1================ 2bpftool-prog 3================ 4------------------------------------------------------------------------------- 5tool for inspection and simple manipulation of eBPF progs 6------------------------------------------------------------------------------- 7 8:Manual section: 8 9 10SYNOPSIS 11======== 12 13 **bpftool** [*OPTIONS*] **prog** *COMMAND* 14 15 *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-f** | **--bpffs** } } 16 17 *COMMANDS* := 18 { **show** | **list** | **dump xlated** | **dump jited** | **pin** | **load** 19 | **loadall** | **help** } 20 21MAP COMMANDS 22============= 23 24| **bpftool** **prog { show | list }** [*PROG*] 25| **bpftool** **prog dump xlated** *PROG* [{**file** *FILE* | **opcodes** | **visual**}] 26| **bpftool** **prog dump jited** *PROG* [{**file** *FILE* | **opcodes**}] 27| **bpftool** **prog pin** *PROG* *FILE* 28| **bpftool** **prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] 29| **bpftool** **prog attach** *PROG* *ATTACH_TYPE* *MAP* 30| **bpftool** **prog detach** *PROG* *ATTACH_TYPE* *MAP* 31| **bpftool** **prog help** 32| 33| *MAP* := { **id** *MAP_ID* | **pinned** *FILE* } 34| *PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* } 35| *TYPE* := { 36| **socket** | **kprobe** | **kretprobe** | **classifier** | **action** | 37| **tracepoint** | **raw_tracepoint** | **xdp** | **perf_event** | **cgroup/skb** | 38| **cgroup/sock** | **cgroup/dev** | **lwt_in** | **lwt_out** | **lwt_xmit** | 39| **lwt_seg6local** | **sockops** | **sk_skb** | **sk_msg** | **lirc_mode2** | 40| **cgroup/bind4** | **cgroup/bind6** | **cgroup/post_bind4** | **cgroup/post_bind6** | 41| **cgroup/connect4** | **cgroup/connect6** | **cgroup/sendmsg4** | **cgroup/sendmsg6** 42| } 43| *ATTACH_TYPE* := { **msg_verdict** | **skb_verdict** | **skb_parse** } 44 45 46DESCRIPTION 47=========== 48 **bpftool prog { show | list }** [*PROG*] 49 Show information about loaded programs. If *PROG* is 50 specified show information only about given program, otherwise 51 list all programs currently loaded on the system. 52 53 Output will start with program ID followed by program type and 54 zero or more named attributes (depending on kernel version). 55 56 **bpftool prog dump xlated** *PROG* [{ **file** *FILE* | **opcodes** | **visual** }] 57 Dump eBPF instructions of the program from the kernel. By 58 default, eBPF will be disassembled and printed to standard 59 output in human-readable format. In this case, **opcodes** 60 controls if raw opcodes should be printed as well. 61 62 If **file** is specified, the binary image will instead be 63 written to *FILE*. 64 65 If **visual** is specified, control flow graph (CFG) will be 66 built instead, and eBPF instructions will be presented with 67 CFG in DOT format, on standard output. 68 69 **bpftool prog dump jited** *PROG* [{ **file** *FILE* | **opcodes** }] 70 Dump jited image (host machine code) of the program. 71 If *FILE* is specified image will be written to a file, 72 otherwise it will be disassembled and printed to stdout. 73 74 **opcodes** controls if raw opcodes will be printed. 75 76 **bpftool prog pin** *PROG* *FILE* 77 Pin program *PROG* as *FILE*. 78 79 Note: *FILE* must be located in *bpffs* mount. It must not 80 contain a dot character ('.'), which is reserved for future 81 extensions of *bpffs*. 82 83 **bpftool prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] [**pinmaps** *MAP_DIR*] 84 Load bpf program(s) from binary *OBJ* and pin as *PATH*. 85 **bpftool prog load** pins only the first program from the 86 *OBJ* as *PATH*. **bpftool prog loadall** pins all programs 87 from the *OBJ* under *PATH* directory. 