1================ 2bpftool-prog 3================ 4------------------------------------------------------------------------------- 5tool for inspection and simple manipulation of eBPF progs 6------------------------------------------------------------------------------- 7 8:Manual section: 8 9 10SYNOPSIS 11======== 12 13 **bpftool** [*OPTIONS*] **prog** *COMMAND* 14 15 *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-f** | **--bpffs** } } 16 17 *COMMANDS* := 18 { **show** | **list** | **dump xlated** | **dump jited** | **pin** | **load** 19 | **loadall** | **help** } 20 21MAP COMMANDS 22============= 23 24| **bpftool** **prog { show | list }** [*PROG*] 25| **bpftool** **prog dump xlated** *PROG* [{**file** *FILE* | **opcodes** | **visual**}] 26| **bpftool** **prog dump jited** *PROG* [{**file** *FILE* | **opcodes**}] 27| **bpftool** **prog pin** *PROG* *FILE* 28| **bpftool** **prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] 29| **bpftool** **prog attach** *PROG* *ATTACH_TYPE* [*MAP*] 30| **bpftool** **prog detach** *PROG* *ATTACH_TYPE* [*MAP*] 31| **bpftool** **prog help** 32| 33| *MAP* := { **id** *MAP_ID* | **pinned** *FILE* } 34| *PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* } 35| *TYPE* := { 36| **socket** | **kprobe** | **kretprobe** | **classifier** | **action** | 37| **tracepoint** | **raw_tracepoint** | **xdp** | **perf_event** | **cgroup/skb** | 38| **cgroup/sock** | **cgroup/dev** | **lwt_in** | **lwt_out** | **lwt_xmit** | 39| **lwt_seg6local** | **sockops** | **sk_skb** | **sk_msg** | **lirc_mode2** | 40| **cgroup/bind4** | **cgroup/bind6** | **cgroup/post_bind4** | **cgroup/post_bind6** | 41| **cgroup/connect4** | **cgroup/connect6** | **cgroup/sendmsg4** | **cgroup/sendmsg6** 42| } 43| *ATTACH_TYPE* := { 44| **msg_verdict** | **skb_verdict** | **skb_parse** | **flow_dissector** 45| } 46 47 48DESCRIPTION 49=========== 50 **bpftool prog { show | list }** [*PROG*] 51 Show information about loaded programs. If *PROG* is 52 specified show information only about given program, otherwise 53 list all programs currently loaded on the system. 54 55 Output will start with program ID followed by program type and 56 zero or more named attributes (depending on kernel version). 57 58 **bpftool prog dump xlated** *PROG* [{ **file** *FILE* | **opcodes** | **visual** }] 59 Dump eBPF instructions of the program from the kernel. By 60 default, eBPF will be disassembled and printed to standard 61 output in human-readable format. In this case, **opcodes** 62 controls if raw opcodes should be printed as well. 63 64 If **file** is specified, the binary image will instead be 65 written to *FILE*. 66 67 If **visual** is specified, control flow graph (CFG) will be 68 built instead, and eBPF instructions will be presented with 69 CFG in DOT format, on standard output. 70 71 **bpftool prog dump jited** *PROG* [{ **file** *FILE* | **opcodes** }] 72 Dump jited image (host machine code) of the program. 73 If *FILE* is specified image will be written to a file, 74 otherwise it will be disassembled and printed to stdout. 75 76 **opcodes** controls if raw opcodes will be printed. 77 78 **bpftool prog pin** *PROG* *FILE* 79 Pin program *PROG* as *FILE*. 80 81 Note: *FILE* must be located in *bpffs* mount. It must not 82 contain a dot character ('.'), which is reserved for future 83 extensions of *bpffs*. 84 85 **bpftool prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] [**pinmaps** *MAP_DIR*] 86 Load bpf program(s) from binary *OBJ* and pin as *PATH*. 87 **bpftool prog load** pins only the first program from the 88 *OBJ* as *PATH*. **bpftool prog loadall** pins all programs 89 from the *OBJ* under *PATH* directory. 90 **type** is optional, if not specified program type will be 91 inferred from section names. 