bpftool-prog(8) System Manager's Manual bpftool-prog(8) (NAME) bpftool-prog - BPF (SYNOPSIS) bpftool [OPTIONS] prog COMMAND OPTIONS := { { -j | --json } [{ -p | --pretty }] | { -d | --debug } | { -f | --bpffs } | { -m | --mapcompat } | { -n | --nomount } | { -L | --use-loader } | [ { -S | --sign } -k -i ] } COMMANDS := { show | list | dump xlated | dump jited | pin | load | loadall | help } PROG (PROG COMMANDS) bpftool prog { show | list } [PROG] bpftool prog dump xlated PROG [{ file FILE | [opcodes] [linum] [visual] }] bpftool prog dump jited PROG [{ file FILE | [opcodes] [linum] }] bpftool prog pin PROG FILE bpftool prog { load | loadall } OBJ PATH [type TYPE] [map { idx IDX | name NAME } MAP] [{ offload_dev | xdpmeta_dev } NAME] [pinmaps MAP_DIR] [autoattach] [kernel_btf BTF_FILE] bpftool prog attach PROG ATTACH_TYPE [MAP] bpftool prog detach PROG ATTACH_TYPE [MAP] bpftool prog tracelog bpftool prog tracelog [ { stdout | stderr } PROG ] bpftool prog run PROG data_in FILE [data_out FILE [data_size_out L]] [ctx_in FILE [ctx_out FILE [ctx_size_out M]]] [repeat N] bpftool prog profile PROG [duration DURATION] METRICs bpftool prog help MAP := { id MAP_ID | pinned FILE | name MAP_NAME } PROG := { id PROG_ID | pinned FILE | tag PROG_TAG | name PROG_NAME } TYPE := { socket | kprobe | kretprobe | classifier | action | tracepoint | raw_tracepoint | xdp | perf_event | cgroup/skb | cgroup/sock | cgroup/dev | lwt_in | lwt_out | lwt_xmit | lwt_seg6local | sockops | sk_skb | sk_msg | lirc_mode2 | cgroup/bind4 | cgroup/bind6 | cgroup/post_bind4 | cgroup/post_bind6 | cgroup/connect4 | cgroup/connect6 | cgroup/connect_unix | cgroup/getpeername4 | cgroup/getpeername6 | cgroup/getpeername_unix | cgroup/getsockname4 | cgroup/getsockname6 | cgroup/getsockname_unix | cgroup/sendmsg4 | cgroup/sendmsg6 | cgroup/sendmsg_unix | cgroup/recvmsg4 | cgroup/recvmsg6 | cgroup/recvmsg_unix | cgroup/sysctl | cgroup/getsockopt | cgroup/setsockopt | cgroup/sock_release | struct_ops | fentry | fexit | fsession | freplace | sk_lookup } ATTACH_TYPE := { sk_msg_verdict | sk_skb_verdict | sk_skb_stream_verdict | sk_skb_stream_parser | flow_dissector } METRICs := { cycles | instructions | l1d_loads | llc_misses | itlb_misses | dtlb_misses } (DESCRIPTION) bpftool prog { show | list } [PROG] . PROG . tag name PROG . (ID) ( ) . . BPF ( ). bpftool . . sysctl kernel.bpf_stats_enabled . . bpftool (FD) BPF . bpftool . bpftool prog dump xlated PROG [{ file FILE | [opcodes] [linum] [visual] }] () eBPF . eBPF . opcodes (raw opcodes) . tag name PROG . file visual PROG . file (binary image) FILE . visual (CFG) eBPF CFG DOT . line_info . linum . bpftool prog dump jited PROG [{ file FILE | [opcodes] [linum] }] JIT ( ) . FILE stdout . file PROG . opcodes . line_info . linum . bpftool prog pin PROG FILE (pin) PROG FILE. : FILE (mount) bpffs . ('.') bpffs . bpftool prog { load | loadall } OBJ PATH [type TYPE] [map { idx IDX | name NAME } MAP] [{ offload_dev | xdpmeta_dev } NAME] [pinmaps MAP_DIR] [autoattach] [kernel_btf BTF_FILE] () bpf OBJ PATH. bpftool prog load OBJ PATH . bpftool prog loadall OBJ PATH . type (sections) . bpftool ELF . map . . IDX ELF ( ) NAME . MAP id (pinned) . offload_dev NAME (offload). xdpmeta_dev NAME (device-bound) XDP . pinmaps MAP_DIR . autoattach (attach) . (link - ) bpftool prog show -f bpftool link show -f . bpftool (libbpf) . autoattach bpftool . kernel_btf BTF BTF (vmlinux) CO-RE . BTF ( fentry/fexit struct_ops) BTF /sys/kernel/btf/vmlinux . : PATH bpffs . ('.') bpffs . bpftool prog attach PROG ATTACH_TYPE [MAP] (attach) bpf PROG ( ATTACH_TYPE). ATTACH_TYPE MAP flow_dissector . bpftool prog detach PROG ATTACH_TYPE [MAP] (detach) bpf PROG ( ATTACH_TYPE). ATTACH_TYPE MAP flow_dissector . bpftool prog tracelog (trace pipe) (stdout). . BPF bpf_trace_printk() . (debugging) . (streaming) BPF perf ( bpftool-map(8) ). bpftool prog tracelog { stdout | stderr } PROG BPF . BPF (kfunc) bpf_stream_vprintk_impl() . . . bpftool prog run PROG data_in FILE [data_out FILE [data_size_out L]] [ctx_in FILE [ctx_out FILE [ctx_size_out M]]] [repeat N] BPF PROG BPF (context) . . FILE data_in . FILE "-" . ( ) FILE ctx_in . "-" . FILE data_out . FILE ctx_out . "-" ( JSON) . . data_size_out ctx_size_out ( ) . repeat . . . . ctx_in/ctx_out . bpftool . bpftool prog profile PROG [duration DURATION] METRICs METRICs bpf PROG DURATION . DURATION . DURATION UINT_MAX . bpftool prog help . (OPTIONS) -h, --help ( bpftool help). -V, --version bpftool ( bpftool version) libbpf bpftool . LLVM libbfd JIT (bpftool prog dump jited) BPF ( bpftool prog profile pid BPF ) . -j, --json JSON. JSON . -p, --pretty JSON . -j . -d, --debug (debug). libbpf (verifier) . -f, --bpffs BPF . -m, --mapcompat . -n, --nomount (mount) ( tracefs BPF) . -L, --use-loader <<>> ("loader"). . bpftool ( PATH ). -d|--debug bpf_trace_printk() BTF ( bpftool prog tracelog ). -S, --sign BPF . -k -i . --use-loader . -k PEM . -i X.509 PEM DER . (EXAMPLES) # bpftool prog show 10: xdp name some_prog tag 005a3d2123620c8b gpl run_time_ns 81632 run_cnt 10 loaded_at 2017-09-29T20:11:00+0000 uid 0 xlated 528B jited 370B memlock 4096B map_ids 10 pids systemd(1) # bpftool --json --pretty prog show [{ "id": 10, "type": "xdp", "tag": "005a3d2123620c8b", "gpl_compatible": true, "run_time_ns": 81632, "run_cnt": 10, "loaded_at": 1506715860, "uid": 0, "bytes_xlated": 528, "jited": true, "bytes_jited": 370, "bytes_memlock": 4096, "map_ids": [10 ], "pids": [{ "pid": 1, "comm": "systemd" } ] } ] # bpftool prog dump xlated id 10 file /tmp/t $ ls -l /tmp/t -rw------- 1 root root 560 Jul 22 01:42 /tmp/t # bpftool prog dump jited tag 005a3d2123620c8b 0: push %rbp 1: mov %rsp,%rbp 2: sub $0x228,%rsp 3: sub $0x28,%rbp 4: mov %rbx,0x0(%rbp) # mount -t bpf none /sys/fs/bpf/ # bpftool prog pin id 10 /sys/fs/bpf/prog # bpftool prog load ./my_prog.o /sys/fs/bpf/prog2 # ls -l /sys/fs/bpf/ -rw------- 1 root root 0 Jul 22 01:43 prog -rw------- 1 root root 0 Jul 22 01:44 prog2 # bpftool prog dump jited pinned /sys/fs/bpf/prog opcodes 0: push %rbp 55 1: mov %rsp,%rbp 48 89 e5 4: sub $0x228,%rsp 48 81 ec 28 02 00 00 b: sub $0x28,%rbp 48 83 ed 28 f: mov %rbx,0x0(%rbp) 48 89 5d 00 # bpftool prog load xdp1_kern.o /sys/fs/bpf/xdp1 type xdp map name rxcnt id 7 # bpftool prog show pinned /sys/fs/bpf/xdp1 9: xdp name xdp_prog1 tag 539ec6ce11b52f98 gpl loaded_at 2018-06-25T16:17:31-0700 uid 0 xlated 488B jited 336B memlock 4096B map_ids 7 # rm /sys/fs/bpf/xdp1 # bpftool prog profile id 337 duration 10 cycles instructions llc_misses 51397 run_cnt 40176203 cycles (83.05%) 42518139 instructions # 1.06 insns per cycle (83.39%) 123 llc_misses # 2.89 LLC misses per million insns (83.15%) (trace logs) . : # bpftool prog tracelog # bpftool prog load -L -d file.o bpftool-620059 [004] d... 2634685.517903: bpf_trace_printk: btf_load size 665 r=5 bpftool-620059 [004] d... 2634685.517912: bpf_trace_printk: map_create sample_map idx 0 type 2 value_size 4 value_btf_id 0 r=6 bpftool-620059 [004] d... 2634685.517997: bpf_trace_printk: prog_load sample insn_cnt 13 r=7 bpftool-620059 [004] d... 2634685.517999: bpf_trace_printk: close(5) = 0 (SEE ALSO) bpf(2), bpf-helpers(7), bpftool(8), bpftool-btf(8), bpftool-cgroup(8), bpftool-feature(8), bpftool-gen(8), bpftool-iter(8), bpftool-link(8), bpftool-map(8), bpftool-net(8), bpftool-perf(8), bpftool-struct_ops(8), bpftool-token(8) bpftool-prog(8)