Commit f7b68543 authored by Rameez Rehman's avatar Rameez Rehman Committed by Daniel Borkmann

bpftool: Use simpler indentation in source rST for documentation

The rST manual pages for bpftool would use a mix of tabs and spaces for
indentation. While this is the norm in C code, this is rather unusual
for rST documents, and over time we've seen many contributors use a
wrong level of indentation for documentation update.

Let's fix bpftool's indentation in docs once and for all:

- Let's use spaces, that are more common in rST files.
- Remove one level of indentation for the synopsis, the command
  description, and the "see also" section. As a result, all sections
  start with the same indentation level in the generated man page.
- Rewrap the paragraphs after the changes.

There is no content change in this patch, only indentation and
rewrapping changes. The wrapping in the generated source files for the
manual pages is changed, but the pages displayed with "man" remain the
same, apart from the adjusted indentation level on relevant sections.

[ Quentin: rebased on bpf-next, removed indent level for command
  description and options, updated synopsis, command summary, and "see
  also" sections. ]
Signed-off-by: default avatarRameez Rehman <rameezrehman408@hotmail.com>
Signed-off-by: default avatarQuentin Monnet <qmo@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20240331200346.29118-2-qmo@kernel.org
parent 623bdd58
...@@ -31,9 +31,9 @@ see_also = $(subst " ",, \ ...@@ -31,9 +31,9 @@ see_also = $(subst " ",, \
"\n" \ "\n" \
"SEE ALSO\n" \ "SEE ALSO\n" \
"========\n" \ "========\n" \
"\t**bpf**\ (2),\n" \ "**bpf**\ (2),\n" \
"\t**bpf-helpers**\\ (7)" \ "**bpf-helpers**\\ (7)" \
$(foreach page,$(call list_pages,$(1)),",\n\t**$(page)**\\ (8)") \ $(foreach page,$(call list_pages,$(1)),",\n**$(page)**\\ (8)") \
"\n") "\n")
$(OUTPUT)%.8: %.rst $(OUTPUT)%.8: %.rst
......
...@@ -14,11 +14,11 @@ tool for inspection of BTF data ...@@ -14,11 +14,11 @@ tool for inspection of BTF data
SYNOPSIS SYNOPSIS
======== ========
**bpftool** [*OPTIONS*] **btf** *COMMAND* **bpftool** [*OPTIONS*] **btf** *COMMAND*
*OPTIONS* := { |COMMON_OPTIONS| | { **-B** | **--base-btf** } } *OPTIONS* := { |COMMON_OPTIONS| | { **-B** | **--base-btf** } }
*COMMANDS* := { **dump** | **help** } *COMMANDS* := { **dump** | **help** }
BTF COMMANDS BTF COMMANDS
============= =============
...@@ -34,62 +34,56 @@ BTF COMMANDS ...@@ -34,62 +34,56 @@ BTF COMMANDS
DESCRIPTION DESCRIPTION
=========== ===========
**bpftool btf { show | list }** [**id** *BTF_ID*] **bpftool btf { show | list }** [**id** *BTF_ID*]
Show information about loaded BTF objects. If a BTF ID is Show information about loaded BTF objects. If a BTF ID is specified, show
specified, show information only about given BTF object, information only about given BTF object, otherwise list all BTF objects
otherwise list all BTF objects currently loaded on the currently loaded on the system.
system.
Since Linux 5.8 bpftool is able to discover information about processes
Since Linux 5.8 bpftool is able to discover information about that hold open file descriptors (FDs) against BTF objects. On such kernels
processes that hold open file descriptors (FDs) against BTF bpftool will automatically emit this information as well.
objects. On such kernels bpftool will automatically emit this
information as well. **bpftool btf dump** *BTF_SRC*
**bpftool btf dump** *BTF_SRC*
Dump BTF entries from a given *BTF_SRC*. Dump BTF entries from a given *BTF_SRC*.
When **id** is specified, BTF object with that ID will be When **id** is specified, BTF object with that ID will be loaded and all
loaded and all its BTF types emitted. its BTF types emitted.
When **map** is provided, it's expected that map has When **map** is provided, it's expected that map has associated BTF object
associated BTF object with BTF types describing key and with BTF types describing key and value. It's possible to select whether to
value. It's possible to select whether to dump only BTF dump only BTF type(s) associated with key (**key**), value (**value**),
type(s) associated with key (**key**), value (**value**), both key and value (**kv**), or all BTF types present in associated BTF
both key and value (**kv**), or all BTF types present in object (**all**). If not specified, **kv** is assumed.
associated BTF object (**all**). If not specified, **kv**
is assumed.
When **prog** is provided, it's expected that program has When **prog** is provided, it's expected that program has associated BTF
associated BTF object with BTF types. object with BTF types.
When specifying *FILE*, an ELF file is expected, containing When specifying *FILE*, an ELF file is expected, containing .BTF section
.BTF section with well-defined BTF binary format data, with well-defined BTF binary format data, typically produced by clang or
typically produced by clang or pahole. pahole.
**format** option can be used to override default (raw) **format** option can be used to override default (raw) output format. Raw
output format. Raw (**raw**) or C-syntax (**c**) output (**raw**) or C-syntax (**c**) output formats are supported.
formats are supported.
**bpftool btf help** **bpftool btf help**
Print short help message. Print short help message.
OPTIONS OPTIONS
======= =======
.. include:: common_options.rst .. include:: common_options.rst
-B, --base-btf *FILE* -B, --base-btf *FILE*
Pass a base BTF object. Base BTF objects are typically used Pass a base BTF object. Base BTF objects are typically used with BTF
with BTF objects for kernel modules. To avoid duplicating objects for kernel modules. To avoid duplicating all kernel symbols
all kernel symbols required by modules, BTF objects for required by modules, BTF objects for modules are "split", they are
modules are "split", they are built incrementally on top of built incrementally on top of the kernel (vmlinux) BTF object. So the
the kernel (vmlinux) BTF object. So the base BTF reference base BTF reference should usually point to the kernel BTF.
should usually point to the kernel BTF.
When the main BTF object to process (for example, the module BTF to
When the main BTF object to process (for example, the dump) is passed as a *FILE*, bpftool attempts to autodetect the path
module BTF to dump) is passed as a *FILE*, bpftool attempts for the base object, and passing this option is optional. When the main
to autodetect the path for the base object, and passing BTF object is passed through other handles, this option becomes
this option is optional. When the main BTF object is passed necessary.
through other handles, this option becomes necessary.
EXAMPLES EXAMPLES
======== ========
......
...@@ -14,12 +14,12 @@ tool for inspection and simple manipulation of eBPF progs ...@@ -14,12 +14,12 @@ tool for inspection and simple manipulation of eBPF progs
SYNOPSIS SYNOPSIS
======== ========
**bpftool** [*OPTIONS*] **cgroup** *COMMAND* **bpftool** [*OPTIONS*] **cgroup** *COMMAND*
*OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } } *OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } }
*COMMANDS* := *COMMANDS* :=
{ **show** | **list** | **tree** | **attach** | **detach** | **help** } { **show** | **list** | **tree** | **attach** | **detach** | **help** }
CGROUP COMMANDS CGROUP COMMANDS
=============== ===============
...@@ -49,49 +49,46 @@ CGROUP COMMANDS ...@@ -49,49 +49,46 @@ CGROUP COMMANDS
DESCRIPTION DESCRIPTION
=========== ===========
**bpftool cgroup { show | list }** *CGROUP* [**effective**] **bpftool cgroup { show | list }** *CGROUP* [**effective**]
List all programs attached to the cgroup *CGROUP*. List all programs attached to the cgroup *CGROUP*.
Output will start with program ID followed by attach type, Output will start with program ID followed by attach type, attach flags and
attach flags and program name. program name.
If **effective** is specified retrieve effective programs that If **effective** is specified retrieve effective programs that will execute
will execute for events within a cgroup. This includes for events within a cgroup. This includes inherited along with attached
inherited along with attached ones. ones.
**bpftool cgroup tree** [*CGROUP_ROOT*] [**effective**] **bpftool cgroup tree** [*CGROUP_ROOT*] [**effective**]
Iterate over all cgroups in *CGROUP_ROOT* and list all Iterate over all cgroups in *CGROUP_ROOT* and list all attached programs.
attached programs. If *CGROUP_ROOT* is not specified, If *CGROUP_ROOT* is not specified, bpftool uses cgroup v2 mountpoint.
bpftool uses cgroup v2 mountpoint.
The output is similar to the output of cgroup show/list The output is similar to the output of cgroup show/list commands: it starts
commands: it starts with absolute cgroup path, followed by with absolute cgroup path, followed by program ID, attach type, attach
program ID, attach type, attach flags and program name. flags and program name.
If **effective** is specified retrieve effective programs that If **effective** is specified retrieve effective programs that will execute
will execute for events within a cgroup. This includes for events within a cgroup. This includes inherited along with attached
inherited along with attached ones. ones.
**bpftool cgroup attach** *CGROUP* *ATTACH_TYPE* *PROG* [*ATTACH_FLAGS*] **bpftool cgroup attach** *CGROUP* *ATTACH_TYPE* *PROG* [*ATTACH_FLAGS*]
Attach program *PROG* to the cgroup *CGROUP* with attach type Attach program *PROG* to the cgroup *CGROUP* with attach type *ATTACH_TYPE*
*ATTACH_TYPE* and optional *ATTACH_FLAGS*. and optional *ATTACH_FLAGS*.
*ATTACH_FLAGS* can be one of: **override** if a sub-cgroup installs *ATTACH_FLAGS* can be one of: **override** if a sub-cgroup installs some
some bpf program, the program in this cgroup yields to sub-cgroup bpf program, the program in this cgroup yields to sub-cgroup program;
program; **multi** if a sub-cgroup installs some bpf program, **multi** if a sub-cgroup installs some bpf program, that cgroup program
that cgroup program gets run in addition to the program in this gets run in addition to the program in this cgroup.
cgroup.
Only one program is allowed to be attached to a cgroup with Only one program is allowed to be attached to a cgroup with no attach flags
no attach flags or the **override** flag. Attaching another or the **override** flag. Attaching another program will release old
program will release old program and attach the new one. program and attach the new one.
