1================
2bpftool-prog
3================
4-------------------------------------------------------------------------------
5tool for inspection and simple manipulation of eBPF progs
6-------------------------------------------------------------------------------
7
8:Manual section: 8
9
10SYNOPSIS
11========
12
13	**bpftool** [*OPTIONS*] **prog** *COMMAND*
14
15	*OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-f** | **--bpffs** } }
16
17	*COMMANDS* :=
18	{ **show** | **list** | **dump xlated** | **dump jited** | **pin** | **load** | **help** }
19
20MAP COMMANDS
21=============
22
23|	**bpftool** **prog { show | list }** [*PROG*]
24|	**bpftool** **prog dump xlated** *PROG* [{**file** *FILE* | **opcodes** | **visual**}]
25|	**bpftool** **prog dump jited**  *PROG* [{**file** *FILE* | **opcodes**}]
26|	**bpftool** **prog pin** *PROG* *FILE*
27|	**bpftool** **prog load** *OBJ* *FILE*
28|	**bpftool** **prog help**
29|
30|	*PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* }
31
32DESCRIPTION
33===========
34	**bpftool prog { show | list }** [*PROG*]
35		  Show information about loaded programs.  If *PROG* is
36		  specified show information only about given program, otherwise
37		  list all programs currently loaded on the system.
38
39		  Output will start with program ID followed by program type and
40		  zero or more named attributes (depending on kernel version).
41
42	**bpftool prog dump xlated** *PROG* [{ **file** *FILE* | **opcodes** | **visual** }]
43		  Dump eBPF instructions of the program from the kernel. By
44		  default, eBPF will be disassembled and printed to standard
45		  output in human-readable format. In this case, **opcodes**
46		  controls if raw opcodes should be printed as well.
47
48		  If **file** is specified, the binary image will instead be
49		  written to *FILE*.
50
51		  If **visual** is specified, control flow graph (CFG) will be
52		  built instead, and eBPF instructions will be presented with
53		  CFG in DOT format, on standard output.
54
55	**bpftool prog dump jited**  *PROG* [{ **file** *FILE* | **opcodes** }]
56		  Dump jited image (host machine code) of the program.
57		  If *FILE* is specified image will be written to a file,
58		  otherwise it will be disassembled and printed to stdout.
59
60		  **opcodes** controls if raw opcodes will be printed.
61
62	**bpftool prog pin** *PROG* *FILE*
63		  Pin program *PROG* as *FILE*.
64
65		  Note: *FILE* must be located in *bpffs* mount.
66
67	**bpftool prog load** *OBJ* *FILE*
68		  Load bpf program from binary *OBJ* and pin as *FILE*.
69
70		  Note: *FILE* must be located in *bpffs* mount.
71
72	**bpftool prog help**
73		  Print short help message.
74
75OPTIONS
76=======
77	-h, --help
78		  Print short generic help message (similar to **bpftool help**).
79
80	-v, --version
81		  Print version number (similar to **bpftool version**).
82
83	-j, --json
84		  Generate JSON output. For commands that cannot produce JSON, this
85		  option has no effect.
86
87	-p, --pretty
88		  Generate human-readable JSON output. Implies **-j**.
89
90	-f, --bpffs
91		  Show file names of pinned programs.
92
93EXAMPLES
94========
95**# bpftool prog show**
96::
97
98  10: xdp  name some_prog  tag 005a3d2123620c8b  gpl
99	loaded_at Sep 29/20:11  uid 0
100	xlated 528B  jited 370B  memlock 4096B  map_ids 10
101
102**# bpftool --json --pretty prog show**
103
104::
105
106    {
107        "programs": [{
108                "id": 10,
109                "type": "xdp",
110                "tag": "005a3d2123620c8b",
111                "gpl_compatible": true,
112                "loaded_at": "Sep 29/20:11",
113                "uid": 0,
114                "bytes_xlated": 528,
115                "jited": true,
116                "bytes_jited": 370,
117                "bytes_memlock": 4096,
118                "map_ids": [10
119                ]
120            }
121        ]
122    }
123
124|
125| **# bpftool prog dump xlated id 10 file /tmp/t**
126| **# ls -l /tmp/t**
127|   -rw------- 1 root root 560 Jul 22 01:42 /tmp/t
128
129**# bpftool prog dum jited tag 005a3d2123620c8b**
130
131::
132
133    push   %rbp
134    mov    %rsp,%rbp
135    sub    $0x228,%rsp
136    sub    $0x28,%rbp
137    mov    %rbx,0x0(%rbp)
138
139|
140| **# mount -t bpf none /sys/fs/bpf/**
141| **# bpftool prog pin id 10 /sys/fs/bpf/prog**
142| **# bpftool prog load ./my_prog.o /sys/fs/bpf/prog2**
143| **# ls -l /sys/fs/bpf/**
144|   -rw------- 1 root root 0 Jul 22 01:43 prog
145|   -rw------- 1 root root 0 Jul 22 01:44 prog2
146
147**# bpftool prog dum jited pinned /sys/fs/bpf/prog opcodes**
148
149::
150
151    push   %rbp
152    55
153    mov    %rsp,%rbp
154    48 89 e5
155    sub    $0x228,%rsp
156    48 81 ec 28 02 00 00
157    sub    $0x28,%rbp
158    48 83 ed 28
159    mov    %rbx,0x0(%rbp)
160    48 89 5d 00
161
162
163SEE ALSO
164========
165	**bpftool**\ (8), **bpftool-map**\ (8), **bpftool-cgroup**\ (8)
166