1================ 2bpftool-prog 3================ 4------------------------------------------------------------------------------- 5tool for inspection and simple manipulation of eBPF progs 6------------------------------------------------------------------------------- 7 8:Manual section: 8 9 10SYNOPSIS 11======== 12 13 **bpftool** [*OPTIONS*] **prog** *COMMAND* 14 15 *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-f** | **--bpffs** } } 16 17 *COMMANDS* := 18 { **show** | **list** | **dump xlated** | **dump jited** | **pin** | **load** | **help** } 19 20MAP COMMANDS 21============= 22 23| **bpftool** **prog { show | list }** [*PROG*] 24| **bpftool** **prog dump xlated** *PROG* [{**file** *FILE* | **opcodes** | **visual**}] 25| **bpftool** **prog dump jited** *PROG* [{**file** *FILE* | **opcodes**}] 26| **bpftool** **prog pin** *PROG* *FILE* 27| **bpftool** **prog load** *OBJ* *FILE* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] 28| **bpftool** **prog attach** *PROG* *ATTACH_TYPE* *MAP* 29| **bpftool** **prog detach** *PROG* *ATTACH_TYPE* *MAP* 30| **bpftool** **prog help** 31| 32| *MAP* := { **id** *MAP_ID* | **pinned** *FILE* } 33| *PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* } 34| *TYPE* := { 35| **socket** | **kprobe** | **kretprobe** | **classifier** | **action** | 36| **tracepoint** | **raw_tracepoint** | **xdp** | **perf_event** | **cgroup/skb** | 37| **cgroup/sock** | **cgroup/dev** | **lwt_in** | **lwt_out** | **lwt_xmit** | 38| **lwt_seg6local** | **sockops** | **sk_skb** | **sk_msg** | **lirc_mode2** | 39| **cgroup/bind4** | **cgroup/bind6** | **cgroup/post_bind4** | **cgroup/post_bind6** | 40| **cgroup/connect4** | **cgroup/connect6** | **cgroup/sendmsg4** | **cgroup/sendmsg6** 41| } 42| *ATTACH_TYPE* := { **msg_verdict** | **skb_verdict** | **skb_parse** } 43 44 45DESCRIPTION 46=========== 47 **bpftool prog { show | list }** [*PROG*] 48 Show information about loaded programs. If *PROG* is 49 specified show information only about given program, otherwise 50 list all programs currently loaded on the system. 51 52 Output will start with program ID followed by program type and 53 zero or more named attributes (depending on kernel version). 54 55 **bpftool prog dump xlated** *PROG* [{ **file** *FILE* | **opcodes** | **visual** }] 56 Dump eBPF instructions of the program from the kernel. By 57 default, eBPF will be disassembled and printed to standard 58 output in human-readable format. In this case, **opcodes** 59 controls if raw opcodes should be printed as well. 60 61 If **file** is specified, the binary image will instead be 62 written to *FILE*. 63 64 If **visual** is specified, control flow graph (CFG) will be 65 built instead, and eBPF instructions will be presented with 66 CFG in DOT format, on standard output. 67 68 **bpftool prog dump jited** *PROG* [{ **file** *FILE* | **opcodes** }] 69 Dump jited image (host machine code) of the program. 70 If *FILE* is specified image will be written to a file, 71 otherwise it will be disassembled and printed to stdout. 72 73 **opcodes** controls if raw opcodes will be printed. 74 75 **bpftool prog pin** *PROG* *FILE* 76 Pin program *PROG* as *FILE*. 77 78 Note: *FILE* must be located in *bpffs* mount. 79 80 **bpftool prog load** *OBJ* *FILE* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] 81 Load bpf program from binary *OBJ* and pin as *FILE*. 82 **type** is optional, if not specified program type will be 83 inferred from section names. 84 By default bpftool will create new maps as declared in the ELF 85 object being loaded. **map** parameter allows for the reuse 86 of existing maps. It can be specified multiple times, each 87 time for a different map. *IDX* refers to index of the map 88 to be replaced in the ELF file counting from 0, while *NAME* 89 allows to replace a map by name. *MAP* specifies the map to 90 use, referring to it by **id** or through a **pinned** file. 91 If **dev** *NAME* is specified program will be loaded onto 92 given networking device (offload). 93 94 Note: *FILE* must be located in *bpffs* mount. 95 96 **bpftool prog attach** *PROG* *ATTACH_TYPE* *MAP* 97 Attach bpf program *PROG* (with type specified by *ATTACH_TYPE*) 98 to the map *MAP*. 99 100 **bpftool prog detach** *PROG* *ATTACH_TYPE* *MAP* 101 Detach bpf program *PROG* (with type specified by *ATTACH_TYPE*) 102 from the map *MAP*. 103 104 **bpftool prog help** 105 Print short help message. 106 107OPTIONS 108======= 109 -h, --help 110 Print short generic help message (similar to **bpftool help**). 111 112 -v, --version 113 Print version number (similar to **bpftool version**). 114 115 -j, --json 116 Generate JSON output. For commands that cannot produce JSON, this 117 option has no effect. 118 119 -p, --pretty 120 Generate human-readable JSON output. Implies **-j**. 121 122 -f, --bpffs 123 Show file names of pinned programs. 124 125EXAMPLES 126======== 127**# bpftool prog show** 128:: 129 130 10: xdp name some_prog tag 005a3d2123620c8b gpl 131 loaded_at Sep 29/20:11 uid 0 132 xlated 528B jited 370B memlock 4096B map_ids 10 133 134**# bpftool --json --pretty prog show** 135 136:: 137 138 { 139 "programs": [{ 140 "id": 10, 141 "type": "xdp", 142 "tag": "005a3d2123620c8b", 143 "gpl_compatible": true, 144 "loaded_at": "Sep 29/20:11", 145 "uid": 0, 146 "bytes_xlated": 528, 147 "jited": true, 148 "bytes_jited": 370, 149 "bytes_memlock": 4096, 150 "map_ids": [10 151 ] 152 } 153 ] 154 } 155 156| 157| **# bpftool prog dump xlated id 10 file /tmp/t** 158| **# ls -l /tmp/t** 159| -rw------- 1 root root 560 Jul 22 01:42 /tmp/t 160 161**# bpftool prog dum jited tag 005a3d2123620c8b** 162 163:: 164 165 push %rbp 166 mov %rsp,%rbp 167 sub $0x228,%rsp 168 sub $0x28,%rbp 169 mov %rbx,0x0(%rbp) 170 171| 172| **# mount -t bpf none /sys/fs/bpf/** 173| **# bpftool prog pin id 10 /sys/fs/bpf/prog** 174| **# bpftool prog load ./my_prog.o /sys/fs/bpf/prog2** 175| **# ls -l /sys/fs/bpf/** 176| -rw------- 1 root root 0 Jul 22 01:43 prog 177| -rw------- 1 root root 0 Jul 22 01:44 prog2 178 179**# bpftool prog dum jited pinned /sys/fs/bpf/prog opcodes** 180 181:: 182 183 push %rbp 184 55 185 mov %rsp,%rbp 186 48 89 e5 187 sub $0x228,%rsp 188 48 81 ec 28 02 00 00 189 sub $0x28,%rbp 190 48 83 ed 28 191 mov %rbx,0x0(%rbp) 192 48 89 5d 00 193 194| 195| **# bpftool prog load xdp1_kern.o /sys/fs/bpf/xdp1 type xdp map name rxcnt id 7** 196| **# bpftool prog show pinned /sys/fs/bpf/xdp1** 197| 9: xdp name xdp_prog1 tag 539ec6ce11b52f98 gpl 198| loaded_at 2018-06-25T16:17:31-0700 uid 0 199| xlated 488B jited 336B memlock 4096B map_ids 7 200| **# rm /sys/fs/bpf/xdp1** 201| 202 203SEE ALSO 204======== 205 **bpftool**\ (8), **bpftool-map**\ (8), **bpftool-cgroup**\ (8) 206