143448428SQuentin Monnet.. SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) 243448428SQuentin Monnet 3cb21ac58SAndrii Nakryiko================ 4cb21ac58SAndrii Nakryikobpftool-gen 5cb21ac58SAndrii Nakryiko================ 6cb21ac58SAndrii Nakryiko------------------------------------------------------------------------------- 7cb21ac58SAndrii Nakryikotool for BPF code-generation 8cb21ac58SAndrii Nakryiko------------------------------------------------------------------------------- 9cb21ac58SAndrii Nakryiko 10cb21ac58SAndrii Nakryiko:Manual section: 8 11cb21ac58SAndrii Nakryiko 12b6231815SQuentin Monnet.. include:: substitutions.rst 13b6231815SQuentin Monnet 14cb21ac58SAndrii NakryikoSYNOPSIS 15cb21ac58SAndrii Nakryiko======== 16cb21ac58SAndrii Nakryiko 17cb21ac58SAndrii Nakryiko **bpftool** [*OPTIONS*] **gen** *COMMAND* 18cb21ac58SAndrii Nakryiko 19b6231815SQuentin Monnet *OPTIONS* := { |COMMON_OPTIONS| | { **-L** | **--use-loader** } } 20cb21ac58SAndrii Nakryiko 21d80b2fcbSAndrii Nakryiko *COMMAND* := { **object** | **skeleton** | **help** } 22cb21ac58SAndrii Nakryiko 23cb21ac58SAndrii NakryikoGEN COMMANDS 24cb21ac58SAndrii Nakryiko============= 25cb21ac58SAndrii Nakryiko 26d80b2fcbSAndrii Nakryiko| **bpftool** **gen object** *OUTPUT_FILE* *INPUT_FILE* [*INPUT_FILE*...] 27c4122665SAndrii Nakryiko| **bpftool** **gen skeleton** *FILE* [**name** *OBJECT_NAME*] 28*1d1ffbf7SRafael David Tinoco| **bpftool** **gen min_core_btf** *INPUT* *OUTPUT* *OBJECT* [*OBJECT*...] 29cb21ac58SAndrii Nakryiko| **bpftool** **gen help** 30cb21ac58SAndrii Nakryiko 31cb21ac58SAndrii NakryikoDESCRIPTION 32cb21ac58SAndrii Nakryiko=========== 33d80b2fcbSAndrii Nakryiko **bpftool gen object** *OUTPUT_FILE* *INPUT_FILE* [*INPUT_FILE*...] 34d80b2fcbSAndrii Nakryiko Statically link (combine) together one or more *INPUT_FILE*'s 35d80b2fcbSAndrii Nakryiko into a single resulting *OUTPUT_FILE*. All the files involved 36d80b2fcbSAndrii Nakryiko are BPF ELF object files. 37d80b2fcbSAndrii Nakryiko 38d80b2fcbSAndrii Nakryiko The rules of BPF static linking are mostly the same as for 39d80b2fcbSAndrii Nakryiko user-space object files, but in addition to combining data 40d80b2fcbSAndrii Nakryiko and instruction sections, .BTF and .BTF.ext (if present in 41d80b2fcbSAndrii Nakryiko any of the input files) data are combined together. .BTF 42d80b2fcbSAndrii Nakryiko data is deduplicated, so all the common types across 43d80b2fcbSAndrii Nakryiko *INPUT_FILE*'s will only be represented once in the resulting 44d80b2fcbSAndrii Nakryiko BTF information. 45d80b2fcbSAndrii Nakryiko 46d80b2fcbSAndrii Nakryiko BPF static linking allows to partition BPF source code into 47d80b2fcbSAndrii Nakryiko individually compiled files that are then linked into 48d80b2fcbSAndrii Nakryiko a single resulting BPF object file, which can be used to 49d80b2fcbSAndrii Nakryiko generated BPF skeleton (with **gen skeleton** command) or 50d80b2fcbSAndrii Nakryiko passed directly into **libbpf** (using **bpf_object__open()** 51d80b2fcbSAndrii Nakryiko family of APIs). 