.. | .. |
---|
15 | 15 | *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-f** | **--bpffs** } } |
---|
16 | 16 | |
---|
17 | 17 | *COMMANDS* := |
---|
18 | | - { **show** | **list** | **dump** | **update** | **lookup** | **getnext** | **delete** |
---|
19 | | - | **pin** | **help** } |
---|
| 18 | + { **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** |
---|
| 19 | + | **delete** | **pin** | **help** } |
---|
20 | 20 | |
---|
21 | 21 | MAP COMMANDS |
---|
22 | 22 | ============= |
---|
23 | 23 | |
---|
24 | | -| **bpftool** **map { show | list }** [*MAP*] |
---|
| 24 | +| **bpftool** **map** { **show** | **list** } [*MAP*] |
---|
| 25 | +| **bpftool** **map create** *FILE* **type** *TYPE* **key** *KEY_SIZE* **value** *VALUE_SIZE* \ |
---|
| 26 | +| **entries** *MAX_ENTRIES* **name** *NAME* [**flags** *FLAGS*] [**inner_map** *MAP*] \ |
---|
| 27 | +| [**dev** *NAME*] |
---|
25 | 28 | | **bpftool** **map dump** *MAP* |
---|
26 | | -| **bpftool** **map update** *MAP* **key** *DATA* **value** *VALUE* [*UPDATE_FLAGS*] |
---|
27 | | -| **bpftool** **map lookup** *MAP* **key** *DATA* |
---|
| 29 | +| **bpftool** **map update** *MAP* [**key** *DATA*] [**value** *VALUE*] [*UPDATE_FLAGS*] |
---|
| 30 | +| **bpftool** **map lookup** *MAP* [**key** *DATA*] |
---|
28 | 31 | | **bpftool** **map getnext** *MAP* [**key** *DATA*] |
---|
29 | 32 | | **bpftool** **map delete** *MAP* **key** *DATA* |
---|
30 | 33 | | **bpftool** **map pin** *MAP* *FILE* |
---|
31 | 34 | | **bpftool** **map event_pipe** *MAP* [**cpu** *N* **index** *M*] |
---|
| 35 | +| **bpftool** **map peek** *MAP* |
---|
| 36 | +| **bpftool** **map push** *MAP* **value** *VALUE* |
---|
| 37 | +| **bpftool** **map pop** *MAP* |
---|
| 38 | +| **bpftool** **map enqueue** *MAP* **value** *VALUE* |
---|
| 39 | +| **bpftool** **map dequeue** *MAP* |
---|
| 40 | +| **bpftool** **map freeze** *MAP* |
---|
32 | 41 | | **bpftool** **map help** |
---|
33 | 42 | | |
---|
34 | | -| *MAP* := { **id** *MAP_ID* | **pinned** *FILE* } |
---|
| 43 | +| *MAP* := { **id** *MAP_ID* | **pinned** *FILE* | **name** *MAP_NAME* } |
---|
35 | 44 | | *DATA* := { [**hex**] *BYTES* } |
---|
36 | | -| *PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* } |
---|
| 45 | +| *PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* | **name** *PROG_NAME* } |
---|
37 | 46 | | *VALUE* := { *DATA* | *MAP* | *PROG* } |
---|
38 | 47 | | *UPDATE_FLAGS* := { **any** | **exist** | **noexist** } |
---|
| 48 | +| *TYPE* := { **hash** | **array** | **prog_array** | **perf_event_array** | **percpu_hash** |
---|
| 49 | +| | **percpu_array** | **stack_trace** | **cgroup_array** | **lru_hash** |
---|
| 50 | +| | **lru_percpu_hash** | **lpm_trie** | **array_of_maps** | **hash_of_maps** |
---|
| 51 | +| | **devmap** | **devmap_hash** | **sockmap** | **cpumap** | **xskmap** | **sockhash** |
---|
| 52 | +| | **cgroup_storage** | **reuseport_sockarray** | **percpu_cgroup_storage** |
---|
| 53 | +| | **queue** | **stack** | **sk_storage** | **struct_ops** | **ringbuf** | **inode_storage** } |
---|
39 | 54 | |
---|
40 | 55 | DESCRIPTION |
---|
41 | 56 | =========== |
---|
42 | 57 | **bpftool map { show | list }** [*MAP*] |
---|
43 | 58 | Show information about loaded maps. If *MAP* is specified |
---|
44 | | - show information only about given map, otherwise list all |
---|
45 | | - maps currently loaded on the system. |
---|
| 59 | + show information only about given maps, otherwise list all |
