[PATCH bpf-next] bpftool: Print verified instruction count in prog show

[PATCH bpf-next] bpftool: Print verified instruction count in prog show

[chenyuan_fl]

From: Yuan Chen <chenyuan@kylinos.cn>

The number of instructions processed by the verifier is available
through bpf_prog_info::verified_insns and the program's fdinfo since
commit aba64c7da983 ("bpf: Add verified_insns to bpf_prog_info and
fdinfo"), but bpftool does not display it, leaving no convenient way
to check a program's verifier cost.

Print the count in the plain and JSON output of bpftool prog show,
following the convention of the other conditional stats
(run_time_ns, run_cnt, recursion_misses): kernels that do not fill
the field leave it zeroed and nothing is printed.

Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
---
 tools/bpf/bpftool/Documentation/bpftool-prog.rst | 3 ++-
 tools/bpf/bpftool/prog.c                         | 4 ++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/bpf/bpftool/Documentation/bpftool-prog.rst b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
index 8dbd34ef3d8b..d4a94e0737a9 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-prog.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
@@ -285,7 +285,7 @@ EXAMPLES
 
 ::
 
-    10: xdp  name some_prog  tag 005a3d2123620c8b  gpl run_time_ns 81632 run_cnt 10
+    10: xdp  name some_prog  tag 005a3d2123620c8b  gpl run_time_ns 81632 run_cnt 10 verified_insns 528
             loaded_at 2017-09-29T20:11:00+0000  uid 0
             xlated 528B  jited 370B  memlock 4096B  map_ids 10
             pids systemd(1)
@@ -301,6 +301,7 @@ EXAMPLES
             "gpl_compatible": true,
             "run_time_ns": 81632,
             "run_cnt": 10,
+            "verified_insns": 528,
             "loaded_at": 1506715860,
             "uid": 0,
             "bytes_xlated": 528,
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index eb077236d2ea..c77e871b8859 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -441,6 +441,8 @@ static void print_prog_header_json(struct bpf_prog_info *info, int fd)
 	}
 	if (info->recursion_misses)
 		jsonw_uint_field(json_wtr, "recursion_misses", info->recursion_misses);
+	if (info->verified_insns)
+		jsonw_uint_field(json_wtr, "verified_insns", info->verified_insns);
 }
 
 static void print_prog_json(struct bpf_prog_info *info, int fd, bool orphaned)
@@ -526,6 +528,8 @@ static void print_prog_header_plain(struct bpf_prog_info *info, int fd)
 		       info->run_time_ns, info->run_cnt);
 	if (info->recursion_misses)
 		printf(" recursion_misses %llu", info->recursion_misses);
+	if (info->verified_insns)
+		printf(" verified_insns %u", info->verified_insns);
 	printf("\n");
 }
 
-- 
2.54.0

[PATCH bpf-next] bpftool: Print map_extra in map show

[chenyuan_fl]

From: Yuan Chen <chenyuan@kylinos.cn>

bpf_map_info::map_extra carries per-map-type creation attributes
(hash function count for bloom filter, VMA start for arena). The
kernel prints it in fdinfo, but bpftool does not. Print the raw
value in plain and JSON output when non-zero, without interpreting
it per map type, like map_flags. The attribute is already overloaded
per map type, and bpftool must not grow per-type knowledge of it.

Example (bloom filter with 7 hash functions):

    117665: bloom_filter  name featu_bloom  flags 0x0
            key 0B  value 8B  max_entries 128  map_extra 0x7  memlock 520B
            pids fixture(3543054)

Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
---
 tools/bpf/bpftool/map.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 20d59eab09a1..62e36c7934ff 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -483,6 +483,8 @@ static int show_map_close_json(int fd, struct bpf_map_info *info)
 	jsonw_uint_field(json_wtr, "bytes_key", info->key_size);
 	jsonw_uint_field(json_wtr, "bytes_value", info->value_size);
 	jsonw_uint_field(json_wtr, "max_entries", info->max_entries);
+	if (info->map_extra)
+		jsonw_lluint_field(json_wtr, "map_extra", info->map_extra);
 
 	if (memlock)
 		jsonw_int_field(json_wtr, "bytes_memlock", atoll(memlock));
@@ -570,6 +572,8 @@ static int show_map_close_plain(int fd, struct bpf_map_info *info)
 	show_map_header_plain(info);
 	printf("\tkey %uB  value %uB  max_entries %u",
 	       info->key_size, info->value_size, info->max_entries);
+	if (info->map_extra)
+		printf("  map_extra %#llx", (unsigned long long)info->map_extra);
 
 	if (memlock)
 		printf("  memlock %sB", memlock);
-- 
2.54.0

Re: [PATCH bpf-next] bpftool: Print verified instruction count in prog show

[Justin Suess]