52d80b2fcbSAndrii Nakryiko 53cb21ac58SAndrii Nakryiko **bpftool gen skeleton** *FILE* 54cb21ac58SAndrii Nakryiko Generate BPF skeleton C header file for a given *FILE*. 55cb21ac58SAndrii Nakryiko 56cb21ac58SAndrii Nakryiko BPF skeleton is an alternative interface to existing libbpf 57cb21ac58SAndrii Nakryiko APIs for working with BPF objects. Skeleton code is intended 58cb21ac58SAndrii Nakryiko to significantly shorten and simplify code to load and work 59cb21ac58SAndrii Nakryiko with BPF programs from userspace side. Generated code is 60cb21ac58SAndrii Nakryiko tailored to specific input BPF object *FILE*, reflecting its 61cb21ac58SAndrii Nakryiko structure by listing out available maps, program, variables, 62cb21ac58SAndrii Nakryiko etc. Skeleton eliminates the need to lookup mentioned 63cb21ac58SAndrii Nakryiko components by name. Instead, if skeleton instantiation 64cb21ac58SAndrii Nakryiko succeeds, they are populated in skeleton structure as valid 65c8caa0bbSQuentin Monnet libbpf types (e.g., **struct bpf_map** pointer) and can be 66cb21ac58SAndrii Nakryiko passed to existing generic libbpf APIs. 67cb21ac58SAndrii Nakryiko 68cb21ac58SAndrii Nakryiko In addition to simple and reliable access to maps and 69c8caa0bbSQuentin Monnet programs, skeleton provides a storage for BPF links (**struct 70c8caa0bbSQuentin Monnet bpf_link**) for each BPF program within BPF object. When 71cb21ac58SAndrii Nakryiko requested, supported BPF programs will be automatically 72cb21ac58SAndrii Nakryiko attached and resulting BPF links stored for further use by 73cb21ac58SAndrii Nakryiko user in pre-allocated fields in skeleton struct. For BPF 74cb21ac58SAndrii Nakryiko programs that can't be automatically attached by libbpf, 75cb21ac58SAndrii Nakryiko user can attach them manually, but store resulting BPF link 76cb21ac58SAndrii Nakryiko in per-program link field. All such set up links will be 77cb21ac58SAndrii Nakryiko automatically destroyed on BPF skeleton destruction. This 78cb21ac58SAndrii Nakryiko eliminates the need for users to manage links manually and 79cb21ac58SAndrii Nakryiko rely on libbpf support to detach programs and free up 80cb21ac58SAndrii Nakryiko resources. 81cb21ac58SAndrii Nakryiko 82cb21ac58SAndrii Nakryiko Another facility provided by BPF skeleton is an interface to 83cb21ac58SAndrii Nakryiko global variables of all supported kinds: mutable, read-only, 84cb21ac58SAndrii Nakryiko as well as extern ones. This interface allows to pre-setup 85cb21ac58SAndrii Nakryiko initial values of variables before BPF object is loaded and 86cb21ac58SAndrii Nakryiko verified by kernel. For non-read-only variables, the same 87cb21ac58SAndrii Nakryiko interface can be used to fetch values of global variables on 88cb21ac58SAndrii Nakryiko userspace side, even if they are modified by BPF code. 89cb21ac58SAndrii Nakryiko 90cb21ac58SAndrii Nakryiko During skeleton generation, contents of source BPF object 91cb21ac58SAndrii Nakryiko *FILE* is embedded within generated code and is thus not 92cb21ac58SAndrii Nakryiko necessary to keep around. This ensures skeleton and BPF 93cb21ac58SAndrii Nakryiko object file are matching 1-to-1 and always stay in sync. 94cb21ac58SAndrii Nakryiko Generated code is dual-licensed under LGPL-2.1 and 95cb21ac58SAndrii Nakryiko BSD-2-Clause licenses. 