[PATCH bpf-next] bpftool: Print verified instruction count in prog show

[PATCH bpf-next] bpftool: Print verified instruction count in prog show

[chenyuan_fl]

From: Yuan Chen <chenyuan@kylinos.cn>

The number of instructions processed by the verifier is available
through bpf_prog_info::verified_insns and the program's fdinfo since
commit aba64c7da983 ("bpf: Add verified_insns to bpf_prog_info and
fdinfo"), but bpftool does not display it, leaving no convenient way
to check a program's verifier cost.

Print the count in the plain and JSON output of bpftool prog show,
following the convention of the other conditional stats
(run_time_ns, run_cnt, recursion_misses): kernels that do not fill
the field leave it zeroed and nothing is printed.

Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
---
 tools/bpf/bpftool/Documentation/bpftool-prog.rst | 3 ++-
 tools/bpf/bpftool/prog.c                         | 4 ++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/bpf/bpftool/Documentation/bpftool-prog.rst b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
index 8dbd34ef3d8b..d4a94e0737a9 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-prog.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
@@ -285,7 +285,7 @@ EXAMPLES
 
 ::
 
-    10: xdp  name some_prog  tag 005a3d2123620c8b  gpl run_time_ns 81632 run_cnt 10
+    10: xdp  name some_prog  tag 005a3d2123620c8b  gpl run_time_ns 81632 run_cnt 10 verified_insns 528
             loaded_at 2017-09-29T20:11:00+0000  uid 0
             xlated 528B  jited 370B  memlock 4096B  map_ids 10
             pids systemd(1)
@@ -301,6 +301,7 @@ EXAMPLES
             "gpl_compatible": true,
             "run_time_ns": 81632,
             "run_cnt": 10,
+            "verified_insns": 528,
             "loaded_at": 1506715860,
             "uid": 0,
             "bytes_xlated": 528,
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index eb077236d2ea..c77e871b8859 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -441,6 +441,8 @@ static void print_prog_header_json(struct bpf_prog_info *info, int fd)
 	}
 	if (info->recursion_misses)
 		jsonw_uint_field(json_wtr, "recursion_misses", info->recursion_misses);
+	if (info->verified_insns)
+		jsonw_uint_field(json_wtr, "verified_insns", info->verified_insns);
 }
 
 static void print_prog_json(struct bpf_prog_info *info, int fd, bool orphaned)
@@ -526,6 +528,8 @@ static void print_prog_header_plain(struct bpf_prog_info *info, int fd)
 		       info->run_time_ns, info->run_cnt);
 	if (info->recursion_misses)
 		printf(" recursion_misses %llu", info->recursion_misses);
+	if (info->verified_insns)
+		printf(" verified_insns %u", info->verified_insns);
 	printf("\n");
 }
 
-- 
2.54.0

Re: [PATCH bpf-next] bpftool: Print verified instruction count in prog show

[Justin Suess]

On Fri, Oct 16, 2026 at 03:16:57PM +0800, chenyuan_fl@163.com wrote:
> From: Yuan Chen <chenyuan@kylinos.cn>
> 
> The number of instructions processed by the verifier is available
> through bpf_prog_info::verified_insns and the program's fdinfo since
> commit aba64c7da983 ("bpf: Add verified_insns to bpf_prog_info and
> fdinfo"), but bpftool does not display it, leaving no convenient way
> to check a program's verifier cost.
> 
> Print the count in the plain and JSON output of bpftool prog show,
> following the convention of the other conditional stats
> (run_time_ns, run_cnt, recursion_misses): kernels that do not fill
> the field leave it zeroed and nothing is printed.
>
Reviewed-by: Justin Suess <utilityemal77@gmail.com>

This patch on it's own looks good to me.

Maybe it would be useful to print subprog count as well? Useful for
analyzing programs.

This looks like it would work to get subprog count regardless of whether
JIT was enabled.

  static __u32 prog_subprog_cnt(const struct bpf_prog_info *info)
  {
          if (info->jited_prog_len)
                  return info->nr_jited_ksyms;    /* exact, BTF or not */
          return info->nr_func_info;              /* interpreter: only BTF knows; 0 = unknown */
  }

Completely optional / don't have to include this if you don't want, just
a suggestion for another patch that could help show how many functions
are being subprog'd or inlined :)

