linux/tools/bpf/bpftool/Documentation, branch master

bpftool: add missing fsession to the usage and docs of bpftool

2026-04-12T19:42:38Z

Add the fsession attach type to the usage of bpftool in do_help(). Meanwhile, add it to the bash-completion and bpftool-prog.rst too. Acked-by: Leon Hwang Acked-by: Quentin Monnet Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20260412060346.142007-4-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov

bpftool: Support merging multiple module BTFs in btf dump

2026-03-05T23:03:02Z

Add support for specifying multiple file sources in 'bpftool btf dump' to generate a single C header containing types from vmlinux plus multiple kernel modules: bpftool btf dump file /sys/kernel/btf/mod1 file /sys/kernel/btf/mod2 format c This is useful for BPF programs that need to access types defined in kernel modules. Previously this required a separate bpftool invocation for each module, producing separate headers that could not be combined due to overlapping vmlinux type definitions. The implementation collects all file paths, then for the multi-file case creates an empty split BTF on the vmlinux base and iteratively merges each module's types into it via btf__add_btf(). The single-file code path is preserved exactly to avoid any regression risk. Auto-detection of vmlinux as the base BTF from sysfs paths works as before. If vmlinux itself appears in the file list it is skipped with a warning since its types are already provided by the base. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Josef Bacik Signed-off-by: Andrii Nakryiko Reviewed-by: Alan Maguire Link: https://lore.kernel.org/bpf/b19c2760ffe48cec546dd3810d237f8cad20d606.1772657690.git.josef@toxicpanda.com

bpftool: Add 'prepend' option for tcx attach to insert at chain start

2026-01-16T22:51:23Z

Add support for the 'prepend' option when attaching tcx_ingress and tcx_egress programs. This option allows inserting a BPF program at the beginning of the TCX chain instead of appending it at the end. The implementation uses BPF_F_BEFORE flag which automatically inserts the program at the beginning of the chain when no relative reference is specified. This change includes: - Modify do_attach_tcx() to support prepend insertion using BPF_F_BEFORE - Update documentation to describe the new 'prepend' option - Add bash completion support for the 'prepend' option on tcx attach types - Add example usage in the documentation - Add validation to reject 'overwrite' for non-XDP attach types The 'prepend' option is only valid for tcx_ingress and tcx_egress attach types. For XDP attach types, the existing 'overwrite' option remains available. Example usage: # bpftool net attach tcx_ingress name tc_prog dev lo prepend This feature is useful when the order of program execution in the TCX chain matters and users need to ensure certain programs run first. Co-developed-by: Siwan Kim Signed-off-by: Siwan Kim Signed-off-by: Gyutae Bae Signed-off-by: Andrii Nakryiko Reviewed-by: Quentin Monnet Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20260112034516.22723-1-gyutae.opensource@navercorp.com

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf after 6.18-rc5+

2025-11-15T01:43:41Z

Cross-merge BPF and other fixes after downstream PR. Minor conflict in kernel/bpf/helpers.c Signed-off-by: Alexei Starovoitov

bpftool: Recognize insn_array map type

2025-11-06T01:31:25Z

Teach bpftool to recognize instruction array map type. Signed-off-by: Anton Protopopov Acked-by: Quentin Monnet Link: https://lore.kernel.org/r/20251105090410.1250500-3-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov

bpf: add _impl suffix for bpf_stream_vprintk() kfunc

2025-11-05T01:50:25Z

Rename bpf_stream_vprintk() to bpf_stream_vprintk_impl(). This makes bpf_stream_vprintk() follow the already established "_impl" suffix-based naming convention for kfuncs with the bpf_prog_aux argument provided by the verifier implicitly. This convention will be taken advantage of with the upcoming KF_IMPLICIT_ARGS feature to preserve backwards compatibility to BPF programs. Acked-by: Andrii Nakryiko Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20251104-implv2-v3-2-4772b9ae0e06@meta.com Signed-off-by: Alexei Starovoitov Acked-by: Ihor Solodrai

bpftool: Add support for signing BPF programs

2025-09-23T02:17:55Z

Two modes of operation being added: Add two modes of operation: * For prog load, allow signing a program immediately before loading. This is essential for command-line testing and administration. bpftool prog load -S -k -i fentry_test.bpf.o * For gen skeleton, embed a pre-generated signature into the C skeleton file. This supports the use of signed programs in compiled applications. bpftool gen skeleton -S -k -i fentry_test.bpf.o Generation of the loader program and its metadata map is implemented in libbpf (bpf_obj__gen_loader). bpftool generates a skeleton that loads the program and automates the required steps: freezing the map, creating an exclusive map, loading, and running. Users can use standard libbpf APIs directly or integrate loader program generation into their own toolchains. Signed-off-by: KP Singh Acked-by: Quentin Monnet Link: https://lore.kernel.org/r/20250921160120.9711-5-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov

bpftool: Add bpftool-token manpage

2025-08-02T01:03:23Z

Add bpftool-token manpage with information and examples of token-related commands. Suggested-by: Quentin Monnet Reviewed-by: Quentin Monnet Signed-off-by: Tao Chen Link: https://lore.kernel.org/r/20250723144442.1427943-2-chen.dylane@linux.dev Signed-off-by: Alexei Starovoitov

bpftool: Add support for dumping streams

2025-07-04T02:30:07Z

Add support for printing the BPF stream contents of a program in bpftool. The new bpftool prog tracelog command is extended to take stdout and stderr arguments, and then the prog specification. The bpf_prog_stream_read() API added in previous patch is simply reused to grab data and then it is dumped to the respective file. The stdout data is sent to stdout, and stderr is printed to stderr. Cc: Quentin Monnet Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250703204818.925464-12-memxor@gmail.com Signed-off-by: Alexei Starovoitov

bpftool: Add support for custom BTF path in prog load/loadall

2025-05-27T17:31:20Z

This patch exposes the btf_custom_path feature to bpftool, allowing users to specify a custom BTF file when loading BPF programs using prog load or prog loadall commands. The argument 'btf_custom_path' in libbpf is used for those kernels that don't have CONFIG_DEBUG_INFO_BTF enabled but still want to perform CO-RE relocations. Suggested-by: Quentin Monnet Reviewed-by: Quentin Monnet Signed-off-by: Jiayuan Chen Link: https://lore.kernel.org/r/20250516144708.298652-1-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov