1BPFTOOL-PROG(8)                                                BPFTOOL-PROG(8)
2
3
4

NAME

6       bpftool-prog  -  tool  for  inspection  and simple manipulation of eBPF
7       progs
8

SYNOPSIS

10          bpftool [OPTIONS] prog COMMAND
11
12          OPTIONS := { { -j | --json } [{ -p | --pretty }] | { -f | --bpffs  }
13          }
14
15          COMMANDS  := { show | list | dump xlated | dump jited | pin | load |
16          loadall | help }
17

PROG COMMANDS

19       bpftool prog { show | list } [PROG]
20       bpftool prog dump xlated PROG [{file FILE | opcodes | visual | linum}]
21       bpftool prog dump jited  PROG [{file FILE | opcodes | linum}]
22       bpftool prog pin PROG FILE
23       bpftool prog { load | loadall } OBJ PATH [type TYPE] [map {idx IDX | name NAME} MAP] [dev NAME]
24       bpftool prog attach PROG ATTACH_TYPE [MAP]
25       bpftool prog detach PROG ATTACH_TYPE [MAP]
26       bpftool prog tracelog
27       bpftool prog help
28
29       MAP := { id MAP_ID | pinned FILE }
30       PROG := { id PROG_ID | pinned FILE | tag PROG_TAG }
31       TYPE := {
32         socket | kprobe | kretprobe | classifier | action |
33         tracepoint | raw_tracepoint | xdp | perf_event | cgroup/skb |
34         cgroup/sock | cgroup/dev | lwt_in | lwt_out | lwt_xmit |
35         lwt_seg6local | sockops | sk_skb | sk_msg | lirc_mode2 |
36         cgroup/bind4 | cgroup/bind6 | cgroup/post_bind4 | cgroup/post_bind6 |
37         cgroup/connect4 | cgroup/connect6 | cgroup/sendmsg4 | cgroup/sendmsg6
38       }
39       ATTACH_TYPE := {
40         msg_verdict | stream_verdict | stream_parser | flow_dissector
41       }
42
43

DESCRIPTION

45          bpftool prog { show | list } [PROG]
46                 Show information about loaded programs.  If PROG is specified
47                 show information only about given program, otherwise list all
48                 programs currently loaded on the system.
49
50                 Output will start with program ID followed  by  program  type
51                 and  zero  or more named attributes (depending on kernel ver‐
52                 sion).
53
54          bpftool prog dump xlated PROG [{ file FILE  |  opcodes  |  visual  |
55          linum }]
56                 Dump  eBPF  instructions  of  the program from the kernel. By
57                 default, eBPF will be disassembled and  printed  to  standard
58                 output  in  human-readable format. In this case, opcodes con‐
59                 trols if raw opcodes should be printed as well.
60
61                 If file is specified, the binary image will instead be  writ‐
62                 ten to FILE.
63
64                 If  visual  is  specified,  control  flow graph (CFG) will be
65                 built instead, and eBPF instructions will be  presented  with
66                 CFG in DOT format, on standard output.
67
68                 If  the prog has line_info available, the source line will be
69                 displayed by default.  If linum is specified,  the  filename,
70                 line  number and line column will also be displayed on top of
71                 the source line.
72
73          bpftool prog dump jited PROG [{ file FILE | opcodes | linum }]
74                 Dump jited image (host machine code) of the program.  If FILE
75                 is  specified  image  will be written to a file, otherwise it
76                 will be disassembled and printed to stdout.
77
78                 opcodes controls if raw opcodes will be printed.
79
80                 If the prog has line_info available, the source line will  be
81                 displayed  by  default.  If linum is specified, the filename,
82                 line number and line column will also be displayed on top  of
83                 the source line.
84
85          bpftool prog pin PROG FILE
86                 Pin program PROG as FILE.
87
88                 Note:  FILE  must be located in bpffs mount. It must not con‐
89                 tain a dot character ('.'),  which  is  reserved  for  future
90                 extensions of bpffs.
91
92          bpftool prog { load | loadall } OBJ PATH [type TYPE] [map {idx IDX |
93          name NAME} MAP] [dev NAME] [pinmaps MAP_DIR]
94                 Load bpf program(s) from binary OBJ and pin as PATH.  bpftool
95                 prog  load  pins only the first program from the OBJ as PATH.
96                 bpftool prog loadall pins all programs  from  the  OBJ  under
97                 PATH  directory.   type is optional, if not specified program
98                 type will be inferred from section names.  By default bpftool
99                 will  create  new  maps  as  declared in the ELF object being
100                 loaded.  map parameter allows for the reuse of existing maps.
101                 It can be specified multiple times, each time for a different
102                 map.  IDX refers to index of the map to be  replaced  in  the
103                 ELF  file counting from 0, while NAME allows to replace a map
104                 by name.  MAP specifies the map to use, referring to it by id
105                 or  through  a pinned file.  If dev NAME is specified program
106                 will  be  loaded  onto  given  networking  device  (offload).
107                 Optional  pinmaps  argument  can  be provided to pin all maps
108                 under MAP_DIR directory.
109
110                 Note: PATH must be located in bpffs mount. It must  not  con‐
111                 tain  a  dot  character  ('.'),  which is reserved for future
112                 extensions of bpffs.
113
114          bpftool prog attach PROG ATTACH_TYPE [MAP]
115                 Attach bpf program PROG (with type specified by ATTACH_TYPE).
116                 Most ATTACH_TYPEs require a MAP parameter, with the exception
117                 of flow_dissector which is  attached  to  current  networking
118                 name space.
119
120          bpftool prog detach PROG ATTACH_TYPE [MAP]
121                 Detach bpf program PROG (with type specified by ATTACH_TYPE).
122                 Most ATTACH_TYPEs require a MAP parameter, with the exception
123                 of flow_dissector which is detached from the current network‐
124                 ing name space.
125
126          bpftool prog tracelog
127                 Dump the trace pipe of the system to  the  console  (stdout).
128                 Hit <Ctrl+C> to stop printing. BPF programs can write to this
129                 trace pipe at runtime  with  the  bpf_trace_printk()  helper.
130                 This  should be used only for debugging purposes. For stream‐
131                 ing data from BPF programs to user space, one  can  use  perf
132                 events (see also bpftool-map(8)).
133
134          bpftool prog help
135                 Print short help message.
136

