1================ 2bpftool-prog 3================ 4------------------------------------------------------------------------------- 5tool for inspection and simple manipulation of eBPF progs 6------------------------------------------------------------------------------- 7 8:Manual section: 8 9 10SYNOPSIS 11======== 12 13 **bpftool** [*OPTIONS*] **prog** *COMMAND* 14 15 *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-f** | **--bpffs** } } 16 17 *COMMANDS* := 18 { **show** | **list** | **dump xlated** | **dump jited** | **pin** | **load** 19 | **loadall** | **help** } 20 21MAP COMMANDS 22============= 23 24| **bpftool** **prog { show | list }** [*PROG*] 25| **bpftool** **prog dump xlated** *PROG* [{**file** *FILE* | **opcodes** | **visual**}] 26| **bpftool** **prog dump jited** *PROG* [{**file** *FILE* | **opcodes**}] 27| **bpftool** **prog pin** *PROG* *FILE* 28| **bpftool** **prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] 29| **bpftool** **prog attach** *PROG* *ATTACH_TYPE* [*MAP*] 30| **bpftool** **prog detach** *PROG* *ATTACH_TYPE* [*MAP*] 31| **bpftool** **prog help** 32| 33| *MAP* := { **id** *MAP_ID* | **pinned** *FILE* } 34| *PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* } 35| *TYPE* := { 36| **socket** | **kprobe** | **kretprobe** | **classifier** | **action** | 37| **tracepoint** | **raw_tracepoint** | **xdp** | **perf_event** | **cgroup/skb** | 38| **cgroup/sock** | **cgroup/dev** | **lwt_in** | **lwt_out** | **lwt_xmit** | 39| **lwt_seg6local** | **sockops** | **sk_skb** | **sk_msg** | **lirc_mode2** | 40| **cgroup/bind4** | **cgroup/bind6** | **cgroup/post_bind4** | **cgroup/post_bind6** | 41| **cgroup/connect4** | **cgroup/connect6** | **cgroup/sendmsg4** | **cgroup/sendmsg6** 42| } 43| *ATTACH_TYPE* := { 44| **msg_verdict** | **skb_verdict** | **skb_parse** | **flow_dissector** 45| } 46 47 48DESCRIPTION 49=========== 50 **bpftool prog { show | list }** [*PROG*] 51 Show information about loaded programs. If *PROG* is 52 specified show information only about given program, otherwise 53 list all programs currently loaded on the system. 54 55 Output will start with program ID followed by program type and 56 zero or more named attributes (depending on kernel version). 57 58 **bpftool prog dump xlated** *PROG* [{ **file** *FILE* | **opcodes** | **visual** }] 59 Dump eBPF instructions of the program from the kernel. By 60 default, eBPF will be disassembled and printed to standard 61 output in human-readable format. In this case, **opcodes** 62 controls if raw opcodes should be printed as well. 63 64 If **file** is specified, the binary image will instead be 65 written to *FILE*. 66 67 If **visual** is specified, control flow graph (CFG) will be 68 built instead, and eBPF instructions will be presented with 69 CFG in DOT format, on standard output. 70 71 **bpftool prog dump jited** *PROG* [{ **file** *FILE* | **opcodes** }] 72 Dump jited image (host machine code) of the program. 73 If *FILE* is specified image will be written to a file, 74 otherwise it will be disassembled and printed to stdout. 75 76 **opcodes** controls if raw opcodes will be printed. 77 78 **bpftool prog pin** *PROG* *FILE* 79 Pin program *PROG* as *FILE*. 80 81 Note: *FILE* must be located in *bpffs* mount. It must not 82 contain a dot character ('.'), which is reserved for future 83 extensions of *bpffs*. 84 85 **bpftool prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] [**pinmaps** *MAP_DIR*] 86 Load bpf program(s) from binary *OBJ* and pin as *PATH*. 87 **bpftool prog load** pins only the first program from the 88 *OBJ* as *PATH*. **bpftool prog loadall** pins all programs 89 from the *OBJ* under *PATH* directory. 90 **type** is optional, if not specified program type will be 91 inferred from section names. 