Comments (5)
OK thank you.
So this is probably not implemented in bpftool itself (bpftool doesn't directly implement disassembling), it likely comes from the disassemblers we use.
Given than both library behave the same, I suspect they have a reason to do so, but it would be nice to understand the reason behind it and to make sure this is the behaviour we want (or to adjust it otherwise). I don't know if there's something we can do about it - I need to look into this into more details (won't be before next week at least).
Thanks for the report and tests!
from bpftool.
It still showed call 0xffffffffc377aedc
, which is the same wrong address.
My steps:
- comment
FEATURE_TESTS += llvm
insrc/Makefile
cd src; make
The stdout from make
was:
$ make
... libbfd: [ on ]
... clang-bpf-co-re: [ on ]
... llvm: [ OFF ]
... libcap: [ OFF ]
3. run the same commands to check bpf_redirect call
$ s ./bpftool p d j tag 71cf8deecfc1bb77 opcode | grep 'redirect(' -A6
; return redirect(ifindex, flags);
15a1: xor %esi,%esi
31 f6
15a3: mov -0xc0(%rbp),%rax
48 8b 85 40 ff ff ff
15aa: call 0xffffffffc377aedc
e8 2d 99 77 c3
from bpftool.
I think this is because we're missing the base address for the program when doing so.
Looking at your numbers:
$ python3 -c 'print(hex(0xffffffffc377992d + 5 + 0x15aa))'
0xffffffffc377aedc
We get the value printed by bpftool by taking the address in the opcodes, adding all offsets except for the base address for the program.
We should be able to retrieve this base address by parsing /proc/kallsyms in bpftool (we do it for other commands), although I'm not sure how we can plug that into the disassembler.
from bpftool.
Sorry I missed the version info, just downloaded the latest version from release page, and issue persists.
bpftool v7.2.0
using libbpf v1.2
features: llvm, skeletons
from bpftool.
Thanks! Could you please try and compare with the libbfd-based disassembler? I'd be curious to see whereas it does the same.
To do so you would need to compile with libbfd installed (usually shipped with binutils-dev
), and to disable the llvm
feature in the Makefile (Commenting FEATURE_TESTS += llvm
should work).
from bpftool.
Related Issues (20)
- Print error and exit instead of diplaying an empty map for unsupported map types
- Fix weird indent in documentation HOT 1
- streamline bpftool net dump HOT 1
- "make install" for man pages stops. HOT 1
- Error: No JIT disassembly support HOT 2
- "libbpf: map 'xxx': unsupported map linkage static" in Android HOT 7
- Have bpftool return ID of created objects
- Attach programs to tcx HOT 6
- The proper usage of `bpftool prog attach` HOT 2
- BPFTool Prog Loadall command Deletes /sys/fs/cgroup virtual file system directory HOT 3
- bpftool: error while loading shared libraries: libLLVM-17.so: cannot open shared object file: No such file or directory HOT 14
- use bpftool dump this bpf_prog_982904fb4a4dfbdb_tracepoint_sche at 0x8a0/0x1000 how to do it? HOT 1
- Typo: `cgroup/sendmsg°unix` HOT 2
- Check that the list of supported programs, map types, attach types, ... are up-to-date HOT 1
- Dump libbpf's output for `build_obj_refs_table()` when user asks for debug info HOT 2
- When loading eBPF binary with bpftool, the 'bpf_trace_printk' seems no output to '/sys/kernel/debug/tracing/trace_pipe' HOT 8
- bpftool 7.4.0 prog load Segmentation fault (core dumped) HOT 2
- Missing bpffs mount when pinning maps for prog load (`pinmaps`) HOT 6
- Cannot list programs attached to cgroup HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from bpftool.