Multiple programs are allowed to be attached to a cgroup with Multiple programs are allowed to be attached to a cgroup with **multi**.
**multi**. They are executed in FIFO order (those that were They are executed in FIFO order (those that were attached first, run
attached first, run first). first).
Non-default *ATTACH_FLAGS* are supported by kernel version 4.14 Non-default *ATTACH_FLAGS* are supported by kernel version 4.14 and later.
and later.
*ATTACH_TYPE* can be on of: *ATTACH_TYPE* can be on of:
**ingress** ingress path of the inet socket (since 4.10); **ingress** ingress path of the inet socket (since 4.10);
...@@ -106,18 +103,18 @@ DESCRIPTION ...@@ -106,18 +103,18 @@ DESCRIPTION
**connect4** call to connect(2) for an inet4 socket (since 4.17); **connect4** call to connect(2) for an inet4 socket (since 4.17);
**connect6** call to connect(2) for an inet6 socket (since 4.17); **connect6** call to connect(2) for an inet6 socket (since 4.17);
**connect_unix** call to connect(2) for a unix socket (since 6.7); **connect_unix** call to connect(2) for a unix socket (since 6.7);
**sendmsg4** call to sendto(2), sendmsg(2), sendmmsg(2) for an **sendmsg4** call to sendto(2), sendmsg(2), sendmmsg(2) for an unconnected
unconnected udp4 socket (since 4.18); udp4 socket (since 4.18);
**sendmsg6** call to sendto(2), sendmsg(2), sendmmsg(2) for an **sendmsg6** call to sendto(2), sendmsg(2), sendmmsg(2) for an unconnected
unconnected udp6 socket (since 4.18); udp6 socket (since 4.18);
**sendmsg_unix** call to sendto(2), sendmsg(2), sendmmsg(2) for **sendmsg_unix** call to sendto(2), sendmsg(2), sendmmsg(2) for an
an unconnected unix socket (since 6.7); unconnected unix socket (since 6.7);
**recvmsg4** call to recvfrom(2), recvmsg(2), recvmmsg(2) for **recvmsg4** call to recvfrom(2), recvmsg(2), recvmmsg(2) for an
an unconnected udp4 socket (since 5.2); unconnected udp4 socket (since 5.2);
**recvmsg6** call to recvfrom(2), recvmsg(2), recvmmsg(2) for **recvmsg6** call to recvfrom(2), recvmsg(2), recvmmsg(2) for an
an unconnected udp6 socket (since 5.2); unconnected udp6 socket (since 5.2);
**recvmsg_unix** call to recvfrom(2), recvmsg(2), recvmmsg(2) for **recvmsg_unix** call to recvfrom(2), recvmsg(2), recvmmsg(2) for an
an unconnected unix socket (since 6.7); unconnected unix socket (since 6.7);
**sysctl** sysctl access (since 5.2); **sysctl** sysctl access (since 5.2);
**getsockopt** call to getsockopt (since 5.3); **getsockopt** call to getsockopt (since 5.3);
**setsockopt** call to setsockopt (since 5.3); **setsockopt** call to setsockopt (since 5.3);
...@@ -129,18 +126,17 @@ DESCRIPTION ...@@ -129,18 +126,17 @@ DESCRIPTION
**getsockname_unix** call to getsockname(2) for a unix socket (since 6.7); **getsockname_unix** call to getsockname(2) for a unix socket (since 6.7);
**sock_release** closing an userspace inet socket (since 5.9). **sock_release** closing an userspace inet socket (since 5.9).
**bpftool cgroup detach** *CGROUP* *ATTACH_TYPE* *PROG* **bpftool cgroup detach** *CGROUP* *ATTACH_TYPE* *PROG*
Detach *PROG* from the cgroup *CGROUP* and attach type Detach *PROG* from the cgroup *CGROUP* and attach type *ATTACH_TYPE*.
*ATTACH_TYPE*.
**bpftool prog help** **bpftool prog help**
Print short help message. Print short help message.
OPTIONS OPTIONS
======= =======
.. include:: common_options.rst .. include:: common_options.rst
-f, --bpffs -f, --bpffs
Show file names of pinned programs. Show file names of pinned programs.
EXAMPLES EXAMPLES
......
...@@ -14,11 +14,11 @@ tool for inspection of eBPF-related parameters for Linux kernel or net device ...@@ -14,11 +14,11 @@ tool for inspection of eBPF-related parameters for Linux kernel or net device
SYNOPSIS SYNOPSIS
======== ========
**bpftool** [*OPTIONS*] **feature** *COMMAND* **bpftool** [*OPTIONS*] **feature** *COMMAND*
*OPTIONS* := { |COMMON_OPTIONS| } *OPTIONS* := { |COMMON_OPTIONS| }
*COMMANDS* := { **probe** | **help** } *COMMANDS* := { **probe** | **help** }
FEATURE COMMANDS FEATURE COMMANDS
================ ================
...@@ -32,59 +32,52 @@ FEATURE COMMANDS ...@@ -32,59 +32,52 @@ FEATURE COMMANDS
DESCRIPTION DESCRIPTION
=========== ===========
**bpftool feature probe** [**kernel**] [**full**] [**macros** [**prefix** *PREFIX*]] **bpftool feature probe** [**kernel**] [**full**] [**macros** [**prefix** *PREFIX*]]
Probe the running kernel and dump a number of eBPF-related Probe the running kernel and dump a number of eBPF-related parameters, such
parameters, such as availability of the **bpf**\ () system call, as availability of the **bpf**\ () system call, JIT status, eBPF program
JIT status, eBPF program types availability, eBPF helper types availability, eBPF helper functions availability, and more.
functions availability, and more.
By default, bpftool **does not run probes** for **bpf_probe_write_user**\
By default, bpftool **does not run probes** for () and **bpf_trace_printk**\() helpers which print warnings to kernel logs.
**bpf_probe_write_user**\ () and **bpf_trace_printk**\() To enable them and run all probes, the **full** keyword should be used.
helpers which print warnings to kernel logs. To enable them
and run all probes, the **full** keyword should be used. If the **macros** keyword (but not the **-j** option) is passed, a subset
of the output is dumped as a list of **#define** macros that are ready to
If the **macros** keyword (but not the **-j** option) is be included in a C header file, for example. If, additionally, **prefix**
passed, a subset of the output is dumped as a list of is used to define a *PREFIX*, the provided string will be used as a prefix
**#define** macros that are ready to be included in a C to the names of the macros: this can be used to avoid conflicts on macro
header file, for example. If, additionally, **prefix** is names when including the output of this command as a header file.
used to define a *PREFIX*, the provided string will be used
as a prefix to the names of the macros: this can be used to Keyword **kernel** can be omitted. If no probe target is specified, probing
avoid conflicts on macro names when including the output of the kernel is the default behaviour.
this command as a header file.
When the **unprivileged** keyword is used, bpftool will dump only the
Keyword **kernel** can be omitted. If no probe target is features available to a user who does not have the **CAP_SYS_ADMIN**
specified, probing the kernel is the default behaviour. capability set. The features available in that case usually represent a
small subset of the parameters supported by the system. Unprivileged users
When the **unprivileged** keyword is used, bpftool will dump MUST use the **unprivileged** keyword: This is to avoid misdetection if
only the features available to a user who does not have the bpftool is inadvertently run as non-root, for example. This keyword is
**CAP_SYS_ADMIN** capability set. The features available in unavailable if bpftool was compiled without libcap.
that case usually represent a small subset of the parameters
supported by the system. Unprivileged users MUST use the **bpftool feature probe dev** *NAME* [**full**] [**macros** [**prefix** *PREFIX*]]
**unprivileged** keyword: This is to avoid misdetection if Probe network device for supported eBPF features and dump results to the
bpftool is inadvertently run as non-root, for example. This console.
keyword is unavailable if bpftool was compiled without
libcap. The keywords **full**, **macros** and **prefix** have the same role as when
probing the kernel.
**bpftool feature probe dev** *NAME* [**full**] [**macros** [**prefix** *PREFIX*]]
Probe network device for supported eBPF features and dump **bpftool feature list_builtins** *GROUP*
results to the console.
The keywords **full**, **macros** and **prefix** have the
same role as when probing the kernel.
**bpftool feature list_builtins** *GROUP*
List items known to bpftool. These can be BPF program types List items known to bpftool. These can be BPF program types
(**prog_types**), BPF map types (**map_types**), attach types (**prog_types**), BPF map types (**map_types**), attach types
(**attach_types**), link types (**link_types**), or BPF helper (**attach_types**), link types (**link_types**), or BPF helper functions
functions (**helpers**). The command does not probe the system, but (**helpers**). The command does not probe the system, but simply lists the
simply lists the elements that bpftool knows from compilation time, elements that bpftool knows from compilation time, as provided from libbpf
as provided from libbpf (for all object types) or from the BPF UAPI (for all object types) or from the BPF UAPI header (list of helpers). This
header (list of helpers). This can be used in scripts to iterate over can be used in scripts to iterate over BPF types or helpers.
BPF types or helpers.
**bpftool feature help**
**bpftool feature help**
Print short help message. Print short help message.
OPTIONS OPTIONS
======= =======
.. include:: common_options.rst .. include:: common_options.rst
...@@ -14,11 +14,11 @@ tool for BPF code-generation ...@@ -14,11 +14,11 @@ tool for BPF code-generation
SYNOPSIS SYNOPSIS
======== ========
**bpftool** [*OPTIONS*] **gen** *COMMAND* **bpftool** [*OPTIONS*] **gen** *COMMAND*
*OPTIONS* := { |COMMON_OPTIONS| | { **-L** | **--use-loader** } } *OPTIONS* := { |COMMON_OPTIONS| | { **-L** | **--use-loader** } }
*COMMAND* := { **object** | **skeleton** | **help** } *COMMAND* := { **object** | **skeleton** | **help** }
GEN COMMANDS GEN COMMANDS
============= =============
...@@ -31,182 +31,160 @@ GEN COMMANDS ...@@ -31,182 +31,160 @@ GEN COMMANDS
DESCRIPTION DESCRIPTION
=========== ===========
**bpftool gen object** *OUTPUT_FILE* *INPUT_FILE* [*INPUT_FILE*...] **bpftool gen object** *OUTPUT_FILE* *INPUT_FILE* [*INPUT_FILE*...]
Statically link (combine) together one or more *INPUT_FILE*'s Statically link (combine) together one or more *INPUT_FILE*'s into a single
into a single resulting *OUTPUT_FILE*. All the files involved resulting *OUTPUT_FILE*. All the files involved are BPF ELF object files.
are BPF ELF object files.
The rules of BPF static linking are mostly the same as for user-space
The rules of BPF static linking are mostly the same as for object files, but in addition to combining data and instruction sections,
user-space object files, but in addition to combining data .BTF and .BTF.ext (if present in any of the input files) data are combined
and instruction sections, .BTF and .BTF.ext (if present in together. .BTF data is deduplicated, so all the common types across
any of the input files) data are combined together. .BTF *INPUT_FILE*'s will only be represented once in the resulting BTF
data is deduplicated, so all the common types across information.
*INPUT_FILE*'s will only be represented once in the resulting
BTF information. BPF static linking allows to partition BPF source code into individually
compiled files that are then linked into a single resulting BPF object
BPF static linking allows to partition BPF source code into file, which can be used to generated BPF skeleton (with **gen skeleton**
individually compiled files that are then linked into command) or passed directly into **libbpf** (using **bpf_object__open()**
a single resulting BPF object file, which can be used to
generated BPF skeleton (with **gen skeleton** command) or
passed directly into **libbpf** (using **bpf_object__open()**
family of APIs). family of APIs).
**bpftool gen skeleton** *FILE* **bpftool gen skeleton** *FILE*
Generate BPF skeleton C header file for a given *FILE*. Generate BPF skeleton C header file for a given *FILE*.
BPF skeleton is an alternative interface to existing libbpf BPF skeleton is an alternative interface to existing libbpf APIs for
APIs for working with BPF objects. Skeleton code is intended working with BPF objects. Skeleton code is intended to significantly
to significantly shorten and simplify code to load and work shorten and simplify code to load and work with BPF programs from userspace
with BPF programs from userspace side. Generated code is side. Generated code is tailored to specific input BPF object *FILE*,
tailored to specific input BPF object *FILE*, reflecting its reflecting its structure by listing out available maps, program, variables,
structure by listing out available maps, program, variables, etc. Skeleton eliminates the need to lookup mentioned components by name.
etc. Skeleton eliminates the need to lookup mentioned Instead, if skeleton instantiation succeeds, they are populated in skeleton
components by name. Instead, if skeleton instantiation structure as valid libbpf types (e.g., **struct bpf_map** pointer) and can
succeeds, they are populated in skeleton structure as valid be passed to existing generic libbpf APIs.
libbpf types (e.g., **struct bpf_map** pointer) and can be
passed to existing generic libbpf APIs. In addition to simple and reliable access to maps and programs, skeleton
provides a storage for BPF links (**struct bpf_link**) for each BPF program
In addition to simple and reliable access to maps and within BPF object. When requested, supported BPF programs will be
programs, skeleton provides a storage for BPF links (**struct automatically attached and resulting BPF links stored for further use by
bpf_link**) for each BPF program within BPF object. When user in pre-allocated fields in skeleton struct. For BPF programs that
requested, supported BPF programs will be automatically can't be automatically attached by libbpf, user can attach them manually,
attached and resulting BPF links stored for further use by but store resulting BPF link in per-program link field. All such set up
user in pre-allocated fields in skeleton struct. For BPF links will be automatically destroyed on BPF skeleton destruction. This
programs that can't be automatically attached by libbpf, eliminates the need for users to manage links manually and rely on libbpf
user can attach them manually, but store resulting BPF link support to detach programs and free up resources.
in per-program link field. All such set up links will be
automatically destroyed on BPF skeleton destruction. This Another facility provided by BPF skeleton is an interface to global
eliminates the need for users to manage links manually and variables of all supported kinds: mutable, read-only, as well as extern
rely on libbpf support to detach programs and free up ones. This interface allows to pre-setup initial values of variables before
resources. BPF object is loaded and verified by kernel. For non-read-only variables,
the same interface can be used to fetch values of global variables on
Another facility provided by BPF skeleton is an interface to
global variables of all supported kinds: mutable, read-only,
as well as extern ones. This interface allows to pre-setup
initial values of variables before BPF object is loaded and
verified by kernel. For non-read-only variables, the same
interface can be used to fetch values of global variables on
userspace side, even if they are modified by BPF code. userspace side, even if they are modified by BPF code.
During skeleton generation, contents of source BPF object During skeleton generation, contents of source BPF object *FILE* is
*FILE* is embedded within generated code and is thus not embedded within generated code and is thus not necessary to keep around.
necessary to keep around. This ensures skeleton and BPF This ensures skeleton and BPF object file are matching 1-to-1 and always
object file are matching 1-to-1 and always stay in sync. stay in sync. Generated code is dual-licensed under LGPL-2.1 and
Generated code is dual-licensed under LGPL-2.1 and
BSD-2-Clause licenses. BSD-2-Clause licenses.
It is a design goal and guarantee that skeleton interfaces It is a design goal and guarantee that skeleton interfaces are
are interoperable with generic libbpf APIs. User should interoperable with generic libbpf APIs. User should always be able to use
always be able to use skeleton API to create and load BPF skeleton API to create and load BPF object, and later use libbpf APIs to
object, and later use libbpf APIs to keep working with keep working with specific maps, programs, etc.
specific maps, programs, etc.
As part of skeleton, few custom functions are generated. Each of them is
As part of skeleton, few custom functions are generated. prefixed with object name. Object name can either be derived from object
Each of them is prefixed with object name. Object name can file name, i.e., if BPF object file name is **example.o**, BPF object name
either be derived from object file name, i.e., if BPF object will be **example**. Object name can be also specified explicitly through
file name is **example.o**, BPF object name will be **name** *OBJECT_NAME* parameter. The following custom functions are
**example**. Object name can be also specified explicitly provided (assuming **example** as the object name):
through **name** *OBJECT_NAME* parameter. The following
custom functions are provided (assuming **example** as
the object name):
- **example__open** and **example__open_opts**. - **example__open** and **example__open_opts**.
These functions are used to instantiate skeleton. It These functions are used to instantiate skeleton. It corresponds to
corresponds to libbpf's **bpf_object__open**\ () API. libbpf's **bpf_object__open**\ () API. **_opts** variants accepts extra
**_opts** variants accepts extra **bpf_object_open_opts** **bpf_object_open_opts** options.
options.
- **example__load**. - **example__load**.
This function creates maps, loads and verifies BPF This function creates maps, loads and verifies BPF programs, initializes
programs, initializes global data maps. It corresponds to global data maps. It corresponds to libppf's **bpf_object__load**\ ()
libppf's **bpf_object__load**\ () API. API.
- **example__open_and_load** combines **example__open** and - **example__open_and_load** combines **example__open** and
**example__load** invocations in one commonly used **example__load** invocations in one commonly used operation.
operation.
- **example__attach** and **example__detach** - **example__attach** and **example__detach**
This pair of functions allow to attach and detach, This pair of functions allow to attach and detach, correspondingly,
correspondingly, already loaded BPF object. Only BPF already loaded BPF object. Only BPF programs of types supported by libbpf
programs of types supported by libbpf for auto-attachment for auto-attachment will be auto-attached and their corresponding BPF
will be auto-attached and their corresponding BPF links links instantiated. For other BPF programs, user can manually create a
instantiated. For other BPF programs, user can manually BPF link and assign it to corresponding fields in skeleton struct.
create a BPF link and assign it to corresponding fields in **example__detach** will detach both links created automatically, as well
skeleton struct. **example__detach** will detach both as those populated by user manually.
links created automatically, as well as those populated by
user manually.
- **example__destroy** - **example__destroy**
Detach and unload BPF programs, free up all the resources Detach and unload BPF programs, free up all the resources used by
used by skeleton and BPF object. skeleton and BPF object.
If BPF object has global variables, corresponding structs If BPF object has global variables, corresponding structs with memory
with memory layout corresponding to global data data section layout corresponding to global data data section layout will be created.
layout will be created. Currently supported ones are: *.data*, Currently supported ones are: *.data*, *.bss*, *.rodata*, and *.kconfig*
*.bss*, *.rodata*, and *.kconfig* structs/data sections. structs/data sections. These data sections/structs can be used to set up
These data sections/structs can be used to set up initial initial values of variables, if set before **example__load**. Afterwards,
values of variables, if set before **example__load**. if target kernel supports memory-mapped BPF arrays, same structs can be
Afterwards, if target kernel supports memory-mapped BPF used to fetch and update (non-read-only) data from userspace, with same
arrays, same structs can be used to fetch and update simplicity as for BPF side.
(non-read-only) data from userspace, with same simplicity
as for BPF side. **bpftool gen subskeleton** *FILE*
**bpftool gen subskeleton** *FILE*
Generate BPF subskeleton C header file for a given *FILE*. Generate BPF subskeleton C header file for a given *FILE*.
Subskeletons are similar to skeletons, except they do not own Subskeletons are similar to skeletons, except they do not own the
the corresponding maps, programs, or global variables. They corresponding maps, programs, or global variables. They require that the
require that the object file used to generate them is already object file used to generate them is already loaded into a *bpf_object* by
loaded into a *bpf_object* by some other means. some other means.
This functionality is useful when a library is included into a This functionality is useful when a library is included into a larger BPF
larger BPF program. A subskeleton for the library would have program. A subskeleton for the library would have access to all objects and
access to all objects and globals defined in it, without globals defined in it, without having to know about the larger program.
having to know about the larger program.
Consequently, there are only two functions defined Consequently, there are only two functions defined for subskeletons:
for subskeletons:
- **example__open(bpf_object\*)** - **example__open(bpf_object\*)**
Instantiates a subskeleton from an already opened (but not Instantiates a subskeleton from an already opened (but not necessarily
necessarily loaded) **bpf_object**. loaded) **bpf_object**.
- **example__destroy()** - **example__destroy()**
Frees the storage for the subskeleton but *does not* unload Frees the storage for the subskeleton but *does not* unload any BPF
any BPF programs or maps. programs or maps.
