Google Git
Sign in
android / platform / external / bcc / refs/heads/simpleperf-release / . / libbpf-tools
tree: 895feb838fbb2b8cd32c900cac34fbb61aca9432 [path history] [tgz]
  1. android/
  2. arm64/
  3. loongarch/
  4. powerpc/
  5. riscv/
  6. x86/
  7. blazesym
  8. bpftool
  9. .gitignore
  10. Android.bp
  11. bashreadline.bpf.c
  12. bashreadline.c
  13. bashreadline.h
  14. bindsnoop.bpf.c
  15. bindsnoop.c
  16. bindsnoop.h
  17. biolatency.bpf.c
  18. biolatency.c
  19. biolatency.h
  20. biopattern.bpf.c
  21. biopattern.c
  22. biopattern.h
  23. biosnoop.bpf.c
  24. biosnoop.c
  25. biosnoop.h
  26. biostacks.bpf.c
  27. biostacks.c
  28. biostacks.h
  29. biotop.bpf.c
  30. biotop.c
  31. biotop.h
  32. bitesize.bpf.c
  33. bitesize.c
  34. bitesize.h
  35. bits.bpf.h
  36. blk_types.h
  37. btf_helpers.c
  38. btf_helpers.h
  39. cachestat.bpf.c
  40. cachestat.c
  41. capable.bpf.c
  42. capable.c
  43. capable.h
  44. compat.bpf.h
  45. compat.c
  46. compat.h
  47. core_fixes.bpf.h
  48. cpudist.bpf.c
  49. cpudist.c
  50. cpudist.h
  51. cpufreq.bpf.c
  52. cpufreq.c
  53. cpufreq.h
  54. drsnoop.bpf.c
  55. drsnoop.c
  56. drsnoop.h
  57. drsnoop_example.txt
  58. errno_helpers.c
  59. errno_helpers.h
  60. execsnoop.bpf.c
  61. execsnoop.c
  62. execsnoop.h
  63. exitsnoop.bpf.c
  64. exitsnoop.c
  65. exitsnoop.h
  66. filelife.bpf.c
  67. filelife.c
  68. filelife.h
  69. filetop.bpf.c
  70. filetop.c
  71. filetop.h
  72. fsdist.bpf.c
  73. fsdist.c
  74. fsdist.h
  75. fsslower.bpf.c
  76. fsslower.c
  77. fsslower.h
  78. funclatency.bpf.c
  79. funclatency.c
  80. funclatency.h
  81. gethostlatency.bpf.c
  82. gethostlatency.c
  83. gethostlatency.h
  84. hardirqs.bpf.c
  85. hardirqs.c
  86. hardirqs.h
  87. javagc.bpf.c
  88. javagc.c
  89. javagc.h
  90. kernel.config
  91. klockstat.bpf.c
  92. klockstat.c
  93. klockstat.h
  94. ksnoop.bpf.c
  95. ksnoop.c
  96. ksnoop.h
  97. llcstat.bpf.c
  98. llcstat.c
  99. llcstat.h
  100. Makefile
  101. Makefile.btfgen
  102. map_helpers.c
  103. map_helpers.h
  104. maps.bpf.h
  105. mdflush.bpf.c
  106. mdflush.c
  107. mdflush.h
  108. memleak.bpf.c
  109. memleak.c
  110. memleak.h
  111. mountsnoop.bpf.c
  112. mountsnoop.c
  113. mountsnoop.h
  114. numamove.bpf.c
  115. numamove.c
  116. offcputime.bpf.c
  117. offcputime.c
  118. offcputime.h
  119. oomkill.bpf.c
  120. oomkill.c
  121. oomkill.h
  122. opensnoop.bpf.c
  123. opensnoop.c
  124. opensnoop.h
  125. readahead.bpf.c
  126. readahead.c
  127. readahead.h
  128. README.md
  129. runqlat.bpf.c
  130. runqlat.c
  131. runqlat.h
  132. runqlen.bpf.c
  133. runqlen.c
  134. runqlen.h
  135. runqslower.bpf.c
  136. runqslower.c
  137. runqslower.h
  138. runqslower_example.txt
  139. sigsnoop.bpf.c
  140. sigsnoop.c
  141. sigsnoop.h
  142. sigsnoop_example.txt
  143. slabratetop.bpf.c
  144. slabratetop.c
  145. slabratetop.h
  146. softirqs.bpf.c
  147. softirqs.c
  148. softirqs.h
  149. solisten.bpf.c
  150. solisten.c
  151. solisten.h
  152. stat.h
  153. statsnoop.bpf.c
  154. statsnoop.c
  155. statsnoop.h
  156. syscall_helpers.c
  157. syscall_helpers.h
  158. syscount.bpf.c
  159. syscount.c
  160. syscount.h
  161. tcpconnect.bpf.c
  162. tcpconnect.c
  163. tcpconnect.h
  164. tcpconnlat.bpf.c
  165. tcpconnlat.c
  166. tcpconnlat.h
  167. tcplife.bpf.c
  168. tcplife.c
  169. tcplife.h
  170. tcppktlat.bpf.c
  171. tcppktlat.c
  172. tcppktlat.h
  173. tcppktlat_example.txt
  174. tcprtt.bpf.c
  175. tcprtt.c
  176. tcprtt.h
  177. tcpstates.bpf.c
  178. tcpstates.c
  179. tcpstates.h
  180. tcpsynbl.bpf.c
  181. tcpsynbl.c
  182. tcpsynbl.h
  183. tcptop.bpf.c
  184. tcptop.c
  185. tcptop.h
  186. tcptracer.bpf.c
  187. tcptracer.c
  188. tcptracer.h
  189. trace_helpers.c
  190. trace_helpers.h
  191. uprobe_helpers.c
  192. uprobe_helpers.h
  193. vfsstat.bpf.c
  194. vfsstat.c
  195. vfsstat.h
  196. wakeuptime.bpf.c
  197. wakeuptime.c
  198. wakeuptime.h
libbpf-tools/README.md

