tools: bpftool: add "bpftool map freeze" subcommand

Add a new subcommand to freeze maps from user space.

Signed-off-by: Quentin Monnet <quentin.monnet@netronome.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

diff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst
index 61d1d270eb5eb577a28e178710ea59cd5fec60c8..1c0f7146aab0a8fc749f6ec87aae642fd3552783 100644 (file)
--- a/tools/bpf/bpftool/Documentation/bpftool-map.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst
@@ -36,6 +36,7 @@ MAP COMMANDS
 |      **bpftool** **map pop**        *MAP*
 |      **bpftool** **map enqueue**    *MAP* **value** *VALUE*
 |      **bpftool** **map dequeue**    *MAP*
+|      **bpftool** **map freeze**     *MAP*
 |      **bpftool** **map help**
 |
 |      *MAP* := { **id** *MAP_ID* | **pinned** *FILE* }
@@ -127,6 +128,14 @@ DESCRIPTION
        **bpftool map dequeue**  *MAP*
                  Dequeue and print **value** from the queue.
 
+       **bpftool map freeze**  *MAP*
+                 Freeze the map as read-only from user space. Entries from a
+                 frozen map can not longer be updated or deleted with the
+                 **bpf\ ()** system call. This operation is not reversible,
+                 and the map remains immutable from user space until its
+                 destruction. However, read and write permissions for BPF
+                 programs to the map remain unchanged.
+
        **bpftool map help**
                  Print short help message.
 

diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool
index 2ffd351f9dbfeca1b3b912c6f762e602f2bf7616..70493a6da206728112149cbb7aa31f3b8448197a 100644 (file)
--- a/tools/bpf/bpftool/bash-completion/bpftool
+++ b/tools/bpf/bpftool/bash-completion/bpftool
@@ -449,7 +449,7 @@ _bpftool()
         map)
             local MAP_TYPE='id pinned'
             case $command in
-                show|list|dump|peek|pop|dequeue)
+                show|list|dump|peek|pop|dequeue|freeze)
                     case $prev in
                         $command)
                             COMPREPLY=( $( compgen -W "$MAP_TYPE" -- "$cur" ) )
@@ -638,7 +638,7 @@ _bpftool()
                     [[ $prev == $object ]] && \
                         COMPREPLY=( $( compgen -W 'delete dump getnext help \
                             lookup pin event_pipe show list update create \
-                            peek push enqueue pop dequeue' -- \
+                            peek push enqueue pop dequeue freeze' -- \
                             "$cur" ) )
                     ;;
             esac

diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index af2e9eb9747bbff04fc49efb9ada30fbb2d3cf46..de61d73b9030b27b5d993040afb6738f416a6c72 100644 (file)
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -1262,6 +1262,35 @@ exit_free:
        return err;
 }
 
+static int do_freeze(int argc, char **argv)
+{
+       int err, fd;
+
+       if (!REQ_ARGS(2))
+               return -1;
+
+       fd = map_parse_fd(&argc, &argv);
+       if (fd < 0)
+               return -1;
+
+       if (argc) {
+               close(fd);
+               return BAD_ARG();
+       }
+
+       err = bpf_map_freeze(fd);
+       close(fd);
+       if (err) {
+               p_err("failed to freeze map: %s", strerror(errno));
+               return err;
+       }
+
+       if (json_output)
+               jsonw_null(json_wtr);
+
+       return 0;
+}
+
 static int do_help(int argc, char **argv)
 {
        if (json_output) {
@@ -1286,6 +1315,7 @@ static int do_help(int argc, char **argv)
                "       %s %s pop        MAP\n"
                "       %s %s enqueue    MAP value VALUE\n"
                "       %s %s dequeue    MAP\n"
+               "       %s %s freeze     MAP\n"
                "       %s %s help\n"
                "\n"
                "       " HELP_SPEC_MAP "\n"
@@ -1304,7 +1334,8 @@ static int do_help(int argc, char **argv)
                bin_name, argv[-2], bin_name, argv[-2], bin_name, argv[-2],
                bin_name, argv[-2], bin_name, argv[-2], bin_name, argv[-2],
                bin_name, argv[-2], bin_name, argv[-2], bin_name, argv[-2],
-               bin_name, argv[-2], bin_name, argv[-2], bin_name, argv[-2]);
+               bin_name, argv[-2], bin_name, argv[-2], bin_name, argv[-2],
+               bin_name, argv[-2]);
 
        return 0;
 }
@@ -1326,6 +1357,7 @@ static const struct cmd cmds[] = {
        { "enqueue",    do_update },
        { "pop",        do_pop_dequeue },
        { "dequeue",    do_pop_dequeue },
+       { "freeze",     do_freeze },
        { 0 }
 };