---|
| 60 | + maps currently loaded on the system. In case of **name**, |
---|
| 61 | + *MAP* may match several maps which will all be shown. |
---|
46 | 62 | |
---|
47 | 63 | Output will start with map ID followed by map type and |
---|
48 | 64 | zero or more named attributes (depending on kernel version). |
---|
49 | 65 | |
---|
50 | | - **bpftool map dump** *MAP* |
---|
51 | | - Dump all entries in a given *MAP*. |
---|
| 66 | + Since Linux 5.8 bpftool is able to discover information about |
---|
| 67 | + processes that hold open file descriptors (FDs) against BPF |
---|
| 68 | + maps. On such kernels bpftool will automatically emit this |
---|
| 69 | + information as well. |
---|
52 | 70 | |
---|
53 | | - **bpftool map update** *MAP* **key** *DATA* **value** *VALUE* [*UPDATE_FLAGS*] |
---|
| 71 | + **bpftool map create** *FILE* **type** *TYPE* **key** *KEY_SIZE* **value** *VALUE_SIZE* **entries** *MAX_ENTRIES* **name** *NAME* [**flags** *FLAGS*] [**inner_map** *MAP*] [**dev** *NAME*] |
---|
| 72 | + Create a new map with given parameters and pin it to *bpffs* |
---|
| 73 | + as *FILE*. |
---|
| 74 | + |
---|
| 75 | + *FLAGS* should be an integer which is the combination of |
---|
| 76 | + desired flags, e.g. 1024 for **BPF_F_MMAPABLE** (see bpf.h |
---|
| 77 | + UAPI header for existing flags). |
---|
| 78 | + |
---|
| 79 | + To create maps of type array-of-maps or hash-of-maps, the |
---|
| 80 | + **inner_map** keyword must be used to pass an inner map. The |
---|
| 81 | + kernel needs it to collect metadata related to the inner maps |
---|
| 82 | + that the new map will work with. |
---|
| 83 | + |
---|
| 84 | + Keyword **dev** expects a network interface name, and is used |
---|
| 85 | + to request hardware offload for the map. |
---|
| 86 | + |
---|
| 87 | + **bpftool map dump** *MAP* |
---|
| 88 | + Dump all entries in a given *MAP*. In case of **name**, |
---|
| 89 | + *MAP* may match several maps which will all be dumped. |
---|
| 90 | + |
---|
| 91 | + **bpftool map update** *MAP* [**key** *DATA*] [**value** *VALUE*] [*UPDATE_FLAGS*] |
---|
54 | 92 | Update map entry for a given *KEY*. |
---|
55 | 93 | |
---|
56 | 94 | *UPDATE_FLAGS* can be one of: **any** update existing entry |
---|
.. | .. |
---|
58 | 96 | exists; **noexist** update only if entry doesn't exist. |
---|
59 | 97 | |
---|
60 | 98 | If the **hex** keyword is provided in front of the bytes |
---|
61 | | - sequence, the bytes are parsed as hexadeximal values, even if |
---|
| 99 | + sequence, the bytes are parsed as hexadecimal values, even if |
---|
62 | 100 | no "0x" prefix is added. If the keyword is not provided, then |
---|
63 | 101 | the bytes are parsed as decimal values, unless a "0x" prefix |
---|
64 | 102 | (for hexadecimal) or a "0" prefix (for octal) is provided. |
---|
65 | 103 | |
---|
66 | | - **bpftool map lookup** *MAP* **key** *DATA* |
---|
| 104 | + **bpftool map lookup** *MAP* [**key** *DATA*] |
---|
67 | 105 | Lookup **key** in the map. |
---|
68 | 106 | |
---|
69 | 107 | **bpftool map getnext** *MAP* [**key** *DATA*] |
---|
.. | .. |
---|
75 | 113 | **bpftool map pin** *MAP* *FILE* |
---|
76 | 114 | Pin map *MAP* as *FILE*. |
---|
77 | 115 | |
---|
78 | | - Note: *FILE* must be located in *bpffs* mount. |
---|
| 116 | + Note: *FILE* must be located in *bpffs* mount. It must not |
---|
| 117 | + contain a dot character ('.'), which is reserved for future |
---|
| 118 | + extensions of *bpffs*. |
