# SOME DESCRIPTIVE TITLE # Copyright (C) YEAR Free Software Foundation, Inc. # This file is distributed under the same license as the PACKAGE package. # FIRST AUTHOR , YEAR. # #, fuzzy msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "POT-Creation-Date: 2024-06-01 05:43+0200\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" "Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" #. type: TH #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "bpf" msgstr "" #. type: TH #: archlinux debian-unstable opensuse-tumbleweed #, no-wrap msgid "2024-05-02" msgstr "" #. type: TH #: archlinux debian-unstable #, no-wrap msgid "Linux man-pages 6.8" msgstr "" #. type: SH #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "NAME" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "bpf - perform a command on an extended BPF map or program" msgstr "" #. type: SH #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "SYNOPSIS" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B<#include Elinux/bpf.hE>\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "BIB<, union bpf_attr *>IB<, unsigned int >IB<);>\n" msgstr "" #. type: SH #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "DESCRIPTION" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The B() system call performs a range of operations related to extended " "Berkeley Packet Filters. Extended BPF (or eBPF) is similar to the original " "(\"classic\") BPF (cBPF) used to filter network packets. For both cBPF and " "eBPF programs, the kernel statically analyzes the programs before loading " "them, in order to ensure that they cannot harm the running system." msgstr "" #. See 'enum bpf_func_id' in include/uapi/linux/bpf.h #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "eBPF extends cBPF in multiple ways, including the ability to call a fixed " "set of in-kernel helper functions (via the B opcode extension " "provided by eBPF) and access shared data structures such as eBPF maps." msgstr "" #. type: SS #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "Extended BPF Design/Architecture" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "eBPF maps are a generic data structure for storage of different data types. " "Data types are generally treated as binary blobs, so a user just specifies " "the size of the key and the size of the value at map-creation time. In " "other words, a key/value for a given map can have an arbitrary structure." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "A user process can create multiple maps (with key/value-pairs being opaque " "bytes of data) and access them via file descriptors. Different eBPF " "programs can access the same maps in parallel. It's up to the user process " "and eBPF program to decide what they store inside maps." msgstr "" #. Defined by the kernel constant MAX_TAIL_CALL_CNT in include/linux/bpf.h #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "There's one special map type, called a program array. This type of map " "stores file descriptors referring to other eBPF programs. When a lookup in " "the map is performed, the program flow is redirected in-place to the " "beginning of another eBPF program and does not return back to the calling " "program. The level of nesting has a fixed limit of 32, so that infinite " "loops cannot be crafted. At run time, the program file descriptors stored " "in the map can be modified, so program functionality can be altered based on " "specific requirements. All programs referred to in a program-array map must " "have been previously loaded into the kernel via B(). If a map lookup " "fails, the current program continues its execution. See " "B below for further details." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Generally, eBPF programs are loaded by the user process and automatically " "unloaded when the process exits. In some cases, for example, B(8), " "the program will continue to stay alive inside the kernel even after the " "process that loaded the program exits. In that case, the tc subsystem holds " "a reference to the eBPF program after the file descriptor has been closed by " "the user-space program. Thus, whether a specific program continues to live " "inside the kernel depends on how it is further attached to a given kernel " "subsystem after it was loaded via B()." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Each eBPF program is a set of instructions that is safe to run until its " "completion. An in-kernel verifier statically determines that the eBPF " "program terminates and is safe to execute. During verification, the kernel " "increments reference counts for each of the maps that the eBPF program uses, " "so that the attached maps can't be removed until the program is unloaded." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "eBPF programs can be attached to different events. These events can be the " "arrival of network packets, tracing events, classification events by network " "queueing disciplines (for eBPF programs attached to a B(8) classifier), " "and other types that may be added in the future. A new event triggers " "execution of the eBPF program, which may store information about the event " "in eBPF maps. Beyond storing data, eBPF programs may call a fixed set of in-" "kernel helper functions." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The same eBPF program can be attached to multiple events and different eBPF " "programs can access the same map:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "" "tracing tracing tracing packet packet packet\n" "event A event B event C on eth0 on eth1 on eth2\n" " | | | | | \\[ha]\n" " | | | | v |\n" " --E tracing E-- tracing socket tc ingress tc egress\n" " prog_1 prog_2 prog_3 classifier action\n" " | | | | prog_4 prog_5\n" " |--- -----| |------| map_3 | |\n" " map_1 map_2 --| map_4 |--\n" msgstr "" #. type: SS #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "Arguments" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The operation to be performed by the B() system call is determined by " "the I argument. Each operation takes an accompanying argument, " "provided via I, which is a pointer to a union of type I (see " "below). The unused fields and padding must be zeroed out before the call. " "The I argument is the size of the union pointed to by I." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "The value provided in I is one of the following:" msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Create a map and return a file descriptor that refers to the map. The close-" "on-exec file descriptor flag (see B(2)) is automatically enabled for " "the new file descriptor." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Look up an element by key in a specified map and return its value." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Create or update an element (key/value pair) in a specified map." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Look up and delete an element by key in a specified map." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Look up an element by key in a specified map and return the key of the next " "element." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Verify and load an eBPF program, returning a new file descriptor associated " "with the program. The close-on-exec file descriptor flag (see B(2)) " "is automatically enabled for the new file descriptor." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The I union consists of various anonymous structures that are used " "by different B() commands:" msgstr "" #. commit 2541517c32be2531e0da59dfd7efc1ce844644f5 #. type: Plain text #: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron #: opensuse-tumbleweed #, no-wrap msgid "" "union bpf_attr {\n" " struct { /* Used by BPF_MAP_CREATE */\n" " __u32 map_type;\n" " __u32 key_size; /* size of key in bytes */\n" " __u32 value_size; /* size of value in bytes */\n" " __u32 max_entries; /* maximum number of entries\n" " in a map */\n" " };\n" "\\&\n" " struct { /* Used by BPF_MAP_*_ELEM and BPF_MAP_GET_NEXT_KEY\n" " commands */\n" " __u32 map_fd;\n" " __aligned_u64 key;\n" " union {\n" " __aligned_u64 value;\n" " __aligned_u64 next_key;\n" " };\n" " __u64 flags;\n" " };\n" "\\&\n" " struct { /* Used by BPF_PROG_LOAD */\n" " __u32 prog_type;\n" " __u32 insn_cnt;\n" " __aligned_u64 insns; /* \\[aq]const struct bpf_insn *\\[aq] */\n" " __aligned_u64 license; /* \\[aq]const char *\\[aq] */\n" " __u32 log_level; /* verbosity level of verifier */\n" " __u32 log_size; /* size of user buffer */\n" " __aligned_u64 log_buf; /* user supplied \\[aq]char *\\[aq]\n" " buffer */\n" " __u32 kern_version;\n" " /* checked when prog_type=kprobe\n" " (since Linux 4.1) */\n" " };\n" "} __attribute__((aligned(8)));\n" msgstr "" #. type: SS #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "eBPF maps" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Maps are a generic data structure for storage of different types of data. " "They allow sharing of data between eBPF kernel programs, and also between " "kernel and user-space applications." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Each map type has the following attributes:" msgstr "" #. type: IP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "\\[bu]" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "type" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "maximum number of elements" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "key size in bytes" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "value size in bytes" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The following wrapper functions demonstrate how various B() commands " "can be used to access the maps. The functions use the I argument to " "invoke different operations." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The B command creates a new map, returning a new file " "descriptor that refers to the map." msgstr "" #. type: Plain text #: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron #: opensuse-tumbleweed #, no-wrap msgid "" "int\n" "bpf_create_map(enum bpf_map_type map_type,\n" " unsigned int key_size,\n" " unsigned int value_size,\n" " unsigned int max_entries)\n" "{\n" " union bpf_attr attr = {\n" " .map_type = map_type,\n" " .key_size = key_size,\n" " .value_size = value_size,\n" " .max_entries = max_entries\n" " };\n" "\\&\n" " return bpf(BPF_MAP_CREATE, &attr, sizeof(attr));\n" "}\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The new map has the type specified by I, and attributes as " "specified in I, I, and I. On success, " "this operation returns a file descriptor. On error, -1 is returned and " "I is set to B, B, or B." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The I and I attributes will be used by the verifier " "during program loading to check that the program is calling " "B() helper functions with a correctly initialized I " "and to check that the program doesn't access the map element I beyond " "the specified I. For example, when a map is created with a " "I of 8 and the eBPF program calls" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "bpf_map_lookup_elem(map_fd, fp - 4)\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "the program will be rejected, since the in-kernel helper function" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "bpf_map_lookup_elem(map_fd, void *key)\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "expects to read 8 bytes from the location pointed to by I, but the " "I (where I is the top of the stack) starting address will " "cause out-of-bounds stack access." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Similarly, when a map is created with a I of 1 and the eBPF " "program contains" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "" "value = bpf_map_lookup_elem(...);\n" "*(u32 *) value = 1;\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "the program will be rejected, since it accesses the I pointer beyond " "the specified 1 byte I limit." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Currently, the following values are supported for I:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "" "enum bpf_map_type {\n" " BPF_MAP_TYPE_UNSPEC, /* Reserve 0 as invalid map type */\n" " BPF_MAP_TYPE_HASH,\n" " BPF_MAP_TYPE_ARRAY,\n" " BPF_MAP_TYPE_PROG_ARRAY,\n" " BPF_MAP_TYPE_PERF_EVENT_ARRAY,\n" " BPF_MAP_TYPE_PERCPU_HASH,\n" " BPF_MAP_TYPE_PERCPU_ARRAY,\n" " BPF_MAP_TYPE_STACK_TRACE,\n" " BPF_MAP_TYPE_CGROUP_ARRAY,\n" " BPF_MAP_TYPE_LRU_HASH,\n" " BPF_MAP_TYPE_LRU_PERCPU_HASH,\n" " BPF_MAP_TYPE_LPM_TRIE,\n" " BPF_MAP_TYPE_ARRAY_OF_MAPS,\n" " BPF_MAP_TYPE_HASH_OF_MAPS,\n" " BPF_MAP_TYPE_DEVMAP,\n" " BPF_MAP_TYPE_SOCKMAP,\n" " BPF_MAP_TYPE_CPUMAP,\n" " BPF_MAP_TYPE_XSKMAP,\n" " BPF_MAP_TYPE_SOCKHASH,\n" " BPF_MAP_TYPE_CGROUP_STORAGE,\n" " BPF_MAP_TYPE_REUSEPORT_SOCKARRAY,\n" " BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE,\n" " BPF_MAP_TYPE_QUEUE,\n" " BPF_MAP_TYPE_STACK,\n" " /* See /usr/include/linux/bpf.h for the full list. */\n" "};\n" msgstr "" #. FIXME We need an explanation of why one might choose each of #. these map implementations #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "I selects one of the available map implementations in the kernel. " "For all map types, eBPF programs access maps with the same " "B() and B() helper functions. " "Further details of the various map types are given below." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The B command looks up an element with a given I " "in the map referred to by the file descriptor I." msgstr "" #. type: Plain text #: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron #: opensuse-tumbleweed #, no-wrap msgid "" "int\n" "bpf_lookup_elem(int fd, const void *key, void *value)\n" "{\n" " union bpf_attr attr = {\n" " .map_fd = fd,\n" " .key = ptr_to_u64(key),\n" " .value = ptr_to_u64(value),\n" " };\n" "\\&\n" " return bpf(BPF_MAP_LOOKUP_ELEM, &attr, sizeof(attr));\n" "}\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "If an element is found, the operation returns zero and stores the element's " "value into I, which must point to a buffer of I bytes." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "If no element is found, the operation returns -1 and sets I to " "B." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The B command creates or updates an element with a " "given I in the map referred to by the file descriptor I." msgstr "" #. type: Plain text #: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron #: opensuse-tumbleweed #, no-wrap msgid "" "int\n" "bpf_update_elem(int fd, const void *key, const void *value,\n" " uint64_t flags)\n" "{\n" " union bpf_attr attr = {\n" " .map_fd = fd,\n" " .key = ptr_to_u64(key),\n" " .value = ptr_to_u64(value),\n" " .flags = flags,\n" " };\n" "\\&\n" " return bpf(BPF_MAP_UPDATE_ELEM, &attr, sizeof(attr));\n" "}\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "The I argument should be specified as one of the following:" msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Create a new element or update an existing element." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Create a new element only if it did not exist." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Update an existing element." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "On success, the operation returns zero. On error, -1 is returned and " "I is set to B, B, B, or B. B " "indicates that the number of elements in the map reached the I " "limit specified at map creation time. B will be returned if " "I specifies B and the element with I already exists " "in the map. B will be returned if I specifies B " "and the element with I doesn't exist in the map." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The B command deletes the element whose key is I " "from the map referred to by the file descriptor I." msgstr "" #. type: Plain text #: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron #: opensuse-tumbleweed #, no-wrap msgid "" "int\n" "bpf_delete_elem(int fd, const void *key)\n" "{\n" " union bpf_attr attr = {\n" " .map_fd = fd,\n" " .key = ptr_to_u64(key),\n" " };\n" "\\&\n" " return bpf(BPF_MAP_DELETE_ELEM, &attr, sizeof(attr));\n" "}\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "On success, zero is returned. If the element is not found, -1 is returned " "and I is set to B." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The B command looks up an element by I in the map " "referred to by the file descriptor I and sets the I pointer to " "the key of the next element." msgstr "" #. type: Plain text #: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron #: opensuse-tumbleweed #, no-wrap msgid "" "int\n" "bpf_get_next_key(int fd, const void *key, void *next_key)\n" "{\n" " union bpf_attr attr = {\n" " .map_fd = fd,\n" " .key = ptr_to_u64(key),\n" " .next_key = ptr_to_u64(next_key),\n" " };\n" "\\&\n" " return bpf(BPF_MAP_GET_NEXT_KEY, &attr, sizeof(attr));\n" "}\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "If I is found, the operation returns zero and sets the I " "pointer to the key of the next element. If I is not found, the " "operation returns zero and sets the I pointer to the key of the " "first element. If I is the last element, -1 is returned and I " "is set to B. Other possible I values are B, " "B, B, and B. This method can be used to iterate over " "all elements in the map." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Delete the map referred to by the file descriptor I. When the user-" "space program that created a map exits, all maps will be deleted " "automatically (but see NOTES)." msgstr "" #. type: SS #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "eBPF map types" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "The following map types are supported:" msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. commit 0f8e4bd8a1fc8c4185f1630061d0a1f2d197a475 #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Hash-table maps have the following characteristics:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Maps are created and destroyed by user-space programs. Both user-space and " "eBPF programs can perform lookup, update, and delete operations." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "The kernel takes care of allocating and freeing key/value pairs." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The B() helper will fail to insert new element when the " "I limit is reached. (This ensures that eBPF programs cannot " "exhaust memory.)" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "B() replaces existing elements atomically." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Hash-table maps are optimized for speed of lookup." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. commit 28fbcfa08d8ed7c5a50d41a0433aad222835e8e3 #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Array maps have the following characteristics:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Optimized for fastest possible lookup. In the future the verifier/JIT " "compiler may recognize lookup() operations that employ a constant key and " "optimize it into constant pointer. It is possible to optimize a non-" "constant key into direct pointer arithmetic as well, since pointers and " "I are constant for the life of the eBPF program. In other " "words, B() may be 'inlined' by the verifier/JIT " "compiler while preserving concurrent access to this map from user space." