AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/09/07 00:53	flow	patch-triage	0m Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "KMSANReasoning": "", "NeedsKMSAN": false, "Reasoning": "The patch only modifies user-space code in tools/bpf/bpftool and tools/testing/selftests/bpf. It does not affect the compiled kernel image (vmlinux) or kernel modules, and is therefore not relevant for syzkaller fuzzing.", "WorthFuzzing": false }
1/1	2026/09/07 00:53	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit bdb56f341f227275b28d1a12610b1ead5b724702\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Mon Sep 7 00:53:30 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst\nindex 5daf3de5c7446..c135338600e8f 100644\n--- a/tools/bpf/bpftool/Documentation/bpftool-map.rst\n+++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst\n@@ -16,7 +16,7 @@ SYNOPSIS\n \n bpftool [OPTIONS] map COMMAND\n \n-OPTIONS := { \|COMMON_OPTIONS\| \| { -f \| --bpffs } \| { -n \| --nomount } }\n+OPTIONS := { \|COMMON_OPTIONS\| \| { -f \| --bpffs } \| { -n \| --nomount } \| { -r \| --recursive } }\n \n COMMANDS :=\n { show \| list \| create \| dump \| update \| lookup \| getnext \|\n@@ -170,6 +170,23 @@ OPTIONS\n Do not automatically attempt to mount any virtual file system (such as\n tracefs or BPF virtual file system) when necessary.\n \n+-r, --recursive\n+ Also dump the inner maps referenced by array_of_maps and hash_of_maps\n+ entries when running map dump. Each map is dumped once, even if several\n+ entries refer to it. Selected maps are followed by their inner maps.\n+\n+ Plain output includes a header identifying each map. On success, JSON output\n+ is always an array of map objects, each containing an id and an\n+ elements array, including when only one map is dumped. Outer map entries\n+ retain their inner_map_id field, which identifies the corresponding inner\n+ map object.\n+\n+ The dump is not a snapshot: concurrent updates can change map contents.\n+ Failure to open a referenced inner map stops the dump and returns a nonzero\n+ exit status. Output may contain maps or entries printed before the error.\n+ In JSON mode, an error during traversal is included in the output and the\n+ enclosing arrays and objects are closed.\n+\n EXAMPLES\n ========\n # bpftool map show\ndiff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool\nindex 75cbcb512ebae..45c336d63be0a 100644\n--- a/tools/bpf/bpftool/bash-completion/bpftool\n+++ b/tools/bpf/bpftool/bash-completion/bpftool\n@@ -261,7 +261,7 @@ _bpftool()\n \n # Deal with options\n if [[ ${words[cword]} == -* ]]; then\n- local c='--version --json --pretty --bpffs --mapcompat --debug \\\n+ local c='--version --json --pretty --recursive --bpffs --mapcompat --debug \\\n --use-loader --base-btf --sign -i -k'\n COMPREPLY=( $( compgen -W \"$c\" -- \"$cur\" ) )\n return 0\ndiff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c\nindex c91e1a6e1a1ec..29021f4dd4518 100644\n--- a/tools/bpf/bpftool/main.c\n+++ b/tools/bpf/bpftool/main.c\n@@ -26,6 +26,7 @@ static int (last_do_help)(int argc, char argv);\n json_writer_t json_wtr;\n bool pretty_output;\n bool json_output;\n+bool recursive;\n bool show_pinned;\n bool block_mount;\n bool verifier_logs;\n@@ -452,6 +453,7 @@ int main(int argc, char argv)\n \t\t{ \"json\",\tno_argument,\tNULL,\t'j' },\n \t\t{ \"help\",\tno_argument,\tNULL,\t'h' },\n \t\t{ \"pretty\",\tno_argument,\tNULL,\t'p' },\n+\t\t{ \"recursive\",\tno_argument,\tNULL,\t'r' },\n \t\t{ \"version\",\tno_argument,\tNULL,\t'V' },\n \t\t{ \"bpffs\",\tno_argument,\tNULL,\t'f' },\n \t\t{ \"mapcompat\",\tno_argument,\tNULL,\t'm' },\n@@ -485,7 +487,7 @@ int main(int argc, char argv)\n \tbin_name = \"bpftool\";\n \n \topterr = 0;\n-\twhile ((opt = getopt_long(argc, argv, \"VhpjfLmndSi:k:B:l\",\n+\twhile ((opt = getopt_long(argc, argv, \"VhpjrfLmndSi:k:B:l\",\n \t\t\t\t options, NULL)) \u003e= 0) {\n \t\tswitch (opt) {\n \t\tcase 'V':\n@@ -507,6 +509,9 @@ int main(int argc, char *argv)\n \t\t\t}\n \t\t\tjsonw_pretty(json_wtr, pretty_output);\n \t\t\tbreak;\n+\t\tcase 'r':\n+\t\t\trecursive = true;\n+\t\t\tbreak;\n \t\tcase 'f':\n \t\t\tshow_pinned = true;\n \t\t\tbreak;\ndiff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h\nindex 78b6e0ebb85d8..b5dc7960cf682 100644\n--- a/tools/bpf/bpftool/main.h\n+++ b/tools/bpf/bpftool/main.h\n@@ -83,6 +83,7 @@ extern const char bin_name;\n \n extern json_writer_t json_wtr;\n extern bool json_output;\n+extern bool recursive;\n extern bool show_pinned;\n extern bool show_pids;\n extern bool block_mount;\ndiff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c\nindex 684a8fb724146..853f775b7d529 100644\n--- a/tools/bpf/bpftool/map.c\n+++ b/tools/bpf/bpftool/map.c\n@@ -745,8 +745,10 @@ static int dump_map_elem(int fd, void key, void value,\n \t\t\t json_writer_t btf_wtr)\n {\n \tif (bpf_map_lookup_elem(fd, key, value)) {\n-\t\tprint_entry_error(map_info, key, errno);\n-\t\treturn -1;\n+\t\tint lookup_errno = errno;\n+\n+\t\tprint_entry_error(map_info, key, lookup_errno);\n+\t\treturn -lookup_errno;\n \t}\n \n \tif (json_output) {\n@@ -826,12 +828,53 @@ static void free_map_kv_btf(struct btf btf)\n \t\tbtf__free(btf);\n }\n \n+struct map_dump_ctx {\n+\tstruct hashmap seen;\n+\tint *fds;\n+\tint nb_fds;\n+};\n+\n+static int collect_inner_map(struct map_dump_ctx ctx, __u32 id)\n+{\n+\tLIBBPF_OPTS(bpf_get_fd_by_id_opts, opts,\n+\t\t.open_flags = BPF_F_RDONLY,\n+\t);\n+\tint fds, fd, err;\n+\n+\tif (hashmap__find(ctx-\u003eseen, id, NULL))\n+\t\treturn 0;\n+\n+\tfd = bpf_map_get_fd_by_id_opts(id, \u0026opts);\n+\tif (fd \u003c 0) {\n+\t\tp_err(\"can't open inner map id %u: %s\", id, strerror(errno));\n+\t\treturn -1;\n+\t}\n+\n+\tfds = realloc(ctx-\u003efds, (ctx-\u003enb_fds + 1ULL) * sizeof(fds));\n+\tif (!fds) {\n+\t\tp_err(\"mem alloc failed\");\n+\t\tclose(fd);\n+\t\treturn -1;\n+\t}\n+\tctx-\u003efds = fds;\n+\n+\terr = hashmap__add(ctx-\u003eseen, id, 0);\n+\tif (err) {\n+\t\tp_err(\"failed to record inner map id %u: %s\", id, strerror(-err));\n+\t\tclose(fd);\n+\t\treturn -1;\n+\t}\n+\tfds[(ctx-\u003enb_fds)++] = fd;\n+\treturn 0;\n+}\n+\n static int\n map_dump(int fd, struct bpf_map_info info, json_writer_t wtr,\n-\t bool show_header)\n+\t bool show_header, struct map_dump_ctx ctx)\n {\n \tvoid key, value, prev_key;\n \tunsigned int num_elems = 0;\n+\tjson_writer_t plain_btf_wtr = NULL;\n \tstruct btf btf = NULL;\n \tint err;\n \n@@ -845,6 +888,17 @@ map_dump(int fd, struct bpf_map_info info, json_writer_t wtr,\n \n \tprev_key = NULL;\n \n+\tif (ctx \u0026\u0026 !wtr \u0026\u0026 (info-\u003ebtf_value_type_id \|\|\n+\t\t\t info-\u003ebtf_vmlinux_value_type_id)) {\n+\t\tplain_btf_wtr = get_btf_writer();\n+\t\tif (plain_btf_wtr) {\n+\t\t\tif (show_header)\n+\t\t\t\tshow_map_header_plain(info);\n+\t\t\tshow_header = false;\n+\t\t\twtr = plain_btf_wtr;\n+\t\t}\n+\t}\n+\n \tif (wtr) {\n \t\terr = get_map_kv_btf(info, \u0026btf);\n \t\tif (err) {\n@@ -874,10 +928,22 @@ map_dump(int fd, struct bpf_map_info info, json_writer_t wtr,\n \t\tif (err) {\n \t\t\tif (errno == ENOENT)\n \t\t\t\terr = 0;\n+\t\t\telse if (ctx)\n+\t\t\t\tp_err(\"can't get next key for map id %u: %s\",\n+\t\t\t\t info-\u003eid, strerror(errno));\n \t\t\tbreak;\n \t\t}\n-\t\tif (!dump_map_elem(fd, key, value, info, btf, wtr))\n+\t\terr = dump_map_elem(fd, key, value, info, btf, wtr);\n+\t\tif (!err) {\n \t\t\tnum_elems++;\n+\t\t\tif (ctx \u0026\u0026 map_is_map_of_maps(info-\u003etype)) {\n+\t\t\t\terr = collect_inner_map(ctx, (__u32 )value);\n+\t\t\t\tif (err)\n+\t\t\t\t\tbreak;\n+\t\t\t}\n+\t\t} else if (ctx \u0026\u0026 err != -ENOENT) {\n+\t\t\tbreak;\n+\t\t}\n \t\tprev_key = key;\n \t}\n \n@@ -894,6 +960,8 @@ map_dump(int fd, struct bpf_map_info info, json_writer_t wtr,\n \tfree(key);\n \tfree(value);\n \tfree_map_kv_btf(btf);\n+\tif (plain_btf_wtr)\n+\t\tjsonw_destroy(\u0026plain_btf_wtr);\n \n \treturn err;\n }\n@@ -902,6 +970,7 @@ static int do_dump(int argc, char argv)\n {\n \tjson_writer_t wtr = NULL, btf_wtr = NULL;\n \tstruct bpf_map_info info = {};\n+\tstruct map_dump_ctx ctx = {};\n \tint nb_fds, i = 0;\n \t__u32 len = sizeof(info);\n \tint fds = NULL;\n@@ -919,9 +988,36 @@ static int do_dump(int argc, char *argv)\n \tif (nb_fds \u003c 1)\n \t\tgoto exit_free;\n \n+\tif (recursive) {\n+\t\tctx.seen = hashmap__new(hash_fn_for_key_as_id,\n+\t\t\t\t\tequal_fn_for_key_as_id, NULL);\n+\t\tif (IS_ERR(ctx.seen)) {\n+\t\t\tctx.seen = NULL;\n+\t\t\tp_err(\"failed to create hashmap for recursive dump\");\n+\t\t\tgoto exit_close;\n+\t\t}\n+\t\tctx.fds = \u0026fds;\n+\t\tctx.nb_fds = \u0026nb_fds;\n+\t\t/ Record the selected maps before discovering any inner maps. /\n+\t\tfor (i = 0; i \u003c nb_fds; i++) {\n+\t\t\tlen = sizeof(info);\n+\t\t\tif (bpf_map_get_info_by_fd(fds[i], \u0026info, \u0026len)) {\n+\t\t\t\tp_err(\"can't get map info: %s\", strerror(errno));\n+\t\t\t\terr = -1;\n+\t\t\t\tgoto exit_close;\n+\t\t\t}\n+\t\t\terr = hashmap__add(ctx.seen, info.id, 0);\n+\t\t\tif (err) {\n+\t\t\t\tp_err(\"failed to record map id %u: %s\", info.id,\n+\t\t\t\t strerror(-err));\n+\t\t\t\tgoto exit_close;\n+\t\t\t}\n+\t\t}\n+\t}\n+\n \tif (json_output) {\n \t\twtr = json_wtr;\n-\t} else {\n+\t} else if (!recursive) {\n \t\tint do_plain_btf;\n \n \t\tdo_plain_btf = maps_have_btf(fds, nb_fds);\n@@ -936,7 +1032,7 @@ static int do_dump(int argc, char argv)\n \t\t}\n \t}\n \n-\tif (wtr \u0026\u0026 nb_fds \u003e 1)\n+\tif (wtr \u0026\u0026 (nb_fds \u003e 1 \|\| recursive))\n \t\tjsonw_start_array(wtr);\t/ root array /\n \tfor (i = 0; i \u003c nb_fds; i++) {\n \t\tif (bpf_map_get_info_by_fd(fds[i], \u0026info, \u0026len)) {\n@@ -944,22 +1040,28 @@ static int do_dump(int argc, char argv)\n \t\t\terr = -1;\n \t\t\tbreak;\n \t\t}\n-\t\terr = map_dump(fds[i], \u0026info, wtr, nb_fds \u003e 1);\n+\t\terr = map_dump(fds[i], \u0026info, wtr, nb_fds \u003e 1 \|\| recursive,\n+\t\t\t recursive ? \u0026ctx : NULL);\n \t\tif (!wtr \u0026\u0026 i != nb_fds - 1)\n \t\t\tprintf(\"\\n\");\n \n \t\tif (err)\n \t\t\tbreak;\n-\t\tclose(fds[i]);\n+\t\t/ Keep discovered maps alive until the recursive dump is complete. /\n+\t\tif (!recursive)\n+\t\t\tclose(fds[i]);\n \t}\n-\tif (wtr \u0026\u0026 nb_fds \u003e 1)\n+\tif (wtr \u0026\u0026 (nb_fds \u003e 1 \|\| recursive))\n \t\tjsonw_end_array(wtr);\t/ root array /\n \n \tif (btf_wtr)\n \t\tjsonw_destroy(\u0026btf_wtr);\n exit_close:\n+\tif (recursive)\n+\t\ti = 0;\n \tfor (; i \u003c nb_fds; i++)\n \t\tclose(fds[i]);\n+\thashmap__free(ctx.seen);\n exit_free:\n \tfree(fds);\n \tfree_btf_vmlinux();\n@@ -1484,7 +1586,7 @@ static int do_help(int argc, char argv)\n \t\t\" task_storage \| bloom_filter \| user_ringbuf \| cgrp_storage \| arena \|\\n\"\n \t\t\" insn_array \| rhash }\\n\"\n \t\t\" \" HELP_SPEC_OPTIONS \" \|\\n\"\n-\t\t\" {-f\|--bpffs} \| {-n\|--nomount} }\\n\"\n+\t\t\" {-f\|--bpffs} \| {-n\|--nomount} \| {-r\|--recursive} }\\n\"\n \t\t\"\",\n \t\tbin_name, argv[-2]);\n \ndiff --git