Justin
> Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
> ---
>  tools/bpf/bpftool/Documentation/bpftool-prog.rst | 3 ++-
>  tools/bpf/bpftool/prog.c                         | 4 ++++
>  2 files changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/bpf/bpftool/Documentation/bpftool-prog.rst b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
> index 8dbd34ef3d8b..d4a94e0737a9 100644
> --- a/tools/bpf/bpftool/Documentation/bpftool-prog.rst
> +++ b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
> @@ -285,7 +285,7 @@ EXAMPLES
>  
>  ::
>  
> -    10: xdp  name some_prog  tag 005a3d2123620c8b  gpl run_time_ns 81632 run_cnt 10
> +    10: xdp  name some_prog  tag 005a3d2123620c8b  gpl run_time_ns 81632 run_cnt 10 verified_insns 528
>              loaded_at 2017-09-29T20:11:00+0000  uid 0
>              xlated 528B  jited 370B  memlock 4096B  map_ids 10
>              pids systemd(1)
> @@ -301,6 +301,7 @@ EXAMPLES
>              "gpl_compatible": true,
>              "run_time_ns": 81632,
>              "run_cnt": 10,
> +            "verified_insns": 528,
>              "loaded_at": 1506715860,
>              "uid": 0,
>              "bytes_xlated": 528,
> diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
> index eb077236d2ea..c77e871b8859 100644
> --- a/tools/bpf/bpftool/prog.c
> +++ b/tools/bpf/bpftool/prog.c
> @@ -441,6 +441,8 @@ static void print_prog_header_json(struct bpf_prog_info *info, int fd)
>  	}
>  	if (info->recursion_misses)
>  		jsonw_uint_field(json_wtr, "recursion_misses", info->recursion_misses);
> +	if (info->verified_insns)
> +		jsonw_uint_field(json_wtr, "verified_insns", info->verified_insns);
>  }
>  
>  static void print_prog_json(struct bpf_prog_info *info, int fd, bool orphaned)
> @@ -526,6 +528,8 @@ static void print_prog_header_plain(struct bpf_prog_info *info, int fd)
>  		       info->run_time_ns, info->run_cnt);
>  	if (info->recursion_misses)
>  		printf(" recursion_misses %llu", info->recursion_misses);
> +	if (info->verified_insns)
> +		printf(" verified_insns %u", info->verified_insns);
>  	printf("\n");
>  }
>  
> -- 
> 2.54.0
> 

Re: [PATCH bpf-next] bpftool: Print verified instruction count in prog show

[Quentin Monnet]

2026-10-16 15:16 UTC+0800 ~ chenyuan_fl@163.com
> From: Yuan Chen <chenyuan@kylinos.cn>
> 
> The number of instructions processed by the verifier is available
> through bpf_prog_info::verified_insns and the program's fdinfo since
> commit aba64c7da983 ("bpf: Add verified_insns to bpf_prog_info and
> fdinfo"), but bpftool does not display it, leaving no convenient way
> to check a program's verifier cost.
> 
> Print the count in the plain and JSON output of bpftool prog show,
> following the convention of the other conditional stats
> (run_time_ns, run_cnt, recursion_misses): kernels that do not fill
> the field leave it zeroed and nothing is printed.


It's different from the other conditional stats though, unless you run
bpftool on an old kernel verified_insns will show up every time. Can we
move it to another line to avoid growing the first line too much,
please? Maybe after loaded_at and uid?


> 
> Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
> ---
>  tools/bpf/bpftool/Documentation/bpftool-prog.rst | 3 ++-
>  tools/bpf/bpftool/prog.c                         | 4 ++++
>  2 files changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/bpf/bpftool/Documentation/bpftool-prog.rst b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
> index 8dbd34ef3d8b..d4a94e0737a9 100644
> --- a/tools/bpf/bpftool/Documentation/bpftool-prog.rst
> +++ b/tools/bpf/bpftool/Documentation/bpftool-prog.rst
> @@ -285,7 +285,7 @@ EXAMPLES
>  
>  ::
>  
> -    10: xdp  name some_prog  tag 005a3d2123620c8b  gpl run_time_ns 81632 run_cnt 10
> +    10: xdp  name some_prog  tag 005a3d2123620c8b  gpl run_time_ns 81632 run_cnt 10 verified_insns 528
>              loaded_at 2017-09-29T20:11:00+0000  uid 0
>              xlated 528B  jited 370B  memlock 4096B  map_ids 10
>              pids systemd(1)
> @@ -301,6 +301,7 @@ EXAMPLES
>              "gpl_compatible": true,
>              "run_time_ns": 81632,
>              "run_cnt": 10,
> +            "verified_insns": 528,
>              "loaded_at": 1506715860,
>              "uid": 0,
>              "bytes_xlated": 528,
> diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
> index eb077236d2ea..c77e871b8859 100644
> --- a/tools/bpf/bpftool/prog.c
> +++ b/tools/bpf/bpftool/prog.c
> @@ -441,6 +441,8 @@ static void print_prog_header_json(struct bpf_prog_info *info, int fd)
>  	}
>  	if (info->recursion_misses)
>  		jsonw_uint_field(json_wtr, "recursion_misses", info->recursion_misses);
> +	if (info->verified_insns)
> +		jsonw_uint_field(json_wtr, "verified_insns", info->verified_insns);
>  }
>  
>  static void print_prog_json(struct bpf_prog_info *info, int fd, bool orphaned)
> @@ -526,6 +528,8 @@ static void print_prog_header_plain(struct bpf_prog_info *info, int fd)
>  		       info->run_time_ns, info->run_cnt);
>  	if (info->recursion_misses)
>  		printf(" recursion_misses %llu", info->recursion_misses);
> +	if (info->verified_insns)
> +		printf(" verified_insns %u", info->verified_insns);


Note: Moving it to another line means you should use a double space
(rather than single) at the beginning of the string.

pw-bot: cr

Thanks,
Quentin