---|
79 | 119 | |
---|
80 | 120 | **bpftool** **map event_pipe** *MAP* [**cpu** *N* **index** *M*] |
---|
81 | | - Read events from a BPF_MAP_TYPE_PERF_EVENT_ARRAY map. |
---|
| 121 | + Read events from a **BPF_MAP_TYPE_PERF_EVENT_ARRAY** map. |
---|
82 | 122 | |
---|
83 | 123 | Install perf rings into a perf event array map and dump |
---|
84 | | - output of any bpf_perf_event_output() call in the kernel. |
---|
| 124 | + output of any **bpf_perf_event_output**\ () call in the kernel. |
---|
85 | 125 | By default read the number of CPUs on the system and |
---|
86 | 126 | install perf ring for each CPU in the corresponding index |
---|
87 | 127 | in the array. |
---|
.. | .. |
---|
93 | 133 | replace any existing ring. Any other application will stop |
---|
94 | 134 | receiving events if it installed its rings earlier. |
---|
95 | 135 | |
---|
| 136 | + **bpftool map peek** *MAP* |
---|
| 137 | + Peek next value in the queue or stack. |
---|
| 138 | + |
---|
| 139 | + **bpftool map push** *MAP* **value** *VALUE* |
---|
| 140 | + Push *VALUE* onto the stack. |
---|
| 141 | + |
---|
| 142 | + **bpftool map pop** *MAP* |
---|
| 143 | + Pop and print value from the stack. |
---|
| 144 | + |
---|
| 145 | + **bpftool map enqueue** *MAP* **value** *VALUE* |
---|
| 146 | + Enqueue *VALUE* into the queue. |
---|
| 147 | + |
---|
| 148 | + **bpftool map dequeue** *MAP* |
---|
| 149 | + Dequeue and print value from the queue. |
---|
| 150 | + |
---|
| 151 | + **bpftool map freeze** *MAP* |
---|
| 152 | + Freeze the map as read-only from user space. Entries from a |
---|
| 153 | + frozen map can not longer be updated or deleted with the |
---|
| 154 | + **bpf**\ () system call. This operation is not reversible, |
---|
| 155 | + and the map remains immutable from user space until its |
---|
| 156 | + destruction. However, read and write permissions for BPF |
---|
| 157 | + programs to the map remain unchanged. |
---|
| 158 | + |
---|
96 | 159 | **bpftool map help** |
---|
97 | 160 | Print short help message. |
---|
98 | 161 | |
---|
99 | 162 | OPTIONS |
---|
100 | 163 | ======= |
---|
101 | | - -h, --help |
---|
102 | | - Print short generic help message (similar to **bpftool help**). |
---|
103 | | - |
---|
104 | | - -v, --version |
---|
105 | | - Print version number (similar to **bpftool version**). |
---|
106 | | - |
---|
107 | | - -j, --json |
---|
108 | | - Generate JSON output. For commands that cannot produce JSON, this |
---|
109 | | - option has no effect. |
---|
110 | | - |
---|
111 | | - -p, --pretty |
---|
112 | | - Generate human-readable JSON output. Implies **-j**. |
---|
| 164 | + .. include:: common_options.rst |
---|
113 | 165 | |
---|
114 | 166 | -f, --bpffs |
---|
115 | 167 | Show file names of pinned maps. |
---|
116 | 168 | |
---|
| 169 | + -n, --nomount |
---|
| 170 | + Do not automatically attempt to mount any virtual file system |
---|
| 171 | + (such as tracefs or BPF virtual file system) when necessary. |
---|
| 172 | + |
---|
117 | 173 | EXAMPLES |
---|
118 | 174 | ======== |
---|
119 | 175 | **# bpftool map show** |
---|
| 176 | + |
---|
120 | 177 | :: |
---|
121 | 178 | |
---|
122 | 179 | 10: hash name some_map flags 0x0 |
---|
123 | | - key 4B value 8B max_entries 2048 memlock 167936B |
---|
| 180 | + key 4B value 8B max_entries 2048 memlock 167936B |
---|
| 181 | + pids systemd(1) |
---|
124 | 182 | |
---|
125 | 183 | The following three commands are equivalent: |
