1================ 2bpftool-prog 3================ 4------------------------------------------------------------------------------- 5tool for inspection and simple manipulation of eBPF progs 6------------------------------------------------------------------------------- 7 8:Manual section: 8 9 10SYNOPSIS 11======== 12 13 **bpftool** [*OPTIONS*] **prog** *COMMAND* 14 15 *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-f** | **--bpffs** } } 16 17 *COMMANDS* := 18 { **show** | **list** | **dump xlated** | **dump jited** | **pin** | **load** 19 | **loadall** | **help** } 20 21MAP COMMANDS 22============= 23 24| **bpftool** **prog { show | list }** [*PROG*] 25| **bpftool** **prog dump xlated** *PROG* [{**file** *FILE* | **opcodes** | **visual**}] 26| **bpftool** **prog dump jited** *PROG* [{**file** *FILE* | **opcodes**}] 27| **bpftool** **prog pin** *PROG* *FILE* 28| **bpftool** **prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] 29| **bpftool** **prog attach** *PROG* *ATTACH_TYPE* *MAP* 30| **bpftool** **prog detach** *PROG* *ATTACH_TYPE* *MAP* 31| **bpftool** **prog help** 32| 33| *MAP* := { **id** *MAP_ID* | **pinned** *FILE* } 34| *PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* } 35| *TYPE* := { 36| **socket** | **kprobe** | **kretprobe** | **classifier** | **action** | 37| **tracepoint** | **raw_tracepoint** | **xdp** | **perf_event** | **cgroup/skb** | 38| **cgroup/sock** | **cgroup/dev** | **lwt_in** | **lwt_out** | **lwt_xmit** | 39| **lwt_seg6local** | **sockops** | **sk_skb** | **sk_msg** | **lirc_mode2** | 40| **cgroup/bind4** | **cgroup/bind6** | **cgroup/post_bind4** | **cgroup/post_bind6** | 41| **cgroup/connect4** | **cgroup/connect6** | **cgroup/sendmsg4** | **cgroup/sendmsg6** 42| } 43| *ATTACH_TYPE* := { **msg_verdict** | **skb_verdict** | **skb_parse** } 44 45 46DESCRIPTION 47=========== 48 **bpftool prog { show | list }** [*PROG*] 49 Show information about loaded programs. If *PROG* is 50 specified show information only about given program, otherwise 51 list all programs currently loaded on the system. 52 53 Output will start with program ID followed by program type and 54 zero or more named attributes (depending on kernel version). 55 56 **bpftool prog dump xlated** *PROG* [{ **file** *FILE* | **opcodes** | **visual** }] 57 Dump eBPF instructions of the program from the kernel. By 58 default, eBPF will be disassembled and printed to standard 59 output in human-readable format. In this case, **opcodes** 60 controls if raw opcodes should be printed as well. 61 62 If **file** is specified, the binary image will instead be 63 written to *FILE*. 64 65 If **visual** is specified, control flow graph (CFG) will be 66 built instead, and eBPF instructions will be presented with 67 CFG in DOT format, on standard output. 68 69 **bpftool prog dump jited** *PROG* [{ **file** *FILE* | **opcodes** }] 70 Dump jited image (host machine code) of the program. 71 If *FILE* is specified image will be written to a file, 72 otherwise it will be disassembled and printed to stdout. 73 74 **opcodes** controls if raw opcodes will be printed. 75 76 **bpftool prog pin** *PROG* *FILE* 77 Pin program *PROG* as *FILE*. 78 79 Note: *FILE* must be located in *bpffs* mount. It must not 80 contain a dot character ('.'), which is reserved for future 81 extensions of *bpffs*. 82 83 **bpftool prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] 84 Load bpf program(s) from binary *OBJ* and pin as *PATH*. 