a/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c\nnew file mode 100644\nindex 0000000000000..3c425dbe2d9d4\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c\n@@ -0,0 +1,252 @@\n+// SPDX-License-Identifier: GPL-2.0-only\n+#include \u003ctest_progs.h\u003e\n+#include \u003cbpftool_helpers.h\u003e\n+#include \u003cbpf/btf.h\u003e\n+\n+#define OUTPUT_SIZE 8192\n+\n+static bool dump_map(__u32 id, const char options, char output)\n+{\n+\tchar command[MAX_BPFTOOL_CMD_LEN];\n+\n+\tsnprintf(command, sizeof(command), \"%s map dump id %u\", options, id);\n+\tmemset(output, 0, OUTPUT_SIZE);\n+\tif (!ASSERT_OK(get_bpftool_command_output(command, output, OUTPUT_SIZE - 1),\n+\t\t \"dump_map\"))\n+\t\treturn false;\n+\t/ The helper doesn't terminate or strip the output. /\n+\toutput[strcspn(output, \"\\n\")] = '\\0';\n+\treturn true;\n+}\n+\n+static __u32 map_id(int fd)\n+{\n+\tstruct bpf_map_info info = {};\n+\t__u32 len = sizeof(info);\n+\n+\tif (!ASSERT_OK(bpf_map_get_info_by_fd(fd, \u0026info, \u0026len), \"map_info\"))\n+\t\treturn 0;\n+\treturn info.id;\n+}\n+\n+static int count_token(const char output, const char token)\n+{\n+\tint count = 0;\n+\n+\twhile ((output = strstr(output, token))) {\n+\t\tcount++;\n+\t\toutput += strlen(token);\n+\t}\n+\treturn count;\n+}\n+\n+static void check_plain(__u32 root_id, __u32 inner_id, const char type,\n+\t\t\tint entries, bool typed)\n+{\n+\tchar command[MAX_BPFTOOL_CMD_LEN], header[128];\n+\tchar output[OUTPUT_SIZE] = {};\n+\tconst char root, inner;\n+\n+\tsnprintf(command, sizeof(command), \"--recursive map dump id %u\", root_id);\n+\tif (!ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),\n+\t\t \"plain_dump\"))\n+\t\treturn;\n+\tsnprintf(header, sizeof(header), \"%u: %s name dump_outer \", root_id, type);\n+\troot = strstr(output, header);\n+\tif (!ASSERT_OK_PTR(root, \"plain_root_header\"))\n+\t\treturn;\n+\tASSERT_EQ(root - output, 0, \"plain_root_first\");\n+\tASSERT_EQ(count_token(output, \"inner_map_id:\"), entries, \"plain_references\");\n+\tif (entries) {\n+\t\tsnprintf(header, sizeof(header), \"%u: hash name dump_inner \", inner_id);\n+\t\tinner = strstr(output, header);\n+\t\tif (ASSERT_OK_PTR(inner, \"plain_inner_header\"))\n+\t\t\tASSERT_GT(inner - root, 0, \"plain_inner_after_root\");\n+\t\tASSERT_EQ(count_token(output, header), 1, \"plain_inner_once\");\n+\t}\n+\tASSERT_EQ(count_token(output, \"Found \"), entries \u0026\u0026 !typed ? 