Helper function `bpf_map_lookup_elem`

The lookup map element helper call is used to read values from maps.

Note

This helper function is only callable from eBPF, but has the same name as the bpf_map_lookup_elem userspace library function, which can only be used from userspace programs.

Definition

Copyright (c) 2015 The Libbpf Authors. All rights reserved.

Perform a lookup in map for an entry associated to key.

Returns

Map value associated to key, or NULL if no entry was found.

static void *(* const bpf_map_lookup_elem)(void *map, const void *key) = (void *) 1;

Usage

The map argument must be a pointer to a map definition and key must be a pointer to the key you wish to lookup.

The return value will be a pointer to the map value or NULL. The value is a direct reference to the kernel memory where this map value is stored, not a copy. Therefor any modifications made to the value are automatically persisted without the need to call any additional helpers.

Warning

modifying map values of non per-CPU maps is subject to race conditions, atomic instructions or spinlocks must be utilized to prevent race conditions if they are detrimental to your use case.

Program types

This helper call can be used in the following program types:

Map types

This helper call can be used with the following map types:

Example

/* Very simple code, increment every time someone calls openat() syscall */

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>

struct {
    __uint(type, BPF_MAP_TYPE_ARRAY);
    __type(key, u32);
    __type(value, u32);
    __uint(max_entries, 1);
} cnt_map SEC(".maps");

SEC("tracepoint/syscalls/sys_enter_openat")
int bpf_prog1(void* ctx)
{
    const char fmt_str[] = "Hello, world! number of openat calls total %d\n";
    u32 key = 0, init_val=0;
    u32 *cnt = bpf_map_lookup_elem(&cnt_map, &key);
    if(cnt) {
        __sync_fetch_and_add(cnt, 1);
    } else {
        bpf_map_update_elem(&cnt_map, &key, &init_val, BPF_ANY);
        return 0;
    }
    bpf_trace_printk(fmt_str, sizeof(fmt_str), *cnt);
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

Helper function bpf_map_lookup_elem