2017-10-05 03:10:05 +00:00
|
|
|
================
|
|
|
|
|
bpftool-prog
|
|
|
|
|
================
|
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
|
tool for inspection and simple manipulation of eBPF progs
|
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
:Manual section: 8
|
|
|
|
|
|
|
|
|
|
SYNOPSIS
|
|
|
|
|
========
|
|
|
|
|
|
2017-10-23 16:24:16 +00:00
|
|
|
**bpftool** [*OPTIONS*] **prog** *COMMAND*
|
|
|
|
|
|
2017-11-08 04:55:49 +00:00
|
|
|
*OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-f** | **--bpffs** } }
|
2017-10-23 16:24:16 +00:00
|
|
|
|
|
|
|
|
*COMMANDS* :=
|
2018-11-09 16:21:44 +00:00
|
|
|
{ **show** | **list** | **dump xlated** | **dump jited** | **pin** | **load**
|
|
|
|
|
| **loadall** | **help** }
|
2017-10-23 16:24:16 +00:00
|
|
|
|
2019-02-06 01:47:23 +00:00
|
|
|
PROG COMMANDS
|
2017-10-23 16:24:16 +00:00
|
|
|
=============
|
|
|
|
|
|
2018-01-02 22:48:36 +00:00
|
|
|
| **bpftool** **prog { show | list }** [*PROG*]
|
bpf: libbpf: bpftool: Print bpf_line_info during prog dump
This patch adds print bpf_line_info function in 'prog dump jitted'
and 'prog dump xlated':
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv
[...]
int test_long_fname_2(struct dummy_tracepoint_args * arg):
bpf_prog_44a040bf25481309_test_long_fname_2:
; static int test_long_fname_2(struct dummy_tracepoint_args *arg)
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x30,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: xor %esi,%esi
; int key = 0;
27: mov %esi,-0x4(%rbp)
; if (!arg->sock)
2a: mov 0x8(%rdi),%rdi
; if (!arg->sock)
2e: cmp $0x0,%rdi
32: je 0x0000000000000070
34: mov %rbp,%rsi
; counts = bpf_map_lookup_elem(&btf_map, &key);
37: add $0xfffffffffffffffc,%rsi
3b: movabs $0xffff8881139d7480,%rdi
45: add $0x110,%rdi
4c: mov 0x0(%rsi),%eax
4f: cmp $0x4,%rax
53: jae 0x000000000000005e
55: shl $0x3,%rax
59: add %rdi,%rax
5c: jmp 0x0000000000000060
5e: xor %eax,%eax
; if (!counts)
60: cmp $0x0,%rax
64: je 0x0000000000000070
; counts->v6++;
66: mov 0x4(%rax),%edi
69: add $0x1,%rdi
6d: mov %edi,0x4(%rax)
70: mov 0x0(%rbp),%rbx
74: mov 0x8(%rbp),%r13
78: mov 0x10(%rbp),%r14
7c: mov 0x18(%rbp),%r15
80: add $0x28,%rbp
84: leaveq
85: retq
[...]
With linum:
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv linum
int _dummy_tracepoint(struct dummy_tracepoint_args * arg):
bpf_prog_b07ccb89267cf242__dummy_tracepoint:
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:9]
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x28,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: callq 0x000000000000851e
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:2]
2a: xor %eax,%eax
2c: mov 0x0(%rbp),%rbx
30: mov 0x8(%rbp),%r13
34: mov 0x10(%rbp),%r14
38: mov 0x18(%rbp),%r15
3c: add $0x28,%rbp
40: leaveq
41: retq
[...]
