1BPFTOOL-PROG(8) BPFTOOL-PROG(8)
2
6 bpftool-prog - tool for inspection and simple manipulation of eBPF
7 progs
8
10 bpftool [OPTIONS] prog COMMAND
11 OPTIONS := { { -j | --json } [{ -p | --pretty }] | { -f | --bpffs }
13 }
14 COMMANDS := { show | list | dump xlated | dump jited | pin | load |
16 help }
17
19 bpftool prog { show | list } [PROG]
20 bpftool prog dump xlated PROG [{file FILE | opcodes | visual}]
21 bpftool prog dump jited PROG [{file FILE | opcodes}]
22 bpftool prog pin PROG FILE
23 bpftool prog load OBJ FILE
24 bpftool prog help
25 PROG := { id PROG_ID | pinned FILE | tag PROG_TAG }
27
30 bpftool prog { show | list } [PROG]
31 Show information about loaded programs. If PROG is specified
32 show information only about given program, otherwise list all
33 programs currently loaded on the system.
34 Output will start with program ID followed by program type
36 and zero or more named attributes (depending on kernel ver‐
37 sion).
38 bpftool prog dump xlated PROG [{ file FILE | opcodes | visual }]
40 Dump eBPF instructions of the program from the kernel. By
41 default, eBPF will be disassembled and printed to standard
42 output in human-readable format. In this case, opcodes con‐
43 trols if raw opcodes should be printed as well.
44 If file is specified, the binary image will instead be writ‐
46 ten to FILE.
47 If visual is specified, control flow graph (CFG) will be
49 built instead, and eBPF instructions will be presented with
50 CFG in DOT format, on standard output.
51 bpftool prog dump jited PROG [{ file FILE | opcodes }]
53 Dump jited image (host machine code) of the program. If FILE
54 is specified image will be written to a file, otherwise it
55 will be disassembled and printed to stdout.
56 opcodes controls if raw opcodes will be printed.
58 bpftool prog pin PROG FILE
60 Pin program PROG as FILE.
61 Note: FILE must be located in bpffs mount.
63 bpftool prog load OBJ FILE
65 Load bpf program from binary OBJ and pin as FILE.
66 Note: FILE must be located in bpffs mount.
68 bpftool prog help
70 Print short help message.
71
73 -h, --help
74 Print short generic help message (similar to bpftool help).
75 -v, --version
77 Print version number (similar to bpftool version).
78 -j, --json
80 Generate JSON output. For commands that cannot produce JSON,
81 this option has no effect.
82 -p, --pretty
84 Generate human-readable JSON output. Implies -j.
85 -f, --bpffs
87 Show file names of pinned programs.
88
90 # bpftool prog show
91 10: xdp name some_prog tag 005a3d2123620c8b gpl
93 loaded_at Sep 29/20:11 uid 0
94 xlated 528B jited 370B memlock 4096B map_ids 10
95 # bpftool --json --pretty prog show
97 {
99 "programs": [{
100 "id": 10,
101 "type": "xdp",
102 "tag": "005a3d2123620c8b",
103 "gpl_compatible": true,
104 "loaded_at": "Sep 29/20:11",
105 "uid": 0,
106 "bytes_xlated": 528,
107 "jited": true,
108 "bytes_jited": 370,
109 "bytes_memlock": 4096,
110 "map_ids": [10
111 ]
112 }
113 ]
114 }
115 # bpftool prog dump xlated id 10 file /tmp/t
117 # ls -l /tmp/t
118 -rw------- 1 root root 560 Jul 22 01:42 /tmp/t
119 # bpftool prog dum jited tag 005a3d2123620c8b
122 push %rbp
124 mov %rsp,%rbp
125 sub $0x228,%rsp
126 sub $0x28,%rbp
127 mov %rbx,0x0(%rbp)
128 # mount -t bpf none /sys/fs/bpf/
130 # bpftool prog pin id 10 /sys/fs/bpf/prog
131 # bpftool prog load ./my_prog.o /sys/fs/bpf/prog2
132 # ls -l /sys/fs/bpf/
133 -rw------- 1 root root 0 Jul 22 01:43 prog
134 -rw------- 1 root root 0 Jul 22 01:44 prog2
135 # bpftool prog dum jited pinned /sys/fs/bpf/prog opcodes
138 push %rbp
140 55
141 mov %rsp,%rbp
142 48 89 e5
143 sub $0x228,%rsp
144 48 81 ec 28 02 00 00
145 sub $0x28,%rbp
146 48 83 ed 28
147 mov %rbx,0x0(%rbp)
148 48 89 5d 00
149
151 bpftool(8), bpftool-map(8), bpftool-cgroup(8)
152 BPFTOOL-PROG(8)