@@ -5,7 +5,7 @@ BPF Type Format (BTF)
5
5
1. Introduction
6
6
***************
7
7
8
- BTF (BPF Type Format) is the meta data format which
8
+ BTF (BPF Type Format) is the metadata format which
9
9
encodes the debug info related to BPF program/map.
10
10
The name BTF was used initially to describe
11
11
data types. The BTF was later extended to include
@@ -40,8 +40,8 @@ details in :ref:`BTF_Type_String`.
40
40
2. BTF Type and String Encoding
41
41
*******************************
42
42
43
- The file ``include/uapi/linux/btf.h `` provides high
44
- level definition on how types/strings are encoded.
43
+ The file ``include/uapi/linux/btf.h `` provides high-level
44
+ definition of how types/strings are encoded.
45
45
46
46
The beginning of data blob must be::
47
47
@@ -59,23 +59,23 @@ The beginning of data blob must be::
59
59
};
60
60
61
61
The magic is ``0xeB9F ``, which has different encoding for big and little
62
- endian system , and can be used to test whether BTF is generated for
63
- big or little endian target.
64
- The btf_header is designed to be extensible with hdr_len equal to
65
- ``sizeof(struct btf_header) `` when the data blob is generated.
62
+ endian systems , and can be used to test whether BTF is generated for
63
+ big- or little- endian target.
64
+ The `` btf_header `` is designed to be extensible with `` hdr_len `` equal to
65
+ ``sizeof(struct btf_header) `` when a data blob is generated.
66
66
67
67
2.1 String Encoding
68
68
===================
69
69
70
70
The first string in the string section must be a null string.
71
- The rest of string table is a concatenation of other null-treminated
71
+ The rest of string table is a concatenation of other null-terminated
72
72
strings.
73
73
74
74
2.2 Type Encoding
75
75
=================
76
76
77
77
The type id ``0 `` is reserved for ``void `` type.
78
- The type section is parsed sequentially and the type id is assigned to
78
+ The type section is parsed sequentially and type id is assigned to
79
79
each recognized type starting from id ``1 ``.
80
80
Currently, the following types are supported::
81
81
@@ -122,9 +122,9 @@ Each type contains the following common data::
122
122
};
123
123
};
124
124
125
- For certain kinds, the common data are followed by kind specific data.
126
- The ``name_off `` in ``struct btf_type `` specifies the offset in the string table.
127
- The following details encoding of each kind.
125
+ For certain kinds, the common data are followed by kind- specific data.
126
+ The ``name_off `` in ``struct btf_type `` specifies the offset in the string
127
+ table. The following sections detail encoding of each kind.
128
128
129
129
2.2.1 BTF_KIND_INT
130
130
~~~~~~~~~~~~~~~~~~
@@ -136,7 +136,7 @@ The following details encoding of each kind.
136
136
* ``info.vlen ``: 0
137
137
* ``size ``: the size of the int type in bytes.
138
138
139
- ``btf_type `` is followed by a ``u32 `` with following bits arrangement::
139
+ ``btf_type `` is followed by a ``u32 `` with the following bits arrangement::
140
140
141
141
#define BTF_INT_ENCODING(VAL) (((VAL) & 0x0f000000) >> 24)
142
142
#define BTF_INT_OFFSET(VAL) (((VAL & 0x00ff0000)) >> 16)
@@ -148,7 +148,7 @@ The ``BTF_INT_ENCODING`` has the following attributes::
148
148
#define BTF_INT_CHAR (1 << 1)
149
149
#define BTF_INT_BOOL (1 << 2)
150
150
151
- The ``BTF_INT_ENCODING() `` provides extra information, signness ,
151
+ The ``BTF_INT_ENCODING() `` provides extra information: signedness ,
152
152
char, or bool, for the int type. The char and bool encoding
153
153
are mostly useful for pretty print. At most one encoding can
154
154
be specified for the int type.
@@ -161,8 +161,7 @@ The maximum value of ``BTF_INT_BITS()`` is 128.
161
161
162
162
The ``BTF_INT_OFFSET() `` specifies the starting bit offset to
163
163
calculate values for this int. For example, a bitfield struct
164
- member has
165
-
164
+ member has:
166
165
* btf member bit offset 100 from the start of the structure,
167
166
* btf member pointing to an int type,
168
167
* the int type has ``BTF_INT_OFFSET() = 2 `` and ``BTF_INT_BITS() = 4 ``
@@ -179,7 +178,7 @@ access the same bits as the above:
179
178
180
179
The original intention of ``BTF_INT_OFFSET() `` is to provide
181
180
flexibility of bitfield encoding.
182
- Currently, both llvm and pahole generates ``BTF_INT_OFFSET() = 0 ``
181
+ Currently, both llvm and pahole generate ``BTF_INT_OFFSET() = 0 ``
183
182
for all int types.
184
183
185
184
2.2.2 BTF_KIND_PTR
@@ -204,7 +203,7 @@ No additional type data follow ``btf_type``.