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "All array elements pre-allocated and zero initialized at init time" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "The key is an array index, and must be exactly four bytes." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "B() fails with the error B, since elements cannot " "be deleted." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "B() replaces elements in a B fashion; for " "atomic updates, a hash-table map should be used instead. There is however " "one special case that can also be used with arrays: the atomic built-in " "B<__sync_fetch_and_add()> can be used on 32 and 64 bit atomic counters. For " "example, it can be applied on the whole value itself if it represents a " "single counter, or in case of a structure containing multiple counters, it " "could be used on individual counters. This is quite often useful for " "aggregation and accounting of events." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Among the uses for array maps are the following:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "As \"global\" eBPF variables: an array of 1 element whose key is (index) 0 " "and where the value is a collection of 'global' variables which eBPF " "programs can use to keep state between events." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Aggregation of tracing events into a fixed set of buckets." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Accounting of networking events, for example, number of packets and packet " "sizes." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B (since Linux 4.2)" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "A program array map is a special kind of array map whose map values contain " "only file descriptors referring to other eBPF programs. Thus, both the " "I and I must be exactly four bytes. This map is used " "in conjunction with the B() helper." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "This means that an eBPF program with a program array map attached to it can " "call from kernel side into" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "" "void bpf_tail_call(void *context, void *prog_map,\n" " unsigned int index);\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "and therefore replace its own program flow with the one from the program at " "the given program array slot, if present. This can be regarded as kind of a " "jump table to a different eBPF program. The invoked program will then reuse " "the same stack. When a jump into the new program has been performed, it " "won't return to the old program anymore." msgstr "" #. MAX_TAIL_CALL_CNT #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "If no eBPF program is found at the given index of the program array (because " "the map slot doesn't contain a valid program file descriptor, the specified " "lookup index/key is out of bounds, or the limit of 32 nested calls has been " "exceed), execution continues with the current eBPF program. This can be " "used as a fall-through for default cases." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "A program array map is useful, for example, in tracing or networking, to " "handle individual system calls or protocols in their own subprograms and use " "their identifiers as an individual map index. This approach may result in " "performance benefits, and also makes it possible to overcome the maximum " "instruction limit of a single eBPF program. In dynamic environments, a user-" "space daemon might atomically replace individual subprograms at run-time " "with newer versions to alter overall program behavior, for instance, if " "global policies change." msgstr "" #. type: SS #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "eBPF programs" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The B command is used to load an eBPF program into the " "kernel. The return value for this command is a new file descriptor " "associated with this eBPF program." msgstr "" #. type: Plain text #: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron #: opensuse-tumbleweed #, no-wrap msgid "" "char bpf_log_buf[LOG_BUF_SIZE];\n" "\\&\n" "int\n" "bpf_prog_load(enum bpf_prog_type type,\n" " const struct bpf_insn *insns, int insn_cnt,\n" " const char *license)\n" "{\n" " union bpf_attr attr = {\n" " .prog_type = type,\n" " .insns = ptr_to_u64(insns),\n" " .insn_cnt = insn_cnt,\n" " .license = ptr_to_u64(license),\n" " .log_buf = ptr_to_u64(bpf_log_buf),\n" " .log_size = LOG_BUF_SIZE,\n" " .log_level = 1,\n" " };\n" "\\&\n" " return bpf(BPF_PROG_LOAD, &attr, sizeof(attr));\n" "}\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "I is one of the available program types:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "" "enum bpf_prog_type {\n" " BPF_PROG_TYPE_UNSPEC, /* Reserve 0 as invalid\n" " program type */\n" " BPF_PROG_TYPE_SOCKET_FILTER,\n" " BPF_PROG_TYPE_KPROBE,\n" " BPF_PROG_TYPE_SCHED_CLS,\n" " BPF_PROG_TYPE_SCHED_ACT,\n" " BPF_PROG_TYPE_TRACEPOINT,\n" " BPF_PROG_TYPE_XDP,\n" " BPF_PROG_TYPE_PERF_EVENT,\n" " BPF_PROG_TYPE_CGROUP_SKB,\n" " BPF_PROG_TYPE_CGROUP_SOCK,\n" " BPF_PROG_TYPE_LWT_IN,\n" " BPF_PROG_TYPE_LWT_OUT,\n" " BPF_PROG_TYPE_LWT_XMIT,\n" " BPF_PROG_TYPE_SOCK_OPS,\n" " BPF_PROG_TYPE_SK_SKB,\n" " BPF_PROG_TYPE_CGROUP_DEVICE,\n" " BPF_PROG_TYPE_SK_MSG,\n" " BPF_PROG_TYPE_RAW_TRACEPOINT,\n" " BPF_PROG_TYPE_CGROUP_SOCK_ADDR,\n" " BPF_PROG_TYPE_LWT_SEG6LOCAL,\n" " BPF_PROG_TYPE_LIRC_MODE2,\n" " BPF_PROG_TYPE_SK_REUSEPORT,\n" " BPF_PROG_TYPE_FLOW_DISSECTOR,\n" " /* See /usr/include/linux/bpf.h for the full list. */\n" "};\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "For further details of eBPF program types, see below." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "The remaining fields of I are set as follows:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "I is an array of I instructions." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "I is the number of instructions in the program referred to by " "I." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "I is a license string, which must be GPL compatible to call helper " "functions marked I. (The licensing rules are the same as for " "kernel modules, so that also dual licenses, such as \"Dual BSD/GPL\", may be " "used.)" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "I is a pointer to a caller-allocated buffer in which the in-kernel " "verifier can store the verification log. This log is a multi-line string " "that can be checked by the program author in order to understand how the " "verifier came to the conclusion that the eBPF program is unsafe. The format " "of the output can change at any time as the verifier evolves." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "I size of the buffer pointed to by I. If the size of the " "buffer is not large enough to store all verifier messages, -1 is returned " "and I is set to B." msgstr "" #. type: Plain text #: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron #: opensuse-tumbleweed msgid "" "I verbosity level of the verifier. A value of zero means that " "the verifier will not provide a log; in this case, I must be a null " "pointer, and I must be zero." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Applying B(2) to the file descriptor returned by B " "will unload the eBPF program (but see NOTES)." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Maps are accessible from eBPF programs and are used to exchange data between " "eBPF programs and between eBPF programs and user-space programs. For " "example, eBPF programs can process various events (like kprobe, packets) and " "store their data into a map, and user-space programs can then fetch data " "from the map. Conversely, user-space programs can use a map as a " "configuration mechanism, populating the map with values checked by the eBPF " "program, which then modifies its behavior on the fly according to those " "values." msgstr "" #. type: SS #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "eBPF program types" msgstr "" # #. FIXME #. Somewhere in this page we need a general introduction to the #. bpf_context. For example, how does a BPF program access the #. context? #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The eBPF program type (I) determines the subset of kernel helper " "functions that the program may call. The program type also determines the " "program input (context)\\[em]the format of I (which is " "the data blob passed into the eBPF program as the first argument)." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "For example, a tracing program does not have the exact same subset of helper " "functions as a socket filter program (though they may have some helpers in " "common). Similarly, the input (context) for a tracing program is a set of " "register values, while for a socket filter it is a network packet." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The set of functions available to eBPF programs of a given type may increase " "in the future." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "The following program types are supported:" msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B (since Linux 3.19)" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Currently, the set of functions for B is:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "" "bpf_map_lookup_elem(map_fd, void *key)\n" " /* look up key in a map_fd */\n" "bpf_map_update_elem(map_fd, void *key, void *value)\n" " /* update key/value */\n" "bpf_map_delete_elem(map_fd, void *key)\n" " /* delete key in a map_fd */\n" msgstr "" # #. FIXME: We need some text here to explain how the program #. accesses __sk_buff. #. See 'struct __sk_buff' and commit 9bac3d6d548e5 #. Alexei commented: #. Actually now in case of SOCKET_FILTER, SCHED_CLS, SCHED_ACT #. the program can now access skb fields. #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "The I argument is a pointer to a I." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B (since Linux 4.1)" msgstr "" #. commit 94caee8c312d96522bcdae88791aaa9ebcd5f22c #. commit a8cb5f556b567974d75ea29c15181c445c541b1f #. FIXME Document this program type #. Describe allowed helper functions for this program type #. Describe bpf_context for this program type #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "[To be documented]" msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B (since Linux 4.1)" msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B (since Linux 4.1)" msgstr "" #. type: SS #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "Events" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Once a program is loaded, it can be attached to an event. Various kernel " "subsystems have different ways to do so." msgstr "" #. commit 89aa075832b0da4402acebd698d0411dcc82d03e #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Since Linux 3.19, the following call will attach the program I to " "the socket I, which was created by an earlier call to B(2):" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "" "setsockopt(sockfd, SOL_SOCKET, SO_ATTACH_BPF,\n" " &prog_fd, sizeof(prog_fd));\n" msgstr "" #. commit 2541517c32be2531e0da59dfd7efc1ce844644f5 #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Since Linux 4.1, the following call may be used to attach the eBPF program " "referred to by the file descriptor I to a perf event file " "descriptor, I, that was created by a previous call to " "B(2):" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "ioctl(event_fd, PERF_EVENT_IOC_SET_BPF, prog_fd);\n" msgstr "" #. type: SH #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "RETURN VALUE" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "For a successful call, the return value depends on the operation:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "The new file descriptor associated with the eBPF map." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "The new file descriptor associated with the eBPF program." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "All other commands" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Zero." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "On error, -1 is returned, and I is set to indicate the error." msgstr "" #. type: SH #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "ERRORS" msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The eBPF program is too large or a map reached the I limit " "(maximum number of elements)." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "For B, even though all program instructions are valid, the " "program has been rejected because it was deemed unsafe. This may be because " "it may have accessed a disallowed memory region or an uninitialized stack/" "register or because the function constraints don't match the actual types or " "because there was a misaligned memory access. In this case, it is " "recommended to call B() again with I and examine " "I for the specific reason provided by the verifier." msgstr "" #. type: TP #: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron #: opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron #: opensuse-tumbleweed msgid "" "For B, indicates that needed resources are blocked. This " "happens when the verifier detects pending signals while it is checking the " "validity of the bpf program. In this case, just call B() again with " "the same parameters." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "I is not an open file descriptor." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "One of the pointers (I or I or I or I) is " "outside the accessible address space." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "The value specified in I is not recognized by this kernel." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "For B, either I or attributes are invalid." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "For B commands, some of the fields of I that " "are not used by this command are not set to zero." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "For B, indicates an attempt to load an invalid program. eBPF " "programs can be deemed invalid due to unrecognized instructions, the use of " "reserved fields, jumps out of range, infinite loops or calls of unknown " "functions." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "For B or B, indicates that the " "element with the given I was not found." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Cannot allocate sufficient memory." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The call was made without sufficient privilege (without the B " "capability)." msgstr "" #. type: SH #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "STANDARDS" msgstr "" #. type: Plain text #: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron #: opensuse-leap-15-6 opensuse-tumbleweed msgid "Linux." msgstr "" #. type: SH #: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron #: opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "HISTORY" msgstr "" #. type: Plain text #: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron #: opensuse-leap-15-6 opensuse-tumbleweed msgid "Linux 3.18." msgstr "" #. type: SH #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "NOTES" msgstr "" #. commit 1be7f75d1668d6296b80bf35dcf6762393530afc #. [Linux 5.6] mtk: The list of available functions is, I think, governed #. by the check in net/core/filter.c::bpf_base_func_proto(). #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Prior to Linux 4.4, all B() commands require the caller to have the " "B capability. From Linux 4.4 onwards, an unprivileged user " "may create limited programs of type B and " "associated maps. However they may not store kernel pointers within the maps " "and are presently limited to the following helper functions:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "get_random" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "get_smp_processor_id" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "tail_call" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "ktime_get_ns" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Unprivileged access may be blocked by writing the value 1 to the file I." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "eBPF objects (maps and programs) can be shared between processes. For " "example, after B(2), the child inherits file descriptors referring to " "the same eBPF objects. In addition, file descriptors referring to eBPF " "objects can be transferred over UNIX domain sockets. File descriptors " "referring to eBPF objects can be duplicated in the usual way, using " "B(2) and similar calls. An eBPF object is deallocated only after all " "file descriptors referring to the object have been closed." msgstr "" #. There are also examples for the tc classifier, in the iproute2 #. project, in examples/bpf #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "eBPF programs can be written in a restricted C that is compiled (using the " "B compiler) into eBPF bytecode. Various features are omitted from " "this restricted C, such as loops, global variables, variadic functions, " "floating-point numbers, and passing structures as function arguments. Some " "examples can be found in the I files in the kernel " "source tree." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The kernel contains a just-in-time (JIT) compiler that translates eBPF " "bytecode into native machine code for better performance. Before Linux " "4.15, the JIT compiler is disabled by default, but its operation can be " "controlled by writing one of the following integer strings to the file I:" msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B<0>" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Disable JIT compilation (default)." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B<1>" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "Normal compilation." msgstr "" #. type: TP #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "B<2>" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Debugging mode. The generated opcodes are dumped in hexadecimal into the " "kernel log. These opcodes can then be disassembled using the program " "I provided in the kernel source tree." msgstr "" #. commit 290af86629b25ffd1ed6232c4e9107da031705cb #. type: Plain text #: archlinux debian-unstable fedora-rawhide opensuse-tumbleweed msgid "" "Since Linux 4.15, the kernel may be configured with the " "B option. In this case, the JIT compiler is " "always enabled, and the I is initialized to 1 and is " "immutable. (This kernel configuration option was provided as a mitigation " "for one of the Spectre attacks against the BPF interpreter.)" msgstr "" #. Last reviewed in Linux 4.18-rc by grepping for BPF_ALU64 in arch/ #. and by checking the documentation for bpf_jit_enable in #. Documentation/sysctl/net.txt #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "The JIT compiler for eBPF is currently available for the following " "architectures:" msgstr "" #. commit 