tools/bpf/bpftool/Documentation/bpftool-iter.rst
.. SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
:Manual section: 8
.. include:: substitutions.rst
**bpftool** [*OPTIONS*] **iter** *COMMAND*
*OPTIONS* := { |COMMON_OPTIONS| }
*COMMANDS* := { **pin** | **help** }
| bpftool iter pin OBJ PATH [map MAP] | bpftool iter help | | OBJ := /a/file/of/bpf_iter_target.o | MAP := { id MAP_ID | pinned FILE }
**bpftool iter pin** *OBJ* *PATH* [**map** *MAP*]
A bpf iterator combines a kernel iterating of
particular kernel data (e.g., tasks, bpf_maps, etc.)
and a bpf program called for each kernel data object
(e.g., one task, one bpf_map, etc.). User space can
*read* kernel iterator output through *read()* syscall.
The *pin* command creates a bpf iterator from *OBJ*,
and pin it to *PATH*. The *PATH* should be located
in *bpffs* mount. It must not contain a dot
character ('.'), which is reserved for future extensions
of *bpffs*.
Map element bpf iterator requires an additional parameter
*MAP* so bpf program can iterate over map elements for
that map. User can have a bpf program in kernel to run
with each map element, do checking, filtering, aggregation,
etc. without copying data to user space.
User can then *cat PATH* to see the bpf iterator output.
**bpftool iter help**
Print short help message.
.. include:: common_options.rst
# bpftool iter pin bpf_iter_netlink.o /sys/fs/bpf/my_netlink
::
Create a file-based bpf iterator from bpf_iter_netlink.o and pin it to /sys/fs/bpf/my_netlink
# bpftool iter pin bpf_iter_hashmap.o /sys/fs/bpf/my_hashmap map id 20
::
Create a file-based bpf iterator from bpf_iter_hashmap.o and map with id 20, and pin it to /sys/fs/bpf/my_hashmap