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-12-08 00:42:32 +00:00
|
|
|
| **bpftool** **prog dump xlated** *PROG* [{**file** *FILE* | **opcodes** | **visual** | **linum**}]
|
|
|
|
|
| **bpftool** **prog dump jited** *PROG* [{**file** *FILE* | **opcodes** | **linum**}]
|
2017-10-23 16:24:15 +00:00
|
|
|
| **bpftool** **prog pin** *PROG* *FILE*
|
2019-04-12 13:29:36 +00:00
|
|
|
| **bpftool** **prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] [**pinmaps** *MAP_DIR*]
|
2018-12-05 10:28:24 +00:00
|
|
|
| **bpftool** **prog attach** *PROG* *ATTACH_TYPE* [*MAP*]
|
|
|
|
|
| **bpftool** **prog detach** *PROG* *ATTACH_TYPE* [*MAP*]
|
|
|
|
|
| **bpftool** **prog tracelog**
|
2017-10-23 16:24:15 +00:00
|
|
|
| **bpftool** **prog help**
|
2017-10-05 03:10:05 +00:00
|
|
|
|
|
2018-07-10 21:43:07 +00:00
|
|
|
| *MAP* := { **id** *MAP_ID* | **pinned** *FILE* }
|
2017-10-23 16:24:15 +00:00
|
|
|
| *PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* }
|
2018-07-10 21:43:00 +00:00
|
|
|
| *TYPE* := {
|
|
|
|
|
| **socket** | **kprobe** | **kretprobe** | **classifier** | **action** |
|
|
|
|
|
| **tracepoint** | **raw_tracepoint** | **xdp** | **perf_event** | **cgroup/skb** |
|
|
|
|
|
| **cgroup/sock** | **cgroup/dev** | **lwt_in** | **lwt_out** | **lwt_xmit** |
|
|
|
|
|
| **lwt_seg6local** | **sockops** | **sk_skb** | **sk_msg** | **lirc_mode2** |
|
|
|
|
|
| **cgroup/bind4** | **cgroup/bind6** | **cgroup/post_bind4** | **cgroup/post_bind6** |
|
2019-04-16 20:13:47 +00:00
|
|
|
| **cgroup/connect4** | **cgroup/connect6** | **cgroup/sendmsg4** | **cgroup/sendmsg6** |
|
2019-06-06 23:49:00 +00:00
|
|
|
| **cgroup/recvmsg4** | **cgroup/recvmsg6** | **cgroup/sysctl**
|
2018-07-10 21:43:00 +00:00
|
|
|
| }
|
2018-11-09 16:21:46 +00:00
|
|
|
| *ATTACH_TYPE* := {
|
2019-02-19 14:13:32 +00:00
|
|
|
| **msg_verdict** | **stream_verdict** | **stream_parser** | **flow_dissector**
|
2018-11-09 16:21:46 +00:00
|
|
|
| }
|
2018-07-10 21:43:00 +00:00
|
|
|
|
2017-10-05 03:10:05 +00:00
|
|
|
|
|
|
|
|
DESCRIPTION
|
|
|
|
|
===========
|
2018-01-02 22:48:36 +00:00
|
|
|
**bpftool prog { show | list }** [*PROG*]
|
2017-10-05 03:10:05 +00:00
|
|
|
Show information about loaded programs. If *PROG* is
|
|
|
|
|
specified show information only about given program, otherwise
|
|
|
|
|
list all programs currently loaded on the system.
|
|
|
|
|
|
|
|
|
|
Output will start with program ID followed by program type and
|
|
|
|
|
zero or more named attributes (depending on kernel version).
|
|
|
|
|
|
2019-04-12 13:29:38 +00:00
|
|
|
Since Linux 5.1 the kernel can collect statistics on BPF
|
|
|
|
|
programs (such as the total time spent running the program,
|
|
|
|
|
and the number of times it was run). If available, bpftool
|
|
|
|
|
shows such statistics. However, the kernel does not collect
|
|
|
|
|
them by defaults, as it slightly impacts performance on each
|
|
|
|
|
program run. Activation or deactivation of the feature is
|
|
|
|
|
performed via the **kernel.bpf_stats_enabled** sysctl knob.
|
|
|
|
|
|
bpf: libbpf: bpftool: Print bpf_line_info during prog dump
This patch adds print bpf_line_info function in 'prog dump jitted'
and 'prog dump xlated':
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv
[...]
