CODEWITHSUNDEEP
linux-kernelllvm-clangbpfebpf
Mark
Mark

Reputation: 6494

Output from bpf_printk()

While running some examples from samples/bpf I noticed that bpf_printk output is prepended with some extra information, e.g. :

telnet-470   [001] .N.. 419421.045894: 0x00000001: BPF command: 2

BPF command: 2 is actual string passed to bpf_printk in the bpf program, but what is the rest? I assume this comes from kernel's JIT ?

Where can I look closer what those bits mean? Thanks.

Upvotes: 7

Views: 11806

Answers (1)

pchaigno
pchaigno

Reputation: 13133

In your example:

telnet-470   [001] .N.. 419421.045894: 0x00000001: BPF command: 2
  • telnet is your current task's name.
  • 470 is your current task's PID.
  • 001 is the CPU number on which the task is running.
  • In .N.., each character refers to a set of options (whether irqs are enabled, scheduling options, whether hard/softirqs are running, level of preempt_disabled respectively). N means that TIF_NEED_RESCHED and PREEMPT_NEED_RESCHED are set.
  • 419421.045894 is a timestamp.
  • 0x00000001 is a fake value used by BPF for the ip register.
  • BPF command: 2 is your message.

Sources

The bpf_trace_printk helper calls trace_printk, whose format is detailed in the documentation for ftrace (Output format section). The fake ip value is commented in the original commit for the bpf_trace_printk helper.

As Qeole mentioned below, this format had nothing to do with the JIT compiler (or the eBPF infrastructure for that matter) and eBPF helpers don't need to be JIT compiled as they're already compiled as part of the kernel's source code.

Upvotes: 9

Related Questions