204
203
* ``info.vlen ``: 0
205
204
* ``size/type ``: 0, not used
206
205
207
- btf_type is followed by one " struct btf_array" ::
206
+ `` btf_type `` is followed by one `` struct btf_array `` ::
208
207
209
208
struct btf_array {
210
209
__u32 type;
@@ -217,27 +216,26 @@ The ``struct btf_array`` encoding:
217
216
* ``index_type ``: the index type
218
217
* ``nelems ``: the number of elements for this array (``0 `` is also allowed).
219
218
220
- The ``index_type `` can be any regular int types
221
- (u8, u16, u32, u64, unsigned __int128).
222
- The original design of including ``index_type `` follows dwarf
223
- which has a ``index_type `` for its array type.
219
+ The ``index_type `` can be any regular int type
220
+ (`` u8 ``, `` u16 ``, `` u32 ``, `` u64 ``, `` unsigned __int128 `` ).
221
+ The original design of including ``index_type `` follows DWARF,
222
+ which has an ``index_type `` for its array type.
224
223
Currently in BTF, beyond type verification, the ``index_type `` is not used.
225
224
226
225
The ``struct btf_array `` allows chaining through element type to represent
227
- multiple dimensional arrays. For example, ``int a[5][6] ``, the following
228
- type system illustrates the chaining:
226
+ multidimensional arrays. For example, for ``int a[5][6] ``, the following
227
+ type information illustrates the chaining:
229
228
230
229
* [1]: int
231
230
* [2]: array, ``btf_array.type = [1] ``, ``btf_array.nelems = 6 ``
232
231
* [3]: array, ``btf_array.type = [2] ``, ``btf_array.nelems = 5 ``
233
232
234
- Currently, both pahole and llvm collapse multiple dimensional array
235
- into one dimensional array, e.g., ``a[5][6] ``, the btf_array.nelems
236
- equal to ``30 ``. This is because the original use case is map pretty
237
- print where the whole array is dumped out so one dimensional array
233
+ Currently, both pahole and llvm collapse multidimensional array
234
+ into one- dimensional array, e.g., for ``a[5][6] ``, the `` btf_array.nelems ``
235
+ is equal to ``30 ``. This is because the original use case is map pretty
236
+ print where the whole array is dumped out so one- dimensional array
238
237
is enough. As more BTF usage is explored, pahole and llvm can be
239
- changed to generate proper chained representation for
240
- multiple dimensional arrays.
238
+ changed to generate proper chained representation for multidimensional arrays.
241
239
242
240
2.2.4 BTF_KIND_STRUCT
243
241
~~~~~~~~~~~~~~~~~~~~~
@@ -382,7 +380,7 @@ No additional type data follow ``btf_type``.
382
380
383
381
No additional type data follow ``btf_type ``.
384
382
385
- A BTF_KIND_FUNC defines, not a type, but a subprogram (function) whose
383
+ A BTF_KIND_FUNC defines not a type, but a subprogram (function) whose
386
384
signature is defined by ``type ``. The subprogram is thus an instance of
387
385
that type. The BTF_KIND_FUNC may in turn be referenced by a func_info in
388
386
the :ref: `BTF_Ext_Section ` (ELF) or in the arguments to
@@ -459,10 +457,10 @@ The workflow typically looks like:
459
457
3.1 BPF_BTF_LOAD
460
458
================
461
459
462
- Load a blob of BTF data into kernel. A blob of data
463
- described in :ref: `BTF_Type_String `
460
+ Load a blob of BTF data into kernel. A blob of data,
461
+ described in :ref: `BTF_Type_String `,
464
462
can be directly loaded into the kernel.
465
- A ``btf_fd `` returns to userspace.
463
+ A ``btf_fd `` is returned to a userspace.
466
464
467
465
3.2 BPF_MAP_CREATE
468
466
==================
@@ -487,7 +485,7 @@ In libbpf, the map can be defined with extra annotation like below:
487
485
Here, the parameters for macro BPF_ANNOTATE_KV_PAIR are map name,
488
486
key and value types for the map.
489
487
During ELF parsing, libbpf is able to extract key/value type_id's
490
- and assigned them to BPF_MAP_CREATE attributes automatically.
488
+ and assign them to BPF_MAP_CREATE attributes automatically.
491
489
492
490
.. _BPF_Prog_Load :
493
491
@@ -532,7 +530,7 @@ Below are requirements for func_info:
532
530
bpf func boundaries.
533
531
534
532
Below are requirements for line_info:
535
- * the first insn in each func must points to a line_info record.
533
+ * the first insn in each func must have a line_info record pointing to it .
536
534
* the line_info insn_off is in strictly increasing order.
537
535
538
536
For line_info, the line number and column number are defined as below:
@@ -544,26 +542,26 @@ For line_info, the line number and column number are defined as below:
544
542
3.4 BPF_{PROG,MAP}_GET_NEXT_ID
545
543
546
544
In kernel, every loaded program, map or btf has a unique id.
547
- The id won't change during the life time of the program, map or btf.
545
+ The id won't change during the lifetime of a program, map, or btf.
548
546
549
547
The bpf syscall command BPF_{PROG,MAP}_GET_NEXT_ID
550
548
returns all id's, one for each command, to user space, for bpf
551
- program or maps,
552
- so the inspection tool can inspect all programs and maps.
549
+ program or maps, respectively,
550
+ so an inspection tool can inspect all programs and maps.
553
551
554
552
3.5 BPF_{PROG,MAP}_GET_FD_BY_ID
555
553
556
- The introspection tool cannot use id to get details about program or maps.
557
- A file descriptor needs to be obtained first for reference counting purpose.
554
+ An introspection tool cannot use id to get details about program or maps.
555
+ A file descriptor needs to be obtained first for reference- counting purpose.
558
556
559
557
3.6 BPF_OBJ_GET_INFO_BY_FD
560
558
==========================
561
559
562
- Once a program/map fd is acquired, the introspection tool can
560
+ Once a program/map fd is acquired, an introspection tool can
563
561
get the detailed information from kernel about this fd,
564
- some of which is btf related. For example,
565
- ``bpf_map_info `` returns ``btf_id ``, key/value type id .
566
- ``bpf_prog_info `` returns ``btf_id ``, func_info and line info
562
+ some of which are BTF- related. For example,
563
+ ``bpf_map_info `` returns ``btf_id `` and key/value type ids .
564
+ ``bpf_prog_info `` returns ``btf_id ``, func_info, and line info
567
565
for translated bpf byte codes, and jited_line_info.
568
566
569
567
3.7 BPF_BTF_GET_FD_BY_ID
@@ -574,9 +572,9 @@ bpf syscall command BPF_BTF_GET_FD_BY_ID can retrieve a btf fd.
574
572
Then, with command BPF_OBJ_GET_INFO_BY_FD, the btf blob, originally
575
573
loaded into the kernel with BPF_BTF_LOAD, can be retrieved.
576
574
577
- With the btf blob, ``bpf_map_info `` and ``bpf_prog_info ``, the introspection
575
+ With the btf blob, ``bpf_map_info ``, and ``bpf_prog_info ``, an introspection
578
576
tool has full btf knowledge and is able to pretty print map key/values,
579
- dump func signatures, dump line info along with byte/jit codes.
577
+ dump func signatures and line info, along with byte/jit codes.
580
578
581
579
4. ELF File Format Interface
582
580
****************************
@@ -625,8 +623,8 @@ The func_info is organized as below.::
625
623
...
626
624
627
625
``func_info_rec_size `` specifies the size of ``bpf_func_info `` structure
628
- when .BTF.ext is generated. btf_ext_info_sec, defined below, is
629
- the func_info for each specific ELF section.::
626
+ when .BTF.ext is generated. `` btf_ext_info_sec `` , defined below, is
627
+ a collection of func_info for each specific ELF section.::
630
628
631
629
struct btf_ext_info_sec {
632
630
__u32 sec_name_off; /* offset to section name */
@@ -661,7 +659,7 @@ from the beginning of section (``btf_ext_info_sec->sec_name_off``).
661
659
662
660
With BTF, the map key/value can be printed based on fields rather than
663
661
simply raw bytes. This is especially
664
- valuable for large structure or if you data structure
662
+ valuable for large structure or if your data structure
665
663
has bitfields. For example, for the following map,::
666
664
667
665
enum A { A1, A2, A3, A4, A5 };
@@ -702,8 +700,8 @@ bpftool is able to pretty print like below:
702
700
5.2 bpftool prog dump
703
701
=====================
704
702
705
- The following is an example to show func_info and line_info
706
- can help prog dump with better kernel symbol name , function prototype
703
+ The following is an example showing how func_info and line_info
704
+ can help prog dump with better kernel symbol names , function prototypes
707
705
and line information.::
708
706
709
707
$ bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv
@@ -733,10 +731,10 @@ and line information.::
733
731
; counts = bpf_map_lookup_elem(&btf_map, &key);
734
732
[...]
735
733
736
- 5.3 verifier log
734
+ 5.3 Verifier Log
737
735
================
738
736
739
- The following is an example how line_info can help verifier failure debug .::
737
+ The following is an example of how line_info can help debugging verification failure .::
740
738
741
739
/* The code at tools/testing/selftests/bpf/test_xdp_noinline.c
742
740
* is modified as below.
@@ -867,4 +865,4 @@ The assembly code (-S) is able to show the BTF encoding in assembly format.::
867
865
7. Testing
868
866
**********
869
867
870
- Kernel bpf selftest `test_btf.c ` provides extensive set of BTF related tests.
868
+ Kernel bpf selftest `test_btf.c ` provides extensive set of BTF- related tests.
0 commit comments