2 : 1,\n+\t\t \"plain_map_count\");\n+\tif (typed) {\n+\t\tASSERT_HAS_SUBSTR(output, \"\\\"key\\\": 0\", \"plain_btf_key\");\n+\t\tASSERT_HAS_SUBSTR(output, \"\\\"value\\\": 16843009\", \"plain_btf_value\");\n+\t}\n+}\n+\n+static void test_outer(enum bpf_map_type type, int entries, bool empty_inner,\n+\t\t bool typed)\n+{\n+\tLIBBPF_OPTS(bpf_map_create_opts, opts);\n+\tLIBBPF_OPTS(bpf_map_create_opts, inner_opts);\n+\tstruct btf btf = NULL;\n+\tchar outer[OUTPUT_SIZE], inner[OUTPUT_SIZE], output[OUTPUT_SIZE];\n+\tchar expected[OUTPUT_SIZE 3], reference[64];\n+\tconst char type_name = libbpf_bpf_map_type_str(type);\n+\tint inner_fd = -1, outer_fd = -1;\n+\t__u32 root_id, inner_id, key, value = 0x01010101;\n+\n+\tif (typed) {\n+\t\tbtf = btf__new_empty();\n+\t\tif (!ASSERT_OK_PTR(btf, \"create_btf\") \|\|\n+\t\t !ASSERT_EQ(btf__add_int(btf, \"unsigned int\", 4, 0), 1, \"btf_int\") \|\|\n+\t\t !ASSERT_OK(btf__load_into_kernel(btf), \"load_btf\"))\n+\t\t\tgoto out;\n+\t\tinner_opts.btf_fd = btf__fd(btf);\n+\t\tinner_opts.btf_key_type_id = 1;\n+\t\tinner_opts.btf_value_type_id = 1;\n+\t}\n+\tinner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, \"dump_inner\", sizeof(key),\n+\t\t\t\t sizeof(value), 2, \u0026inner_opts);\n+\tif (!ASSERT_OK_FD(inner_fd, \"create_inner\"))\n+\t\tgoto out;\n+\tkey = 0;\n+\tif (!empty_inner \u0026\u0026\n+\t !ASSERT_OK(bpf_map_update_elem(inner_fd, \u0026key, \u0026value, BPF_ANY),\n+\t\t \"populate_inner\"))\n+\t\tgoto out;\n+\topts.inner_map_fd = inner_fd;\n+\touter_fd = bpf_map_create(type, \"dump_outer\", sizeof(key), sizeof(__u32),\n+\t\t\t\t 3, \u0026opts);\n+\tif (!ASSERT_OK_FD(outer_fd, \"create_outer\"))\n+\t\tgoto out;\n+\t/ The unused third array slot also exercises failed lookups. /\n+\tfor (key = 0; key \u003c entries; key++)\n+\t\tif (!ASSERT_OK(bpf_map_update_elem(outer_fd, \u0026key, \u0026inner_fd, BPF_ANY),\n+\t\t\t \"populate_outer\"))\n+\t\t\tgoto out;\n+\troot_id = map_id(outer_fd);\n+\tinner_id = map_id(inner_fd);\n+\tif (!root_id \|\| !inner_id \|\| !dump_map(root_id, \"-j\", outer) \|\|\n+\t !dump_map(inner_id, \"-j\", inner))\n+\t\tgoto out;\n+\n+\tASSERT_EQ(outer[0], '[', \"default_array\");\n+\tASSERT_EQ(count_token(outer, \"\\\"elements\\\":\"), 0, \"default_no_wrapper\");\n+\tASSERT_EQ(count_token(outer, \"\\\"id\\\":\"), 0, \"default_no_header\");\n+\tsnprintf(reference, sizeof(reference), \"\\\"inner_map_id\\\":%u\", inner_id);\n+\tASSERT_EQ(count_token(outer, reference), entries, \"default_references\");\n+\tif (!entries)\n+\t\tASSERT_STREQ(outer, \"[]\", \"empty_outer_default\");\n+\tif (empty_inner)\n+\t\tASSERT_STREQ(inner, \"[]\", \"empty_inner_default\");\n+\telse if (typed)\n+\t\tASSERT_HAS_SUBSTR(inner, \"\\\"formatted\\\":{\\\"key\\\":0,\\\"value\\\":16843009}\",\n+\t\t\t\t \"typed_inner\");\n+\telse\n+\t\tASSERT_STREQ(inner,\n+\t\t\t \"[{\\\"key\\\":[\\\"0x00\\\",\\\"0x00\\\",\\\"0x00\\\",\\\"0x00\\\"],\"\n+\t\t\t \"\\\"value\\\":[\\\"0x01\\\",\\\"0x01\\\",\\\"0x01\\\",\\\"0x01\\\"]}]\",\n+\t\t\t \"ordinary_default\");\n+\n+\t/ Compare the complete JSON document: a flat array with the root first,\n+\t * one copy of the shared inner map, and unchanged entry representations.