96cb21ac58SAndrii Nakryiko 97cb21ac58SAndrii Nakryiko It is a design goal and guarantee that skeleton interfaces 98cb21ac58SAndrii Nakryiko are interoperable with generic libbpf APIs. User should 99cb21ac58SAndrii Nakryiko always be able to use skeleton API to create and load BPF 100cb21ac58SAndrii Nakryiko object, and later use libbpf APIs to keep working with 101cb21ac58SAndrii Nakryiko specific maps, programs, etc. 102cb21ac58SAndrii Nakryiko 103cb21ac58SAndrii Nakryiko As part of skeleton, few custom functions are generated. 104c4122665SAndrii Nakryiko Each of them is prefixed with object name. Object name can 105c4122665SAndrii Nakryiko either be derived from object file name, i.e., if BPF object 106c4122665SAndrii Nakryiko file name is **example.o**, BPF object name will be 107c4122665SAndrii Nakryiko **example**. Object name can be also specified explicitly 108c4122665SAndrii Nakryiko through **name** *OBJECT_NAME* parameter. The following 109c4122665SAndrii Nakryiko custom functions are provided (assuming **example** as 110c4122665SAndrii Nakryiko the object name): 111cb21ac58SAndrii Nakryiko 112cb21ac58SAndrii Nakryiko - **example__open** and **example__open_opts**. 113cb21ac58SAndrii Nakryiko These functions are used to instantiate skeleton. It 114c8caa0bbSQuentin Monnet corresponds to libbpf's **bpf_object__open**\ () API. 115cb21ac58SAndrii Nakryiko **_opts** variants accepts extra **bpf_object_open_opts** 116cb21ac58SAndrii Nakryiko options. 117cb21ac58SAndrii Nakryiko 118cb21ac58SAndrii Nakryiko - **example__load**. 119cb21ac58SAndrii Nakryiko This function creates maps, loads and verifies BPF 120cb21ac58SAndrii Nakryiko programs, initializes global data maps. It corresponds to 121c8caa0bbSQuentin Monnet libppf's **bpf_object__load**\ () API. 122cb21ac58SAndrii Nakryiko 123cb21ac58SAndrii Nakryiko - **example__open_and_load** combines **example__open** and 124cb21ac58SAndrii Nakryiko **example__load** invocations in one commonly used 125cb21ac58SAndrii Nakryiko operation. 126cb21ac58SAndrii Nakryiko 127cb21ac58SAndrii Nakryiko - **example__attach** and **example__detach** 128cb21ac58SAndrii Nakryiko This pair of functions allow to attach and detach, 129cb21ac58SAndrii Nakryiko correspondingly, already loaded BPF object. Only BPF 130cb21ac58SAndrii Nakryiko programs of types supported by libbpf for auto-attachment 131cb21ac58SAndrii Nakryiko will be auto-attached and their corresponding BPF links 132cb21ac58SAndrii Nakryiko instantiated. For other BPF programs, user can manually 133cb21ac58SAndrii Nakryiko create a BPF link and assign it to corresponding fields in 134cb21ac58SAndrii Nakryiko skeleton struct. **example__detach** will detach both 135cb21ac58SAndrii Nakryiko links created automatically, as well as those populated by 136cb21ac58SAndrii Nakryiko user manually. 137cb21ac58SAndrii Nakryiko 138cb21ac58SAndrii Nakryiko - **example__destroy** 139cb21ac58SAndrii Nakryiko Detach and unload BPF programs, free up all the resources 140cb21ac58SAndrii Nakryiko used by skeleton and BPF object. 