int test_long_fname_2(struct dummy_tracepoint_args * arg):
bpf_prog_44a040bf25481309_test_long_fname_2:
; static int test_long_fname_2(struct dummy_tracepoint_args *arg)
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x30,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: xor %esi,%esi
; int key = 0;
27: mov %esi,-0x4(%rbp)
; if (!arg->sock)
2a: mov 0x8(%rdi),%rdi
; if (!arg->sock)
2e: cmp $0x0,%rdi
32: je 0x0000000000000070
34: mov %rbp,%rsi
; counts = bpf_map_lookup_elem(&btf_map, &key);
37: add $0xfffffffffffffffc,%rsi
3b: movabs $0xffff8881139d7480,%rdi
45: add $0x110,%rdi
4c: mov 0x0(%rsi),%eax
4f: cmp $0x4,%rax
53: jae 0x000000000000005e
55: shl $0x3,%rax
59: add %rdi,%rax
5c: jmp 0x0000000000000060
5e: xor %eax,%eax
; if (!counts)
60: cmp $0x0,%rax
64: je 0x0000000000000070
; counts->v6++;
66: mov 0x4(%rax),%edi
69: add $0x1,%rdi
6d: mov %edi,0x4(%rax)
70: mov 0x0(%rbp),%rbx
74: mov 0x8(%rbp),%r13
78: mov 0x10(%rbp),%r14
7c: mov 0x18(%rbp),%r15
80: add $0x28,%rbp
84: leaveq
85: retq
[...]
With linum:
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv linum
int _dummy_tracepoint(struct dummy_tracepoint_args * arg):
bpf_prog_b07ccb89267cf242__dummy_tracepoint:
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:9]
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x28,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: callq 0x000000000000851e
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:2]
2a: xor %eax,%eax
2c: mov 0x0(%rbp),%rbx
30: mov 0x8(%rbp),%r13
34: mov 0x10(%rbp),%r14
38: mov 0x18(%rbp),%r15
3c: add $0x28,%rbp
40: leaveq
41: retq
[...]
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-12-08 00:42:32 +00:00
|
|
|
**bpftool prog dump xlated** *PROG* [{ **file** *FILE* | **opcodes** | **visual** | **linum** }]
|
2018-03-02 02:01:22 +00:00
|
|
|
Dump eBPF instructions of the program from the kernel. By
|
|
|
|
|
default, eBPF will be disassembled and printed to standard
|
|
|
|
|
output in human-readable format. In this case, **opcodes**
|
|
|
|
|
controls if raw opcodes should be printed as well.
|
2017-10-09 17:30:13 +00:00
|
|
|
|
2018-03-02 02:01:22 +00:00
|
|
|
If **file** is specified, the binary image will instead be
|
|
|
|
|
written to *FILE*.
|
|
|
|
|
|
|
|
|
|
If **visual** is specified, control flow graph (CFG) will be
|
|
|
|
|
built instead, and eBPF instructions will be presented with
|
|
|
|
|
CFG in DOT format, on standard output.
|
2017-10-05 03:10:05 +00:00
|
|
|
|
bpf: libbpf: bpftool: Print bpf_line_info during prog dump
This patch adds print bpf_line_info function in 'prog dump jitted'
and 'prog dump xlated':
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv
[...]
int test_long_fname_2(struct dummy_tracepoint_args * arg):
bpf_prog_44a040bf25481309_test_long_fname_2:
; static int test_long_fname_2(struct dummy_tracepoint_args *arg)
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x30,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: xor %esi,%esi
; int key = 0;
27: mov %esi,-0x4(%rbp)
; if (!arg->sock)
2a: mov 0x8(%rdi),%rdi
; if (!arg->sock)
2e: cmp $0x0,%rdi
32: je 0x0000000000000070
34: mov %rbp,%rsi
; counts = bpf_map_lookup_elem(&btf_map, &key);
37: add $0xfffffffffffffffc,%rsi
3b: movabs $0xffff8881139d7480,%rdi
45: add $0x110,%rdi
4c: mov 0x0(%rsi),%eax
4f: cmp $0x4,%rax
53: jae 0x000000000000005e
55: shl $0x3,%rax
59: add %rdi,%rax
5c: jmp 0x0000000000000060
5e: xor %eax,%eax
; if (!counts)
60: cmp $0x0,%rax
64: je 0x0000000000000070
; counts->v6++;
66: mov 0x4(%rax),%edi
69: add $0x1,%rdi
6d: mov %edi,0x4(%rax)
70: mov 0x0(%rbp),%rbx
74: mov 0x8(%rbp),%r13
78: mov 0x10(%rbp),%r14
7c: mov 0x18(%rbp),%r15
80: add $0x28,%rbp
84: leaveq
85: retq
[...]
