc8c635SQuentin Monnet libelf. 2108cc8c635SQuentin Monnet 211cb21ac58SAndrii NakryikoEXAMPLES 212cb21ac58SAndrii Nakryiko======== 213d80b2fcbSAndrii Nakryiko**$ cat example1.bpf.c** 21416f3ddfbSQuentin Monnet 215cb21ac58SAndrii Nakryiko:: 216cb21ac58SAndrii Nakryiko 217cb21ac58SAndrii Nakryiko #include <stdbool.h> 218cb21ac58SAndrii Nakryiko #include <linux/ptrace.h> 219cb21ac58SAndrii Nakryiko #include <linux/bpf.h> 220d80b2fcbSAndrii Nakryiko #include <bpf/bpf_helpers.h> 221cb21ac58SAndrii Nakryiko 222cb21ac58SAndrii Nakryiko const volatile int param1 = 42; 223cb21ac58SAndrii Nakryiko bool global_flag = true; 224cb21ac58SAndrii Nakryiko struct { int x; } data = {}; 225cb21ac58SAndrii Nakryiko 226cb21ac58SAndrii Nakryiko SEC("raw_tp/sys_enter") 227cb21ac58SAndrii Nakryiko int handle_sys_enter(struct pt_regs *ctx) 228cb21ac58SAndrii Nakryiko { 229cb21ac58SAndrii Nakryiko static long my_static_var; 230cb21ac58SAndrii Nakryiko if (global_flag) 231cb21ac58SAndrii Nakryiko my_static_var++; 232cb21ac58SAndrii Nakryiko else 233cb21ac58SAndrii Nakryiko data.x += param1; 234cb21ac58SAndrii Nakryiko return 0; 235cb21ac58SAndrii Nakryiko } 236cb21ac58SAndrii Nakryiko 237d80b2fcbSAndrii Nakryiko**$ cat example2.bpf.c** 238d80b2fcbSAndrii Nakryiko 239d80b2fcbSAndrii Nakryiko:: 240d80b2fcbSAndrii Nakryiko 241d80b2fcbSAndrii Nakryiko #include <linux/ptrace.h> 242d80b2fcbSAndrii Nakryiko #include <linux/bpf.h> 243d80b2fcbSAndrii Nakryiko #include <bpf/bpf_helpers.h> 244d80b2fcbSAndrii Nakryiko 245d80b2fcbSAndrii Nakryiko struct { 246d80b2fcbSAndrii Nakryiko __uint(type, BPF_MAP_TYPE_HASH); 247d80b2fcbSAndrii Nakryiko __uint(max_entries, 128); 248d80b2fcbSAndrii Nakryiko __type(key, int); 249d80b2fcbSAndrii Nakryiko __type(value, long); 250d80b2fcbSAndrii Nakryiko } my_map SEC(".maps"); 251d80b2fcbSAndrii Nakryiko 252cb21ac58SAndrii Nakryiko SEC("raw_tp/sys_exit") 253cb21ac58SAndrii Nakryiko int handle_sys_exit(struct pt_regs *ctx) 254cb21ac58SAndrii Nakryiko { 255cb21ac58SAndrii Nakryiko int zero = 0; 256cb21ac58SAndrii Nakryiko bpf_map_lookup_elem(&my_map, &zero); 257cb21ac58SAndrii Nakryiko return 0; 258cb21ac58SAndrii Nakryiko } 259cb21ac58SAndrii Nakryiko 260cb21ac58SAndrii NakryikoThis is example BPF application with two BPF programs and a mix of BPF maps 261d80b2fcbSAndrii Nakryikoand global variables. Source code is split across two source code files. 262cb21ac58SAndrii Nakryiko 263*bbaf1ff0SFangrui Song**$ clang --target=bpf -g example1.bpf.c -o example1.bpf.o** 2641d1ffbf7SRafael David Tinoco 265*bbaf1ff0SFangrui Song**$ clang --target=bpf -g example2.bpf.c -o example2.bpf.o** 2661d1ffbf7SRafael David Tinoco 267d80b2fcbSAndrii Nakryiko**$ bpftool gen object example.bpf.o example1.bpf.o example2.bpf.o** 268d80b2fcbSAndrii Nakryiko 269d80b2fcbSAndrii NakryikoThis set of commands compiles *example1.bpf.c* and *example2.bpf.c* 270d80b2fcbSAndrii Nakryikoindividually and then statically links respective object files into the final 271d80b2fcbSAndrii NakryikoBPF ELF object file *example.bpf.o*. 