141cb21ac58SAndrii Nakryiko 142cb21ac58SAndrii Nakryiko If BPF object has global variables, corresponding structs 143cb21ac58SAndrii Nakryiko with memory layout corresponding to global data data section 144dacce641SAndrii Nakryiko layout will be created. Currently supported ones are: *.data*, 145dacce641SAndrii Nakryiko *.bss*, *.rodata*, and *.kconfig* structs/data sections. 146dacce641SAndrii Nakryiko These data sections/structs can be used to set up initial 147dacce641SAndrii Nakryiko values of variables, if set before **example__load**. 148dacce641SAndrii Nakryiko Afterwards, if target kernel supports memory-mapped BPF 149dacce641SAndrii Nakryiko arrays, same structs can be used to fetch and update 150dacce641SAndrii Nakryiko (non-read-only) data from userspace, with same simplicity 151dacce641SAndrii Nakryiko as for BPF side. 152cb21ac58SAndrii Nakryiko 153*1d1ffbf7SRafael David Tinoco **bpftool** **gen min_core_btf** *INPUT* *OUTPUT* *OBJECT* [*OBJECT*...] 154*1d1ffbf7SRafael David Tinoco Generate a minimum BTF file as *OUTPUT*, derived from a given 155*1d1ffbf7SRafael David Tinoco *INPUT* BTF file, containing all needed BTF types so one, or 156*1d1ffbf7SRafael David Tinoco more, given eBPF objects CO-RE relocations may be satisfied. 157*1d1ffbf7SRafael David Tinoco 158*1d1ffbf7SRafael David Tinoco When kernels aren't compiled with CONFIG_DEBUG_INFO_BTF, 159*1d1ffbf7SRafael David Tinoco libbpf, when loading an eBPF object, has to rely on external 160*1d1ffbf7SRafael David Tinoco BTF files to be able to calculate CO-RE relocations. 161*1d1ffbf7SRafael David Tinoco 162*1d1ffbf7SRafael David Tinoco Usually, an external BTF file is built from existing kernel 163*1d1ffbf7SRafael David Tinoco DWARF data using pahole. It contains all the types used by 164*1d1ffbf7SRafael David Tinoco its respective kernel image and, because of that, is big. 165*1d1ffbf7SRafael David Tinoco 166*1d1ffbf7SRafael David Tinoco The min_core_btf feature builds smaller BTF files, customized 167*1d1ffbf7SRafael David Tinoco to one or multiple eBPF objects, so they can be distributed 168*1d1ffbf7SRafael David Tinoco together with an eBPF CO-RE based application, turning the 169*1d1ffbf7SRafael David Tinoco application portable to different kernel versions. 170*1d1ffbf7SRafael David Tinoco 171*1d1ffbf7SRafael David Tinoco Check examples bellow for more information how to use it. 172*1d1ffbf7SRafael David Tinoco 173cb21ac58SAndrii Nakryiko **bpftool gen help** 174cb21ac58SAndrii Nakryiko Print short help message. 175cb21ac58SAndrii Nakryiko 176cb21ac58SAndrii NakryikoOPTIONS 177cb21ac58SAndrii Nakryiko======= 178f28ef96dSQuentin Monnet .. include:: common_options.rst 179cb21ac58SAndrii Nakryiko 1808cc8c635SQuentin Monnet -L, --use-loader 1818cc8c635SQuentin Monnet For skeletons, generate a "light" skeleton (also known as "loader" 1828cc8c635SQuentin Monnet skeleton). A light skeleton contains a loader eBPF program. It does 1838cc8c635SQuentin Monnet not use the majority of the libbpf infrastructure, and does not need 1848cc8c635SQuentin Monnet libelf. 