**bpftool** **gen min_core_btf** *INPUT* *OUTPUT* *OBJECT* [*OBJECT*...] **bpftool** **gen min_core_btf** *INPUT* *OUTPUT* *OBJECT* [*OBJECT*...]
Generate a minimum BTF file as *OUTPUT*, derived from a given Generate a minimum BTF file as *OUTPUT*, derived from a given *INPUT* BTF
*INPUT* BTF file, containing all needed BTF types so one, or file, containing all needed BTF types so one, or more, given eBPF objects
more, given eBPF objects CO-RE relocations may be satisfied. CO-RE relocations may be satisfied.
When kernels aren't compiled with CONFIG_DEBUG_INFO_BTF, When kernels aren't compiled with CONFIG_DEBUG_INFO_BTF, libbpf, when
libbpf, when loading an eBPF object, has to rely on external loading an eBPF object, has to rely on external BTF files to be able to
BTF files to be able to calculate CO-RE relocations. calculate CO-RE relocations.
Usually, an external BTF file is built from existing kernel Usually, an external BTF file is built from existing kernel DWARF data
DWARF data using pahole. It contains all the types used by using pahole. It contains all the types used by its respective kernel image
its respective kernel image and, because of that, is big. and, because of that, is big.
The min_core_btf feature builds smaller BTF files, customized The min_core_btf feature builds smaller BTF files, customized to one or
to one or multiple eBPF objects, so they can be distributed multiple eBPF objects, so they can be distributed together with an eBPF
together with an eBPF CO-RE based application, turning the CO-RE based application, turning the application portable to different
application portable to different kernel versions. kernel versions.
Check examples bellow for more information how to use it. Check examples bellow for more information how to use it.
**bpftool gen help** **bpftool gen help**
Print short help message. Print short help message.
OPTIONS OPTIONS
======= =======
.. include:: common_options.rst .. include:: common_options.rst
-L, --use-loader -L, --use-loader
For skeletons, generate a "light" skeleton (also known as "loader" For skeletons, generate a "light" skeleton (also known as "loader"
skeleton). A light skeleton contains a loader eBPF program. It does skeleton). A light skeleton contains a loader eBPF program. It does not use
not use the majority of the libbpf infrastructure, and does not need the majority of the libbpf infrastructure, and does not need libelf.
libelf.
EXAMPLES EXAMPLES
======== ========
......
...@@ -14,11 +14,11 @@ tool to create BPF iterators ...@@ -14,11 +14,11 @@ tool to create BPF iterators
SYNOPSIS SYNOPSIS
======== ========
**bpftool** [*OPTIONS*] **iter** *COMMAND* **bpftool** [*OPTIONS*] **iter** *COMMAND*
*OPTIONS* := { |COMMON_OPTIONS| } *OPTIONS* := { |COMMON_OPTIONS| }
*COMMANDS* := { **pin** | **help** } *COMMANDS* := { **pin** | **help** }
ITER COMMANDS ITER COMMANDS
=================== ===================
...@@ -31,33 +31,29 @@ ITER COMMANDS ...@@ -31,33 +31,29 @@ ITER COMMANDS
DESCRIPTION DESCRIPTION
=========== ===========
**bpftool iter pin** *OBJ* *PATH* [**map** *MAP*] **bpftool iter pin** *OBJ* *PATH* [**map** *MAP*]
A bpf iterator combines a kernel iterating of A bpf iterator combines a kernel iterating of particular kernel data (e.g.,
particular kernel data (e.g., tasks, bpf_maps, etc.) tasks, bpf_maps, etc.) and a bpf program called for each kernel data object
and a bpf program called for each kernel data object (e.g., one task, one bpf_map, etc.). User space can *read* kernel iterator
(e.g., one task, one bpf_map, etc.). User space can output through *read()* syscall.
*read* kernel iterator output through *read()* syscall.
The *pin* command creates a bpf iterator from *OBJ*, and pin it to *PATH*.
The *pin* command creates a bpf iterator from *OBJ*, The *PATH* should be located in *bpffs* mount. It must not contain a dot
and pin it to *PATH*. The *PATH* should be located character ('.'), which is reserved for future extensions of *bpffs*.
in *bpffs* mount. It must not contain a dot
character ('.'), which is reserved for future extensions Map element bpf iterator requires an additional parameter *MAP* so bpf
of *bpffs*. program can iterate over map elements for that map. User can have a bpf
program in kernel to run with each map element, do checking, filtering,
Map element bpf iterator requires an additional parameter aggregation, etc. without copying data to user space.
*MAP* so bpf program can iterate over map elements for
that map. User can have a bpf program in kernel to run
with each map element, do checking, filtering, aggregation,
etc. without copying data to user space.
User can then *cat PATH* to see the bpf iterator output. User can then *cat PATH* to see the bpf iterator output.
**bpftool iter help** **bpftool iter help**
Print short help message. Print short help message.
OPTIONS OPTIONS
======= =======
.. include:: common_options.rst .. include:: common_options.rst
EXAMPLES EXAMPLES
======== ========
......
...@@ -14,11 +14,11 @@ tool for inspection and simple manipulation of eBPF links ...@@ -14,11 +14,11 @@ tool for inspection and simple manipulation of eBPF links
SYNOPSIS SYNOPSIS
======== ========
**bpftool** [*OPTIONS*] **link** *COMMAND* **bpftool** [*OPTIONS*] **link** *COMMAND*
*OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } | { **-n** | **--nomount** } } *OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } | { **-n** | **--nomount** } }
*COMMANDS* := { **show** | **list** | **pin** | **help** } *COMMANDS* := { **show** | **list** | **pin** | **help** }
LINK COMMANDS LINK COMMANDS
============= =============
...@@ -33,35 +33,31 @@ LINK COMMANDS ...@@ -33,35 +33,31 @@ LINK COMMANDS
DESCRIPTION DESCRIPTION
=========== ===========
**bpftool link { show | list }** [*LINK*] **bpftool link { show | list }** [*LINK*]
Show information about active links. If *LINK* is Show information about active links. If *LINK* is specified show
specified show information only about given link, information only about given link, otherwise list all links currently
otherwise list all links currently active on the system. active on the system.
Output will start with link ID followed by link type and Output will start with link ID followed by link type and zero or more named
zero or more named attributes, some of which depend on type attributes, some of which depend on type of link.
of link.
Since Linux 5.8 bpftool is able to discover information about Since Linux 5.8 bpftool is able to discover information about processes
processes that hold open file descriptors (FDs) against BPF that hold open file descriptors (FDs) against BPF links. On such kernels
links. On such kernels bpftool will automatically emit this bpftool will automatically emit this information as well.
information as well.
**bpftool link pin** *LINK* *FILE* **bpftool link pin** *LINK* *FILE*
Pin link *LINK* as *FILE*. Pin link *LINK* as *FILE*.
Note: *FILE* must be located in *bpffs* mount. It must not Note: *FILE* must be located in *bpffs* mount. It must not contain a dot
contain a dot character ('.'), which is reserved for future character ('.'), which is reserved for future extensions of *bpffs*.
extensions of *bpffs*.
**bpftool link detach** *LINK* **bpftool link detach** *LINK*
Force-detach link *LINK*. BPF link and its underlying BPF Force-detach link *LINK*. BPF link and its underlying BPF program will stay
program will stay valid, but they will be detached from the valid, but they will be detached from the respective BPF hook and BPF link
respective BPF hook and BPF link will transition into will transition into a defunct state until last open file descriptor for
a defunct state until last open file descriptor for that that link is closed.
link is closed.
**bpftool link help** **bpftool link help**
Print short help message. Print short help message.
OPTIONS OPTIONS
...@@ -69,12 +65,11 @@ OPTIONS ...@@ -69,12 +65,11 @@ OPTIONS
.. include:: common_options.rst .. include:: common_options.rst
-f, --bpffs -f, --bpffs
When showing BPF links, show file names of pinned When showing BPF links, show file names of pinned links.
links.
-n, --nomount -n, --nomount
Do not automatically attempt to mount any virtual file system Do not automatically attempt to mount any virtual file system (such as
(such as tracefs or BPF virtual file system) when necessary. tracefs or BPF virtual file system) when necessary.
EXAMPLES EXAMPLES
======== ========
......
...@@ -14,13 +14,13 @@ tool for inspection and simple manipulation of eBPF maps ...@@ -14,13 +14,13 @@ tool for inspection and simple manipulation of eBPF maps
SYNOPSIS SYNOPSIS
======== ========
**bpftool** [*OPTIONS*] **map** *COMMAND* **bpftool** [*OPTIONS*] **map** *COMMAND*
*OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } | { **-n** | **--nomount** } } *OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } | { **-n** | **--nomount** } }
*COMMANDS* := *COMMANDS* :=
{ **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** | { **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** |
**delete** | **pin** | **help** } **delete** | **pin** | **help** }
MAP COMMANDS MAP COMMANDS
============= =============
...@@ -59,121 +59,115 @@ MAP COMMANDS ...@@ -59,121 +59,115 @@ MAP COMMANDS
DESCRIPTION DESCRIPTION
=========== ===========
**bpftool map { show | list }** [*MAP*] **bpftool map { show | list }** [*MAP*]
Show information about loaded maps. If *MAP* is specified Show information about loaded maps. If *MAP* is specified show information
show information only about given maps, otherwise list all only about given maps, otherwise list all maps currently loaded on the
maps currently loaded on the system. In case of **name**, system. In case of **name**, *MAP* may match several maps which will all
*MAP* may match several maps which will all be shown. be shown.
Output will start with map ID followed by map type and Output will start with map ID followed by map type and zero or more named
zero or more named attributes (depending on kernel version). attributes (depending on kernel version).
Since Linux 5.8 bpftool is able to discover information about Since Linux 5.8 bpftool is able to discover information about processes
processes that hold open file descriptors (FDs) against BPF that hold open file descriptors (FDs) against BPF maps. On such kernels
maps. On such kernels bpftool will automatically emit this bpftool will automatically emit this information as well.
information as well.