On Fri, Oct 16, 2026 at 03:16:57PM +0800, chenyuan_fl@163.com wrote:
> From: Yuan Chen <chenyuan@kylinos.cn>
> 
> The number of instructions processed by the verifier is available
> through bpf_prog_info::verified_insns and the program's fdinfo since
> commit aba64c7da983 ("bpf: Add verified_insns to bpf_prog_info and
> fdinfo"), but bpftool does not display it, leaving no convenient way
> to check a program's verifier cost.
> 
> Print the count in the plain and JSON output of bpftool prog show,
> following the convention of the other conditional stats
> (run_time_ns, run_cnt, recursion_misses): kernels that do not fill
> the field leave it zeroed and nothing is printed.
>
Reviewed-by: Justin Suess <utilityemal77@gmail.com>

This patch on it's own looks good to me.

Maybe it would be useful to print subprog count as well? Useful for
analyzing programs.

This looks like it would work to get subprog count regardless of whether
JIT was enabled.

  static __u32 prog_subprog_cnt(const struct bpf_prog_info *info)
  {
          if (info->jited_prog_len)
                  return info->nr_jited_ksyms;    /* exact, BTF or not */
          return info->nr_func_info;              /* interpreter: only BTF knows; 0 = unknown */
  }

Completely optional / don't have to include this if you don't want, just
a suggestion for another patch that could help show how many functions
are being subprog'd or inlined :)

Justin
> Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
> ---
>  tools/bpf/bpftool/Documentation/bpftool-prog.rst | 3 ++-
>  tools/bpf/bpftool/prog.c                         | 4 ++++
>  2 files changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/bpf/bpftool/Documentation/bpftool-prog.rst b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
> index 8dbd34ef3d8b..d4a94e0737a9 100644
> --- a/tools/bpf/bpftool/Documentation/bpftool-prog.rst
> +++ b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
> @@ -285,7 +285,7 @@ EXAMPLES
>  
>  ::
>  
> -    10: xdp  name some_prog  tag 005a3d2123620c8b  gpl run_time_ns 81632 run_cnt 10
> +    10: xdp  name some_prog  tag 005a3d2123620c8b  gpl run_time_ns 81632 run_cnt 10 verified_insns 528
>              loaded_at 2017-09-29T20:11:00+0000  uid 0
>              xlated 528B  jited 370B  memlock 4096B  map_ids 10
>              pids systemd(1)
> @@ -301,6 +301,7 @@ EXAMPLES
>              "gpl_compatible": true,
>              "run_time_ns": 81632,
>              "run_cnt": 10,
> +            "verified_insns": 528,
>              "loaded_at": 1506715860,
>              "uid": 0,
>              "bytes_xlated": 528,
> diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
> index eb077236d2ea..c77e871b8859 100644
> --- a/tools/bpf/bpftool/prog.c
> +++ b/tools/bpf/bpftool/prog.c
> @@ -441,6 +441,8 @@ static void print_prog_header_json(struct bpf_prog_info *info, int fd)
>  	}
>  	if (info->recursion_misses)
>  		jsonw_uint_field(json_wtr, "recursion_misses", info->recursion_misses);
> +	if (info->verified_insns)
> +		jsonw_uint_field(json_wtr, "verified_insns", info->verified_insns);
>  }
>  
>  static void print_prog_json(struct bpf_prog_info *info, int fd, bool orphaned)
> @@ -526,6 +528,8 @@ static void print_prog_header_plain(struct bpf_prog_info *info, int fd)
>  		       info->run_time_ns, info->run_cnt);
>  	if (info->recursion_misses)
>  		printf(" recursion_misses %llu", info->recursion_misses);
> +	if (info->verified_insns)
> +		printf(" verified_insns %u", info->verified_insns);
>  	printf("\n");
>  }
>  
> -- 
> 2.54.0
> 

Re: [PATCH bpf-next] bpftool: Print verified instruction count in prog show

[Quentin Monnet]

2026-10-16 15:16 UTC+0800 ~ chenyuan_fl@163.com
> From: Yuan Chen <chenyuan@kylinos.cn>
> 
> The number of instructions processed by the verifier is available
> through bpf_prog_info::verified_insns and the program's fdinfo since
> commit aba64c7da983 ("bpf: Add verified_insns to bpf_prog_info and
> fdinfo"), but bpftool does not display it, leaving no convenient way
> to check a program's verifier cost.
> 
> Print the count in the plain and JSON output of bpftool prog show,
> following the convention of the other conditional stats
> (run_time_ns, run_cnt, recursion_misses): kernels that do not fill
> the field leave it zeroed and nothing is printed.