1858cc8c635SQuentin Monnet 186cb21ac58SAndrii NakryikoEXAMPLES 187cb21ac58SAndrii Nakryiko======== 188d80b2fcbSAndrii Nakryiko**$ cat example1.bpf.c** 18916f3ddfbSQuentin Monnet 190cb21ac58SAndrii Nakryiko:: 191cb21ac58SAndrii Nakryiko 192cb21ac58SAndrii Nakryiko #include <stdbool.h> 193cb21ac58SAndrii Nakryiko #include <linux/ptrace.h> 194cb21ac58SAndrii Nakryiko #include <linux/bpf.h> 195d80b2fcbSAndrii Nakryiko #include <bpf/bpf_helpers.h> 196cb21ac58SAndrii Nakryiko 197cb21ac58SAndrii Nakryiko const volatile int param1 = 42; 198cb21ac58SAndrii Nakryiko bool global_flag = true; 199cb21ac58SAndrii Nakryiko struct { int x; } data = {}; 200cb21ac58SAndrii Nakryiko 201cb21ac58SAndrii Nakryiko SEC("raw_tp/sys_enter") 202cb21ac58SAndrii Nakryiko int handle_sys_enter(struct pt_regs *ctx) 203cb21ac58SAndrii Nakryiko { 204cb21ac58SAndrii Nakryiko static long my_static_var; 205cb21ac58SAndrii Nakryiko if (global_flag) 206cb21ac58SAndrii Nakryiko my_static_var++; 207cb21ac58SAndrii Nakryiko else 208cb21ac58SAndrii Nakryiko data.x += param1; 209cb21ac58SAndrii Nakryiko return 0; 210cb21ac58SAndrii Nakryiko } 211cb21ac58SAndrii Nakryiko 212d80b2fcbSAndrii Nakryiko**$ cat example2.bpf.c** 213d80b2fcbSAndrii Nakryiko 214d80b2fcbSAndrii Nakryiko:: 215d80b2fcbSAndrii Nakryiko 216d80b2fcbSAndrii Nakryiko #include <linux/ptrace.h> 217d80b2fcbSAndrii Nakryiko #include <linux/bpf.h> 218d80b2fcbSAndrii Nakryiko #include <bpf/bpf_helpers.h> 219d80b2fcbSAndrii Nakryiko 220d80b2fcbSAndrii Nakryiko struct { 221d80b2fcbSAndrii Nakryiko __uint(type, BPF_MAP_TYPE_HASH); 222d80b2fcbSAndrii Nakryiko __uint(max_entries, 128); 223d80b2fcbSAndrii Nakryiko __type(key, int); 224d80b2fcbSAndrii Nakryiko __type(value, long); 225d80b2fcbSAndrii Nakryiko } my_map SEC(".maps"); 226d80b2fcbSAndrii Nakryiko 227cb21ac58SAndrii Nakryiko SEC("raw_tp/sys_exit") 228cb21ac58SAndrii Nakryiko int handle_sys_exit(struct pt_regs *ctx) 229cb21ac58SAndrii Nakryiko { 230cb21ac58SAndrii Nakryiko int zero = 0; 231cb21ac58SAndrii Nakryiko bpf_map_lookup_elem(&my_map, &zero); 232cb21ac58SAndrii Nakryiko return 0; 233cb21ac58SAndrii Nakryiko } 234cb21ac58SAndrii Nakryiko 235cb21ac58SAndrii NakryikoThis is example BPF application with two BPF programs and a mix of BPF maps 236d80b2fcbSAndrii Nakryikoand global variables. Source code is split across two source code files. 237cb21ac58SAndrii Nakryiko 238d80b2fcbSAndrii Nakryiko**$ clang -target bpf -g example1.bpf.c -o example1.bpf.o** 239*1d1ffbf7SRafael David Tinoco 240d80b2fcbSAndrii Nakryiko**$ clang -target bpf -g example2.bpf.c -o example2.bpf.o** 241*1d1ffbf7SRafael David Tinoco 242d80b2fcbSAndrii Nakryiko**$ bpftool gen object example.bpf.o example1.bpf.o example2.bpf.o** 243d80b2fcbSAndrii Nakryiko 244d80b2fcbSAndrii NakryikoThis set of commands compiles *example1.bpf.c* and *example2.bpf.c* 245d80b2fcbSAndrii Nakryikoindividually and then statically links respective object files into the final 246d80b2fcbSAndrii NakryikoBPF ELF object file *example.bpf.o*. 