With linum:
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv linum
int _dummy_tracepoint(struct dummy_tracepoint_args * arg):
bpf_prog_b07ccb89267cf242__dummy_tracepoint:
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:9]
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x28,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: callq 0x000000000000851e
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:2]
2a: xor %eax,%eax
2c: mov 0x0(%rbp),%rbx
30: mov 0x8(%rbp),%r13
34: mov 0x10(%rbp),%r14
38: mov 0x18(%rbp),%r15
3c: add $0x28,%rbp
40: leaveq
41: retq
[...]
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-12-08 00:42:32 +00:00
|
|
|
If the prog has line_info available, the source line will
|
|
|
|
|
be displayed by default. If **linum** is specified,
|
|
|
|
|
the filename, line number and line column will also be
|
|
|
|
|
displayed on top of the source line.
|
2018-12-10 18:53:24 +00:00
|
|
|
|
bpf: libbpf: bpftool: Print bpf_line_info during prog dump
This patch adds print bpf_line_info function in 'prog dump jitted'
and 'prog dump xlated':
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv
[...]
int test_long_fname_2(struct dummy_tracepoint_args * arg):
bpf_prog_44a040bf25481309_test_long_fname_2:
; static int test_long_fname_2(struct dummy_tracepoint_args *arg)
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x30,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: xor %esi,%esi
; int key = 0;
27: mov %esi,-0x4(%rbp)
; if (!arg->sock)
2a: mov 0x8(%rdi),%rdi
; if (!arg->sock)
2e: cmp $0x0,%rdi
32: je 0x0000000000000070
34: mov %rbp,%rsi
; counts = bpf_map_lookup_elem(&btf_map, &key);
37: add $0xfffffffffffffffc,%rsi
3b: movabs $0xffff8881139d7480,%rdi
45: add $0x110,%rdi
4c: mov 0x0(%rsi),%eax
4f: cmp $0x4,%rax
53: jae 0x000000000000005e
55: shl $0x3,%rax
59: add %rdi,%rax
5c: jmp 0x0000000000000060
5e: xor %eax,%eax
; if (!counts)
60: cmp $0x0,%rax
64: je 0x0000000000000070
; counts->v6++;
66: mov 0x4(%rax),%edi
69: add $0x1,%rdi
6d: mov %edi,0x4(%rax)
70: mov 0x0(%rbp),%rbx
74: mov 0x8(%rbp),%r13
78: mov 0x10(%rbp),%r14
7c: mov 0x18(%rbp),%r15
80: add $0x28,%rbp
84: leaveq
85: retq
[...]
With linum:
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv linum
int _dummy_tracepoint(struct dummy_tracepoint_args * arg):
bpf_prog_b07ccb89267cf242__dummy_tracepoint:
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:9]
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x28,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: callq 0x000000000000851e
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:2]
2a: xor %eax,%eax
2c: mov 0x0(%rbp),%rbx
30: mov 0x8(%rbp),%r13
34: mov 0x10(%rbp),%r14
38: mov 0x18(%rbp),%r15
3c: add $0x28,%rbp
40: leaveq
41: retq
[...]
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-12-08 00:42:32 +00:00
|
|
|
**bpftool prog dump jited** *PROG* [{ **file** *FILE* | **opcodes** | **linum** }]
|
2017-10-05 03:10:05 +00:00
|
|
|
Dump jited image (host machine code) of the program.
|
|
|
|
|
If *FILE* is specified image will be written to a file,
|
|
|
|
|
otherwise it will be disassembled and printed to stdout.
|
|
|
|
|
|
|
|
|
|
**opcodes** controls if raw opcodes will be printed.
|
|
|
|
|
|
bpf: libbpf: bpftool: Print bpf_line_info during prog dump
This patch adds print bpf_line_info function in 'prog dump jitted'
and 'prog dump xlated':
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv
[...]
int test_long_fname_2(struct dummy_tracepoint_args * arg):
bpf_prog_44a040bf25481309_test_long_fname_2:
; static int test_long_fname_2(struct dummy_tracepoint_args *arg)
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x30,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: xor %esi,%esi
; int key = 0;
27: mov %esi,-0x4(%rbp)
; if (!arg->sock)
2a: mov 0x8(%rdi),%rdi
; if (!arg->sock)
2e: cmp $0x0,%rdi
32: je 0x0000000000000070
34: mov %rbp,%rsi
; counts = bpf_map_lookup_elem(&btf_map, &key);
37: add $0xfffffffffffffffc,%rsi
3b: movabs $0xffff8881139d7480,%rdi
45: add $0x110,%rdi
4c: mov 0x0(%rsi),%eax
4f: cmp $0x4,%rax
53: jae 0x000000000000005e
55: shl $0x3,%rax
59: add %rdi,%rax
5c: jmp 0x0000000000000060
5e: xor %eax,%eax
; if (!counts)
60: cmp $0x0,%rax
64: je 0x0000000000000070
; counts->v6++;
66: mov 0x4(%rax),%edi
69: add $0x1,%rdi
6d: mov %edi,0x4(%rax)
70: mov 0x0(%rbp),%rbx
74: mov 0x8(%rbp),%r13
78: mov 0x10(%rbp),%r14
7c: mov 0x18(%rbp),%r15
80: add $0x28,%rbp
84: leaveq
85: retq
[...]
With linum:
[root@arch-fb-vm1 bpf]# ~/devshare/fb-kernel/linux/tools/bpf/bpftool/bpftool prog dump jited pinned /sys/fs/bpf/test_btf_haskv linum
int _dummy_tracepoint(struct dummy_tracepoint_args * arg):
bpf_prog_b07ccb89267cf242__dummy_tracepoint:
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:9]
0: push %rbp
1: mov %rsp,%rbp
4: sub $0x28,%rsp
b: sub $0x28,%rbp
f: mov %rbx,0x0(%rbp)
13: mov %r13,0x8(%rbp)
17: mov %r14,0x10(%rbp)
1b: mov %r15,0x18(%rbp)
1f: xor %eax,%eax
21: mov %rax,0x20(%rbp)
25: callq 0x000000000000851e
; return test_long_fname_1(arg); [file:/data/users/kafai/fb-kernel/linux/tools/testing/selftests/bpf/test_btf_haskv.c line_num:54 line_col:2]
2a: xor %eax,%eax
2c: mov 0x0(%rbp),%rbx
30: mov 0x8(%rbp),%r13
34: mov 0x10(%rbp),%r14
38: mov 0x18(%rbp),%r15
3c: add $0x28,%rbp
40: leaveq
41: retq
[...]
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-12-08 00:42:32 +00:00
|
|
|
If the prog has line_info available, the source line will
|
|
|
|
|
be displayed by default. If **linum** is specified,
|
|
|
|
|
the filename, line number and line column will also be
|
|
|
|
|
displayed on top of the source line.
|
2018-12-10 18:53:24 +00:00
|
|
|
|
2017-10-05 03:10:05 +00:00
|
|
|
**bpftool prog pin** *PROG* *FILE*
|
|
|
|
|
Pin program *PROG* as *FILE*.
|
|
|
|
|
|
2018-10-20 22:01:48 +00:00
|
|
|
Note: *FILE* must be located in *bpffs* mount. It must not
|
|
|
|
|
contain a dot character ('.'), which is reserved for future
|
|
|
|
|
extensions of *bpffs*.
|
2017-10-05 03:10:05 +00:00
|
|
|
|
2018-11-09 16:21:45 +00:00
|
|
|
**bpftool prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** {**idx** *IDX* | **name** *NAME*} *MAP*] [**dev** *NAME*] [**pinmaps** *MAP_DIR*]
|
2018-11-09 16:21:44 +00:00
|
|
|
Load bpf program(s) from binary *OBJ* and pin as *PATH*.
|
|
|
|
|
**bpftool prog load** pins only the first program from the
|
|
|
|
|
*OBJ* as *PATH*. **bpftool prog loadall** pins all programs
|
|
|
|
|
from the *OBJ* under *PATH* directory.
|
2018-07-10 21:43:00 +00:00
|
|
|
**type** is optional, if not specified program type will be
|
|
|
|
|
inferred from section names.
