1================ 2bpftool-prog 3================ 4------------------------------------------------------------------------------- 5tool for inspection and simple manipulation of eBPF progs 6------------------------------------------------------------------------------- 7 8:Manual section: 8 9 10SYNOPSIS 11======== 12 13 **bpftool** [*OPTIONS*] **prog** *COMMAND* 14 15 *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-f** | **--bpffs** } } 16 17 *COMMANDS* := 18 { **show** | **list** | **dump xlated** | **dump jited** | **pin** | **load** 19 | **loadall** | **help** } 20 21MAP COMMANDS 22============= 23 24| **bpftool** **prog { show | list }** [*PROG*] 25| **bpftool** **prog dump xlated** *PROG* [{**file** *FILE* | **opcodes** | **visual**}] 26| **bpftool** **prog dump jited** *PROG* [{**file** *FILE* | **opcodes**}] 27| **bpftool** **prog pin** *PROG* *FILE* 28| **bpftool** **prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] 29| **bpftool** **prog attach** *PROG* *ATTACH_TYPE* [*MAP*] 30| **bpftool** **prog detach** *PROG* *ATTACH_TYPE* [*MAP*] 31| **bpftool** **prog tracelog** 32| **bpftool** **prog help** 33| 34| *MAP* := { **id** *MAP_ID* | **pinned** *FILE* } 35| *PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* } 36| *TYPE* := { 37| **socket** | **kprobe** | **kretprobe** | **classifier** | **action** | 38| **tracepoint** | **raw_tracepoint** | **xdp** | **perf_event** | **cgroup/skb** | 39| **cgroup/sock** | **cgroup/dev** | **lwt_in** | **lwt_out** | **lwt_xmit** | 40| **lwt_seg6local** | **sockops** | **sk_skb** | **sk_msg** | **lirc_mode2** | 41| **cgroup/bind4** | **cgroup/bind6** | **cgroup/post_bind4** | **cgroup/post_bind6** | 42| **cgroup/connect4** | **cgroup/connect6** | **cgroup/sendmsg4** | **cgroup/sendmsg6** 43| } 44| *ATTACH_TYPE* := { 45| **msg_verdict** | **skb_verdict** | **skb_parse** | **flow_dissector** 46| } 47 48 49DESCRIPTION 50=========== 51 **bpftool prog { show | list }** [*PROG*] 52 Show information about loaded programs. If *PROG* is 53 specified show information only about given program, otherwise 54 list all programs currently loaded on the system. 55 56 Output will start with program ID followed by program type and 57 zero or more named attributes (depending on kernel version). 58 59 **bpftool prog dump xlated** *PROG* [{ **file** *FILE* | **opcodes** | **visual** }] 60 Dump eBPF instructions of the program from the kernel. By 61 default, eBPF will be disassembled and printed to standard 62 output in human-readable format. In this case, **opcodes** 63 controls if raw opcodes should be printed as well. 64 65 If **file** is specified, the binary image will instead be 66 written to *FILE*. 67 68 If **visual** is specified, control flow graph (CFG) will be 69 built instead, and eBPF instructions will be presented with 70 CFG in DOT format, on standard output. 71 72 **bpftool prog dump jited** *PROG* [{ **file** *FILE* | **opcodes** }] 73 Dump jited image (host machine code) of the program. 74 If *FILE* is specified image will be written to a file, 75 otherwise it will be disassembled and printed to stdout. 76 77 **opcodes** controls if raw opcodes will be printed. 78 79 **bpftool prog pin** *PROG* *FILE* 80 Pin program *PROG* as *FILE*. 81 82 Note: *FILE* must be located in *bpffs* mount. It must not 83 contain a dot character ('.'), which is reserved for future 84 extensions of *bpffs*. 85 86 **bpftool prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] [**pinmaps** *MAP_DIR*] 87 Load bpf program(s) from binary *OBJ* and pin as *PATH*. 88 **bpftool prog load** pins only the first program from the 89 *OBJ* as *PATH*. **bpftool prog loadall** pins all programs 90 from the *OBJ* under *PATH* directory. 91 **type** is optional, if not specified program type will be 92 inferred from section names. 