NAME

       bpftool-prog - tool for inspection and simple manipulation of eBPF progs

SYNOPSIS

          bpftool [OPTIONS] prog COMMAND

          OPTIONS := { { -j | --json } [{ -p | --pretty }] | { -f | --bpffs } }

          COMMANDS := { show | dump xlated | dump jited | pin | help }

MAP COMMANDS

       bpftool prog show [PROG]
       bpftool prog dump xlated PROG [{file FILE | opcodes}]
       bpftool prog dump jited  PROG [{file FILE | opcodes}]
       bpftool prog pin PROG FILE
       bpftool prog help

       PROG := { id PROG_ID | pinned FILE | tag PROG_TAG }

DESCRIPTION

          bpftool prog show [PROG]
                 Show information about loaded programs.  If PROG is specified show information only about given
                 program, otherwise list all programs currently loaded on the system.

                 Output  will  start  with program ID followed by program type and zero or more named attributes
                 (depending on kernel version).

          bpftool prog dump xlated PROG [{ file FILE | opcodes }]
                 Dump eBPF instructions of the program from the kernel.  If FILE  is  specified  image  will  be
                 written to a file, otherwise it will be disassembled and printed to stdout.

                 opcodes controls if raw opcodes will be printed.

          bpftool prog dump jited PROG [{ file FILE | opcodes }]
                 Dump  jited  image  (host  machine  code)  of  the program.  If FILE is specified image will be
                 written to a file, otherwise it will be disassembled and printed to stdout.

                 opcodes controls if raw opcodes will be printed.

          bpftool prog pin PROG FILE
                 Pin program PROG as FILE.

                 Note: FILE must be located in bpffs mount.

          bpftool prog help
                 Print short help message.

OPTIONS

          -h, --help
                 Print short generic help message (similar to bpftool help).

          -v, --version
                 Print version number (similar to bpftool version).

          -j, --json
                 Generate JSON output. For commands that cannot produce JSON, this option has no effect.

          -p, --pretty
                 Generate human-readable JSON output. Implies -j.

          -f, --bpffs
                 Show file names of pinned programs.

EXAMPLES

       # bpftool prog show

          10: xdp  name some_prog  tag 005a3d2123620c8b
                loaded_at Sep 29/20:11  uid 0
                xlated 528B  jited 370B  memlock 4096B  map_ids 10

       # bpftool --json --pretty prog show

          {
              "programs": [{
                      "id": 10,
                      "type": "xdp",
                      "tag": "005a3d2123620c8b",
                      "loaded_at": "Sep 29/20:11",
                      "uid": 0,
                      "bytes_xlated": 528,
                      "jited": true,
                      "bytes_jited": 370,
                      "bytes_memlock": 4096,
                      "map_ids": [10
                      ]
                  }
              ]
          }

       # bpftool prog dump xlated id 10 file /tmp/t
       # ls -l /tmp/t
         -rw------- 1 root root 560 Jul 22 01:42 /tmp/t

       # bpftool prog dum jited tag 005a3d2123620c8b

          push   %rbp
          mov    %rsp,%rbp
          sub    $0x228,%rsp
          sub    $0x28,%rbp
          mov    %rbx,0x0(%rbp)

       # mount -t bpf none /sys/fs/bpf/
       # bpftool prog pin id 10 /sys/fs/bpf/prog
       # ls -l /sys/fs/bpf/
         -rw------- 1 root root 0 Jul 22 01:43 prog

       # bpftool prog dum jited pinned /sys/fs/bpf/prog opcodes

          push   %rbp
          55
          mov    %rsp,%rbp
          48 89 e5
          sub    $0x228,%rsp
          48 81 ec 28 02 00 00
          sub    $0x28,%rbp
          48 83 ed 28
          mov    %rbx,0x0(%rbp)
          48 89 5d 00

SEE ALSO

          bpftool(8), bpftool-map(8)

                                                                                                 BPFTOOL-PROG(8)