92 By default bpftool will create new maps as declared in the ELF 93 object being loaded. **map** parameter allows for the reuse 94 of existing maps. It can be specified multiple times, each 95 time for a different map. *IDX* refers to index of the map 96 to be replaced in the ELF file counting from 0, while *NAME* 97 allows to replace a map by name. *MAP* specifies the map to 98 use, referring to it by **id** or through a **pinned** file. 99 If **dev** *NAME* is specified program will be loaded onto 100 given networking device (offload). 101 Optional **pinmaps** argument can be provided to pin all 102 maps under *MAP_DIR* directory. 103 104 Note: *PATH* must be located in *bpffs* mount. It must not 105 contain a dot character ('.'), which is reserved for future 106 extensions of *bpffs*. 107 108 **bpftool prog attach** *PROG* *ATTACH_TYPE* [*MAP*] 109 Attach bpf program *PROG* (with type specified by 110 *ATTACH_TYPE*). Most *ATTACH_TYPEs* require a *MAP* 111 parameter, with the exception of *flow_dissector* which is 112 attached to current networking name space. 113 114 **bpftool prog detach** *PROG* *ATTACH_TYPE* [*MAP*] 115 Detach bpf program *PROG* (with type specified by 116 *ATTACH_TYPE*). Most *ATTACH_TYPEs* require a *MAP* 117 parameter, with the exception of *flow_dissector* which is 118 detached from the current networking name space. 119 120 **bpftool prog help** 121 Print short help message. 122 123OPTIONS 124======= 125 -h, --help 126 Print short generic help message (similar to **bpftool help**). 127 128 -v, --version 129 Print version number (similar to **bpftool version**). 130 131 -j, --json 132 Generate JSON output. For commands that cannot produce JSON, this 133 option has no effect. 134 135 -p, --pretty 136 Generate human-readable JSON output. Implies **-j**. 137 138 -f, --bpffs 139 Show file names of pinned programs. 140 141EXAMPLES 142======== 143**# bpftool prog show** 144:: 145 146 10: xdp name some_prog tag 005a3d2123620c8b gpl 147 loaded_at Sep 29/20:11 uid 0 148 xlated 528B jited 370B memlock 4096B map_ids 10 149 150**# bpftool --json --pretty prog show** 151 152:: 153 154 { 155 "programs": [{ 156 "id": 10, 157 "type": "xdp", 158 "tag": "005a3d2123620c8b", 159 "gpl_compatible": true, 160 "loaded_at": "Sep 29/20:11", 161 "uid": 0, 162 "bytes_xlated": 528, 163 "jited": true, 164 "bytes_jited": 370, 165 "bytes_memlock": 4096, 166 "map_ids": [10 167 ] 168 } 169 ] 170 } 171 172| 173| **# bpftool prog dump xlated id 10 file /tmp/t** 174| **# ls -l /tmp/t** 175| -rw------- 1 root root 560 Jul 22 01:42 /tmp/t 176 177**# bpftool prog dum jited tag 005a3d2123620c8b** 178 179:: 180 181 push %rbp 182 mov %rsp,%rbp 183 sub $0x228,%rsp 184 sub $0x28,%rbp 185 mov %rbx,0x0(%rbp) 186 187| 188| **# mount -t bpf none /sys/fs/bpf/** 189| **# bpftool prog pin id 10 /sys/fs/bpf/prog** 190| **# bpftool prog load ./my_prog.o /sys/fs/bpf/prog2** 191| **# ls -l /sys/fs/bpf/** 192| -rw------- 1 root root 0 Jul 22 01:43 prog 193| -rw------- 1 root root 0 Jul 22 01:44 prog2 194 195**# bpftool prog dum jited pinned /sys/fs/bpf/prog opcodes** 196 197:: 198 199 push %rbp 200 55 201 mov %rsp,%rbp 202 48 89 e5 203 sub $0x228,%rsp 204 48 81 ec 28 02 00 00 205 sub $0x28,%rbp 206 48 83 ed 28 207 mov %rbx,0x0(%rbp) 208 48 89 5d 00 209 210| 211| **# bpftool prog load xdp1_kern.o /sys/fs/bpf/xdp1 type xdp map name rxcnt id 7** 212| **# bpftool prog show pinned /sys/fs/bpf/xdp1** 213| 9: xdp name xdp_prog1 tag 539ec6ce11b52f98 gpl 214| loaded_at 2018-06-25T16:17:31-0700 uid 0 215| xlated 488B jited 336B memlock 4096B map_ids 7 216| **# rm /sys/fs/bpf/xdp1** 217| 218 219SEE ALSO 220======== 221 **bpftool**\ (8), **bpftool-map**\ (8), **bpftool-cgroup**\ (8) 222