понедельник, 1 июля 2024 г.

dumping ebpf kind_ops

Very funny article about (im)possible future of ebpf. Given that right now 8 small BPF scripts with only 7 opcodes occupy 1Mb whole kernel on ebpf will require exabytes of RAM, he-he
Anyway there is another case of info hiding in linux - mentioned in article struct_ops has type btf_kind_operations and cannot be found in include (as usually). So I add today dumping of it in my lkcd. Sample of output:
NR_BTF_KINDS: 17
btf_ops[1] at 0xffffffffaea3b240 - kernel!int_ops
  check_meta: 0xffffffffada6f320 - kernel!btf_int_check_meta
  resolve: 0xffffffffada6f150 - kernel!btf_df_resolve
  check_member: 0xffffffffada6fb10 - kernel!btf_int_check_member
  check_kflag_member: 0xffffffffada6fa30 - kernel!btf_int_check_kflag_member
  log_details: 0xffffffffada6e110 - kernel!btf_int_log
  show: 0xffffffffada70ac0 - kernel!btf_int_show
btf_ops[2] at 0xffffffffaf7fe4c0 - kernel!ptr_ops
  check_meta: 0xffffffffada72180 - kernel!btf_ref_type_check_meta
  resolve: 0xffffffffada74c60 - kernel!btf_ptr_resolve
  check_member: 0xffffffffada6f9d0 - kernel!btf_ptr_check_member
  check_kflag_member: 0xffffffffada6f7c0 - kernel!btf_generic_check_kflag_member
  log_details: 0xffffffffada6e030 - kernel!btf_ref_type_log
  show: 0xffffffffada708b0 - kernel!btf_ptr_show
btf_ops[3] at 0xffffffffaf7fe440 - kernel!array_ops
  check_meta: 0xffffffffada6f1e0 - kernel!btf_array_check_meta
  resolve: 0xffffffffada749a0 - kernel!btf_array_resolve
  check_member: 0xffffffffada748f0 - kernel!btf_array_check_member
  check_kflag_member: 0xffffffffada6f7c0 - kernel!btf_generic_check_kflag_member
  log_details: 0xffffffffada6e0e0 - kernel!btf_array_log
  show: 0xffffffffada736e0 - kernel!btf_array_show
btf_ops[4] at 0xffffffffaf7fe400 - kernel!struct_ops
  check_meta: 0xffffffffada72440 - kernel!btf_struct_check_meta
  resolve: 0xffffffffada71470 - kernel!btf_struct_resolve
  check_member: 0xffffffffada6f960 - kernel!btf_struct_check_member
  check_kflag_member: 0xffffffffada6f7c0 - kernel!btf_generic_check_kflag_member
  log_details: 0xffffffffada6e090 - kernel!btf_struct_log
  show: 0xffffffffada71ea0 - kernel!btf_struct_show
btf_ops[5] at 0xffffffffaf7fe400 - kernel!struct_ops
  check_meta: 0xffffffffada72440 - kernel!btf_struct_check_meta
  resolve: 0xffffffffada71470 - kernel!btf_struct_resolve
  check_member: 0xffffffffada6f960 - kernel!btf_struct_check_member
  check_kflag_member: 0xffffffffada6f7c0 - kernel!btf_generic_check_kflag_member
  log_details: 0xffffffffada6e090 - kernel!btf_struct_log
  show: 0xffffffffada71ea0 - kernel!btf_struct_show
btf_ops[6] at 0xffffffffaf7fe3c0 - kernel!enum_ops
  check_meta: 0xffffffffada722c0 - kernel!btf_enum_check_meta
  resolve: 0xffffffffada6f150 - kernel!btf_df_resolve
  check_member: 0xffffffffada6f9c0 - kernel!btf_enum_check_member
  check_kflag_member: 0xffffffffada6f8d0 - kernel!btf_enum_check_kflag_member
  log_details: 0xffffffffada6e0c0 - kernel!btf_enum_log
  show: 0xffffffffada70620 - kernel!btf_enum_show
btf_ops[7] at 0xffffffffaf7fe480 - kernel!fwd_ops
  check_meta: 0xffffffffada72230 - kernel!btf_fwd_check_meta
  resolve: 0xffffffffada6f150 - kernel!btf_df_resolve
  check_member: 0xffffffffada6f1b0 - kernel!btf_df_check_member
  check_kflag_member: 0xffffffffada6f180 - kernel!btf_df_check_kflag_member
  log_details: 0xffffffffada6e050 - kernel!btf_fwd_type_log
  show: 0xffffffffada6e200 - kernel!btf_df_show
btf_ops[8] at 0xffffffffaf7fe500 - kernel!modifier_ops
  check_meta: 0xffffffffada72180 - kernel!btf_ref_type_check_meta
  resolve: 0xffffffffada74700 - kernel!btf_modifier_resolve
  check_member: 0xffffffffada74620 - kernel!btf_modifier_check_member
