EBPF: Difference between revisions
No edit summary |
No edit summary |
||
| Line 4: | Line 4: | ||
==Tools== | ==Tools== | ||
* <tt>bpftrace</tt> provides a terse DSL that looks an awful lot like awk, allowing simple eBPF programs to be instantiated and attached directly from the command line. | * <tt>bpftrace</tt> provides a terse DSL that looks an awful lot like awk, allowing simple eBPF programs to be instantiated and attached directly from the command line. | ||
* <tt>llvm-readelf</tt> can analyze an ELF object, including those targeting eBPF | * <tt>llvm-readelf</tt> can analyze an ELF object, including those targeting eBPF | ||
* <tt>llvm-objdump</tt> can disassemble an ELF object to eBPF bytecode | * <tt>llvm-objdump</tt> can disassemble an ELF object to eBPF bytecode | ||
===bpftool=== | |||
<tt>bpftool</tt> can be built in <tt>tools/bpf</tt> of the installed kernel's source. | |||
* <tt>bpftool feature</tt> examines the running kernel, and enumerates all capabilities present related to eBPF (program types, map types, kernel config options, eBPF helpers, etc.) | |||
* <tt>bpftool prog</tt> enumerates attached eBPF programs, loads and attaches programs, and can dump loaded programs' bytecode (or JITted host code) | |||
* <tt>bpftool perf</tt> lists kprobes and other tracepoints with attached programs | |||
* <tt>bpftool map</tt> enumerates manipulates maps | |||
==Compiling eBPF== | ==Compiling eBPF== | ||