88 **type** is optional, if not specified program type will be 89 inferred from section names. 90 By default bpftool will create new maps as declared in the ELF 91 object being loaded. **map** parameter allows for the reuse 92 of existing maps. It can be specified multiple times, each 93 time for a different map. *IDX* refers to index of the map 94 to be replaced in the ELF file counting from 0, while *NAME* 95 allows to replace a map by name. *MAP* specifies the map to 96 use, referring to it by **id** or through a **pinned** file. 97 If **dev** *NAME* is specified program will be loaded onto 98 given networking device (offload). 99 Optional **pinmaps** argument can be provided to pin all 100 maps under *MAP_DIR* directory. 101 102 Note: *PATH* must be located in *bpffs* mount. It must not 103 contain a dot character ('.'), which is reserved for future 104 extensions of *bpffs*. 105 106 **bpftool prog attach** *PROG* *ATTACH_TYPE* *MAP* 107 Attach bpf program *PROG* (with type specified by *ATTACH_TYPE*) 108 to the map *MAP*. 109 110 **bpftool prog detach** *PROG* *ATTACH_TYPE* *MAP* 111 Detach bpf program *PROG* (with type specified by *ATTACH_TYPE*) 112 from the map *MAP*. 113 114 **bpftool prog help** 115 Print short help message. 116 117OPTIONS 118======= 119 -h, --help 120 Print short generic help message (similar to **bpftool help**). 121 122 -v, --version 123 Print version number (similar to **bpftool version**). 124 125 -j, --json 126 Generate JSON output. For commands that cannot produce JSON, this 127 option has no effect. 128 129 -p, --pretty 130 Generate human-readable JSON output. Implies **-j**. 131 132 -f, --bpffs 133 Show file names of pinned programs. 134 135EXAMPLES 136======== 137**# bpftool prog show** 138:: 139 140 10: xdp name some_prog tag 005a3d2123620c8b gpl 141 loaded_at Sep 29/20:11 uid 0 142 xlated 528B jited 370B memlock 4096B map_ids 10 143 144**# bpftool --json --pretty prog show** 145 146:: 147 148 { 149 "programs": [{ 150 "id": 10, 151 "type": "xdp", 152 "tag": "005a3d2123620c8b", 153 "gpl_compatible": true, 154 "loaded_at": "Sep 29/20:11", 155 "uid": 0, 156 "bytes_xlated": 528, 157 "jited": true, 158 "bytes_jited": 370, 159 "bytes_memlock": 4096, 160 "map_ids": [10 161 ] 162 } 163 ] 164 } 165 166| 167| **# bpftool prog dump xlated id 10 file /tmp/t** 168| **# ls -l /tmp/t** 169| -rw------- 1 root root 560 Jul 22 01:42 /tmp/t 170 171**# bpftool prog dum jited tag 005a3d2123620c8b** 172 173:: 174 175 push %rbp 176 mov %rsp,%rbp 177 sub $0x228,%rsp 178 sub $0x28,%rbp 179 mov %rbx,0x0(%rbp) 180 181| 182| **# mount -t bpf none /sys/fs/bpf/** 183| **# bpftool prog pin id 10 /sys/fs/bpf/prog** 184| **# bpftool prog load ./my_prog.o /sys/fs/bpf/prog2** 185| **# ls -l /sys/fs/bpf/** 186| -rw------- 1 root root 0 Jul 22 01:43 prog 187| -rw------- 1 root root 0 Jul 22 01:44 prog2 188 189**# bpftool prog dum jited pinned /sys/fs/bpf/prog opcodes** 190 191:: 192 193 push %rbp 194 55 195 mov %rsp,%rbp 196 48 89 e5 197 sub $0x228,%rsp 198 48 81 ec 28 02 00 00 199 sub $0x28,%rbp 200 48 83 ed 28 201 mov %rbx,0x0(%rbp) 202 48 89 5d 00 203 204| 205| **# bpftool prog load xdp1_kern.o /sys/fs/bpf/xdp1 type xdp map name rxcnt id 7** 206| **# bpftool prog show pinned /sys/fs/bpf/xdp1** 207| 9: xdp name xdp_prog1 tag 539ec6ce11b52f98 gpl 208| loaded_at 2018-06-25T16:17:31-0700 uid 0 209| xlated 488B jited 336B memlock 4096B map_ids 7 210| **# rm /sys/fs/bpf/xdp1** 211| 212 213SEE ALSO 214======== 215 **bpftool**\ (8), **bpftool-map**\ (8), **bpftool-cgroup**\ (8) 216