247d80b2fcbSAndrii Nakryiko 248d80b2fcbSAndrii Nakryiko**$ bpftool gen skeleton example.bpf.o name example | tee example.skel.h** 24916f3ddfbSQuentin Monnet 250cb21ac58SAndrii Nakryiko:: 251cb21ac58SAndrii Nakryiko 252cb21ac58SAndrii Nakryiko /* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ 253cb21ac58SAndrii Nakryiko 254cb21ac58SAndrii Nakryiko /* THIS FILE IS AUTOGENERATED! */ 255cb21ac58SAndrii Nakryiko #ifndef __EXAMPLE_SKEL_H__ 256cb21ac58SAndrii Nakryiko #define __EXAMPLE_SKEL_H__ 257cb21ac58SAndrii Nakryiko 258cb21ac58SAndrii Nakryiko #include <stdlib.h> 259229c3b47SToke Høiland-Jørgensen #include <bpf/libbpf.h> 260cb21ac58SAndrii Nakryiko 261cb21ac58SAndrii Nakryiko struct example { 262cb21ac58SAndrii Nakryiko struct bpf_object_skeleton *skeleton; 263cb21ac58SAndrii Nakryiko struct bpf_object *obj; 264cb21ac58SAndrii Nakryiko struct { 265cb21ac58SAndrii Nakryiko struct bpf_map *rodata; 266cb21ac58SAndrii Nakryiko struct bpf_map *data; 267cb21ac58SAndrii Nakryiko struct bpf_map *bss; 268cb21ac58SAndrii Nakryiko struct bpf_map *my_map; 269cb21ac58SAndrii Nakryiko } maps; 270cb21ac58SAndrii Nakryiko struct { 271cb21ac58SAndrii Nakryiko struct bpf_program *handle_sys_enter; 272cb21ac58SAndrii Nakryiko struct bpf_program *handle_sys_exit; 273cb21ac58SAndrii Nakryiko } progs; 274cb21ac58SAndrii Nakryiko struct { 275cb21ac58SAndrii Nakryiko struct bpf_link *handle_sys_enter; 276cb21ac58SAndrii Nakryiko struct bpf_link *handle_sys_exit; 277cb21ac58SAndrii Nakryiko } links; 278cb21ac58SAndrii Nakryiko struct example__bss { 279cb21ac58SAndrii Nakryiko struct { 280cb21ac58SAndrii Nakryiko int x; 281cb21ac58SAndrii Nakryiko } data; 282cb21ac58SAndrii Nakryiko } *bss; 283cb21ac58SAndrii Nakryiko struct example__data { 284cb21ac58SAndrii Nakryiko _Bool global_flag; 285cb21ac58SAndrii Nakryiko long int handle_sys_enter_my_static_var; 286cb21ac58SAndrii Nakryiko } *data; 287cb21ac58SAndrii Nakryiko struct example__rodata { 288cb21ac58SAndrii Nakryiko int param1; 289cb21ac58SAndrii Nakryiko } *rodata; 290cb21ac58SAndrii Nakryiko }; 291cb21ac58SAndrii Nakryiko 292cb21ac58SAndrii Nakryiko static void example__destroy(struct example *obj); 293cb21ac58SAndrii Nakryiko static inline struct example *example__open_opts( 294cb21ac58SAndrii Nakryiko const struct bpf_object_open_opts *opts); 295cb21ac58SAndrii Nakryiko static inline struct example *example__open(); 296cb21ac58SAndrii Nakryiko static inline int example__load(struct example *obj); 297cb21ac58SAndrii Nakryiko static inline struct example *example__open_and_load(); 298cb21ac58SAndrii Nakryiko static inline int example__attach(struct example *obj); 299cb21ac58SAndrii Nakryiko static inline void example__detach(struct example *obj); 300cb21ac58SAndrii Nakryiko 301cb21ac58SAndrii Nakryiko #endif /* __EXAMPLE_SKEL_H__ */ 302cb21ac58SAndrii Nakryiko 303d80b2fcbSAndrii Nakryiko**$ cat example.c** 30416f3ddfbSQuentin Monnet 305cb21ac58SAndrii Nakryiko:: 306cb21ac58SAndrii Nakryiko 307cb21ac58SAndrii Nakryiko #include "example.skel.h" 308cb21ac58SAndrii Nakryiko 309cb21ac58SAndrii Nakryiko int main() 310cb21ac58SAndrii Nakryiko { 311cb21ac58SAndrii Nakryiko struct