---|
126 | 184 | |
---|
.. | .. |
---|
137 | 195 | |
---|
138 | 196 | |
---|
139 | 197 | **# bpftool map dump id 10** |
---|
| 198 | + |
---|
140 | 199 | :: |
---|
141 | 200 | |
---|
142 | 201 | key: 00 01 02 03 value: 00 01 02 03 04 05 06 07 |
---|
.. | .. |
---|
144 | 203 | Found 2 elements |
---|
145 | 204 | |
---|
146 | 205 | **# bpftool map getnext id 10 key 0 1 2 3** |
---|
| 206 | + |
---|
147 | 207 | :: |
---|
148 | 208 | |
---|
149 | 209 | key: |
---|
.. | .. |
---|
156 | 216 | | **# bpftool map pin id 10 /sys/fs/bpf/map** |
---|
157 | 217 | | **# bpftool map del pinned /sys/fs/bpf/map key 13 00 07 00** |
---|
158 | 218 | |
---|
159 | | -SEE ALSO |
---|
160 | | -======== |
---|
161 | | - **bpftool**\ (8), **bpftool-prog**\ (8), **bpftool-cgroup**\ (8) |
---|
| 219 | +Note that map update can also be used in order to change the program references |
---|
| 220 | +hold by a program array map. This can be used, for example, to change the |
---|
| 221 | +programs used for tail-call jumps at runtime, without having to reload the |
---|
| 222 | +entry-point program. Below is an example for this use case: we load a program |
---|
| 223 | +defining a prog array map, and with a main function that contains a tail call |
---|
| 224 | +to other programs that can be used either to "process" packets or to "debug" |
---|
| 225 | +processing. Note that the prog array map MUST be pinned into the BPF virtual |
---|
| 226 | +file system for the map update to work successfully, as kernel flushes prog |
---|
| 227 | +array maps when they have no more references from user space (and the update |
---|
| 228 | +would be lost as soon as bpftool exits). |
---|
| 229 | + |
---|
| 230 | +| |
---|
| 231 | +| **# bpftool prog loadall tail_calls.o /sys/fs/bpf/foo type xdp** |
---|
| 232 | +| **# bpftool prog --bpffs** |
---|
| 233 | + |
---|
| 234 | +:: |
---|
| 235 | + |
---|
| 236 | + 545: xdp name main_func tag 674b4b5597193dc3 gpl |
---|
| 237 | + loaded_at 2018-12-12T15:02:58+0000 uid 0 |
---|
| 238 | + xlated 240B jited 257B memlock 4096B map_ids 294 |
---|
| 239 | + pinned /sys/fs/bpf/foo/xdp |
---|
| 240 | + 546: xdp name bpf_func_process tag e369a529024751fc gpl |
---|
| 241 | + loaded_at 2018-12-12T15:02:58+0000 uid 0 |
---|
| 242 | + xlated 200B jited 164B memlock 4096B |
---|
| 243 | + pinned /sys/fs/bpf/foo/process |
---|
| 244 | + 547: xdp name bpf_func_debug tag 0b597868bc7f0976 gpl |
---|
| 245 | + loaded_at 2018-12-12T15:02:58+0000 uid 0 |
---|
| 246 | + xlated 200B jited 164B memlock 4096B |
---|
| 247 | + pinned /sys/fs/bpf/foo/debug |
---|
| 248 | + |
---|
| 249 | +**# bpftool map** |
---|
| 250 | + |
---|
| 251 | +:: |
---|
| 252 | + |
---|
| 253 | + 294: prog_array name jmp_table flags 0x0 |
---|
| 254 | + key 4B value 4B max_entries 1 memlock 4096B |
---|
| 255 | + owner_prog_type xdp owner jited |
---|
| 256 | + |
---|
| 257 | +| |
---|
| 258 | +| **# bpftool map pin id 294 /sys/fs/bpf/bar** |
---|
| 259 | +| **# bpftool map dump pinned /sys/fs/bpf/bar** |
---|
| 260 | + |
---|
| 261 | +:: |
---|
| 262 | + |
---|
| 263 | + Found 0 elements |
---|
| 264 | + |
---|
| 265 | +| |
---|
| 266 | +| **# bpftool map update pinned /sys/fs/bpf/bar key 0 0 0 0 value pinned /sys/fs/bpf/foo/debug** |
---|
| 267 | +| **# bpftool map dump pinned /sys/fs/bpf/bar** |
---|
| 268 | + |
---|
| 269 | +:: |
---|
| 270 | + |
---|
| 271 | + key: 00 00 00 00 value: 22 02 00 00 |
---|
| 272 | + Found 1 element |
---|