OPTIONS

138          -h, --help
139                 Print short generic help message (similar to bpftool help).
140
141          -v, --version
142                 Print version number (similar to bpftool version).
143
144          -j, --json
145                 Generate  JSON output. For commands that cannot produce JSON,
146                 this option has no effect.
147
148          -p, --pretty
149                 Generate human-readable JSON output. Implies -j.
150
151          -f, --bpffs
152                 When showing BPF programs, show file  names  of  pinned  pro‐
153                 grams.
154
155          -m, --mapcompat
156                 Allow loading maps with unknown map definitions.
157
158          -n, --nomount
159                 Do not automatically attempt to mount any virtual file system
160                 (such as tracefs or BPF virtual file system) when necessary.
161

EXAMPLES

163       # bpftool prog show
164
165          10: xdp  name some_prog  tag 005a3d2123620c8b  gpl run_time_ns 81632 run_cnt 10
166                  loaded_at 2017-09-29T20:11:00+0000  uid 0
167                  xlated 528B  jited 370B  memlock 4096B  map_ids 10
168
169       # bpftool --json --pretty prog show
170
171          [{
172                  "id": 10,
173                  "type": "xdp",
174                  "tag": "005a3d2123620c8b",
175                  "gpl_compatible": true,
176                  "run_time_ns": 81632,
177                  "run_cnt": 10,
178                  "loaded_at": 1506715860,
179                  "uid": 0,
180                  "bytes_xlated": 528,
181                  "jited": true,
182                  "bytes_jited": 370,
183                  "bytes_memlock": 4096,
184                  "map_ids": [10
185                  ]
186              }
187          ]
188
189       # bpftool prog dump xlated id 10 file /tmp/t
190       # ls -l /tmp/t
191
192
193          -rw------- 1 root root 560 Jul 22 01:42 /tmp/t
194
195       # bpftool prog dump jited tag 005a3d2123620c8b
196
197          0:   push   %rbp
198          1:   mov    %rsp,%rbp
199          2:   sub    $0x228,%rsp
200          3:   sub    $0x28,%rbp
201          4:   mov    %rbx,0x0(%rbp)
202
203       # mount -t bpf none /sys/fs/bpf/
204       # bpftool prog pin id 10 /sys/fs/bpf/prog
205       # bpftool prog load ./my_prog.o /sys/fs/bpf/prog2
206       # ls -l /sys/fs/bpf/
207
208
209          -rw------- 1 root root 0 Jul 22 01:43 prog
210          -rw------- 1 root root 0 Jul 22 01:44 prog2
211
212       # bpftool prog dump jited pinned /sys/fs/bpf/prog opcodes
213
214          0:   push   %rbp
215               55
216          1:   mov    %rsp,%rbp
217               48 89 e5
218          4:   sub    $0x228,%rsp
219               48 81 ec 28 02 00 00
220          b:   sub    $0x28,%rbp
221               48 83 ed 28
222          f:   mov    %rbx,0x0(%rbp)
223               48 89 5d 00
224
225       # bpftool prog load xdp1_kern.o /sys/fs/bpf/xdp1 type xdp map name rxcnt id 7
226       # bpftool prog show pinned /sys/fs/bpf/xdp1
227
228
229          9: xdp  name xdp_prog1  tag 539ec6ce11b52f98  gpl
230                  loaded_at 2018-06-25T16:17:31-0700  uid 0
231                  xlated 488B  jited 336B  memlock 4096B  map_ids 7
232
233       # rm /sys/fs/bpf/xdp1
234

SEE ALSO

236          bpf(2),      bpf-helpers(7),       bpftool(8),       bpftool-map(8),
237          bpftool-cgroup(8),        bpftool-feature(8),        bpftool-net(8),
238          bpftool-perf(8)
239
240
241
242
243                                                               BPFTOOL-PROG(8)
Impressum