| .. | .. |
|---|
| 15 | 15 | *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-f** | **--bpffs** } } |
|---|
| 16 | 16 | |
|---|
| 17 | 17 | *COMMANDS* := |
|---|
| 18 | | - { **show** | **list** | **dump** | **update** | **lookup** | **getnext** | **delete** |
|---|
| 19 | | - | **pin** | **help** } |
|---|
| 18 | + { **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** |
|---|
| 19 | + | **delete** | **pin** | **help** } |
|---|
| 20 | 20 | |
|---|
| 21 | 21 | MAP COMMANDS |
|---|
| 22 | 22 | ============= |
|---|
| 23 | 23 | |
|---|
| 24 | | -| **bpftool** **map { show | list }** [*MAP*] |
|---|
| 24 | +| **bpftool** **map** { **show** | **list** } [*MAP*] |
|---|
| 25 | +| **bpftool** **map create** *FILE* **type** *TYPE* **key** *KEY_SIZE* **value** *VALUE_SIZE* \ |
|---|
| 26 | +| **entries** *MAX_ENTRIES* **name** *NAME* [**flags** *FLAGS*] [**inner_map** *MAP*] \ |
|---|
| 27 | +| [**dev** *NAME*] |
|---|
| 25 | 28 | | **bpftool** **map dump** *MAP* |
|---|
| 26 | | -| **bpftool** **map update** *MAP* **key** *DATA* **value** *VALUE* [*UPDATE_FLAGS*] |
|---|
| 27 | | -| **bpftool** **map lookup** *MAP* **key** *DATA* |
|---|
| 29 | +| **bpftool** **map update** *MAP* [**key** *DATA*] [**value** *VALUE*] [*UPDATE_FLAGS*] |
|---|
| 30 | +| **bpftool** **map lookup** *MAP* [**key** *DATA*] |
|---|
| 28 | 31 | | **bpftool** **map getnext** *MAP* [**key** *DATA*] |
|---|
| 29 | 32 | | **bpftool** **map delete** *MAP* **key** *DATA* |
|---|
| 30 | 33 | | **bpftool** **map pin** *MAP* *FILE* |
|---|
| 31 | 34 | | **bpftool** **map event_pipe** *MAP* [**cpu** *N* **index** *M*] |
|---|
| 35 | +| **bpftool** **map peek** *MAP* |
|---|
| 36 | +| **bpftool** **map push** *MAP* **value** *VALUE* |
|---|
| 37 | +| **bpftool** **map pop** *MAP* |
|---|
| 38 | +| **bpftool** **map enqueue** *MAP* **value** *VALUE* |
|---|
| 39 | +| **bpftool** **map dequeue** *MAP* |
|---|
| 40 | +| **bpftool** **map freeze** *MAP* |
|---|
| 32 | 41 | | **bpftool** **map help** |
|---|
| 33 | 42 | | |
|---|
| 34 | | -| *MAP* := { **id** *MAP_ID* | **pinned** *FILE* } |
|---|
| 43 | +| *MAP* := { **id** *MAP_ID* | **pinned** *FILE* | **name** *MAP_NAME* } |
|---|
| 35 | 44 | | *DATA* := { [**hex**] *BYTES* } |
|---|
| 36 | | -| *PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* } |
|---|
| 45 | +| *PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* | **name** *PROG_NAME* } |
|---|
| 37 | 46 | | *VALUE* := { *DATA* | *MAP* | *PROG* } |
|---|
| 38 | 47 | | *UPDATE_FLAGS* := { **any** | **exist** | **noexist** } |
|---|
| 48 | +| *TYPE* := { **hash** | **array** | **prog_array** | **perf_event_array** | **percpu_hash** |
|---|
| 49 | +| | **percpu_array** | **stack_trace** | **cgroup_array** | **lru_hash** |
|---|
| 50 | +| | **lru_percpu_hash** | **lpm_trie** | **array_of_maps** | **hash_of_maps** |
|---|
| 51 | +| | **devmap** | **devmap_hash** | **sockmap** | **cpumap** | **xskmap** | **sockhash** |
|---|
| 52 | +| | **cgroup_storage** | **reuseport_sockarray** | **percpu_cgroup_storage** |
|---|
| 53 | +| | **queue** | **stack** | **sk_storage** | **struct_ops** | **ringbuf** | **inode_storage** } |
|---|
| 39 | 54 | |
|---|
| 40 | 55 | DESCRIPTION |
|---|
| 41 | 56 | =========== |
|---|
| 42 | 57 | **bpftool map { show | list }** [*MAP*] |
|---|
| 43 | 58 | Show information about loaded maps. If *MAP* is specified |
|---|
| 44 | | - show information only about given map, otherwise list all |
|---|
| 45 | | - maps currently loaded on the system. |
|---|
| 59 | + show information only about given maps, otherwise list all |