It's different from the other conditional stats though, unless you run
bpftool on an old kernel verified_insns will show up every time. Can we
move it to another line to avoid growing the first line too much,
please? Maybe after loaded_at and uid?


> 
> Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
> ---
>  tools/bpf/bpftool/Documentation/bpftool-prog.rst | 3 ++-
>  tools/bpf/bpftool/prog.c                         | 4 ++++
>  2 files changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/bpf/bpftool/Documentation/bpftool-prog.rst b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
> index 8dbd34ef3d8b..d4a94e0737a9 100644
> --- a/tools/bpf/bpftool/Documentation/bpftool-prog.rst
> +++ b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
> @@ -285,7 +285,7 @@ EXAMPLES
>  
>  ::
>  
> -    10: xdp  name some_prog  tag 005a3d2123620c8b  gpl run_time_ns 81632 run_cnt 10
> +    10: xdp  name some_prog  tag 005a3d2123620c8b  gpl run_time_ns 81632 run_cnt 10 verified_insns 528
>              loaded_at 2017-09-29T20:11:00+0000  uid 0
>              xlated 528B  jited 370B  memlock 4096B  map_ids 10
>              pids systemd(1)
> @@ -301,6 +301,7 @@ EXAMPLES
>              "gpl_compatible": true,
>              "run_time_ns": 81632,
>              "run_cnt": 10,
> +            "verified_insns": 528,
>              "loaded_at": 1506715860,
>              "uid": 0,
>              "bytes_xlated": 528,
> diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
> index eb077236d2ea..c77e871b8859 100644
> --- a/tools/bpf/bpftool/prog.c
> +++ b/tools/bpf/bpftool/prog.c
> @@ -441,6 +441,8 @@ static void print_prog_header_json(struct bpf_prog_info *info, int fd)
>  	}
>  	if (info->recursion_misses)
>  		jsonw_uint_field(json_wtr, "recursion_misses", info->recursion_misses);
> +	if (info->verified_insns)
> +		jsonw_uint_field(json_wtr, "verified_insns", info->verified_insns);
>  }
>  
>  static void print_prog_json(struct bpf_prog_info *info, int fd, bool orphaned)
> @@ -526,6 +528,8 @@ static void print_prog_header_plain(struct bpf_prog_info *info, int fd)
>  		       info->run_time_ns, info->run_cnt);
>  	if (info->recursion_misses)
>  		printf(" recursion_misses %llu", info->recursion_misses);
> +	if (info->verified_insns)
> +		printf(" verified_insns %u", info->verified_insns);


Note: Moving it to another line means you should use a double space
(rather than single) at the beginning of the string.

pw-bot: cr

Thanks,
Quentin

Re: [PATCH bpf-next] bpftool: Print map_extra in map show

[Quentin Monnet]

2026-10-16 15:16 UTC+0800 ~ chenyuan_fl@163.com
> From: Yuan Chen <chenyuan@kylinos.cn>
> 
> bpf_map_info::map_extra carries per-map-type creation attributes
> (hash function count for bloom filter, VMA start for arena). The
> kernel prints it in fdinfo, but bpftool does not. Print the raw
> value in plain and JSON output when non-zero, without interpreting
> it per map type, like map_flags. The attribute is already overloaded
> per map type, and bpftool must not grow per-type knowledge of it.


Why not? Do we expect the semantic of map_extra to change? Having
something like "nr_hash_funcs 7" in plain output in the case of a Bloom
filter would be easier to interpret?


> 
> Example (bloom filter with 7 hash functions):
> 
>     117665: bloom_filter  name featu_bloom  flags 0x0
>             key 0B  value 8B  max_entries 128  map_extra 0x7  memlock 520B
>             pids fixture(3543054)
> 
> Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>