\n+\t /\n+\tif (entries)\n+\t\tsnprintf(expected, sizeof(expected),\n+\t\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"%s\\\",\\\"name\\\":\\\"dump_outer\\\",\"\n+\t\t\t \"\\\"flags\\\":0,\\\"elements\\\":%s},{\\\"id\\\":%u,\\\"type\\\":\\\"hash\\\",\"\n+\t\t\t \"\\\"name\\\":\\\"dump_inner\\\",\\\"flags\\\":0,\\\"elements\\\":%s}]\",\n+\t\t\t root_id, type_name, outer, inner_id, inner);\n+\telse\n+\t\tsnprintf(expected, sizeof(expected),\n+\t\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"%s\\\",\\\"name\\\":\\\"dump_outer\\\",\"\n+\t\t\t \"\\\"flags\\\":0,\\\"elements\\\":[]}]\", root_id, type_name);\n+\tif (dump_map(root_id, \"-j -r\", output))\n+\t\tASSERT_STREQ(output, expected, \"recursive_json\");\n+\tif (dump_map(root_id, \"--json --recursive\", output))\n+\t\tASSERT_STREQ(output, expected, \"recursive_long_options\");\n+\tcheck_plain(root_id, inner_id, type_name, entries, typed);\n+\n+\t/ Recursion on an ordinary map still emits a single map object. /\n+\tsnprintf(expected, sizeof(expected),\n+\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"hash\\\",\\\"name\\\":\\\"dump_inner\\\",\"\n+\t\t \"\\\"flags\\\":0,\\\"elements\\\":%s}]\", inner_id, inner);\n+\tif (dump_map(inner_id, \"-j -r\", output))\n+\t\tASSERT_STREQ(output, expected, \"ordinary_recursive\");\n+out:\n+\tif (outer_fd \u003e= 0)\n+\t\tclose(outer_fd);\n+\tif (inner_fd \u003e= 0)\n+\t\tclose(inner_fd);\n+\tbtf__free(btf);\n+}\n+\n+static void test_multiple_roots(void)\n+{\n+\tLIBBPF_OPTS(bpf_map_create_opts, opts);\n+\tchar command[MAX_BPFTOOL_CMD_LEN], name[BPF_OBJ_NAME_LEN];\n+\tchar output[OUTPUT_SIZE] = {}, expected[OUTPUT_SIZE 4], elements[OUTPUT_SIZE];\n+\tstatic const char * const types[] = { \"hash\", \"array_of_maps\", \"hash_of_maps\", \"hash\" };\n+\tint fds[] = { -1, -1, -1, -1 };\n+\t__u32 ids[4], key;\n+\tint i, len = 0;\n+\n+\t/* Select the first inner map and both outers as roots. The other inner\n+\t * map must be appended after all three roots, even though it is found\n+\t * while dumping the first outer. A process-specific name avoids other\n+\t * tests' maps joining the selection.\n+\t */\n+\tsnprintf(name, sizeof(name), \"dump_%u\", getpid());\n+\tfds[0] = bpf_map_create(BPF_MAP_TYPE_HASH, name, 4, 4, 1, NULL);\n+\tif (!ASSERT_OK_FD(fds[0], \"create_selected_inner\"))\n+\t\tgoto out;\n+\tfds[3] = bpf_map_create(BPF_MAP_TYPE_HASH, \"dump_discovered\", 4, 4, 1, NULL);\n+\tif (!ASSERT_OK_FD(fds[3], \"create_discovered_inner\"))\n+\t\tgoto out;\n+\topts.inner_map_fd = fds[0];\n+\tfds[1] = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, name, 