example *skel; 312cb21ac58SAndrii Nakryiko int err = 0; 313cb21ac58SAndrii Nakryiko 314cb21ac58SAndrii Nakryiko skel = example__open(); 315cb21ac58SAndrii Nakryiko if (!skel) 316cb21ac58SAndrii Nakryiko goto cleanup; 317cb21ac58SAndrii Nakryiko 318cb21ac58SAndrii Nakryiko skel->rodata->param1 = 128; 319cb21ac58SAndrii Nakryiko 320cb21ac58SAndrii Nakryiko err = example__load(skel); 321cb21ac58SAndrii Nakryiko if (err) 322cb21ac58SAndrii Nakryiko goto cleanup; 323cb21ac58SAndrii Nakryiko 324cb21ac58SAndrii Nakryiko err = example__attach(skel); 325cb21ac58SAndrii Nakryiko if (err) 326cb21ac58SAndrii Nakryiko goto cleanup; 327cb21ac58SAndrii Nakryiko 328cb21ac58SAndrii Nakryiko /* all libbpf APIs are usable */ 329cb21ac58SAndrii Nakryiko printf("my_map name: %s\n", bpf_map__name(skel->maps.my_map)); 330cb21ac58SAndrii Nakryiko printf("sys_enter prog FD: %d\n", 331cb21ac58SAndrii Nakryiko bpf_program__fd(skel->progs.handle_sys_enter)); 332cb21ac58SAndrii Nakryiko 333cb21ac58SAndrii Nakryiko /* detach and re-attach sys_exit program */ 334cb21ac58SAndrii Nakryiko bpf_link__destroy(skel->links.handle_sys_exit); 335cb21ac58SAndrii Nakryiko skel->links.handle_sys_exit = 336cb21ac58SAndrii Nakryiko bpf_program__attach(skel->progs.handle_sys_exit); 337cb21ac58SAndrii Nakryiko 338cb21ac58SAndrii Nakryiko printf("my_static_var: %ld\n", 339cb21ac58SAndrii Nakryiko skel->bss->handle_sys_enter_my_static_var); 340cb21ac58SAndrii Nakryiko 341cb21ac58SAndrii Nakryiko cleanup: 342cb21ac58SAndrii Nakryiko example__destroy(skel); 343cb21ac58SAndrii Nakryiko return err; 344cb21ac58SAndrii Nakryiko } 345cb21ac58SAndrii Nakryiko 346d80b2fcbSAndrii Nakryiko**# ./example** 34716f3ddfbSQuentin Monnet 348cb21ac58SAndrii Nakryiko:: 349cb21ac58SAndrii Nakryiko 350cb21ac58SAndrii Nakryiko my_map name: my_map 351cb21ac58SAndrii Nakryiko sys_enter prog FD: 8 352cb21ac58SAndrii Nakryiko my_static_var: 7 353cb21ac58SAndrii Nakryiko 354cb21ac58SAndrii NakryikoThis is a stripped-out version of skeleton generated for above example code. 355*1d1ffbf7SRafael David Tinoco 356*1d1ffbf7SRafael David Tinocomin_core_btf 357*1d1ffbf7SRafael David Tinoco------------ 358*1d1ffbf7SRafael David Tinoco 359*1d1ffbf7SRafael David Tinoco**$ bpftool btf dump file 5.4.0-example.btf format raw** 360*1d1ffbf7SRafael David Tinoco 361*1d1ffbf7SRafael David Tinoco:: 362*1d1ffbf7SRafael David Tinoco 363*1d1ffbf7SRafael David Tinoco [1] INT 'long unsigned int' size=8 bits_offset=0 nr_bits=64 encoding=(none) 364*1d1ffbf7SRafael David Tinoco [2] CONST '(anon)' type_id=1 365*1d1ffbf7SRafael David Tinoco [3] VOLATILE '(anon)' type_id=1 366*1d1ffbf7SRafael David Tinoco [4] ARRAY '(anon)' type_id=1 index_type_id=21 nr_elems=2 367*1d1ffbf7SRafael David Tinoco [5] PTR '(anon)' type_id=8 368*1d1ffbf7SRafael David Tinoco [6] CONST '(anon)' type_id=5 369*1d1ffbf7SRafael David Tinoco [7] INT 'char' size=1 bits_offset=0 nr_bits=8 encoding=(none) 370*1d1ffbf7SRafael David Tinoco [8] CONST '(anon)' type_id=7 371*1d1ffbf7SRafael David Tinoco [9] INT 'unsigned int' size=4 bits_offset=0 nr_bits=32 encoding=(none) 372*1d1ffbf7SRafael David