|
2018-07-10 21:43:07 +00:00
|
|
|
By default bpftool will create new maps as declared in the ELF
|
|
|
|
|
object being loaded. **map** parameter allows for the reuse
|
|
|
|
|
of existing maps. It can be specified multiple times, each
|
|
|
|
|
time for a different map. *IDX* refers to index of the map
|
|
|
|
|
to be replaced in the ELF file counting from 0, while *NAME*
|
|
|
|
|
allows to replace a map by name. *MAP* specifies the map to
|
|
|
|
|
use, referring to it by **id** or through a **pinned** file.
|
2018-07-10 21:42:58 +00:00
|
|
|
If **dev** *NAME* is specified program will be loaded onto
|
|
|
|
|
given networking device (offload).
|
2018-11-09 16:21:45 +00:00
|
|
|
Optional **pinmaps** argument can be provided to pin all
|
|
|
|
|
maps under *MAP_DIR* directory.
|
2017-12-13 15:18:53 +00:00
|
|
|
|
2018-11-09 16:21:44 +00:00
|
|
|
Note: *PATH* must be located in *bpffs* mount. It must not
|
2018-10-20 22:01:48 +00:00
|
|
|
contain a dot character ('.'), which is reserved for future
|
|
|
|
|
extensions of *bpffs*.
|
2017-12-13 15:18:53 +00:00
|
|
|
|
2018-11-09 16:21:46 +00:00
|
|
|
**bpftool prog attach** *PROG* *ATTACH_TYPE* [*MAP*]
|
|
|
|
|
Attach bpf program *PROG* (with type specified by
|
|
|
|
|
*ATTACH_TYPE*). Most *ATTACH_TYPEs* require a *MAP*
|
|
|
|
|
parameter, with the exception of *flow_dissector* which is
|
|
|
|
|
attached to current networking name space.
|
|
|
|
|
|
|
|
|
|
**bpftool prog detach** *PROG* *ATTACH_TYPE* [*MAP*]
|
|
|
|
|
Detach bpf program *PROG* (with type specified by
|
|
|
|
|
*ATTACH_TYPE*). Most *ATTACH_TYPEs* require a *MAP*
|
|
|
|
|
parameter, with the exception of *flow_dissector* which is
|
|
|
|
|
detached from the current networking name space.
|
2018-10-15 18:19:50 +00:00
|
|
|
|
2018-12-05 10:28:24 +00:00
|
|
|
**bpftool prog tracelog**
|
|
|
|
|
Dump the trace pipe of the system to the console (stdout).
|
|
|
|
|
Hit <Ctrl+C> to stop printing. BPF programs can write to this
|
|
|
|
|
trace pipe at runtime with the **bpf_trace_printk()** helper.
|
|
|
|
|
This should be used only for debugging purposes. For
|
|
|
|
|
streaming data from BPF programs to user space, one can use
|
|
|
|
|
perf events (see also **bpftool-map**\ (8)).
|
|
|
|
|
|
2017-10-05 03:10:05 +00:00
|
|
|
**bpftool prog help**
|
|
|
|
|
Print short help message.
|
|
|
|
|
|
2017-10-23 16:24:06 +00:00
|
|
|
OPTIONS
|
|
|
|
|
=======
|
|
|
|
|
-h, --help
|
|
|
|
|
Print short generic help message (similar to **bpftool help**).
|
|
|
|
|
|
2019-04-12 13:29:37 +00:00
|
|
|
-V, --version
|
2017-10-23 16:24:06 +00:00
|
|
|
Print version number (similar to **bpftool version**).
|
|
|
|
|
|
2017-10-23 16:24:16 +00:00
|
|
|
-j, --json
|
|
|
|
|
Generate JSON output. For commands that cannot produce JSON, this
|
|
|
|
|
option has no effect.
|
|
|
|
|
|
|
|
|
|
-p, --pretty
|
|
|
|
|
Generate human-readable JSON output. Implies **-j**.
|
|
|
|
|
|
2017-11-08 04:55:49 +00:00
|
|
|
-f, --bpffs
|
2018-11-08 11:52:26 +00:00
|
|
|
When showing BPF programs, show file names of pinned
|
|
|
|
|
programs.