**bpftool map create** *FILE* **type** *TYPE* **key** *KEY_SIZE* **value** *VALUE_SIZE* **entries** *MAX_ENTRIES* **name** *NAME* [**flags** *FLAGS*] [**inner_map** *MAP*] [**offload_dev** *NAME*] **bpftool map create** *FILE* **type** *TYPE* **key** *KEY_SIZE* **value** *VALUE_SIZE* **entries** *MAX_ENTRIES* **name** *NAME* [**flags** *FLAGS*] [**inner_map** *MAP*] [**offload_dev** *NAME*]
Create a new map with given parameters and pin it to *bpffs* Create a new map with given parameters and pin it to *bpffs* as *FILE*.
as *FILE*.
*FLAGS* should be an integer which is the combination of *FLAGS* should be an integer which is the combination of desired flags,
desired flags, e.g. 1024 for **BPF_F_MMAPABLE** (see bpf.h e.g. 1024 for **BPF_F_MMAPABLE** (see bpf.h UAPI header for existing
UAPI header for existing flags). flags).
To create maps of type array-of-maps or hash-of-maps, the To create maps of type array-of-maps or hash-of-maps, the **inner_map**
**inner_map** keyword must be used to pass an inner map. The keyword must be used to pass an inner map. The kernel needs it to collect
kernel needs it to collect metadata related to the inner maps metadata related to the inner maps that the new map will work with.
that the new map will work with.
Keyword **offload_dev** expects a network interface name, Keyword **offload_dev** expects a network interface name, and is used to
and is used to request hardware offload for the map. request hardware offload for the map.
**bpftool map dump** *MAP* **bpftool map dump** *MAP*
Dump all entries in a given *MAP*. In case of **name**, Dump all entries in a given *MAP*. In case of **name**, *MAP* may match
*MAP* may match several maps which will all be dumped. several maps which will all be dumped.
**bpftool map update** *MAP* [**key** *DATA*] [**value** *VALUE*] [*UPDATE_FLAGS*] **bpftool map update** *MAP* [**key** *DATA*] [**value** *VALUE*] [*UPDATE_FLAGS*]
Update map entry for a given *KEY*. Update map entry for a given *KEY*.
*UPDATE_FLAGS* can be one of: **any** update existing entry *UPDATE_FLAGS* can be one of: **any** update existing entry or add if
or add if doesn't exit; **exist** update only if entry already doesn't exit; **exist** update only if entry already exists; **noexist**
exists; **noexist** update only if entry doesn't exist. update only if entry doesn't exist.
If the **hex** keyword is provided in front of the bytes If the **hex** keyword is provided in front of the bytes sequence, the
sequence, the bytes are parsed as hexadecimal values, even if bytes are parsed as hexadecimal values, even if no "0x" prefix is added. If
no "0x" prefix is added. If the keyword is not provided, then the keyword is not provided, then the bytes are parsed as decimal values,
the bytes are parsed as decimal values, unless a "0x" prefix unless a "0x" prefix (for hexadecimal) or a "0" prefix (for octal) is
(for hexadecimal) or a "0" prefix (for octal) is provided. provided.
**bpftool map lookup** *MAP* [**key** *DATA*] **bpftool map lookup** *MAP* [**key** *DATA*]
Lookup **key** in the map. Lookup **key** in the map.
**bpftool map getnext** *MAP* [**key** *DATA*] **bpftool map getnext** *MAP* [**key** *DATA*]
Get next key. If *key* is not specified, get first key. Get next key. If *key* is not specified, get first key.
**bpftool map delete** *MAP* **key** *DATA* **bpftool map delete** *MAP* **key** *DATA*
Remove entry from the map. Remove entry from the map.
**bpftool map pin** *MAP* *FILE* **bpftool map pin** *MAP* *FILE*
Pin map *MAP* as *FILE*. Pin map *MAP* as *FILE*.
Note: *FILE* must be located in *bpffs* mount. It must not Note: *FILE* must be located in *bpffs* mount. It must not contain a dot
contain a dot character ('.'), which is reserved for future character ('.'), which is reserved for future extensions of *bpffs*.
extensions of *bpffs*.
**bpftool** **map event_pipe** *MAP* [**cpu** *N* **index** *M*] **bpftool** **map event_pipe** *MAP* [**cpu** *N* **index** *M*]
Read events from a **BPF_MAP_TYPE_PERF_EVENT_ARRAY** map. Read events from a **BPF_MAP_TYPE_PERF_EVENT_ARRAY** map.
Install perf rings into a perf event array map and dump Install perf rings into a perf event array map and dump output of any
output of any **bpf_perf_event_output**\ () call in the kernel. **bpf_perf_event_output**\ () call in the kernel. By default read the
By default read the number of CPUs on the system and number of CPUs on the system and install perf ring for each CPU in the
install perf ring for each CPU in the corresponding index corresponding index in the array.
in the array.
If **cpu** and **index** are specified, install perf ring If **cpu** and **index** are specified, install perf ring for given **cpu**
for given **cpu** at **index** in the array (single ring). at **index** in the array (single ring).
Note that installing a perf ring into an array will silently Note that installing a perf ring into an array will silently replace any
replace any existing ring. Any other application will stop existing ring. Any other application will stop receiving events if it
receiving events if it installed its rings earlier. installed its rings earlier.
**bpftool map peek** *MAP* **bpftool map peek** *MAP*
Peek next value in the queue or stack. Peek next value in the queue or stack.
**bpftool map push** *MAP* **value** *VALUE* **bpftool map push** *MAP* **value** *VALUE*
Push *VALUE* onto the stack. Push *VALUE* onto the stack.
**bpftool map pop** *MAP* **bpftool map pop** *MAP*
Pop and print value from the stack. Pop and print value from the stack.
**bpftool map enqueue** *MAP* **value** *VALUE* **bpftool map enqueue** *MAP* **value** *VALUE*
Enqueue *VALUE* into the queue. Enqueue *VALUE* into the queue.
**bpftool map dequeue** *MAP* **bpftool map dequeue** *MAP*
Dequeue and print value from the queue. Dequeue and print value from the queue.
**bpftool map freeze** *MAP* **bpftool map freeze** *MAP*
Freeze the map as read-only from user space. Entries from a Freeze the map as read-only from user space. Entries from a frozen map can
frozen map can not longer be updated or deleted with the not longer be updated or deleted with the **bpf**\ () system call. This
**bpf**\ () system call. This operation is not reversible, operation is not reversible, and the map remains immutable from user space
and the map remains immutable from user space until its until its destruction. However, read and write permissions for BPF programs
destruction. However, read and write permissions for BPF to the map remain unchanged.
programs to the map remain unchanged.
**bpftool map help** **bpftool map help**
Print short help message. Print short help message.
OPTIONS OPTIONS
======= =======
.. include:: common_options.rst .. include:: common_options.rst
-f, --bpffs -f, --bpffs
Show file names of pinned maps. Show file names of pinned maps.
-n, --nomount -n, --nomount
Do not automatically attempt to mount any virtual file system Do not automatically attempt to mount any virtual file system (such as
(such as tracefs or BPF virtual file system) when necessary. tracefs or BPF virtual file system) when necessary.
EXAMPLES EXAMPLES
======== ========
......
...@@ -14,12 +14,11 @@ tool for inspection of networking related bpf prog attachments ...@@ -14,12 +14,11 @@ tool for inspection of networking related bpf prog attachments
SYNOPSIS SYNOPSIS
======== ========
**bpftool** [*OPTIONS*] **net** *COMMAND* **bpftool** [*OPTIONS*] **net** *COMMAND*
*OPTIONS* := { |COMMON_OPTIONS| } *OPTIONS* := { |COMMON_OPTIONS| }
*COMMANDS* := *COMMANDS* := { **show** | **list** | **attach** | **detach** | **help** }
{ **show** | **list** | **attach** | **detach** | **help** }
NET COMMANDS NET COMMANDS
============ ============
...@@ -34,37 +33,36 @@ NET COMMANDS ...@@ -34,37 +33,36 @@ NET COMMANDS
DESCRIPTION DESCRIPTION
=========== ===========
**bpftool net { show | list }** [ **dev** *NAME* ] **bpftool net { show | list }** [ **dev** *NAME* ]
List bpf program attachments in the kernel networking subsystem. List bpf program attachments in the kernel networking subsystem.
Currently, device driver xdp attachments, tcx, netkit and old-style tc Currently, device driver xdp attachments, tcx, netkit and old-style tc
classifier/action attachments, flow_dissector as well as netfilter classifier/action attachments, flow_dissector as well as netfilter
attachments are implemented, i.e., for attachments are implemented, i.e., for program types **BPF_PROG_TYPE_XDP**,
program types **BPF_PROG_TYPE_XDP**, **BPF_PROG_TYPE_SCHED_CLS**, **BPF_PROG_TYPE_SCHED_CLS**, **BPF_PROG_TYPE_SCHED_ACT**,
**BPF_PROG_TYPE_SCHED_ACT**, **BPF_PROG_TYPE_FLOW_DISSECTOR**, **BPF_PROG_TYPE_FLOW_DISSECTOR**, **BPF_PROG_TYPE_NETFILTER**.
**BPF_PROG_TYPE_NETFILTER**.
For programs attached to a particular cgroup, e.g., For programs attached to a particular cgroup, e.g.,
**BPF_PROG_TYPE_CGROUP_SKB**, **BPF_PROG_TYPE_CGROUP_SOCK**, **BPF_PROG_TYPE_CGROUP_SKB**, **BPF_PROG_TYPE_CGROUP_SOCK**,
**BPF_PROG_TYPE_SOCK_OPS** and **BPF_PROG_TYPE_CGROUP_SOCK_ADDR**, **BPF_PROG_TYPE_SOCK_OPS** and **BPF_PROG_TYPE_CGROUP_SOCK_ADDR**, users
users can use **bpftool cgroup** to dump cgroup attachments. can use **bpftool cgroup** to dump cgroup attachments. For sk_{filter, skb,
For sk_{filter, skb, msg, reuseport} and lwt/seg6 msg, reuseport} and lwt/seg6 bpf programs, users should consult other
bpf programs, users should consult other tools, e.g., iproute2. tools, e.g., iproute2.