0a14842f5a3c0e88a1e59fac5c3025db39721f74 #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "x86-64 (since Linux 3.18; cBPF since Linux 3.0);" msgstr "" #. commit ddecdfcea0ae891f782ae853771c867ab51024c2 #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "ARM32 (since Linux 3.18; cBPF since Linux 3.4);" msgstr "" #. commit 2809a2087cc44b55e4377d7b9be3f7f5d2569091 #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "SPARC 32 (since Linux 3.18; cBPF since Linux 3.5);" msgstr "" #. commit e54bcde3d69d40023ae77727213d14f920eb264a #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "ARM-64 (since Linux 3.18);" msgstr "" #. commit c10302efe569bfd646b4c22df29577a4595b4580 #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "s390 (since Linux 4.1; cBPF since Linux 3.7);" msgstr "" #. commit 0ca87f05ba8bdc6791c14878464efc901ad71e99 #. commit 156d0e290e969caba25f1851c52417c14d141b24 #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "PowerPC 64 (since Linux 4.8; cBPF since Linux 3.1);" msgstr "" #. commit 7a12b5031c6b947cc13918237ae652b536243b76 #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "SPARC 64 (since Linux 4.12);" msgstr "" #. commit 03f5781be2c7b7e728d724ac70ba10799cc710d7 #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "x86-32 (since Linux 4.18);" msgstr "" #. commit c6610de353da5ca6eee5b8960e838a87a90ead0c #. commit f381bf6d82f032b7410185b35d000ea370ac706b #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "MIPS 64 (since Linux 4.18; cBPF since Linux 3.16);" msgstr "" #. commit 2353ecc6f91fd15b893fa01bf85a1c7a823ee4f2 #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "riscv (since Linux 5.1)." msgstr "" #. type: SH #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "EXAMPLES" msgstr "" #. == atomic64_add #. type: Plain text #: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron #: opensuse-tumbleweed #, no-wrap msgid "" "/* bpf+sockets example:\n" " * 1. create array map of 256 elements\n" " * 2. load program that counts number of packets received\n" " * r0 = skb-Edata[ETH_HLEN + offsetof(struct iphdr, protocol)]\n" " * map[r0]++\n" " * 3. attach prog_fd to raw socket via setsockopt()\n" " * 4. print number of received TCP/UDP packets every second\n" " */\n" "int\n" "main(int argc, char *argv[])\n" "{\n" " int sock, map_fd, prog_fd, key;\n" " long long value = 0, tcp_cnt, udp_cnt;\n" "\\&\n" " map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(key),\n" " sizeof(value), 256);\n" " if (map_fd E 0) {\n" " printf(\"failed to create map \\[aq]%s\\[aq]\\en\", strerror(errno));\n" " /* likely not run as root */\n" " return 1;\n" " }\n" "\\&\n" " struct bpf_insn prog[] = {\n" " BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), /* r6 = r1 */\n" " BPF_LD_ABS(BPF_B, ETH_HLEN + offsetof(struct iphdr, protocol)),\n" " /* r0 = ip-Eproto */\n" " BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4),\n" " /* *(u32 *)(fp - 4) = r0 */\n" " BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* r2 = fp */\n" " BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = r2 - 4 */\n" " BPF_LD_MAP_FD(BPF_REG_1, map_fd), /* r1 = map_fd */\n" " BPF_CALL_FUNC(BPF_FUNC_map_lookup_elem),\n" " /* r0 = map_lookup(r1, r2) */\n" " BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),\n" " /* if (r0 == 0) goto pc+2 */\n" " BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */\n" " BPF_XADD(BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0),\n" " /* lock *(u64 *) r0 += r1 */\n" " BPF_MOV64_IMM(BPF_REG_0, 0), /* r0 = 0 */\n" " BPF_EXIT_INSN(), /* return r0 */\n" " };\n" "\\&\n" " prog_fd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, prog,\n" " sizeof(prog) / sizeof(prog[0]), \"GPL\");\n" "\\&\n" " sock = open_raw_sock(\"lo\");\n" "\\&\n" " assert(setsockopt(sock, SOL_SOCKET, SO_ATTACH_BPF, &prog_fd,\n" " sizeof(prog_fd)) == 0);\n" "\\&\n" " for (;;) {\n" " key = IPPROTO_TCP;\n" " assert(bpf_lookup_elem(map_fd, &key, &tcp_cnt) == 0);\n" " key = IPPROTO_UDP;\n" " assert(bpf_lookup_elem(map_fd, &key, &udp_cnt) == 0);\n" " printf(\"TCP %lld UDP %lld packets\\en\", tcp_cnt, udp_cnt);\n" " sleep(1);\n" " }\n" "\\&\n" " return 0;\n" "}\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Some complete working code can be found in the I directory in " "the kernel source tree." msgstr "" #. type: SH #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed #, no-wrap msgid "SEE ALSO" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "B(2), B(7), B(7), B(8), B(8)" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide #: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed msgid "" "Both classic and extended BPF are explained in the kernel source file " "I." msgstr "" #. type: TH #: debian-bookworm #, no-wrap msgid "2023-02-05" msgstr "" #. type: TH #: debian-bookworm #, no-wrap msgid "Linux man-pages 6.03" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" "union bpf_attr {\n" " struct { /* Used by BPF_MAP_CREATE */\n" " __u32 map_type;\n" " __u32 key_size; /* size of key in bytes */\n" " __u32 value_size; /* size of value in bytes */\n" " __u32 max_entries; /* maximum number of entries\n" " in a map */\n" " };\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" " struct { /* Used by BPF_MAP_*_ELEM and BPF_MAP_GET_NEXT_KEY\n" " commands */\n" " __u32 map_fd;\n" " __aligned_u64 key;\n" " union {\n" " __aligned_u64 value;\n" " __aligned_u64 next_key;\n" " };\n" " __u64 flags;\n" " };\n" msgstr "" #. commit 2541517c32be2531e0da59dfd7efc1ce844644f5 #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" " struct { /* Used by BPF_PROG_LOAD */\n" " __u32 prog_type;\n" " __u32 insn_cnt;\n" " __aligned_u64 insns; /* \\[aq]const struct bpf_insn *\\[aq] */\n" " __aligned_u64 license; /* \\[aq]const char *\\[aq] */\n" " __u32 log_level; /* verbosity level of verifier */\n" " __u32 log_size; /* size of user buffer */\n" " __aligned_u64 log_buf; /* user supplied \\[aq]char *\\[aq]\n" " buffer */\n" " __u32 kern_version;\n" " /* checked when prog_type=kprobe\n" " (since Linux 4.1) */\n" " };\n" "} __attribute__((aligned(8)));\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" "int\n" "bpf_create_map(enum bpf_map_type map_type,\n" " unsigned int key_size,\n" " unsigned int value_size,\n" " unsigned int max_entries)\n" "{\n" " union bpf_attr attr = {\n" " .map_type = map_type,\n" " .key_size = key_size,\n" " .value_size = value_size,\n" " .max_entries = max_entries\n" " };\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" " return bpf(BPF_MAP_CREATE, &attr, sizeof(attr));\n" "}\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" "int\n" "bpf_lookup_elem(int fd, const void *key, void *value)\n" "{\n" " union bpf_attr attr = {\n" " .map_fd = fd,\n" " .key = ptr_to_u64(key),\n" " .value = ptr_to_u64(value),\n" " };\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" " return bpf(BPF_MAP_LOOKUP_ELEM, &attr, sizeof(attr));\n" "}\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" "int\n" "bpf_update_elem(int fd, const void *key, const void *value,\n" " uint64_t flags)\n" "{\n" " union bpf_attr attr = {\n" " .map_fd = fd,\n" " .key = ptr_to_u64(key),\n" " .value = ptr_to_u64(value),\n" " .flags = flags,\n" " };\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" " return bpf(BPF_MAP_UPDATE_ELEM, &attr, sizeof(attr));\n" "}\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" "int\n" "bpf_delete_elem(int fd, const void *key)\n" "{\n" " union bpf_attr attr = {\n" " .map_fd = fd,\n" " .key = ptr_to_u64(key),\n" " };\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" " return bpf(BPF_MAP_DELETE_ELEM, &attr, sizeof(attr));\n" "}\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" "int\n" "bpf_get_next_key(int fd, const void *key, void *next_key)\n" "{\n" " union bpf_attr attr = {\n" " .map_fd = fd,\n" " .key = ptr_to_u64(key),\n" " .next_key = ptr_to_u64(next_key),\n" " };\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" " return bpf(BPF_MAP_GET_NEXT_KEY, &attr, sizeof(attr));\n" "}\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "char bpf_log_buf[LOG_BUF_SIZE];\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" "int\n" "bpf_prog_load(enum bpf_prog_type type,\n" " const struct bpf_insn *insns, int insn_cnt,\n" " const char *license)\n" "{\n" " union bpf_attr attr = {\n" " .prog_type = type,\n" " .insns = ptr_to_u64(insns),\n" " .insn_cnt = insn_cnt,\n" " .license = ptr_to_u64(license),\n" " .log_buf = ptr_to_u64(bpf_log_buf),\n" " .log_size = LOG_BUF_SIZE,\n" " .log_level = 1,\n" " };\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" " return bpf(BPF_PROG_LOAD, &attr, sizeof(attr));\n" "}\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 msgid "" "I verbosity level of the verifier. A value of zero means that " "the verifier will not provide a log; in this case, I must be a NULL " "pointer, and I must be zero." msgstr "" #. type: SH #: debian-bookworm #, no-wrap msgid "VERSIONS" msgstr "" #. type: Plain text #: debian-bookworm msgid "The B() system call first appeared in Linux 3.18." msgstr "" #. type: Plain text #: debian-bookworm msgid "The B() system call is Linux-specific." msgstr "" #. commit 290af86629b25ffd1ed6232c4e9107da031705cb #. type: Plain text #: debian-bookworm fedora-40 mageia-cauldron opensuse-leap-15-6 msgid "" "Since Linux 4.15, the kernel may configured with the " "B option. In this case, the JIT compiler is " "always enabled, and the I is initialized to 1 and is " "immutable. (This kernel configuration option was provided as a mitigation " "for one of the Spectre attacks against the BPF interpreter.)" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" "/* bpf+sockets example:\n" " * 1. create array map of 256 elements\n" " * 2. load program that counts number of packets received\n" " * r0 = skb-Edata[ETH_HLEN + offsetof(struct iphdr, protocol)]\n" " * map[r0]++\n" " * 3. attach prog_fd to raw socket via setsockopt()\n" " * 4. print number of received TCP/UDP packets every second\n" " */\n" "int\n" "main(int argc, char *argv[])\n" "{\n" " int sock, map_fd, prog_fd, key;\n" " long long value = 0, tcp_cnt, udp_cnt;\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" " map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(key),\n" " sizeof(value), 256);\n" " if (map_fd E 0) {\n" " printf(\"failed to create map \\[aq]%s\\[aq]\\en\", strerror(errno));\n" " /* likely not run as root */\n" " return 1;\n" " }\n" msgstr "" #. == atomic64_add #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" " struct bpf_insn prog[] = {\n" " BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), /* r6 = r1 */\n" " BPF_LD_ABS(BPF_B, ETH_HLEN + offsetof(struct iphdr, protocol)),\n" " /* r0 = ip-Eproto */\n" " BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4),\n" " /* *(u32 *)(fp - 4) = r0 */\n" " BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* r2 = fp */\n" " BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = r2 - 4 */\n" " BPF_LD_MAP_FD(BPF_REG_1, map_fd), /* r1 = map_fd */\n" " BPF_CALL_FUNC(BPF_FUNC_map_lookup_elem),\n" " /* r0 = map_lookup(r1, r2) */\n" " BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),\n" " /* if (r0 == 0) goto pc+2 */\n" " BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */\n" " BPF_XADD(BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0),\n" " /* lock *(u64 *) r0 += r1 */\n" " BPF_MOV64_IMM(BPF_REG_0, 0), /* r0 = 0 */\n" " BPF_EXIT_INSN(), /* return r0 */\n" " };\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" " prog_fd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, prog,\n" " sizeof(prog) / sizeof(prog[0]), \"GPL\");\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid " sock = open_raw_sock(\"lo\");\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" " assert(setsockopt(sock, SOL_SOCKET, SO_ATTACH_BPF, &prog_fd,\n" " sizeof(prog_fd)) == 0);\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" " for (;;) {\n" " key = IPPROTO_TCP;\n" " assert(bpf_lookup_elem(map_fd, &key, &tcp_cnt) == 0);\n" " key = IPPROTO_UDP;\n" " assert(bpf_lookup_elem(map_fd, &key, &udp_cnt) == 0);\n" " printf(\"TCP %lld UDP %lld packets\\en\", tcp_cnt, udp_cnt);\n" " sleep(1);\n" " }\n" msgstr "" #. type: Plain text #: debian-bookworm opensuse-leap-15-6 #, no-wrap msgid "" " return 0;\n" "}\n" msgstr "" #. type: TH #: fedora-40 mageia-cauldron #, no-wrap msgid "2023-11-01" msgstr "" #. type: TH #: fedora-40 mageia-cauldron #, no-wrap msgid "Linux man-pages 6.06" msgstr "" #. type: TH #: fedora-rawhide #, no-wrap msgid "2024-03-18" msgstr "" #. type: TH #: fedora-rawhide #, no-wrap msgid "Linux man-pages 6.7" msgstr "" #. type: TH #: opensuse-leap-15-6 #, no-wrap msgid "2023-03-30" msgstr "" #. type: TH #: opensuse-leap-15-6 #, no-wrap msgid "Linux man-pages 6.04" msgstr "" #. type: TH #: opensuse-tumbleweed #, no-wrap msgid "Linux man-pages (unreleased)" msgstr ""