|---|
| 60 | + maps currently loaded on the system. In case of **name**, |
|---|
| 61 | + *MAP* may match several maps which will all be shown. |
|---|
| 46 | 62 | |
|---|
| 47 | 63 | Output will start with map ID followed by map type and |
|---|
| 48 | 64 | zero or more named attributes (depending on kernel version). |
|---|
| 49 | 65 | |
|---|
| 50 | | - **bpftool map dump** *MAP* |
|---|
| 51 | | - Dump all entries in a given *MAP*. |
|---|
| 66 | + Since Linux 5.8 bpftool is able to discover information about |
|---|
| 67 | + processes that hold open file descriptors (FDs) against BPF |
|---|
| 68 | + maps. On such kernels bpftool will automatically emit this |
|---|
| 69 | + information as well. |
|---|
| 52 | 70 | |
|---|
| 53 | | - **bpftool map update** *MAP* **key** *DATA* **value** *VALUE* [*UPDATE_FLAGS*] |
|---|
| 71 | + **bpftool map create** *FILE* **type** *TYPE* **key** *KEY_SIZE* **value** *VALUE_SIZE* **entries** *MAX_ENTRIES* **name** *NAME* [**flags** *FLAGS*] [**inner_map** *MAP*] [**dev** *NAME*] |
|---|
| 72 | + Create a new map with given parameters and pin it to *bpffs* |
|---|
| 73 | + as *FILE*. |
|---|
| 74 | + |
|---|
| 75 | + *FLAGS* should be an integer which is the combination of |
|---|
| 76 | + desired flags, e.g. 1024 for **BPF_F_MMAPABLE** (see bpf.h |
|---|
| 77 | + UAPI header for existing flags). |
|---|
| 78 | + |
|---|
| 79 | + To create maps of type array-of-maps or hash-of-maps, the |
|---|
| 80 | + **inner_map** keyword must be used to pass an inner map. The |
|---|
| 81 | + kernel needs it to collect metadata related to the inner maps |
|---|
| 82 | + that the new map will work with. |
|---|
| 83 | + |
|---|
| 84 | + Keyword **dev** expects a network interface name, and is used |
|---|
| 85 | + to request hardware offload for the map. |
|---|
| 86 | + |
|---|
| 87 | + **bpftool map dump** *MAP* |
|---|
| 88 | + Dump all entries in a given *MAP*. In case of **name**, |
|---|
| 89 | + *MAP* may match several maps which will all be dumped. |
|---|
| 90 | + |
|---|
| 91 | + **bpftool map update** *MAP* [**key** *DATA*] [**value** *VALUE*] [*UPDATE_FLAGS*] |
|---|
| 54 | 92 | Update map entry for a given *KEY*. |
|---|
| 55 | 93 | |
|---|
| 56 | 94 | *UPDATE_FLAGS* can be one of: **any** update existing entry |
|---|
| .. | .. |
|---|
| 58 | 96 | exists; **noexist** update only if entry doesn't exist. |
|---|
| 59 | 97 | |
|---|
| 60 | 98 | If the **hex** keyword is provided in front of the bytes |
|---|
| 61 | | - sequence, the bytes are parsed as hexadeximal values, even if |
|---|
| 99 | + sequence, the bytes are parsed as hexadecimal values, even if |
|---|
| 62 | 100 | no "0x" prefix is added. If the keyword is not provided, then |
|---|
| 63 | 101 | the bytes are parsed as decimal values, unless a "0x" prefix |
|---|
| 64 | 102 | (for hexadecimal) or a "0" prefix (for octal) is provided. |
|---|
| 65 | 103 | |
|---|
| 66 | | - **bpftool map lookup** *MAP* **key** *DATA* |
|---|
| 104 | + **bpftool map lookup** *MAP* [**key** *DATA*] |
|---|
| 67 | 105 | Lookup **key** in the map. |
|---|
| 68 | 106 | |
|---|
| 69 | 107 | **bpftool map getnext** *MAP* [**key** *DATA*] |
|---|
| .. | .. |
|---|
| 75 | 113 | **bpftool map pin** *MAP* *FILE* |
|---|
| 76 | 114 | Pin map *MAP* as *FILE*. |
|---|
| 77 | 115 | |
|---|
| 78 | | - Note: *FILE* must be located in *bpffs* mount. |
|---|
| 116 | + Note: *FILE* must be located in *bpffs* mount. It must not |
|---|
| 117 | + contain a dot character ('.'), which is reserved for future |
|---|
| 118 | + extensions of *bpffs*. |
|---|
| 79 | 119 | |