The current output will start with all xdp program attachments, followed by The current output will start with all xdp program attachments, followed by
all tcx, netkit, then tc class/qdisc bpf program attachments, then flow_dissector all tcx, netkit, then tc class/qdisc bpf program attachments, then
and finally netfilter programs. Both xdp programs and tcx/netkit/tc programs are flow_dissector and finally netfilter programs. Both xdp programs and
ordered based on ifindex number. If multiple bpf programs attached tcx/netkit/tc programs are ordered based on ifindex number. If multiple bpf
to the same networking device through **tc**, the order will be first programs attached to the same networking device through **tc**, the order
all bpf programs attached to tcx, netkit, then tc classes, then all bpf programs will be first all bpf programs attached to tcx, netkit, then tc classes,
attached to non clsact qdiscs, and finally all bpf programs attached then all bpf programs attached to non clsact qdiscs, and finally all bpf
to root and clsact qdisc. programs attached to root and clsact qdisc.
**bpftool** **net attach** *ATTACH_TYPE* *PROG* **dev** *NAME* [ **overwrite** ] **bpftool** **net attach** *ATTACH_TYPE* *PROG* **dev** *NAME* [ **overwrite** ]
Attach bpf program *PROG* to network interface *NAME* with Attach bpf program *PROG* to network interface *NAME* with type specified
type specified by *ATTACH_TYPE*. Previously attached bpf program by *ATTACH_TYPE*. Previously attached bpf program can be replaced by the
can be replaced by the command used with **overwrite** option. command used with **overwrite** option. Currently, only XDP-related modes
Currently, only XDP-related modes are supported for *ATTACH_TYPE*. are supported for *ATTACH_TYPE*.
*ATTACH_TYPE* can be of: *ATTACH_TYPE* can be of:
**xdp** - try native XDP and fallback to generic XDP if NIC driver does not support it; **xdp** - try native XDP and fallback to generic XDP if NIC driver does not support it;
...@@ -72,18 +70,18 @@ DESCRIPTION ...@@ -72,18 +70,18 @@ DESCRIPTION
**xdpdrv** - Native XDP. runs earliest point in driver's receive path; **xdpdrv** - Native XDP. runs earliest point in driver's receive path;
**xdpoffload** - Offload XDP. runs directly on NIC on each packet reception; **xdpoffload** - Offload XDP. runs directly on NIC on each packet reception;
**bpftool** **net detach** *ATTACH_TYPE* **dev** *NAME* **bpftool** **net detach** *ATTACH_TYPE* **dev** *NAME*
Detach bpf program attached to network interface *NAME* with Detach bpf program attached to network interface *NAME* with type specified
type specified by *ATTACH_TYPE*. To detach bpf program, same by *ATTACH_TYPE*. To detach bpf program, same *ATTACH_TYPE* previously used
*ATTACH_TYPE* previously used for attach must be specified. for attach must be specified. Currently, only XDP-related modes are
Currently, only XDP-related modes are supported for *ATTACH_TYPE*. supported for *ATTACH_TYPE*.
**bpftool net help** **bpftool net help**
Print short help message. Print short help message.
OPTIONS OPTIONS
======= =======
.. include:: common_options.rst .. include:: common_options.rst
EXAMPLES EXAMPLES
======== ========
......
...@@ -14,12 +14,12 @@ tool for inspection of perf related bpf prog attachments ...@@ -14,12 +14,12 @@ tool for inspection of perf related bpf prog attachments
SYNOPSIS SYNOPSIS
======== ========
**bpftool** [*OPTIONS*] **perf** *COMMAND* **bpftool** [*OPTIONS*] **perf** *COMMAND*
*OPTIONS* := { |COMMON_OPTIONS| } *OPTIONS* := { |COMMON_OPTIONS| }
*COMMANDS* := *COMMANDS* :=
{ **show** | **list** | **help** } { **show** | **list** | **help** }
PERF COMMANDS PERF COMMANDS
============= =============
...@@ -29,22 +29,22 @@ PERF COMMANDS ...@@ -29,22 +29,22 @@ PERF COMMANDS
DESCRIPTION DESCRIPTION
=========== ===========
**bpftool perf { show | list }** **bpftool perf { show | list }**
List all raw_tracepoint, tracepoint, kprobe attachment in the system. List all raw_tracepoint, tracepoint, kprobe attachment in the system.
Output will start with process id and file descriptor in that process, Output will start with process id and file descriptor in that process,
followed by bpf program id, attachment information, and attachment point. followed by bpf program id, attachment information, and attachment point.
The attachment point for raw_tracepoint/tracepoint is the trace probe name. The attachment point for raw_tracepoint/tracepoint is the trace probe name.
The attachment point for k[ret]probe is either symbol name and offset, The attachment point for k[ret]probe is either symbol name and offset, or a
or a kernel virtual address. kernel virtual address. The attachment point for u[ret]probe is the file
The attachment point for u[ret]probe is the file name and the file offset. name and the file offset.
**bpftool perf help** **bpftool perf help**
Print short help message. Print short help message.
OPTIONS OPTIONS
======= =======
.. include:: common_options.rst .. include:: common_options.rst
EXAMPLES EXAMPLES
======== ========
......
...@@ -14,15 +14,15 @@ tool for inspection and simple manipulation of eBPF progs ...@@ -14,15 +14,15 @@ tool for inspection and simple manipulation of eBPF progs
SYNOPSIS SYNOPSIS
======== ========
**bpftool** [*OPTIONS*] **prog** *COMMAND* **bpftool** [*OPTIONS*] **prog** *COMMAND*
*OPTIONS* := { |COMMON_OPTIONS| | *OPTIONS* := { |COMMON_OPTIONS| |
{ **-f** | **--bpffs** } | { **-m** | **--mapcompat** } | { **-n** | **--nomount** } | { **-f** | **--bpffs** } | { **-m** | **--mapcompat** } | { **-n** | **--nomount** } |
{ **-L** | **--use-loader** } } { **-L** | **--use-loader** } }
*COMMANDS* := *COMMANDS* :=
{ **show** | **list** | **dump xlated** | **dump jited** | **pin** | **load** | { **show** | **list** | **dump xlated** | **dump jited** | **pin** | **load** |
**loadall** | **help** } **loadall** | **help** }
PROG COMMANDS PROG COMMANDS
============= =============
...@@ -67,197 +67,173 @@ PROG COMMANDS ...@@ -67,197 +67,173 @@ PROG COMMANDS
DESCRIPTION DESCRIPTION
=========== ===========
**bpftool prog { show | list }** [*PROG*] **bpftool prog { show | list }** [*PROG*]
Show information about loaded programs. If *PROG* is Show information about loaded programs. If *PROG* is specified show
specified show information only about given programs, information only about given programs, otherwise list all programs
otherwise list all programs currently loaded on the system. currently loaded on the system. In case of **tag** or **name**, *PROG* may
In case of **tag** or **name**, *PROG* may match several match several programs which will all be shown.
programs which will all be shown.
Output will start with program ID followed by program type and zero or more
Output will start with program ID followed by program type and named attributes (depending on kernel version).
zero or more named attributes (depending on kernel version).
Since Linux 5.1 the kernel can collect statistics on BPF programs (such as
Since Linux 5.1 the kernel can collect statistics on BPF the total time spent running the program, and the number of times it was
programs (such as the total time spent running the program, run). If available, bpftool shows such statistics. However, the kernel does
and the number of times it was run). If available, bpftool not collect them by defaults, as it slightly impacts performance on each
shows such statistics. However, the kernel does not collect program run. Activation or deactivation of the feature is performed via the
them by defaults, as it slightly impacts performance on each **kernel.bpf_stats_enabled** sysctl knob.
program run. Activation or deactivation of the feature is
performed via the **kernel.bpf_stats_enabled** sysctl knob. Since Linux 5.8 bpftool is able to discover information about processes
that hold open file descriptors (FDs) against BPF programs. On such kernels
Since Linux 5.8 bpftool is able to discover information about bpftool will automatically emit this information as well.
processes that hold open file descriptors (FDs) against BPF
programs. On such kernels bpftool will automatically emit this **bpftool prog dump xlated** *PROG* [{ **file** *FILE* | [**opcodes**] [**linum**] [**visual**] }]
information as well. Dump eBPF instructions of the programs from the kernel. By default, eBPF
will be disassembled and printed to standard output in human-readable
**bpftool prog dump xlated** *PROG* [{ **file** *FILE* | [**opcodes**] [**linum**] [**visual**] }] format. In this case, **opcodes** controls if raw opcodes should be printed
Dump eBPF instructions of the programs from the kernel. By as well.
default, eBPF will be disassembled and printed to standard
output in human-readable format. In this case, **opcodes** In case of **tag** or **name**, *PROG* may match several programs which
controls if raw opcodes should be printed as well. will all be dumped. However, if **file** or **visual** is specified,
*PROG* must match a single program.
In case of **tag** or **name**, *PROG* may match several
programs which will all be dumped. However, if **file** or If **file** is specified, the binary image will instead be written to
**visual** is specified, *PROG* must match a single program. *FILE*.
If **file** is specified, the binary image will instead be If **visual** is specified, control flow graph (CFG) will be built instead,
written to *FILE*. and eBPF instructions will be presented with CFG in DOT format, on standard
output.
If **visual** is specified, control flow graph (CFG) will be
built instead, and eBPF instructions will be presented with If the programs have line_info available, the source line will be
CFG in DOT format, on standard output. displayed. If **linum** is specified, the filename, line number and line
column will also be displayed.
If the programs have line_info available, the source line will
be displayed. If **linum** is specified, the filename, line **bpftool prog dump jited** *PROG* [{ **file** *FILE* | [**opcodes**] [**linum**] }]
number and line column will also be displayed.
**bpftool prog dump jited** *PROG* [{ **file** *FILE* | [**opcodes**] [**linum**] }]
Dump jited image (host machine code) of the program. Dump jited image (host machine code) of the program.
If *FILE* is specified image will be written to a file, If *FILE* is specified image will be written to a file, otherwise it will
otherwise it will be disassembled and printed to stdout. be disassembled and printed to stdout. *PROG* must match a single program
*PROG* must match a single program when **file** is specified. when **file** is specified.
