Ubuntu Manpage: bpftool-btf - tool for inspection of BTF data

Provided by: linux-tools-common_5.19.0-21.21_all

NAME

       bpftool-btf - tool for inspection of BTF data

SYNOPSIS

          bpftool [OPTIONS] btf COMMAND

          OPTIONS := { { -j | --json } [{ -p | --pretty }] | { -d | --debug } | { -l | --legacy }
          | { -B | --base-btf } }

          COMMANDS := { dump | help }

BTF COMMANDS

       bpftool btf { show | list } [id BTF_ID]
       bpftool btf dump BTF_SRC [format FORMAT]
       bpftool btf help

       BTF_SRC := { id BTF_ID | prog PROG | map MAP [{key | value | kv | all}] | file FILE }
       FORMAT := { raw | c }
       MAP := { id MAP_ID | pinned FILE }
       PROG := { id PROG_ID | pinned FILE | tag PROG_TAG }

DESCRIPTION

bpftool btf { show | list } [id BTF_ID]
Show information about loaded BTF objects. If a BTF ID is specified, show
information only about given BTF object, otherwise list all BTF objects
currently loaded on the system.

Since Linux 5.8 bpftool is able to discover information about processes that
hold open file descriptors (FDs) against BTF objects. On such kernels bpftool
will automatically emit this information as well.

bpftool btf dump BTF_SRC
Dump BTF entries from a given BTF_SRC.

When id is specified, BTF object with that ID will be loaded and all its BTF
types emitted.

When map is provided, it's expected that map has associated BTF object with BTF
types describing key and value. It's possible to select whether to dump only BTF
type(s) associated with key (key), value (value), both key and value (kv), or
all BTF types present in associated BTF object (all). If not specified, kv is
assumed.

When prog is provided, it's expected that program has associated BTF object with
BTF types.

When specifying FILE, an ELF file is expected, containing .BTF section with
well-defined BTF binary format data, typically produced by clang or pahole.

format option can be used to override default (raw) output format. Raw (raw) or
C-syntax (c) output formats are supported.

bpftool btf help
Print short help message.

OPTIONS

-h, --help
Print short help message (similar to bpftool help).

-V, --version
Print bpftool's version number (similar to bpftool version), the number of the
libbpf version in use, and optional features that were included when bpftool was
compiled. Optional features include linking against libbfd to provide the
disassembler for JIT-ted programs (bpftool prog dump jited) and usage of BPF
skeletons (some features like bpftool prog profile or showing pids associated to
BPF objects may rely on it).

-j, --json
Generate JSON output. For commands that cannot produce JSON, this option has no
effect.

-p, --pretty
Generate human-readable JSON output. Implies -j.

-d, --debug
Print all logs available, even debug-level information. This includes logs from
libbpf as well as from the verifier, when attempting to load programs.

-l, --legacy
Use legacy libbpf mode which has more relaxed BPF program requirements. By
default, bpftool has more strict requirements about section names, changes
pinning logic and doesn't support some of the older non-BTF map declarations.

See https://github.com/libbpf/libbpf/wiki/Libbpf:-the-road-to-v1.0 for details.

-B, --base-btf FILE
Pass a base BTF object. Base BTF objects are typically used with BTF objects for
kernel modules. To avoid duplicating all kernel symbols required by modules, BTF
objects for modules are "split", they are built incrementally on top of the
kernel (vmlinux) BTF object. So the base BTF reference should usually point to
the kernel BTF.

When the main BTF object to process (for example, the module BTF to dump) is
passed as a FILE, bpftool attempts to autodetect the path for the base object,
and passing this option is optional. When the main BTF object is passed through
other handles, this option becomes necessary.

EXAMPLES