272d80b2fcbSAndrii Nakryiko 273d80b2fcbSAndrii Nakryiko**$ bpftool gen skeleton example.bpf.o name example | tee example.skel.h** 27416f3ddfbSQuentin Monnet 275cb21ac58SAndrii Nakryiko:: 276cb21ac58SAndrii Nakryiko 277cb21ac58SAndrii Nakryiko /* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ 278cb21ac58SAndrii Nakryiko 279cb21ac58SAndrii Nakryiko /* THIS FILE IS AUTOGENERATED! */ 280cb21ac58SAndrii Nakryiko #ifndef __EXAMPLE_SKEL_H__ 281cb21ac58SAndrii Nakryiko #define __EXAMPLE_SKEL_H__ 282cb21ac58SAndrii Nakryiko 283cb21ac58SAndrii Nakryiko #include <stdlib.h> 284229c3b47SToke Høiland-Jørgensen #include <bpf/libbpf.h> 285cb21ac58SAndrii Nakryiko 286cb21ac58SAndrii Nakryiko struct example { 287cb21ac58SAndrii Nakryiko struct bpf_object_skeleton *skeleton; 288cb21ac58SAndrii Nakryiko struct bpf_object *obj; 289cb21ac58SAndrii Nakryiko struct { 290cb21ac58SAndrii Nakryiko struct bpf_map *rodata; 291cb21ac58SAndrii Nakryiko struct bpf_map *data; 292cb21ac58SAndrii Nakryiko struct bpf_map *bss; 293cb21ac58SAndrii Nakryiko struct bpf_map *my_map; 294cb21ac58SAndrii Nakryiko } maps; 295cb21ac58SAndrii Nakryiko struct { 296cb21ac58SAndrii Nakryiko struct bpf_program *handle_sys_enter; 297cb21ac58SAndrii Nakryiko struct bpf_program *handle_sys_exit; 298cb21ac58SAndrii Nakryiko } progs; 299cb21ac58SAndrii Nakryiko struct { 300cb21ac58SAndrii Nakryiko struct bpf_link *handle_sys_enter; 301cb21ac58SAndrii Nakryiko struct bpf_link *handle_sys_exit; 302cb21ac58SAndrii Nakryiko } links; 303cb21ac58SAndrii Nakryiko struct example__bss { 304cb21ac58SAndrii Nakryiko struct { 305cb21ac58SAndrii Nakryiko int x; 306cb21ac58SAndrii Nakryiko } data; 307cb21ac58SAndrii Nakryiko } *bss; 308cb21ac58SAndrii Nakryiko struct example__data { 309cb21ac58SAndrii Nakryiko _Bool global_flag; 310cb21ac58SAndrii Nakryiko long int handle_sys_enter_my_static_var; 311cb21ac58SAndrii Nakryiko } *data; 312cb21ac58SAndrii Nakryiko struct example__rodata { 313cb21ac58SAndrii Nakryiko int param1; 314cb21ac58SAndrii Nakryiko } *rodata; 315cb21ac58SAndrii Nakryiko }; 316cb21ac58SAndrii Nakryiko 317cb21ac58SAndrii Nakryiko static void example__destroy(struct example *obj); 318cb21ac58SAndrii Nakryiko static inline struct example *example__open_opts( 319cb21ac58SAndrii Nakryiko const struct bpf_object_open_opts *opts); 320cb21ac58SAndrii Nakryiko static inline struct example *example__open(); 321cb21ac58SAndrii Nakryiko static inline int example__load(struct example *obj); 322cb21ac58SAndrii Nakryiko static inline struct example *example__open_and_load(); 323cb21ac58SAndrii Nakryiko static inline int example__attach(struct example *obj); 324cb21ac58SAndrii Nakryiko static inline void example__detach(struct example *obj); 325cb21ac58SAndrii Nakryiko 326cb21ac58SAndrii Nakryiko #endif /* __EXAMPLE_SKEL_H__ */ 327cb21ac58SAndrii Nakryiko 328d80b2fcbSAndrii Nakryiko**$ cat example.c** 32916f3ddfbSQuentin Monnet 330cb21ac58SAndrii Nakryiko:: 331cb21ac58SAndrii Nakryiko 332cb21ac58SAndrii Nakryiko #include "example.skel.h" 333cb21ac58SAndrii Nakryiko 334cb21ac58SAndrii Nakryiko int main() 335cb21ac58SAndrii Nakryiko { 336cb21ac58SAndrii Nakryiko struct example *skel; 337cb21ac58SAndrii Nakryiko int err = 0; 338cb21ac58SAndrii Nakryiko 339cb21ac58SAndrii Nakryiko skel = example__open(); 340cb21ac58SAndrii Nakryiko if (!skel) 341cb21ac58SAndrii Nakryiko goto cleanup; 342cb21ac58SAndrii Nakryiko 343cb21ac58SAndrii Nakryiko skel->rodata->param1 = 128; 344cb21ac58SAndrii Nakryiko 345cb21ac58SAndrii Nakryiko err = example__load(skel); 346cb21ac58SAndrii Nakryiko if (err) 347cb21ac58SAndrii Nakryiko goto cleanup; 348cb21ac58SAndrii Nakryiko 349cb21ac58SAndrii Nakryiko err = example__attach(skel); 350cb21ac58SAndrii Nakryiko if (err) 351cb21ac58SAndrii Nakryiko goto cleanup; 352cb21ac58SAndrii Nakryiko 353cb21ac58SAndrii Nakryiko /* all libbpf APIs are usable */ 354cb21ac58SAndrii Nakryiko printf("my_map name: %s\n", bpf_map__name(skel->maps.my_map)); 355cb21ac58SAndrii Nakryiko printf("sys_enter prog FD: %d\n", 356cb21ac58SAndrii Nakryiko bpf_program__fd(skel->progs.handle_sys_enter)); 357cb21ac58SAndrii Nakryiko 358cb21ac58SAndrii Nakryiko /* detach and re-attach sys_exit program */ 359cb21ac58SAndrii Nakryiko bpf_link__destroy(skel->links.handle_sys_exit); 360cb21ac58SAndrii Nakryiko skel->links.handle_sys_exit = 361cb21ac58SAndrii Nakryiko bpf_program__attach(skel->progs.handle_sys_exit); 362cb21ac58SAndrii Nakryiko 363cb21ac58SAndrii Nakryiko printf("my_static_var: %ld\n", 364cb21ac58SAndrii Nakryiko skel->bss->handle_sys_enter_my_static_var); 365cb21ac58SAndrii Nakryiko 366cb21ac58SAndrii Nakryiko cleanup: 367cb21ac58SAndrii Nakryiko example__destroy(skel); 368cb21ac58SAndrii Nakryiko return err; 369cb21ac58SAndrii Nakryiko } 370cb21ac58SAndrii Nakryiko 371d80b2fcbSAndrii Nakryiko**# ./example** 37216f3ddfbSQuentin Monnet 373cb21ac58SAndrii Nakryiko:: 374cb21ac58SAndrii Nakryiko 375cb21ac58SAndrii Nakryiko my_map name: my_map 376cb21ac58SAndrii Nakryiko sys_enter prog FD: 8 377cb21ac58SAndrii Nakryiko my_static_var: 7 378cb21ac58SAndrii Nakryiko 379cb21ac58SAndrii NakryikoThis is a stripped-out version of skeleton generated for above example code. 3801d1ffbf7SRafael David Tinoco 3811d1ffbf7SRafael David Tinocomin_core_btf 3821d1ffbf7SRafael David Tinoco------------ 3831d1ffbf7SRafael David Tinoco 3841d1ffbf7SRafael David Tinoco**$ bpftool btf dump file 5.4.0-example.btf format raw** 3851d1ffbf7SRafael David Tinoco 3861d1ffbf7SRafael David Tinoco:: 3871d1ffbf7SRafael David Tinoco 3881d1ffbf7SRafael David Tinoco [1] INT 'long unsigned int' size=8 bits_offset=0 nr_bits=64 encoding=(none) 3891d1ffbf7SRafael David Tinoco [2] CONST '(anon)' type_id=1 3901d1ffbf7SRafael David Tinoco [3] VOLATILE '(anon)' type_id=1 3911d1ffbf7SRafael David Tinoco [4] ARRAY '(anon)' type_id=1 index_type_id=21 nr_elems=2 3921d1ffbf7SRafael David Tinoco [5] PTR '(anon)' type_id=8 3931d1ffbf7SRafael David Tinoco [6] CONST '(anon)' type_id=5 3941d1ffbf7SRafael David Tinoco [7] INT 'char' size=1 bits_offset=0 nr_bits=8 encoding=(none) 3951d1ffbf7SRafael David Tinoco [8] CONST '(anon)' type_id=7 3961d1ffbf7SRafael David Tinoco [9] INT 'unsigned int' size=4 bits_offset=0 nr_bits=32 encoding=(none) 3971d1ffbf7SRafael David Tinoco <long output> 3981d1ffbf7SRafael David Tinoco 3991d1ffbf7SRafael David Tinoco**$ bpftool btf dump file one.bpf.o format raw** 4001d1ffbf7SRafael David Tinoco 4011d1ffbf7SRafael David Tinoco:: 4021d1ffbf7SRafael David Tinoco 4031d1ffbf7SRafael David Tinoco [1] PTR '(anon)' type_id=2 4041d1ffbf7SRafael David Tinoco [2] STRUCT 'trace_event_raw_sys_enter' size=64 vlen=4 4051d1ffbf7SRafael David Tinoco 'ent' type_id=3 bits_offset=0 4061d1ffbf7SRafael David Tinoco 'id' type_id=7 bits_offset=64 4071d1ffbf7SRafael David Tinoco 'args' type_id=9 bits_offset=128 4081d1ffbf7SRafael David Tinoco '__data' type_id=12 bits_offset=512 4091d1ffbf7SRafael David Tinoco [3] STRUCT 'trace_entry' size=8 vlen=4 4101d1ffbf7SRafael David Tinoco 'type' type_id=4 bits_offset=0 4111d1ffbf7SRafael David Tinoco 'flags' type_id=5 bits_offset=16 4121d1ffbf7SRafael David Tinoco 'preempt_count' type_id=5 bits_offset=24 4131d1ffbf7SRafael David Tinoco <long output> 4141d1ffbf7SRafael David Tinoco 4151d1ffbf7SRafael David Tinoco**$ bpftool gen min_core_btf 5.4.0-example.btf 5.4.0-smaller.btf one.bpf.o** 4161d1ffbf7SRafael David Tinoco 4171d1ffbf7SRafael David Tinoco**$ bpftool btf dump file 5.4.0-smaller.btf format raw** 4181d1ffbf7SRafael David Tinoco 4191d1ffbf7SRafael David Tinoco:: 4201d1ffbf7SRafael David Tinoco 4211d1ffbf7SRafael David Tinoco [1] TYPEDEF 'pid_t' type_id=6 4221d1ffbf7SRafael David Tinoco [2] STRUCT 'trace_event_raw_sys_enter' size=64 vlen=1 4231d1ffbf7SRafael David Tinoco 'args' type_id=4 bits_offset=128 4241d1ffbf7SRafael David Tinoco [3] STRUCT 'task_struct' size=9216 vlen=2 4251d1ffbf7SRafael David Tinoco 'pid' type_id=1 bits_offset=17920 4261d1ffbf7SRafael David Tinoco 'real_parent' type_id=7 bits_offset=18048 4271d1ffbf7SRafael David Tinoco [4] ARRAY '(anon)' type_id=5 index_type_id=8 nr_elems=6 4281d1ffbf7SRafael David Tinoco [5] INT 'long unsigned int' size=8 bits_offset=0 nr_bits=64 encoding=(none) 4291d1ffbf7SRafael David Tinoco [6] TYPEDEF '__kernel_pid_t' type_id=8 4301d1ffbf7SRafael David Tinoco [7] PTR '(anon)' type_id=3 4311d1ffbf7SRafael David Tinoco [8] INT 'int' size=4 bits_offset=0 nr_bits=32 encoding=SIGNED 4321d1ffbf7SRafael David Tinoco <end> 4331d1ffbf7SRafael David Tinoco 4341d1ffbf7SRafael David TinocoNow, the "5.4.0-smaller.btf" file may be used by libbpf as an external BTF file 4351d1ffbf7SRafael David Tinocowhen loading the "one.bpf.o" object into the "5.4.0-example" kernel. Note that 4361d1ffbf7SRafael David Tinocothe generated BTF file won't allow other eBPF objects to be loaded, just the 4371d1ffbf7SRafael David Tinocoones given to min_core_btf. 4381d1ffbf7SRafael David Tinoco 4391d1ffbf7SRafael David Tinoco:: 4401d1ffbf7SRafael David Tinoco 4411d1ffbf7SRafael David Tinoco LIBBPF_OPTS(bpf_object_open_opts, opts, .btf_custom_path = "5.4.0-smaller.btf"); 4421d1ffbf7SRafael David Tinoco struct bpf_object *obj; 4431d1ffbf7SRafael David Tinoco 4441d1ffbf7SRafael David Tinoco obj = bpf_object__open_file("one.bpf.o", &opts); 4451d1ffbf7SRafael David Tinoco 4461d1ffbf7SRafael David Tinoco ... 447