85 **bpftool prog load** pins only the first program from the 86 *OBJ* as *PATH*. **bpftool prog loadall** pins all programs 87 from the *OBJ* under *PATH* directory. 88 **type** is optional, if not specified program type will be 89 inferred from section names. 90 By default bpftool will create new maps as declared in the ELF 91 object being loaded. **map** parameter allows for the reuse 92 of existing maps. It can be specified multiple times, each 93 time for a different map. *IDX* refers to index of the map 94 to be replaced in the ELF file counting from 0, while *NAME* 95 allows to replace a map by name. *MAP* specifies the map to 96 use, referring to it by **id** or through a **pinned** file. 97 If **dev** *NAME* is specified program will be loaded onto 98 given networking device (offload). 99 100 Note: *PATH* must be located in *bpffs* mount. It must not 101 contain a dot character ('.'), which is reserved for future 102 extensions of *bpffs*. 103 104 **bpftool prog attach** *PROG* *ATTACH_TYPE* *MAP* 105 Attach bpf program *PROG* (with type specified by *ATTACH_TYPE*) 106 to the map *MAP*. 107 108 **bpftool prog detach** *PROG* *ATTACH_TYPE* *MAP* 109 Detach bpf program *PROG* (with type specified by *ATTACH_TYPE*) 110 from the map *MAP*. 111 112 **bpftool prog help** 113 Print short help message. 114 115OPTIONS 116======= 117 -h, --help 118 Print short generic help message (similar to **bpftool help**). 119 120 -v, --version 121 Print version number (similar to **bpftool version**). 122 123 -j, --json 124 Generate JSON output. For commands that cannot produce JSON, this 125 option has no effect. 126 127 -p, --pretty 128 Generate human-readable JSON output. Implies **-j**. 129 130 -f, --bpffs 131 Show file names of pinned programs. 132 133EXAMPLES 134======== 135**# bpftool prog show** 136:: 137 138 10: xdp name some_prog tag 005a3d2123620c8b gpl 139 loaded_at Sep 29/20:11 uid 0 140 xlated 528B jited 370B memlock 4096B map_ids 10 141 142**# bpftool --json --pretty prog show** 143 144:: 145 146 { 147 "programs": [{ 148 "id": 10, 149 "type": "xdp", 150 "tag": "005a3d2123620c8b", 151 "gpl_compatible": true, 152 "loaded_at": "Sep 29/20:11", 153 "uid": 0, 154 "bytes_xlated": 528, 155 "jited": true, 156 "bytes_jited": 370, 157 "bytes_memlock": 4096, 158 "map_ids": [10 159 ] 160 } 161 ] 162 } 163 164| 165| **# bpftool prog dump xlated id 10 file /tmp/t** 166| **# ls -l /tmp/t** 167| -rw------- 1 root root 560 Jul 22 01:42 /tmp/t 168 169**# bpftool prog dum jited tag 005a3d2123620c8b** 170 171:: 172 173 push %rbp 174 mov %rsp,%rbp 175 sub $0x228,%rsp 176 sub $0x28,%rbp 177 mov %rbx,0x0(%rbp) 178 179| 180| **# mount -t bpf none /sys/fs/bpf/** 181| **# bpftool prog pin id 10 /sys/fs/bpf/prog** 182| **# bpftool prog load ./my_prog.o /sys/fs/bpf/prog2** 183| **# ls -l /sys/fs/bpf/** 184| -rw------- 1 root root 0 Jul 22 01:43 prog 185| -rw------- 1 root root 0 Jul 22 01:44 prog2 186 187**# bpftool prog dum jited pinned /sys/fs/bpf/prog opcodes** 188 189:: 190 191 push %rbp 192 55 193 mov %rsp,%rbp 194 48 89 e5 195 sub $0x228,%rsp 196 48 81 ec 28 02 00 00 197 sub $0x28,%rbp 198 48 83 ed 28 199 mov %rbx,0x0(%rbp) 200 48 89 5d 00 201 202| 203| **# bpftool prog load xdp1_kern.o /sys/fs/bpf/xdp1 type xdp map name rxcnt id 7** 204| **# bpftool prog show pinned /sys/fs/bpf/xdp1** 205| 9: xdp name xdp_prog1 tag 539ec6ce11b52f98 gpl 206| loaded_at 2018-06-25T16:17:31-0700 uid 0 207| xlated 488B jited 336B memlock 4096B map_ids 7 208| **# rm /sys/fs/bpf/xdp1** 209| 210 211SEE ALSO 212======== 213 **bpftool**\ (8), **bpftool-map**\ (8), **bpftool-cgroup**\ (8) 214