Useful links

Building

To build libbpf-based tools, simply run make. This will build all the listed tools/applications. All the build artifacts, by default, go into .output subdirectory to keep source code and build artifacts completely separate. The only exception is resulting tool binaries, which are put in a current directory. make clean will clean up all the build artifacts, including generated binaries.

Given that the libbpf package might not be available across wide variety of distributions, all libbpf-based tools are linked statically against a version of libbpf that BCC links against (from submodule under src/cc/libbpf). This results in binaries with minimal amount of dependencies (libc, libelf, and libz are linked dynamically, though, given their widespread availability). If your build fails because the libbpf submodule is outdated, try running git submodule update --init --recursive.

Tools are expected to follow a simple naming convention:

  • .c contains userspace C code of a tool.
  • .bpf.c contains BPF C code, which gets compiled into BPF ELF file. This ELF file is used to generate BPF skeleton .skel.h, which is subsequently is included from .c.
  • .h can optionally contain any types and constants, shared by both BPF and userspace sides of a tool.

For such cases, simply adding name to Makefile's APPS variable will ensure this tool is built alongside others.

For more complicated applications, some extra Makefile rules might need to be created. For such cases, it is advised to put application into a dedicated subdirectory and link it from main Makefile.

vmlinux.h generation

vmlinux.h contains all kernel types, both exported and internal-only. BPF CO-RE-based applications are expected to include this file in their BPF program C source code to avoid dependency on kernel headers package.

For more reproducible builds, vmlinux.h header file is pre-generated and checked in along the other sources. This is done to avoid dependency on specific user/build server's kernel configuration, because vmlinux.h generation depends on having a kernel with BTF type information built-in (which is enabled by CONFIG_DEBUG_INFO_BTF=y Kconfig option See below).

vmlinux.h is generated from upstream Linux version at particular minor version tag. E.g., vmlinux_505.h is generated from v5.5 tag. Exact set of types available in compiled kernel depends on configuration used to compile it. To generate present vmlinux.h header, default configuration was used, with only extra CONFIG_DEBUG_INFO_BTF=y option enabled.

Given different kernel version can have incompatible type definitions, it might be important to use vmlinux.h of a specific kernel version as a “base” version of header. To that extent, all vmlinux.h headers are versioned by appending suffix to a file name. There is always a symbolic link vmlinux.h, that points to whichever version is deemed to be default (usually, latest).

bpftool

bpftool is a universal tool used for inspection of BPF resources, as well as providing various extra BPF-related facilities, like code-generation of BPF program skeletons. The latter functionality is heavily used by these tools to load and interact with BPF programs.

Given bpftool package can't yet be expected to be available widely across many distributions, bpftool binary is checked in into BCC repository in bin/ subdirectory. Once bpftool package is more widely available, this can be changed in favor of using pre-packaged version of bpftool.

Re-compiling your Kernel with CONFIG_DEBUG_INFO_BTF=y

libbpf probes to see if your sys fs exports the file /sys/kernel/btf/vmlinux (from Kernel 5.5+) or if you have the ELF version in your system code Please note the ELF file could exist without the BTF info in it. Your Kconfig should contain the options below

  1. Compile options
CONFIG_DEBUG_INFO_BTF=y
CONFIG_DEBUG_INFO=y
  1. Also, make sure that you have pahole 1.13 (or preferably 1.16+) during the kernel build (it comes from dwarves package). Without it, BTF won‘t be generated, and on older kernels you’d get only warning, but still would build kernel successfully

Running in kernels without CONFIG_DEBUG_INFO_BTF=y

It‘s possible to run some tools in kernels that don’t expose /sys/kernel/btf/vmlinux. For those cases, BTFGen and BTFHub can be used to generate small BTF files for the most popular Linux distributions that are shipped with the tools in order to provide the needed information to perform the CO-RE relocations when loading the eBPF programs.

If you haven‘t cloned the btfhub-archive repository, you can run make and it’ll clone it for you into the $HOME/.local/share directory:

make ENABLE_MIN_CORE_BTFS=1 -j$(nproc)

If you have a local copy of such repository, you can pass it's location to avoid cloning it again:

make ENABLE_MIN_CORE_BTFS=1 BTF_HUB_ARCHIVE=<path_to_btfhub-archive> -j$(nproc)