**opcodes** controls if raw opcodes will be printed. **opcodes** controls if raw opcodes will be printed.
If the prog has line_info available, the source line will If the prog has line_info available, the source line will be displayed. If
be displayed. If **linum** is specified, the filename, line **linum** is specified, the filename, line number and line column will also
number and line column will also be displayed. be displayed.
**bpftool prog pin** *PROG* *FILE* **bpftool prog pin** *PROG* *FILE*
Pin program *PROG* as *FILE*. Pin program *PROG* as *FILE*.
Note: *FILE* must be located in *bpffs* mount. It must not Note: *FILE* must be located in *bpffs* mount. It must not contain a dot
contain a dot character ('.'), which is reserved for future character ('.'), which is reserved for future extensions of *bpffs*.
extensions of *bpffs*.
**bpftool prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** { **idx** *IDX* | **name** *NAME* } *MAP*] [{ **offload_dev** | **xdpmeta_dev** } *NAME*] [**pinmaps** *MAP_DIR*] [**autoattach**]
**bpftool prog { load | loadall }** *OBJ* *PATH* [**type** *TYPE*] [**map** { **idx** *IDX* | **name** *NAME* } *MAP*] [{ **offload_dev** | **xdpmeta_dev** } *NAME*] [**pinmaps** *MAP_DIR*] [**autoattach**] Load bpf program(s) from binary *OBJ* and pin as *PATH*. **bpftool prog
Load bpf program(s) from binary *OBJ* and pin as *PATH*. load** pins only the first program from the *OBJ* as *PATH*. **bpftool prog
**bpftool prog load** pins only the first program from the loadall** pins all programs from the *OBJ* under *PATH* directory. **type**
*OBJ* as *PATH*. **bpftool prog loadall** pins all programs is optional, if not specified program type will be inferred from section
from the *OBJ* under *PATH* directory. names. By default bpftool will create new maps as declared in the ELF
**type** is optional, if not specified program type will be object being loaded. **map** parameter allows for the reuse of existing
inferred from section names. maps. It can be specified multiple times, each time for a different map.
By default bpftool will create new maps as declared in the ELF *IDX* refers to index of the map to be replaced in the ELF file counting
object being loaded. **map** parameter allows for the reuse from 0, while *NAME* allows to replace a map by name. *MAP* specifies the
of existing maps. It can be specified multiple times, each map to use, referring to it by **id** or through a **pinned** file. If
time for a different map. *IDX* refers to index of the map **offload_dev** *NAME* is specified program will be loaded onto given
to be replaced in the ELF file counting from 0, while *NAME* networking device (offload). If **xdpmeta_dev** *NAME* is specified program
allows to replace a map by name. *MAP* specifies the map to will become device-bound without offloading, this facilitates access to XDP
use, referring to it by **id** or through a **pinned** file. metadata. Optional **pinmaps** argument can be provided to pin all maps
If **offload_dev** *NAME* is specified program will be loaded under *MAP_DIR* directory.
onto given networking device (offload).
If **xdpmeta_dev** *NAME* is specified program will become If **autoattach** is specified program will be attached before pin. In that
device-bound without offloading, this facilitates access case, only the link (representing the program attached to its hook) is
to XDP metadata. pinned, not the program as such, so the path won't show in **bpftool prog
Optional **pinmaps** argument can be provided to pin all show -f**, only show in **bpftool link show -f**. Also, this only works
maps under *MAP_DIR* directory. when bpftool (libbpf) is able to infer all necessary information from the
object file, in particular, it's not supported for all program types. If a
If **autoattach** is specified program will be attached program does not support autoattach, bpftool falls back to regular pinning
before pin. In that case, only the link (representing the
program attached to its hook) is pinned, not the program as
such, so the path won't show in **bpftool prog show -f**,
only show in **bpftool link show -f**. Also, this only works
when bpftool (libbpf) is able to infer all necessary
information from the object file, in particular, it's not
supported for all program types. If a program does not
support autoattach, bpftool falls back to regular pinning
for that program instead. for that program instead.
Note: *PATH* must be located in *bpffs* mount. It must not Note: *PATH* must be located in *bpffs* mount. It must not contain a dot
contain a dot character ('.'), which is reserved for future character ('.'), which is reserved for future extensions of *bpffs*.
extensions of *bpffs*.
**bpftool prog attach** *PROG* *ATTACH_TYPE* [*MAP*]
**bpftool prog attach** *PROG* *ATTACH_TYPE* [*MAP*] Attach bpf program *PROG* (with type specified by *ATTACH_TYPE*). Most
Attach bpf program *PROG* (with type specified by *ATTACH_TYPEs* require a *MAP* parameter, with the exception of
*ATTACH_TYPE*). Most *ATTACH_TYPEs* require a *MAP* *flow_dissector* which is attached to current networking name space.
parameter, with the exception of *flow_dissector* which is
attached to current networking name space. **bpftool prog detach** *PROG* *ATTACH_TYPE* [*MAP*]
Detach bpf program *PROG* (with type specified by *ATTACH_TYPE*). Most
**bpftool prog detach** *PROG* *ATTACH_TYPE* [*MAP*] *ATTACH_TYPEs* require a *MAP* parameter, with the exception of
Detach bpf program *PROG* (with type specified by *flow_dissector* which is detached from the current networking name space.
*ATTACH_TYPE*). Most *ATTACH_TYPEs* require a *MAP*
parameter, with the exception of *flow_dissector* which is **bpftool prog tracelog**
detached from the current networking name space. Dump the trace pipe of the system to the console (stdout). Hit <Ctrl+C> to
stop printing. BPF programs can write to this trace pipe at runtime with
**bpftool prog tracelog** the **bpf_trace_printk**\ () helper. This should be used only for debugging
Dump the trace pipe of the system to the console (stdout). purposes. For streaming data from BPF programs to user space, one can use
Hit <Ctrl+C> to stop printing. BPF programs can write to this
trace pipe at runtime with the **bpf_trace_printk**\ () helper.
This should be used only for debugging purposes. For
streaming data from BPF programs to user space, one can use
perf events (see also **bpftool-map**\ (8)). perf events (see also **bpftool-map**\ (8)).
**bpftool prog run** *PROG* **data_in** *FILE* [**data_out** *FILE* [**data_size_out** *L*]] [**ctx_in** *FILE* [**ctx_out** *FILE* [**ctx_size_out** *M*]]] [**repeat** *N*] **bpftool prog run** *PROG* **data_in** *FILE* [**data_out** *FILE* [**data_size_out** *L*]] [**ctx_in** *FILE* [**ctx_out** *FILE* [**ctx_size_out** *M*]]] [**repeat** *N*]
Run BPF program *PROG* in the kernel testing infrastructure Run BPF program *PROG* in the kernel testing infrastructure for BPF,
for BPF, meaning that the program works on the data and meaning that the program works on the data and context provided by the
context provided by the user, and not on actual packets or user, and not on actual packets or monitored functions etc. Return value
monitored functions etc. Return value and duration for the and duration for the test run are printed out to the console.
test run are printed out to the console.
Input data is read from the *FILE* passed with **data_in**. If this *FILE*
Input data is read from the *FILE* passed with **data_in**. is "**-**", input data is read from standard input. Input context, if any,
If this *FILE* is "**-**", input data is read from standard is read from *FILE* passed with **ctx_in**. Again, "**-**" can be used to
input. Input context, if any, is read from *FILE* passed with read from standard input, but only if standard input is not already in use
**ctx_in**. Again, "**-**" can be used to read from standard for input data. If a *FILE* is passed with **data_out**, output data is
input, but only if standard input is not already in use for written to that file. Similarly, output context is written to the *FILE*
input data. If a *FILE* is passed with **data_out**, output passed with **ctx_out**. For both output flows, "**-**" can be used to
data is written to that file. Similarly, output context is print to the standard output (as plain text, or JSON if relevant option was
written to the *FILE* passed with **ctx_out**. For both passed). If output keywords are omitted, output data and context are
output flows, "**-**" can be used to print to the standard discarded. Keywords **data_size_out** and **ctx_size_out** are used to pass
output (as plain text, or JSON if relevant option was the size (in bytes) for the output buffers to the kernel, although the
passed). If output keywords are omitted, output data and default of 32 kB should be more than enough for most cases.
context are discarded. Keywords **data_size_out** and
**ctx_size_out** are used to pass the size (in bytes) for the Keyword **repeat** is used to indicate the number of consecutive runs to
output buffers to the kernel, although the default of 32 kB perform. Note that output data and context printed to files correspond to
should be more than enough for most cases. the last of those runs. The duration printed out at the end of the runs is
an average over all runs performed by the command.
Keyword **repeat** is used to indicate the number of
consecutive runs to perform. Note that output data and Not all program types support test run. Among those which do, not all of
context printed to files correspond to the last of those them can take the **ctx_in**/**ctx_out** arguments. bpftool does not
runs. The duration printed out at the end of the runs is an perform checks on program types.
average over all runs performed by the command.
**bpftool prog profile** *PROG* [**duration** *DURATION*] *METRICs*
Not all program types support test run. Among those which do, Profile *METRICs* for bpf program *PROG* for *DURATION* seconds or until
not all of them can take the **ctx_in**/**ctx_out** user hits <Ctrl+C>. *DURATION* is optional. If *DURATION* is not specified,
arguments. bpftool does not perform checks on program types. the profiling will run up to **UINT_MAX** seconds.
**bpftool prog profile** *PROG* [**duration** *DURATION*] *METRICs* **bpftool prog help**
Profile *METRICs* for bpf program *PROG* for *DURATION*
seconds or until user hits <Ctrl+C>. *DURATION* is optional.
If *DURATION* is not specified, the profiling will run up to
**UINT_MAX** seconds.
**bpftool prog help**
Print short help message. Print short help message.
OPTIONS OPTIONS
======= =======
.. include:: common_options.rst .. include:: common_options.rst
-f, --bpffs -f, --bpffs
When showing BPF programs, show file names of pinned When showing BPF programs, show file names of pinned programs.
programs.
-m, --mapcompat -m, --mapcompat
Allow loading maps with unknown map definitions. Allow loading maps with unknown map definitions.
-n, --nomount -n, --nomount
Do not automatically attempt to mount any virtual file system Do not automatically attempt to mount any virtual file system (such as
(such as tracefs or BPF virtual file system) when necessary. tracefs or BPF virtual file system) when necessary.
-L, --use-loader -L, --use-loader
Load program as a "loader" program. This is useful to debug Load program as a "loader" program. This is useful to debug the generation
the generation of such programs. When this option is in of such programs. When this option is in use, bpftool attempts to load the
use, bpftool attempts to load the programs from the object programs from the object file into the kernel, but does not pin them
file into the kernel, but does not pin them (therefore, the (therefore, the *PATH* must not be provided).
*PATH* must not be provided).
When combined with the **-d**\ \|\ **--debug** option, additional debug
When combined with the **-d**\ \|\ **--debug** option, messages are generated, and the execution of the loader program will use
additional debug messages are generated, and the execution the **bpf_trace_printk**\ () helper to log each step of loading BTF,
of the loader program will use the **bpf_trace_printk**\ () creating the maps, and loading the programs (see **bpftool prog tracelog**
helper to log each step of loading BTF, creating the maps, as a way to dump those messages).
and loading the programs (see **bpftool prog tracelog** as
a way to dump those messages).
EXAMPLES EXAMPLES
======== ========
......
...@@ -14,12 +14,12 @@ tool to register/unregister/introspect BPF struct_ops ...@@ -14,12 +14,12 @@ tool to register/unregister/introspect BPF struct_ops
SYNOPSIS SYNOPSIS
======== ========
**bpftool** [*OPTIONS*] **struct_ops** *COMMAND* **bpftool** [*OPTIONS*] **struct_ops** *COMMAND*
*OPTIONS* := { |COMMON_OPTIONS| } *OPTIONS* := { |COMMON_OPTIONS| }
*COMMANDS* := *COMMANDS* :=
{ **show** | **list** | **dump** | **register** | **unregister** | **help** } { **show** | **list** | **dump** | **register** | **unregister** | **help** }
STRUCT_OPS COMMANDS STRUCT_OPS COMMANDS
=================== ===================
...@@ -36,39 +36,38 @@ STRUCT_OPS COMMANDS ...@@ -36,39 +36,38 @@ STRUCT_OPS COMMANDS
DESCRIPTION DESCRIPTION
=========== ===========
**bpftool struct_ops { show | list }** [*STRUCT_OPS_MAP*] **bpftool struct_ops { show | list }** [*STRUCT_OPS_MAP*]
Show brief information about the struct_ops in the system. Show brief information about the struct_ops in the system. If
If *STRUCT_OPS_MAP* is specified, it shows information only *STRUCT_OPS_MAP* is specified, it shows information only for the given
for the given struct_ops. Otherwise, it lists all struct_ops struct_ops. Otherwise, it lists all struct_ops currently existing in the
currently existing in the system. system.
Output will start with struct_ops map ID, followed by its map Output will start with struct_ops map ID, followed by its map name and its
name and its struct_ops's kernel type. struct_ops's kernel type.
**bpftool struct_ops dump** [*STRUCT_OPS_MAP*] **bpftool struct_ops dump** [*STRUCT_OPS_MAP*]
Dump details information about the struct_ops in the system. Dump details information about the struct_ops in the system. If
If *STRUCT_OPS_MAP* is specified, it dumps information only *STRUCT_OPS_MAP* is specified, it dumps information only for the given
for the given struct_ops. Otherwise, it dumps all struct_ops struct_ops. Otherwise, it dumps all struct_ops currently existing in the
currently existing in the system. system.
**bpftool struct_ops register** *OBJ* [*LINK_DIR*] **bpftool struct_ops register** *OBJ* [*LINK_DIR*]
Register bpf struct_ops from *OBJ*. All struct_ops under Register bpf struct_ops from *OBJ*. All struct_ops under the ELF section
the ELF section ".struct_ops" and ".struct_ops.link" will ".struct_ops" and ".struct_ops.link" will be registered to its kernel
be registered to its kernel subsystem. For each subsystem. For each struct_ops in the ".struct_ops.link" section, a link
struct_ops in the ".struct_ops.link" section, a link will be created. You can give *LINK_DIR* to provide a directory path where
will be created. You can give *LINK_DIR* to provide a these links will be pinned with the same name as their corresponding map
directory path where these links will be pinned with the name.
same name as their corresponding map name.
**bpftool struct_ops unregister** *STRUCT_OPS_MAP*
**bpftool struct_ops unregister** *STRUCT_OPS_MAP*
Unregister the *STRUCT_OPS_MAP* from the kernel subsystem. Unregister the *STRUCT_OPS_MAP* from the kernel subsystem.
**bpftool struct_ops help** **bpftool struct_ops help**
Print short help message. Print short help message.
OPTIONS OPTIONS
======= =======
.. include:: common_options.rst .. include:: common_options.rst
EXAMPLES EXAMPLES
======== ========
......
...@@ -14,57 +14,57 @@ tool for inspection and simple manipulation of eBPF programs and maps ...@@ -14,57 +14,57 @@ tool for inspection and simple manipulation of eBPF programs and maps
SYNOPSIS SYNOPSIS
======== ========
**bpftool** [*OPTIONS*] *OBJECT* { *COMMAND* | **help** } **bpftool** [*OPTIONS*] *OBJECT* { *COMMAND* | **help** }
**bpftool** **batch file** *FILE* **bpftool** **batch file** *FILE*
**bpftool** **version** **bpftool** **version**
*OBJECT* := { **map** | **prog** | **link** | **cgroup** | **perf** | **net** | **feature** | *OBJECT* := { **map** | **prog** | **link** | **cgroup** | **perf** | **net** | **feature** |
**btf** | **gen** | **struct_ops** | **iter** } **btf** | **gen** | **struct_ops** | **iter** }
*OPTIONS* := { { **-V** | **--version** } | |COMMON_OPTIONS| } *OPTIONS* := { { **-V** | **--version** } | |COMMON_OPTIONS| }
*MAP-COMMANDS* := *MAP-COMMANDS* :=
{ **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** | { **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** |
**delete** | **pin** | **event_pipe** | **help** } **delete** | **pin** | **event_pipe** | **help** }
*PROG-COMMANDS* := { **show** | **list** | **dump jited** | **dump xlated** | **pin** | *PROG-COMMANDS* := { **show** | **list** | **dump jited** | **dump xlated** | **pin** |
**load** | **attach** | **detach** | **help** } **load** | **attach** | **detach** | **help** }
*LINK-COMMANDS* := { **show** | **list** | **pin** | **detach** | **help** } *LINK-COMMANDS* := { **show** | **list** | **pin** | **detach** | **help** }
*CGROUP-COMMANDS* := { **show** | **list** | **attach** | **detach** | **help** } *CGROUP-COMMANDS* := { **show** | **list** | **attach** | **detach** | **help** }
*PERF-COMMANDS* := { **show** | **list** | **help** } *PERF-COMMANDS* := { **show** | **list** | **help** }
*NET-COMMANDS* := { **show** | **list** | **help** } *NET-COMMANDS* := { **show** | **list** | **help** }
*FEATURE-COMMANDS* := { **probe** | **help** } *FEATURE-COMMANDS* := { **probe** | **help** }
*BTF-COMMANDS* := { **show** | **list** | **dump** | **help** } *BTF-COMMANDS* := { **show** | **list** | **dump** | **help** }
*GEN-COMMANDS* := { **object** | **skeleton** | **min_core_btf** | **help** } *GEN-COMMANDS* := { **object** | **skeleton** | **min_core_btf** | **help** }
*STRUCT-OPS-COMMANDS* := { **show** | **list** | **dump** | **register** | **unregister** | **help** } *STRUCT-OPS-COMMANDS* := { **show** | **list** | **dump** | **register** | **unregister** | **help** }
*ITER-COMMANDS* := { **pin** | **help** } *ITER-COMMANDS* := { **pin** | **help** }
DESCRIPTION DESCRIPTION
=========== ===========
*bpftool* allows for inspection and simple modification of BPF objects *bpftool* allows for inspection and simple modification of BPF objects on the
on the system. system.
Note that format of the output of all tools is not guaranteed to be Note that format of the output of all tools is not guaranteed to be stable and
stable and should not be depended upon. should not be depended upon.
OPTIONS OPTIONS
======= =======
.. include:: common_options.rst .. include:: common_options.rst
-m, --mapcompat -m, --mapcompat
Allow loading maps with unknown map definitions. Allow loading maps with unknown map definitions.
-n, --nomount -n, --nomount
Do not automatically attempt to mount any virtual file system Do not automatically attempt to mount any virtual file system (such as
(such as tracefs or BPF virtual file system) when necessary. tracefs or BPF virtual file system) when necessary.
...@@ -4,22 +4,20 @@ ...@@ -4,22 +4,20 @@
Print short help message (similar to **bpftool help**). Print short help message (similar to **bpftool help**).
-V, --version -V, --version
Print bpftool's version number (similar to **bpftool version**), the Print bpftool's version number (similar to **bpftool version**), the number
number of the libbpf version in use, and optional features that were of the libbpf version in use, and optional features that were included when
included when bpftool was compiled. Optional features include linking bpftool was compiled. Optional features include linking against LLVM or
against LLVM or libbfd to provide the disassembler for JIT-ted libbfd to provide the disassembler for JIT-ted programs (**bpftool prog
programs (**bpftool prog dump jited**) and usage of BPF skeletons dump jited**) and usage of BPF skeletons (some features like **bpftool prog
(some features like **bpftool prog profile** or showing pids profile** or showing pids associated to BPF objects may rely on it).
associated to BPF objects may rely on it).
-j, --json -j, --json
Generate JSON output. For commands that cannot produce JSON, this Generate JSON output. For commands that cannot produce JSON, this option
option has no effect. has no effect.
-p, --pretty -p, --pretty
Generate human-readable JSON output. Implies **-j**. Generate human-readable JSON output. Implies **-j**.
-d, --debug -d, --debug
Print all logs available, even debug-level information. This includes Print all logs available, even debug-level information. This includes logs
logs from libbpf as well as from the verifier, when attempting to from libbpf as well as from the verifier, when attempting to load programs.
load programs.
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment