@@ -3,7 +3,7 @@ BPF Type Format (BTF)
33=====================
44
551. Introduction
6- ***************
6+ ===============
77
88BTF (BPF Type Format) is the metadata format which encodes the debug info
99related to BPF program/map. The name BTF was used initially to describe data
@@ -30,7 +30,7 @@ sections are discussed in details in :ref:`BTF_Type_String`.
3030.. _BTF_Type_String :
3131
32322. BTF Type and String Encoding
33- *******************************
33+ ===============================
3434
3535The file ``include/uapi/linux/btf.h `` provides high-level definition of how
3636types/strings are encoded.
@@ -57,13 +57,13 @@ little-endian target. The ``btf_header`` is designed to be extensible with
5757generated.
5858
59592.1 String Encoding
60- ===================
60+ -------------------
6161
6262The first string in the string section must be a null string. The rest of
6363string table is a concatenation of other null-terminated strings.
6464
65652.2 Type Encoding
66- =================
66+ -----------------
6767
6868The type id ``0 `` is reserved for ``void `` type. The type section is parsed
6969sequentially and type id is assigned to each recognized type starting from id
@@ -504,7 +504,7 @@ valid index (starting from 0) pointing to a member or an argument.
504504 * ``type ``: the type with ``btf_type_tag `` attribute
505505
5065063. BTF Kernel API
507- *****************
507+ =================
508508
509509The following bpf syscall command involves BTF:
510510 * BPF_BTF_LOAD: load a blob of BTF data into kernel
@@ -547,14 +547,14 @@ The workflow typically looks like:
547547
548548
5495493.1 BPF_BTF_LOAD
550- ================
550+ ----------------
551551
552552Load a blob of BTF data into kernel. A blob of data, described in
553553:ref: `BTF_Type_String `, can be directly loaded into the kernel. A ``btf_fd ``
554554is returned to a userspace.
555555
5565563.2 BPF_MAP_CREATE
557- ==================
557+ ------------------
558558
559559A map can be created with ``btf_fd `` and specified key/value type id.::
560560
@@ -581,7 +581,7 @@ automatically.
581581.. _BPF_Prog_Load :
582582
5835833.3 BPF_PROG_LOAD
584- =================
584+ -----------------
585585
586586During prog_load, func_info and line_info can be passed to kernel with proper
587587values for the following attributes:
@@ -631,7 +631,7 @@ For line_info, the line number and column number are defined as below:
631631 #define BPF_LINE_INFO_LINE_COL(line_col) ((line_col) & 0x3ff)
632632
6336333.4 BPF_{PROG,MAP}_GET_NEXT_ID
634- ==============================
634+ ------------------------------
635635
636636In kernel, every loaded program, map or btf has a unique id. The id won't
637637change during the lifetime of a program, map, or btf.
@@ -641,13 +641,13 @@ each command, to user space, for bpf program or maps, respectively, so an
641641inspection tool can inspect all programs and maps.
642642
6436433.5 BPF_{PROG,MAP}_GET_FD_BY_ID
644- ===============================
644+ -------------------------------
645645
646646An introspection tool cannot use id to get details about program or maps.
647647A file descriptor needs to be obtained first for reference-counting purpose.
648648
6496493.6 BPF_OBJ_GET_INFO_BY_FD
650- ==========================
650+ --------------------------
651651
652652Once a program/map fd is acquired, an introspection tool can get the detailed
653653information from kernel about this fd, some of which are BTF-related. For
@@ -656,7 +656,7 @@ example, ``bpf_map_info`` returns ``btf_id`` and key/value type ids.
656656bpf byte codes, and jited_line_info.
657657
6586583.7 BPF_BTF_GET_FD_BY_ID
659- ========================
659+ ------------------------
660660
661661With ``btf_id `` obtained in ``bpf_map_info `` and ``bpf_prog_info ``, bpf
662662syscall command BPF_BTF_GET_FD_BY_ID can retrieve a btf fd. Then, with
@@ -668,18 +668,18 @@ tool has full btf knowledge and is able to pretty print map key/values, dump
668668func signatures and line info, along with byte/jit codes.
669669
6706704. ELF File Format Interface
671- ****************************
671+ ============================
672672
6736734.1 .BTF section
674- ================
674+ ----------------
675675
676676The .BTF section contains type and string data. The format of this section is
677677same as the one describe in :ref: `BTF_Type_String `.
678678
679679.. _BTF_Ext_Section :
680680
6816814.2 .BTF.ext section
682- ====================
682+ --------------------
683683
684684The .BTF.ext section encodes func_info and line_info which needs loader
685685manipulation before loading into the kernel.
@@ -743,7 +743,7 @@ bpf_insn``. For ELF API, the ``insn_off`` is the byte offset from the
743743beginning of section (``btf_ext_info_sec->sec_name_off ``).
744744
7457454.2 .BTF_ids section
746- ====================
746+ --------------------
747747
748748The .BTF_ids section encodes BTF ID values that are used within the kernel.
749749
@@ -804,10 +804,10 @@ All the BTF ID lists and sets are compiled in the .BTF_ids section and
804804resolved during the linking phase of kernel build by ``resolve_btfids `` tool.
805805
8068065. Using BTF
807- ************
807+ ============
808808
8098095.1 bpftool map pretty print
810- ============================
810+ ----------------------------
811811
812812With BTF, the map key/value can be printed based on fields rather than simply
813813raw bytes. This is especially valuable for large structure or if your data
@@ -849,7 +849,7 @@ bpftool is able to pretty print like below:
849849 ]
850850
8518515.2 bpftool prog dump
852- =====================
852+ ---------------------
853853
854854The following is an example showing how func_info and line_info can help prog
855855dump with better kernel symbol names, function prototypes and line
@@ -883,7 +883,7 @@ information.::
883883 [...]
884884
8858855.3 Verifier Log
886- ================
886+ ----------------
887887
888888The following is an example of how line_info can help debugging verification
889889failure.::
@@ -909,7 +909,7 @@ failure.::
909909 R2 offset is outside of the packet
910910
9119116. BTF Generation
912- *****************
912+ =================
913913
914914You need latest pahole
915915
@@ -1016,6 +1016,6 @@ format.::
10161016 .long 8206 # Line 8 Col 14
10171017
101810187. Testing
1019- **********
1019+ ==========
10201020
10211021Kernel bpf selftest `test_btf.c ` provides extensive set of BTF-related tests.
0 commit comments