93 By default bpftool will create new maps as declared in the ELF 94 object being loaded. **map** parameter allows for the reuse 95 of existing maps. It can be specified multiple times, each 96 time for a different map. *IDX* refers to index of the map 97 to be replaced in the ELF file counting from 0, while *NAME* 98 allows to replace a map by name. *MAP* specifies the map to 99 use, referring to it by **id** or through a **pinned** file. 100 If **dev** *NAME* is specified program will be loaded onto 101 given networking device (offload). 102 Optional **pinmaps** argument can be provided to pin all 103 maps under *MAP_DIR* directory. 104 105 Note: *PATH* must be located in *bpffs* mount. It must not 106 contain a dot character ('.'), which is reserved for future 107 extensions of *bpffs*. 108 109 **bpftool prog attach** *PROG* *ATTACH_TYPE* [*MAP*] 110 Attach bpf program *PROG* (with type specified by 111 *ATTACH_TYPE*). Most *ATTACH_TYPEs* require a *MAP* 112 parameter, with the exception of *flow_dissector* which is 113 attached to current networking name space. 114 115 **bpftool prog detach** *PROG* *ATTACH_TYPE* [*MAP*] 116 Detach bpf program *PROG* (with type specified by 117 *ATTACH_TYPE*). Most *ATTACH_TYPEs* require a *MAP* 118 parameter, with the exception of *flow_dissector* which is 119 detached from the current networking name space. 120 121 **bpftool prog tracelog** 122 Dump the trace pipe of the system to the console (stdout). 123 Hit <Ctrl+C> to stop printing. BPF programs can write to this 124 trace pipe at runtime with the **bpf_trace_printk()** helper. 125 This should be used only for debugging purposes. For 126 streaming data from BPF programs to user space, one can use 127 perf events (see also **bpftool-map**\ (8)). 128 129 **bpftool prog help** 130 Print short help message. 131 132OPTIONS 133======= 134 -h, --help 135 Print short generic help message (similar to **bpftool help**). 136 137 -v, --version 138 Print version number (similar to **bpftool version**). 139 140 -j, --json 141 Generate JSON output. For commands that cannot produce JSON, this 142 option has no effect. 143 144 -p, --pretty 145 Generate human-readable JSON output. Implies **-j**. 146 147 -f, --bpffs 148 When showing BPF programs, show file names of pinned 149 programs. 150 151EXAMPLES 152======== 153**# bpftool prog show** 154:: 155 156 10: xdp name some_prog tag 005a3d2123620c8b gpl 157 loaded_at Sep 29/20:11 uid 0 158 xlated 528B jited 370B memlock 4096B map_ids 10 159 160**# bpftool --json --pretty prog show** 161 162:: 163 164 { 165 "programs": [{ 166 "id": 10, 167 "type": "xdp", 168 "tag": "005a3d2123620c8b", 169 "gpl_compatible": true, 170 "loaded_at": "Sep 29/20:11", 171 "uid": 0, 172 "bytes_xlated": 528, 173 "jited": true, 174 "bytes_jited": 370, 175 "bytes_memlock": 4096, 176 "map_ids": [10 177 ] 178 } 179 ] 180 } 181 182| 183| **# bpftool prog dump xlated id 10 file /tmp/t** 184| **# ls -l /tmp/t** 185| -rw------- 1 root root 560 Jul 22 01:42 /tmp/t 186 187**# bpftool prog dum jited tag 005a3d2123620c8b** 188 189:: 190 191 push %rbp 192 mov %rsp,%rbp 193 sub $0x228,%rsp 194 sub $0x28,%rbp 195 mov %rbx,0x0(%rbp) 196 197| 198| **# mount -t bpf none /sys/fs/bpf/** 199| **# bpftool prog pin id 10 /sys/fs/bpf/prog** 200| **# bpftool prog load ./my_prog.o /sys/fs/bpf/prog2** 201| **# ls -l /sys/fs/bpf/** 202| -rw------- 1 root root 0 Jul 22 01:43 prog 203| -rw------- 1 root root 0 Jul 22 01:44 prog2 204 205**# bpftool prog dum jited pinned /sys/fs/bpf/prog opcodes** 206 207:: 208 209 push %rbp 210 55 211 mov %rsp,%rbp 212 48 89 e5 213 sub $0x228,%rsp 214 48 81 ec 28 02 00 00 215 sub $0x28,%rbp 216 48 83 ed 28 217 mov %rbx,0x0(%rbp) 218 48 89 5d 00 219 220| 221| **# bpftool prog load xdp1_kern.o /sys/fs/bpf/xdp1 type xdp map name rxcnt id 7** 222| **# bpftool prog show pinned /sys/fs/bpf/xdp1** 223| 9: xdp name xdp_prog1 tag 539ec6ce11b52f98 gpl 224| loaded_at 2018-06-25T16:17:31-0700 uid 0 225| xlated 488B jited 336B memlock 4096B map_ids 7 226| **# rm /sys/fs/bpf/xdp1** 227| 228 229SEE ALSO 230======== 231 **bpf**\ (2), 232 **bpf-helpers**\ (7), 233 **bpftool**\ (8), 234 **bpftool-map**\ (8), 235 **bpftool-cgroup**\ (8), 236 **bpftool-net**\ (8), 237 **bpftool-perf**\ (8) 238