|
2017-11-08 04:55:49 +00:00
|
|
|
|
2018-12-14 13:55:57 +00:00
|
|
|
-m, --mapcompat
|
|
|
|
|
Allow loading maps with unknown map definitions.
|
|
|
|
|
|
2018-12-18 10:13:19 +00:00
|
|
|
-n, --nomount
|
|
|
|
|
Do not automatically attempt to mount any virtual file system
|
|
|
|
|
(such as tracefs or BPF virtual file system) when necessary.
|
|
|
|
|
|
2019-05-24 10:36:46 +00:00
|
|
|
-d, --debug
|
2019-05-24 10:36:48 +00:00
|
|
|
Print all logs available, even debug-level information. This
|
|
|
|
|
includes logs from libbpf as well as from the verifier, when
|
|
|
|
|
attempting to load programs.
|
2019-05-24 10:36:46 +00:00
|
|
|
|
2017-10-05 03:10:05 +00:00
|
|
|
EXAMPLES
|
|
|
|
|
========
|
|
|
|
|
**# bpftool prog show**
|
2018-12-14 13:55:58 +00:00
|
|
|
|
2017-10-05 03:10:05 +00:00
|
|
|
::
|
|
|
|
|
|
tools/bpftool: recognize bpf_prog_info run_time_ns and run_cnt
$ bpftool p s
1: kprobe tag a56587d488d216c9 gpl run_time_ns 79786 run_cnt 8
loaded_at 2019-02-22T12:22:51-0800 uid 0
xlated 352B not jited memlock 4096B
$ bpftool --json --pretty p s
[{
"id": 1,
"type": "kprobe",
"tag": "a56587d488d216c9",
"gpl_compatible": true,
"run_time_ns": 79786,
"run_cnt": 8,
"loaded_at": 1550866971,
"uid": 0,
"bytes_xlated": 352,
"jited": false,
"bytes_memlock": 4096
}
]
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-02-25 22:28:42 +00:00
|
|
|
10: xdp name some_prog tag 005a3d2123620c8b gpl run_time_ns 81632 run_cnt 10
|
2018-12-14 13:55:58 +00:00
|
|
|
loaded_at 2017-09-29T20:11:00+0000 uid 0
|
|
|
|
|
xlated 528B jited 370B memlock 4096B map_ids 10
|
2017-10-05 03:10:05 +00:00
|
|
|
|
2017-10-23 16:24:16 +00:00
|
|
|
**# bpftool --json --pretty prog show**
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
2018-12-14 13:55:58 +00:00
|
|
|
[{
|
|
|
|
|
"id": 10,
|
|
|
|
|
"type": "xdp",
|
|
|
|
|
"tag": "005a3d2123620c8b",
|
|
|
|
|
"gpl_compatible": true,
|
tools/bpftool: recognize bpf_prog_info run_time_ns and run_cnt
$ bpftool p s
1: kprobe tag a56587d488d216c9 gpl run_time_ns 79786 run_cnt 8
loaded_at 2019-02-22T12:22:51-0800 uid 0
xlated 352B not jited memlock 4096B
$ bpftool --json --pretty p s
[{
"id": 1,
"type": "kprobe",
"tag": "a56587d488d216c9",
"gpl_compatible": true,
"run_time_ns": 79786,
"run_cnt": 8,
"loaded_at": 1550866971,
"uid": 0,
"bytes_xlated": 352,
"jited": false,
"bytes_memlock": 4096
}
]
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-02-25 22:28:42 +00:00
|
|
|
"run_time_ns": 81632,
|
|
|
|
|
"run_cnt": 10,
|
2018-12-14 13:55:58 +00:00
|
|
|
"loaded_at": 1506715860,
|
|
|
|
|
"uid": 0,
|
|
|
|
|
"bytes_xlated": 528,
|
|
|
|
|
"jited": true,
|
|
