1BPFTOOL-PROG(8) BPFTOOL-PROG(8)
2
6 bpftool-prog - tool for inspection and simple manipulation of eBPF
7 progs
8
10 bpftool [OPTIONS] prog COMMAND
11 OPTIONS := { { -j | --json } [{ -p | --pretty }] | { -f | --bpffs }
13 }
14 COMMANDS := { show | list | dump xlated | dump jited | pin | load |
16 help }
17
19 bpftool prog { show | list } [PROG]
20 bpftool prog dump xlated PROG [{file FILE | opcodes}]
21 bpftool prog dump jited PROG [{file FILE | opcodes}]
22 bpftool prog pin PROG FILE
23 bpftool prog load OBJ FILE
24 bpftool prog help
25 PROG := { id PROG_ID | pinned FILE | tag PROG_TAG }
27
30 bpftool prog { show | list } [PROG]
31 Show information about loaded programs. If PROG is specified
32 show information only about given program, otherwise list all
33 programs currently loaded on the system.
34 Output will start with program ID followed by program type
36 and zero or more named attributes (depending on kernel ver‐
37 sion).
38 bpftool prog dump xlated PROG [{ file FILE | opcodes }]
40 Dump eBPF instructions of the program from the kernel. If
41 FILE is specified image will be written to a file, otherwise
42 it will be disassembled and printed to stdout.
43 opcodes controls if raw opcodes will be printed.
45 bpftool prog dump jited PROG [{ file FILE | opcodes }]
47 Dump jited image (host machine code) of the program. If FILE
48 is specified image will be written to a file, otherwise it
49 will be disassembled and printed to stdout.
50 opcodes controls if raw opcodes will be printed.
52 bpftool prog pin PROG FILE
54 Pin program PROG as FILE.
55 Note: FILE must be located in bpffs mount.
57 bpftool prog load OBJ FILE
59 Load bpf program from binary OBJ and pin as FILE.
60 Note: FILE must be located in bpffs mount.
62 bpftool prog help
64 Print short help message.
65
67 -h, --help
68 Print short generic help message (similar to bpftool help).
69 -v, --version
71 Print version number (similar to bpftool version).
72 -j, --json
74 Generate JSON output. For commands that cannot produce JSON,
75 this option has no effect.
76 -p, --pretty
78 Generate human-readable JSON output. Implies -j.
79 -f, --bpffs
81 Show file names of pinned programs.
82
84 # bpftool prog show
85 10: xdp name some_prog tag 005a3d2123620c8b gpl
87 loaded_at Sep 29/20:11 uid 0
88 xlated 528B jited 370B memlock 4096B map_ids 10
89 # bpftool --json --pretty prog show
91 {
93 "programs": [{
94 "id": 10,
95 "type": "xdp",
96 "tag": "005a3d2123620c8b",
97 "gpl_compatible": true,
98 "loaded_at": "Sep 29/20:11",
99 "uid": 0,
100 "bytes_xlated": 528,
101 "jited": true,
102 "bytes_jited": 370,
103 "bytes_memlock": 4096,
104 "map_ids": [10
105 ]
106 }
107 ]
108 }
109 # bpftool prog dump xlated id 10 file /tmp/t
111 # ls -l /tmp/t
112 -rw------- 1 root root 560 Jul 22 01:42 /tmp/t
113 # bpftool prog dum jited tag 005a3d2123620c8b
116 push %rbp
118 mov %rsp,%rbp
119 sub $0x228,%rsp
120 sub $0x28,%rbp
121 mov %rbx,0x0(%rbp)
122 # mount -t bpf none /sys/fs/bpf/
124 # bpftool prog pin id 10 /sys/fs/bpf/prog
125 # bpftool prog load ./my_prog.o /sys/fs/bpf/prog2
126 # ls -l /sys/fs/bpf/
127 -rw------- 1 root root 0 Jul 22 01:43 prog
128 -rw------- 1 root root 0 Jul 22 01:44 prog2
129 # bpftool prog dum jited pinned /sys/fs/bpf/prog opcodes
132 push %rbp
134 55
135 mov %rsp,%rbp
136 48 89 e5
137 sub $0x228,%rsp
138 48 81 ec 28 02 00 00
139 sub $0x28,%rbp
140 48 83 ed 28
141 mov %rbx,0x0(%rbp)
142 48 89 5d 00
143
145 bpftool(8), bpftool-map(8), bpftool-cgroup(8)
146 BPFTOOL-PROG(8)