/proc/sys/kernel/bpf_stats_enabled ## Three ways to access kernel eBPF stats ## bpftool prog show ## ☐ ☐ ☐ $ sudo bpftool prog show 100: kprobe name do_sys_open tag b3b38339b16f56d9 gpl run_time_ns int fd = enable_stats(); if (fd < 0) { return; } // do profiling close(fd); ## bpftool prog profile ## bpftool prog profile – Added in kernel v5.7 – Uses hardware perf counters – Available metrics: instructions, lld loads, llc misses – Used for more in-depth profiling ## bpftool prog run / BPF_PROG_TEST_RUN ## bpftool prog run – Added in kernel v4.12 – Only for specific program types – Specify

need VM running Linux kernel 5.9+ bpftool 5.9+ libbpf headers ☐ kernel headers ## vm $ uname -r 5.9.1-36.vanilla.1.fc32.x86_64 vm $ bpftool version bpftool v5.9.1 ## Code and instructions at https://github -target bpf -c -o echo_dispatch.bpf.o echo_dispatch.bpf.c # bpftool prog load echo_dispatch.bpf.o /sys/fs/bpf/echo_dispatch_prog # bpftool prog show pinned /sys/fs/bpf/echo_dispatch_prog load & pin ~vagrant/bpffs # bpftool map show id 28 28: hash name echo_ports flags 0x0 key 2B value 1B max_entries 1024 memlock 86016B # bpftool map pin id 28 ~vagrant/bpffs/echo_ports # bpftool map show id 29 29:

to the Linux kernel, respectively. Similarly, for debugging and introspection purposes building bpftool is optional, but recommended. ## Fedora The following applies to Fedora 25 or later: $ sudo dnf earlier. ## Compiling bpftool bpftool is an essential tool around debugging and introspection of BPF programs and maps. It is part of the kernel tree and available under tools/bpf/bpftool/. Make sure to have kernel tree as described earlier. In order to build and install bpftool, the following steps are required: $ cd /tools/bpf/bpftool/ $ make Auto-detecting system features: ... libbfd: [ on ]

to the Linux kernel, respectively. Similarly, for debugging and introspection purposes building bpftool is optional, but recommended. ## Fedora The following applies to Fedora 25 or later: $ sudo dnf earlier. ## Compiling bpftool bpftool is an essential tool around debugging and introspection of BPF programs and maps. It is part of the kernel tree and available under tools/bpf/bpftool/. Make sure to have kernel tree as described earlier. In order to build and install bpftool, the following steps are required: $ cd /tools/bpf/bpftool/ $ make Auto-detecting system features: ... libbfd: [ on ]

Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain Development Environment LLVM iproute2 bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP to the Linux kernel, respectively. Similarly, for debugging and introspection purposes building bpftool is optional, but recommended. Fedora The following applies to Fedora 25 or later: $ sudo dnf install earlier. Compiling bpftool bpftool is an essential tool around debugging and introspection of BPF programs and maps. It is part of the kernel tree and available under tools/bpf/bpftool/. Make sure to have

Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain Development Environment LLVM iproute2 bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types programs running in the parent cgroup hierarchy by following the bpftool documentation [https://manpages.ubuntu.com/manpages/focal/man8/bpftool-cgroup.8.html]. For more information, see the Pull Request [https://github [https://github.com/cilium/cilium/pull/16259]. level=warning msg="+ bpftool cgroup attach /var/run/cilium/cgroupv2 connect6 pinned /sys/fs/bpf/tc/globals/cilium_cgroups_connect6" subsys=datapath-loader

Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain Development Environment LLVM iproute2 bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP programs running in the parent cgroup hierarchy by following the bpftool documentation [https://manpages.ubuntu.com/manpages/focal/man8/bpftool-cgroup.8.html]. For more information, see the Pull Request [https://github [https://github.com/cilium/cilium/pull/16259]. level=warning msg="+ bpftool cgroup attach /var/run/cilium/cgroupv2 connect6 pinned /sys/fs/bpf/tc/globals/cilium_cgroups_connect6" subsys=datapath-loader

Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain Development Environment LLVM iproute2 bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP to the Linux kernel, respectively. Similarly, for debugging and introspection purposes building bpftool is optional, but recommended. Fedora The following applies to Fedora 25 or later: $ sudo dnf install earlier. Compiling bpftool bpftool is an essential tool around debugging and introspection of BPF programs and maps. It is part of the kernel tree and available under tools/bpf/bpftool/. Make sure to have

Hardening ■ Offloads ## ○ Toolchain ■ Development Environment ■ LLVM ■ iproute2 ■ bpftool ■ BPF sysctls ■ Kernel Testing - JIT Debugging - Introspection - Tracing.pipe - Miscellaneous programs running in the parent cgroup hierarchy by following the bpftool documentation [https://manpages.ubuntu.com/manpages/focal/man8/bpftool-cgroup.8.html]. For more information, see the Pull Request [https://github [https://github.com/cilium/cilium/pull/16259]. level=warning msg="+ bpftool cgroup attach /var/run/cilium/cgroupv2 connect6 pinned /sys/fs/bpf/tc/globals/cilium_cgroups_connect6" subsys=datapath-loader

all register states after each instruction. ## I lvm-objdump, Ilvm-mc ## bpftool ## $KERNEL_SRC/tools/bpf /bpftool bpftool - bash-completion - btf.c - btf_dumper.c - cfg.c - cfg.h - cgroup.c xlated_dumper.c - xlated_dumper.h # bpftool prog show 1337: sched_cls name cls_entry tag e202124da7c84e89 loaded_at Mar 08/19:53 uid 0 xlated 304B not jited memlock 4096B # bpftool prog dump xlated id 1337 pc+7 3: (bf) r6 = r1 [...] 37: (95) exit ## # bpftool map 1234: array name ch_rings flags 0x0 key 4B value 4B max_entries 7860 memlock 65536B # bpftool map dump id 1234 key: 00 00 00 00 value: 00 00