linux-kernel - Re: [RFC] Loading BTF and pretty printing maps with bpftool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 26 Jan 2019 05:37:12 +0000
From:   Martin Lau <kafai@...com>
To:     Arnaldo Carvalho de Melo <acme@...nel.org>
CC:     Yonghong Song <yhs@...com>, Song Liu <songliubraving@...com>,
        "Andrii Nakryiko" <andrii.nakryiko@...il.com>,
        Alexei Starovoitov <ast@...nel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        "Linux Networking Development Mailing List" <netdev@...r.kernel.org>
Subject: Re: [RFC] Loading BTF and pretty printing maps with bpftool

On Fri, Jan 25, 2019 at 11:20:57AM +0100, Arnaldo Carvalho de Melo wrote:
>   # bpftool version
>   bpftool v5.0.0-rc3
>   #
> 
>   # bpftool prog | tail -6
>   309: tracepoint  name sys_enter  tag 819967866022f1e1  gpl
> 	loaded_at 2019-01-25T11:05:41+0100  uid 0
> 	xlated 528B  jited 381B  memlock 4096B  map_ids 200,199,198
>   310: tracepoint  name sys_exit  tag c1bd85c092d6e4aa  gpl
> 	loaded_at 2019-01-25T11:05:41+0100  uid 0
> 	xlated 256B  jited 191B  memlock 4096B  map_ids 200,199
>   #
> 
> And the maps:
> 
>   # bpftool map | tail -6
>   198: perf_event_array  name __augmented_sys  flags 0x0
> 	key 4B  value 4B  max_entries 8  memlock 4096B
>   199: array  name syscalls  flags 0x0
> 	key 4B  value 1B  max_entries 512  memlock 8192B
>   200: hash  name pids_filtered  flags 0x0
> 	key 4B  value 1B  max_entries 64  memlock 8192B
>   #
> 
> So, dumping the entries for those entries:
> 
> [root@...co ~]# egrep sleep /tmp/build/perf/arch/x86/include/generated/asm/syscalls_64.c
> 	[35] = "nanosleep",
> 	[230] = "clock_nanosleep",
> [root@...co ~]#
> 
> Looking at just the open and nanosleep:
> 
>   # bpftool map dump id 199 | grep "value: 01"
>   key: 23 00 00 00  value: 01
>   key: e6 00 00 00  value: 01
>   #
> 
>   # bpftool map lookup id 199 key 35
>   Error: key expected 4 bytes got 1
>   #
> 
>   # bpftool map lookup id 199 key 35 00 00 00
>   key: 23 00 00 00  value: 01
>   # bpftool map lookup id 199 key 230 00 00 00
>   key: e6 00 00 00  value: 01
>   # 
> 
> I thought it was that --pretty option, so I tried:
> 
>   # bpftool map --pretty lookup id 199 key 230 00 00 00
>   {
>     "key": ["0xe6","0x00","0x00","0x00"
>     ],
>     "value": ["0x01"
>     ]
>   }
>   #
libbpf pr_warning on failing to load BTF
or failing to create a MAP after BTF has been loaded and
____btf_map_xxx can be found.

Did you see any of them?  It seems it can load the BTF
from your email.

It may be useful to set the libbpf's __pr_debug which
should be NULL by default iirc.