|
|
|
"bytes_jited": 370,
|
|
|
|
|
"bytes_memlock": 4096,
|
|
|
|
|
"map_ids": [10
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
]
|
2017-10-23 16:24:16 +00:00
|
|
|
|
2017-10-05 03:10:05 +00:00
|
|
|
|
|
|
|
|
|
| **# bpftool prog dump xlated id 10 file /tmp/t**
|
|
|
|
|
| **# ls -l /tmp/t**
|
|
|
|
|
|
2018-12-14 13:55:58 +00:00
|
|
|
::
|
|
|
|
|
|
|
|
|
|
-rw------- 1 root root 560 Jul 22 01:42 /tmp/t
|
|
|
|
|
|
|
|
|
|
**# bpftool prog dump jited tag 005a3d2123620c8b**
|
2017-10-05 03:10:05 +00:00
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
2018-12-14 13:55:58 +00:00
|
|
|
0: push %rbp
|
|
|
|
|
1: mov %rsp,%rbp
|
|
|
|
|
2: sub $0x228,%rsp
|
|
|
|
|
3: sub $0x28,%rbp
|
|
|
|
|
4: mov %rbx,0x0(%rbp)
|
2017-10-05 03:10:05 +00:00
|
|
|
|
2017-10-23 16:24:16 +00:00
|
|
|
|
|
|
|
|
|
| **# mount -t bpf none /sys/fs/bpf/**
|
|
|
|
|
| **# bpftool prog pin id 10 /sys/fs/bpf/prog**
|
2017-12-13 15:18:53 +00:00
|
|
|
| **# bpftool prog load ./my_prog.o /sys/fs/bpf/prog2**
|
2017-10-23 16:24:16 +00:00
|
|
|
| **# ls -l /sys/fs/bpf/**
|
|
|
|
|
|
2018-12-14 13:55:58 +00:00
|
|
|
::
|
|
|
|
|
|
|
|
|
|
-rw------- 1 root root 0 Jul 22 01:43 prog
|
|
|
|
|
-rw------- 1 root root 0 Jul 22 01:44 prog2
|
|
|
|
|
|
|
|
|
|
**# bpftool prog dump jited pinned /sys/fs/bpf/prog opcodes**
|
2017-10-23 16:24:16 +00:00
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
2018-12-14 13:55:58 +00:00
|
|
|
0: push %rbp
|
|
|
|
|
55
|
|
|
|
|
1: mov %rsp,%rbp
|
|
|
|
|
48 89 e5
|
|
|
|
|
4: sub $0x228,%rsp
|
|
|
|
|
48 81 ec 28 02 00 00
|
|
|
|
|
b: sub $0x28,%rbp
|
|
|
|
|
48 83 ed 28
|
|
|
|
|
f: mov %rbx,0x0(%rbp)
|
|
|
|
|
48 89 5d 00
|
2017-10-05 03:10:05 +00:00
|
|
|
|
2018-07-10 21:43:07 +00:00
|
|
|
|
|
|
|
|
|
| **# bpftool prog load xdp1_kern.o /sys/fs/bpf/xdp1 type xdp map name rxcnt id 7**
|
|
|
|
|
| **# bpftool prog show pinned /sys/fs/bpf/xdp1**
|
2018-12-14 13:55:58 +00:00
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
9: xdp name xdp_prog1 tag 539ec6ce11b52f98 gpl
|
|
|
|
|
loaded_at 2018-06-25T16:17:31-0700 uid 0
|
|
|
|
|
xlated 488B jited 336B memlock 4096B map_ids 7
|
|
|
|
|
|
|
|
|
|
**# rm /sys/fs/bpf/xdp1**
|
2017-10-05 03:10:05 +00:00
|
|
|
|
|
|
|
|
SEE ALSO
|
|
|
|
|
========
|
2018-11-08 11:52:28 +00:00
|
|
|
**bpf**\ (2),
|
|
|
|
|
**bpf-helpers**\ (7),
|
|
|
|
|
**bpftool**\ (8),
|
|
|
|
|
**bpftool-map**\ (8),
|
|
|
|
|
**bpftool-cgroup**\ (8),
|
2019-01-17 15:27:50 +00:00
|
|
|
**bpftool-feature**\ (8),
|
2018-11-08 11:52:28 +00:00
|
|
|
**bpftool-net**\ (8),
|
2019-04-25 22:30:09 +00:00
|
|
|
**bpftool-perf**\ (8),
|
|
|
|
|
**bpftool-btf**\ (8)
|