|---|
| 80 | 120 | **bpftool** **map event_pipe** *MAP* [**cpu** *N* **index** *M*] |
|---|
| 81 | | - Read events from a BPF_MAP_TYPE_PERF_EVENT_ARRAY map. |
|---|
| 121 | + Read events from a **BPF_MAP_TYPE_PERF_EVENT_ARRAY** map. |
|---|
| 82 | 122 | |
|---|
| 83 | 123 | Install perf rings into a perf event array map and dump |
|---|
| 84 | | - output of any bpf_perf_event_output() call in the kernel. |
|---|
| 124 | + output of any **bpf_perf_event_output**\ () call in the kernel. |
|---|
| 85 | 125 | By default read the number of CPUs on the system and |
|---|
| 86 | 126 | install perf ring for each CPU in the corresponding index |
|---|
| 87 | 127 | in the array. |
|---|
| .. | .. |
|---|
| 93 | 133 | replace any existing ring. Any other application will stop |
|---|
| 94 | 134 | receiving events if it installed its rings earlier. |
|---|
| 95 | 135 | |
|---|
| 136 | + **bpftool map peek** *MAP* |
|---|
| 137 | + Peek next value in the queue or stack. |
|---|
| 138 | + |
|---|
| 139 | + **bpftool map push** *MAP* **value** *VALUE* |
|---|
| 140 | + Push *VALUE* onto the stack. |
|---|
| 141 | + |
|---|
| 142 | + **bpftool map pop** *MAP* |
|---|
| 143 | + Pop and print value from the stack. |
|---|
| 144 | + |
|---|
| 145 | + **bpftool map enqueue** *MAP* **value** *VALUE* |
|---|
| 146 | + Enqueue *VALUE* into the queue. |
|---|
| 147 | + |
|---|
| 148 | + **bpftool map dequeue** *MAP* |
|---|
| 149 | + Dequeue and print value from the queue. |
|---|
| 150 | + |
|---|
| 151 | + **bpftool map freeze** *MAP* |
|---|
| 152 | + Freeze the map as read-only from user space. Entries from a |
|---|
| 153 | + frozen map can not longer be updated or deleted with the |
|---|
| 154 | + **bpf**\ () system call. This operation is not reversible, |
|---|
| 155 | + and the map remains immutable from user space until its |
|---|
| 156 | + destruction. However, read and write permissions for BPF |
|---|
| 157 | + programs to the map remain unchanged. |
|---|
| 158 | + |
|---|
| 96 | 159 | **bpftool map help** |
|---|
| 97 | 160 | Print short help message. |
|---|
| 98 | 161 | |
|---|
| 99 | 162 | OPTIONS |
|---|
| 100 | 163 | ======= |
|---|
| 101 | | - -h, --help |
|---|
| 102 | | - Print short generic help message (similar to **bpftool help**). |
|---|
| 103 | | - |
|---|
| 104 | | - -v, --version |
|---|
| 105 | | - Print version number (similar to **bpftool version**). |
|---|
| 106 | | - |
|---|
| 107 | | - -j, --json |
|---|
| 108 | | - Generate JSON output. For commands that cannot produce JSON, this |
|---|
| 109 | | - option has no effect. |
|---|
| 110 | | - |
|---|
| 111 | | - -p, --pretty |
|---|
| 112 | | - Generate human-readable JSON output. Implies **-j**. |
|---|
| 164 | + .. include:: common_options.rst |
|---|
| 113 | 165 | |
|---|
| 114 | 166 | -f, --bpffs |
|---|
| 115 | 167 | Show file names of pinned maps. |
|---|
| 116 | 168 | |
|---|
| 169 | + -n, --nomount |
|---|
| 170 | + Do not automatically attempt to mount any virtual file system |
|---|
| 171 | + (such as tracefs or BPF virtual file system) when necessary. |
|---|
| 172 | + |
|---|
| 117 | 173 | EXAMPLES |
|---|
| 118 | 174 | ======== |
|---|
| 119 | 175 | **# bpftool map show** |
|---|
| 176 | + |
|---|
| 120 | 177 | :: |
|---|
| 121 | 178 | |
|---|
| 122 | 179 | 10: hash name some_map flags 0x0 |
|---|
| 123 | | - key 4B value 8B max_entries 2048 memlock 167936B |
|---|
| 180 | + key 4B value 8B max_entries 2048 memlock 167936B |
|---|
| 181 | + pids systemd(1) |
|---|
| 124 | 182 | |
|---|
| 125 | 183 | The following three commands are equivalent: |