92 By default bpftool will create new maps as declared in the ELF 93 object being loaded. **map** parameter allows for the reuse 94 of existing maps. It can be specified multiple times, each 95 time for a different map. *IDX* refers to index of the map 96 to be replaced in the ELF file counting from 0, while *NAME* 97 allows to replace a map by name. *MAP* specifies the map to 98 use, referring to it by **id** or through a **pinned** file. 99 If **dev** *NAME* is specified program will be loaded onto 100 given networking device (offload). 101 Optional **pinmaps** argument can be provided to pin all 102 maps under *MAP_DIR* directory. 103 104 Note: *PATH* must be located in *bpffs* mount. It must not 105 contain a dot character ('.'), which is reserved for future 106 extensions of *bpffs*. 107 108 **bpftool prog attach** *PROG* *ATTACH_TYPE* [*MAP*] 109 Attach bpf program *PROG* (with type specified by 110 *ATTACH_TYPE*). Most *ATTACH_TYPEs* require a *MAP* 111 parameter, with the exception of *flow_dissector* which is 112 attached to current networking name space. 113 114 **bpftool prog detach** *PROG* *ATTACH_TYPE* [*MAP*] 115 Detach bpf program *PROG* (with type specified by 116 *ATTACH_TYPE*). Most *ATTACH_TYPEs* require a *MAP* 117 parameter, with the exception of *flow_dissector* which is 118 detached from the current networking name space. 119 120 **bpftool prog help** 121 Print short help message. 122 123OPTIONS 124======= 125 -h, --help 126 Print short generic help message (similar to **bpftool help**). 127 128 -v, --version 129 Print version number (similar to **bpftool version**). 130 131 -j, --json 132 Generate JSON output. For commands that cannot produce JSON, this 133 option has no effect. 134 135 -p, --pretty 136 Generate human-readable JSON output. Implies **-j**. 137 138 -f, --bpffs 139 When showing BPF programs, show file names of pinned 140 programs. 141 142EXAMPLES 143======== 144**# bpftool prog show** 145:: 146 147 10: xdp name some_prog tag 005a3d2123620c8b gpl 148 loaded_at Sep 29/20:11 uid 0 149 xlated 528B jited 370B memlock 4096B map_ids 10 150 151**# bpftool --json --pretty prog show** 152 153:: 154 155 { 156 "programs": [{ 157 "id": 10, 158 "type": "xdp", 159 "tag": "005a3d2123620c8b", 160 "gpl_compatible": true, 161 "loaded_at": "Sep 29/20:11", 162 "uid": 0, 163 "bytes_xlated": 528, 164 "jited": true, 165 "bytes_jited": 370, 166 "bytes_memlock": 4096, 167 "map_ids": [10 168 ] 169 } 170 ] 171 } 172 173| 174| **# bpftool prog dump xlated id 10 file /tmp/t** 175| **# ls -l /tmp/t** 176| -rw------- 1 root root 560 Jul 22 01:42 /tmp/t 177 178**# bpftool prog dum jited tag 005a3d2123620c8b** 179 180:: 181 182 push %rbp 183 mov %rsp,%rbp 184 sub $0x228,%rsp 185 sub $0x28,%rbp 186 mov %rbx,0x0(%rbp) 187 188| 189| **# mount -t bpf none /sys/fs/bpf/** 190| **# bpftool prog pin id 10 /sys/fs/bpf/prog** 191| **# bpftool prog load ./my_prog.o /sys/fs/bpf/prog2** 192| **# ls -l /sys/fs/bpf/** 193| -rw------- 1 root root 0 Jul 22 01:43 prog 194| -rw------- 1 root root 0 Jul 22 01:44 prog2 195 196**# bpftool prog dum jited pinned /sys/fs/bpf/prog opcodes** 197 198:: 199 200 push %rbp 201 55 202 mov %rsp,%rbp 203 48 89 e5 204 sub $0x228,%rsp 205 48 81 ec 28 02 00 00 206 sub $0x28,%rbp 207 48 83 ed 28 208 mov %rbx,0x0(%rbp) 209 48 89 5d 00 210 211| 212| **# bpftool prog load xdp1_kern.o /sys/fs/bpf/xdp1 type xdp map name rxcnt id 7** 213| **# bpftool prog show pinned /sys/fs/bpf/xdp1** 214| 9: xdp name xdp_prog1 tag 539ec6ce11b52f98 gpl 215| loaded_at 2018-06-25T16:17:31-0700 uid 0 216| xlated 488B jited 336B memlock 4096B map_ids 7 217| **# rm /sys/fs/bpf/xdp1** 218| 219 220SEE ALSO 221======== 222 **bpf**\ (2), 223 **bpf-helpers**\ (7), 224 **bpftool**\ (8), 225 **bpftool-map**\ (8), 226 **bpftool-cgroup**\ (8), 227 **bpftool-net**\ (8), 228 **bpftool-perf**\ (8) 229