  check_kflag_member: 0xffffffffada74540 - kernel!btf_modifier_check_kflag_member
  log_details: 0xffffffffada6e030 - kernel!btf_ref_type_log
  show: 0xffffffffada72a70 - kernel!btf_modifier_show
btf_ops[9] at 0xffffffffaf7fe500 - kernel!modifier_ops
  check_meta: 0xffffffffada72180 - kernel!btf_ref_type_check_meta
  resolve: 0xffffffffada74700 - kernel!btf_modifier_resolve
  check_member: 0xffffffffada74620 - kernel!btf_modifier_check_member
  check_kflag_member: 0xffffffffada74540 - kernel!btf_modifier_check_kflag_member
  log_details: 0xffffffffada6e030 - kernel!btf_ref_type_log
  show: 0xffffffffada72a70 - kernel!btf_modifier_show
btf_ops[10] at 0xffffffffaf7fe500 - kernel!modifier_ops
  check_meta: 0xffffffffada72180 - kernel!btf_ref_type_check_meta
  resolve: 0xffffffffada74700 - kernel!btf_modifier_resolve
  check_member: 0xffffffffada74620 - kernel!btf_modifier_check_member
  check_kflag_member: 0xffffffffada74540 - kernel!btf_modifier_check_kflag_member
  log_details: 0xffffffffada6e030 - kernel!btf_ref_type_log
  show: 0xffffffffada72a70 - kernel!btf_modifier_show
btf_ops[11] at 0xffffffffaf7fe500 - kernel!modifier_ops
  check_meta: 0xffffffffada72180 - kernel!btf_ref_type_check_meta
  resolve: 0xffffffffada74700 - kernel!btf_modifier_resolve
  check_member: 0xffffffffada74620 - kernel!btf_modifier_check_member
  check_kflag_member: 0xffffffffada74540 - kernel!btf_modifier_check_kflag_member
  log_details: 0xffffffffada6e030 - kernel!btf_ref_type_log
  show: 0xffffffffada72a70 - kernel!btf_modifier_show
btf_ops[12] at 0xffffffffaf7fe340 - kernel!func_ops
  check_meta: 0xffffffffada720f0 - kernel!btf_func_check_meta
  resolve: 0xffffffffada6f150 - kernel!btf_df_resolve
  check_member: 0xffffffffada6f1b0 - kernel!btf_df_check_member
  check_kflag_member: 0xffffffffada6f180 - kernel!btf_df_check_kflag_member
  log_details: 0xffffffffada6e030 - kernel!btf_ref_type_log
  show: 0xffffffffada6e200 - kernel!btf_df_show
btf_ops[13] at 0xffffffffaf7fe380 - kernel!func_proto_ops
  check_meta: 0xffffffffada71890 - kernel!btf_func_proto_check_meta
  resolve: 0xffffffffada6f150 - kernel!btf_df_resolve
  check_member: 0xffffffffada6f1b0 - kernel!btf_df_check_member
  check_kflag_member: 0xffffffffada6f180 - kernel!btf_df_check_kflag_member
  log_details: 0xffffffffada6ecf0 - kernel!btf_func_proto_log
  show: 0xffffffffada6e200 - kernel!btf_df_show
btf_ops[14] at 0xffffffffaea3b200 - kernel!var_ops
  check_meta: 0xffffffffada72000 - kernel!btf_var_check_meta
  resolve: 0xffffffffada74330 - kernel!btf_var_resolve
  check_member: 0xffffffffada6f1b0 - kernel!btf_df_check_member
  check_kflag_member: 0xffffffffada6f180 - kernel!btf_df_check_kflag_member
  log_details: 0xffffffffada6e000 - kernel!btf_var_log
  show: 0xffffffffada6d8e0 - kernel!btf_var_show
btf_ops[15] at 0xffffffffaea3b1c0 - kernel!datasec_ops
  check_meta: 0xffffffffada72680 - kernel!btf_datasec_check_meta
  resolve: 0xffffffffada740e0 - kernel!btf_datasec_resolve
  check_member: 0xffffffffada6f1b0 - kernel!btf_df_check_member
  check_kflag_member: 0xffffffffada6f180 - kernel!btf_df_check_kflag_member
  log_details: 0xffffffffada6e0d0 - kernel!btf_datasec_log
  show: 0xffffffffada70380 - kernel!btf_datasec_show
btf_ops[16] at 0xffffffffaea3b180 - kernel!float_ops
  check_meta: 0xffffffffada71800 - kernel!btf_float_check_meta
  resolve: 0xffffffffada6f150 - kernel!btf_df_resolve
  check_member: 0xffffffffada6f850 - kernel!btf_float_check_member
  check_kflag_member: 0xffffffffada6f7c0 - kernel!btf_generic_check_kflag_member
  log_details: 0xffffffffada6dfe0 - kernel!btf_float_log
  show: 0xffffffffada6e200 - kernel!btf_df_show

Комментариев нет:

Отправить комментарий