|---|
| 126 | 184 | |
|---|
| .. | .. |
|---|
| 137 | 195 | |
|---|
| 138 | 196 | |
|---|
| 139 | 197 | **# bpftool map dump id 10** |
|---|
| 198 | + |
|---|
| 140 | 199 | :: |
|---|
| 141 | 200 | |
|---|
| 142 | 201 | key: 00 01 02 03 value: 00 01 02 03 04 05 06 07 |
|---|
| .. | .. |
|---|
| 144 | 203 | Found 2 elements |
|---|
| 145 | 204 | |
|---|
| 146 | 205 | **# bpftool map getnext id 10 key 0 1 2 3** |
|---|
| 206 | + |
|---|
| 147 | 207 | :: |
|---|
| 148 | 208 | |
|---|
| 149 | 209 | key: |
|---|
| .. | .. |
|---|
| 156 | 216 | | **# bpftool map pin id 10 /sys/fs/bpf/map** |
|---|
| 157 | 217 | | **# bpftool map del pinned /sys/fs/bpf/map key 13 00 07 00** |
|---|
| 158 | 218 | |
|---|
| 159 | | -SEE ALSO |
|---|
| 160 | | -======== |
|---|
| 161 | | - **bpftool**\ (8), **bpftool-prog**\ (8), **bpftool-cgroup**\ (8) |
|---|
| 219 | +Note that map update can also be used in order to change the program references |
|---|
| 220 | +hold by a program array map. This can be used, for example, to change the |
|---|
| 221 | +programs used for tail-call jumps at runtime, without having to reload the |
|---|
| 222 | +entry-point program. Below is an example for this use case: we load a program |
|---|
| 223 | +defining a prog array map, and with a main function that contains a tail call |
|---|
| 224 | +to other programs that can be used either to "process" packets or to "debug" |
|---|
| 225 | +processing. Note that the prog array map MUST be pinned into the BPF virtual |
|---|
| 226 | +file system for the map update to work successfully, as kernel flushes prog |
|---|
| 227 | +array maps when they have no more references from user space (and the update |
|---|
| 228 | +would be lost as soon as bpftool exits). |
|---|
| 229 | + |
|---|
| 230 | +| |
|---|
| 231 | +| **# bpftool prog loadall tail_calls.o /sys/fs/bpf/foo type xdp** |
|---|
| 232 | +| **# bpftool prog --bpffs** |
|---|
| 233 | + |
|---|
| 234 | +:: |
|---|
| 235 | + |
|---|
| 236 | + 545: xdp name main_func tag 674b4b5597193dc3 gpl |
|---|
| 237 | + loaded_at 2018-12-12T15:02:58+0000 uid 0 |
|---|
| 238 | + xlated 240B jited 257B memlock 4096B map_ids 294 |
|---|
| 239 | + pinned /sys/fs/bpf/foo/xdp |
|---|
| 240 | + 546: xdp name bpf_func_process tag e369a529024751fc gpl |
|---|
| 241 | + loaded_at 2018-12-12T15:02:58+0000 uid 0 |
|---|
| 242 | + xlated 200B jited 164B memlock 4096B |
|---|
| 243 | + pinned /sys/fs/bpf/foo/process |
|---|
| 244 | + 547: xdp name bpf_func_debug tag 0b597868bc7f0976 gpl |
|---|
| 245 | + loaded_at 2018-12-12T15:02:58+0000 uid 0 |
|---|
| 246 | + xlated 200B jited 164B memlock 4096B |
|---|
| 247 | + pinned /sys/fs/bpf/foo/debug |
|---|
| 248 | + |
|---|
| 249 | +**# bpftool map** |
|---|
| 250 | + |
|---|
| 251 | +:: |
|---|
| 252 | + |
|---|
| 253 | + 294: prog_array name jmp_table flags 0x0 |
|---|
| 254 | + key 4B value 4B max_entries 1 memlock 4096B |
|---|
| 255 | + owner_prog_type xdp owner jited |
|---|
| 256 | + |
|---|
| 257 | +| |
|---|
| 258 | +| **# bpftool map pin id 294 /sys/fs/bpf/bar** |
|---|
| 259 | +| **# bpftool map dump pinned /sys/fs/bpf/bar** |
|---|
| 260 | + |
|---|
| 261 | +:: |
|---|
| 262 | + |
|---|
| 263 | + Found 0 elements |
|---|
| 264 | + |
|---|
| 265 | +| |
|---|
| 266 | +| **# bpftool map update pinned /sys/fs/bpf/bar key 0 0 0 0 value pinned /sys/fs/bpf/foo/debug** |
|---|
| 267 | +| **# bpftool map dump pinned /sys/fs/bpf/bar** |
|---|
| 268 | + |
|---|
| 269 | +:: |
|---|
| 270 | + |
|---|
| 271 | + key: 00 00 00 00 value: 22 02 00 00 |
|---|
| 272 | + Found 1 element |
|---|