Tinoco <long output> 373*1d1ffbf7SRafael David Tinoco 374*1d1ffbf7SRafael David Tinoco**$ bpftool btf dump file one.bpf.o format raw** 375*1d1ffbf7SRafael David Tinoco 376*1d1ffbf7SRafael David Tinoco:: 377*1d1ffbf7SRafael David Tinoco 378*1d1ffbf7SRafael David Tinoco [1] PTR '(anon)' type_id=2 379*1d1ffbf7SRafael David Tinoco [2] STRUCT 'trace_event_raw_sys_enter' size=64 vlen=4 380*1d1ffbf7SRafael David Tinoco 'ent' type_id=3 bits_offset=0 381*1d1ffbf7SRafael David Tinoco 'id' type_id=7 bits_offset=64 382*1d1ffbf7SRafael David Tinoco 'args' type_id=9 bits_offset=128 383*1d1ffbf7SRafael David Tinoco '__data' type_id=12 bits_offset=512 384*1d1ffbf7SRafael David Tinoco [3] STRUCT 'trace_entry' size=8 vlen=4 385*1d1ffbf7SRafael David Tinoco 'type' type_id=4 bits_offset=0 386*1d1ffbf7SRafael David Tinoco 'flags' type_id=5 bits_offset=16 387*1d1ffbf7SRafael David Tinoco 'preempt_count' type_id=5 bits_offset=24 388*1d1ffbf7SRafael David Tinoco <long output> 389*1d1ffbf7SRafael David Tinoco 390*1d1ffbf7SRafael David Tinoco**$ bpftool gen min_core_btf 5.4.0-example.btf 5.4.0-smaller.btf one.bpf.o** 391*1d1ffbf7SRafael David Tinoco 392*1d1ffbf7SRafael David Tinoco**$ bpftool btf dump file 5.4.0-smaller.btf format raw** 393*1d1ffbf7SRafael David Tinoco 394*1d1ffbf7SRafael David Tinoco:: 395*1d1ffbf7SRafael David Tinoco 396*1d1ffbf7SRafael David Tinoco [1] TYPEDEF 'pid_t' type_id=6 397*1d1ffbf7SRafael David Tinoco [2] STRUCT 'trace_event_raw_sys_enter' size=64 vlen=1 398*1d1ffbf7SRafael David Tinoco 'args' type_id=4 bits_offset=128 399*1d1ffbf7SRafael David Tinoco [3] STRUCT 'task_struct' size=9216 vlen=2 400*1d1ffbf7SRafael David Tinoco 'pid' type_id=1 bits_offset=17920 401*1d1ffbf7SRafael David Tinoco 'real_parent' type_id=7 bits_offset=18048 402*1d1ffbf7SRafael David Tinoco [4] ARRAY '(anon)' type_id=5 index_type_id=8 nr_elems=6 403*1d1ffbf7SRafael David Tinoco [5] INT 'long unsigned int' size=8 bits_offset=0 nr_bits=64 encoding=(none) 404*1d1ffbf7SRafael David Tinoco [6] TYPEDEF '__kernel_pid_t' type_id=8 405*1d1ffbf7SRafael David Tinoco [7] PTR '(anon)' type_id=3 406*1d1ffbf7SRafael David Tinoco [8] INT 'int' size=4 bits_offset=0 nr_bits=32 encoding=SIGNED 407*1d1ffbf7SRafael David Tinoco <end> 408*1d1ffbf7SRafael David Tinoco 409*1d1ffbf7SRafael David TinocoNow, the "5.4.0-smaller.btf" file may be used by libbpf as an external BTF file 410*1d1ffbf7SRafael David Tinocowhen loading the "one.bpf.o" object into the "5.4.0-example" kernel. Note that 411*1d1ffbf7SRafael David Tinocothe generated BTF file won't allow other eBPF objects to be loaded, just the 412*1d1ffbf7SRafael David Tinocoones given to min_core_btf. 413*1d1ffbf7SRafael David Tinoco 414*1d1ffbf7SRafael David Tinoco:: 415*1d1ffbf7SRafael David Tinoco 416*1d1ffbf7SRafael David Tinoco LIBBPF_OPTS(bpf_object_open_opts, opts, .btf_custom_path = "5.4.0-smaller.btf"); 417*1d1ffbf7SRafael David Tinoco struct bpf_object *obj; 418*1d1ffbf7SRafael David Tinoco 419*1d1ffbf7SRafael David Tinoco obj = bpf_object__open_file("one.bpf.o", &opts); 420*1d1ffbf7SRafael David Tinoco 421*1d1ffbf7SRafael David Tinoco ... 422