.nf
.B #include <linux/bpf.h>
-.BI "int bpf(int " cmd ", union bpf_attr *" attr ", unsigned int " size ");
+.BI "int bpf(int " cmd ", union bpf_attr *" attr ", unsigned int " size );
.fi
.SH DESCRIPTION
The
The operation to be performed by the
.BR bpf ()
system call is determined by the
-.IR cmd
+.I cmd
argument.
Each operation takes an accompanying argument,
provided via
.IR attr ,
which is a pointer to a union of type
-.IR bpf_attr
+.I bpf_attr
(see below).
The
.I size
.IR attr .
.PP
The value provided in
-.IR cmd
+.I cmd
is one of the following:
.TP
.B BPF_MAP_CREATE
.BR bpf ()
commands can be used to access the maps.
The functions use the
-.IR cmd
+.I cmd
argument to invoke different operations.
.TP
.B BPF_MAP_CREATE
beyond the specified
.IR value_size .
For example, when a map is created with a
-.IR key_size
+.I key_size
of 8 and the eBPF program calls
.IP
.in +4n
expects to read 8 bytes from the location pointed to by
.IR key ,
but the
-.IR "fp\ -\ 4"
+.I fp\ -\ 4
(where
.I fp
is the top of the stack)
command looks up an element by
.I key
in the map referred to by the file descriptor
-.IR fd
+.I fd
and sets the
.I next_key
pointer to the key of the next element.
for atomic updates, a hash-table map should be used instead.
There is however one special case that can also be used with arrays:
the atomic built-in
-.BR __sync_fetch_and_add()
+.B __sync_fetch_and_add()
can be used on 32 and 64 bit atomic counters.
For example, it can be
applied on the whole value itself if it represents a single counter,
.\" the program can now access skb fields.
.\"
.TP
-.BR BPF_PROG_TYPE_KPROBE " (since Linux 4.1)
+.BR BPF_PROG_TYPE_KPROBE " (since Linux 4.1)"
.\" commit 2541517c32be2531e0da59dfd7efc1ce844644f5
[To be documented]
.\" FIXME Document this program type
.\"
.\" FIXME We need text here to describe 'kern_version'
.TP
-.BR BPF_PROG_TYPE_SCHED_CLS " (since Linux 4.1)
+.BR BPF_PROG_TYPE_SCHED_CLS " (since Linux 4.1)"
.\" commit 96be4325f443dbbfeb37d2a157675ac0736531a1
.\" commit e2e9b6541dd4b31848079da80fe2253daaafb549
[To be documented]
.\" Describe allowed helper functions for this program type
.\" Describe bpf_context for this program type
.TP
-.BR BPF_PROG_TYPE_SCHED_ACT " (since Linux 4.1)
+.BR BPF_PROG_TYPE_SCHED_ACT " (since Linux 4.1)"
.\" commit 94caee8c312d96522bcdae88791aaa9ebcd5f22c
.\" commit a8cb5f556b567974d75ea29c15181c445c541b1f
[To be documented]
.EE
.PP
Some complete working code can be found in the
-.IR samples/bpf
+.I samples/bpf
directory in the kernel source tree.
.SH RETURN VALUE
For a successful call, the return value depends on the operation:
is set appropriately.
.SH ERRORS
.TP
-.BR E2BIG
+.B E2BIG
The eBPF program is too large or a map reached the
.I max_entries
limit (maximum number of elements).
.TP
-.BR EACCES
+.B EACCES
For
-.BR BPF_PROG_LOAD,
+.BR BPF_PROG_LOAD ,
even though all program instructions are valid, the program has been
rejected because it was deemed unsafe.
This may be because it may have
.TP
.B EINVAL
For
-.BR BPF_MAP_*_ELEM
+.B BPF_MAP_*_ELEM
commands,
some of the fields of
.I "union bpf_attr"
.TP
.B EINVAL
For
-.BR BPF_PROG_LOAD,
+.BR BPF_PROG_LOAD ,
indicates an attempt to load an invalid program.
eBPF programs can be deemed
invalid due to unrecognized instructions, the use of reserved fields, jumps
out of range, infinite loops or calls of unknown functions.
.TP
-.BR ENOENT
+.B ENOENT
For
.B BPF_MAP_LOOKUP_ELEM
or
Debugging mode.
The generated opcodes are dumped in hexadecimal into the kernel log.
These opcodes can then be disassembled using the program
-.IR tools/net/bpf_jit_disasm.c
+.I tools/net/bpf_jit_disasm.c
provided in the kernel source tree.
.PP
Since Linux 4.15,