4, 4, 2, \u0026opts);\n+\tif (!ASSERT_OK_FD(fds[1], \"create_array_root\"))\n+\t\tgoto out;\n+\tfds[2] = bpf_map_create(BPF_MAP_TYPE_HASH_OF_MAPS, name, 4, 4, 2, \u0026opts);\n+\tif (!ASSERT_OK_FD(fds[2], \"create_hash_root\"))\n+\t\tgoto out;\n+\tfor (i = 1; i \u003c= 2; i++) {\n+\t\tkey = 0;\n+\t\tif (!ASSERT_OK(bpf_map_update_elem(fds[i], \u0026key, \u0026fds[0], BPF_ANY),\n+\t\t\t \"reference_selected_inner\"))\n+\t\t\tgoto out;\n+\t\tkey = 1;\n+\t\tif (!ASSERT_OK(bpf_map_update_elem(fds[i], \u0026key, \u0026fds[3], BPF_ANY),\n+\t\t\t \"reference_discovered_inner\"))\n+\t\t\tgoto out;\n+\t}\n+\tfor (i = 0; i \u003c ARRAY_SIZE(fds); i++) {\n+\t\tids[i] = map_id(fds[i]);\n+\t\tif (!ids[i] \|\| !dump_map(ids[i], \"-j\", elements))\n+\t\t\tgoto out;\n+\t\tlen += snprintf(expected + len, sizeof(expected) - len,\n+\t\t\t\t\"%s{\\\"id\\\":%u,\\\"type\\\":\\\"%s\\\",\\\"name\\\":\\\"%s\\\",\"\n+\t\t\t\t\"\\\"flags\\\":0,\\\"elements\\\":%s}%s\",\n+\t\t\t\ti ? \",\" : \"[\", ids[i], types[i],\n+\t\t\t\ti == 3 ? \"dump_discovered\" : name, elements, i == 3 ? \"]\" : \"\");\n+\t}\n+\tsnprintf(command, sizeof(command), \"-j -r map dump name %s\", name);\n+\tif (ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),\n+\t\t \"dump_multiple_roots\")) {\n+\t\toutput[strcspn(output, \"\\n\")] = '\\0';\n+\t\tASSERT_STREQ(output, expected, \"roots_first_and_seed_dedup\");\n+\t}\n+out:\n+\tfor (i = 0; i \u003c ARRAY_SIZE(fds); i++)\n+\t\tif (fds[i] \u003e= 0)\n+\t\t\tclose(fds[i]);\n+}\n+\n+void test_bpftool_map_dump(void)\n+{\n+\tif (test__start_subtest(\"multiple_roots\"))\n+\t\ttest_multiple_roots();\n+\tif (test__start_subtest(\"array_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 1, false, false);\n+\tif (test__start_subtest(\"hash_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, false);\n+\tif (test__start_subtest(\"shared_inner\"))\n+\t\ttest_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 2, false, false);\n+\tif (test__start_subtest(\"empty_array_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 0, false, false);\n+\tif (test__start_subtest(\"empty_hash_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 0, false, false);\n+\tif (test__start_subtest(\"btf_inner\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, true);\n+\tif (test__start_subtest(\"empty_inner\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, true, false);\n+}\n" }
2/1	2026/09/07 00:53	agent	patch-evaluator	0m Model: core Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch only modifies user-space code in tools/bpf/bpftool and tools/testing/selftests/bpf. It does not affect the compiled kernel image (vmlinux) or kernel modules, and is therefore not relevant for syzkaller fuzzing.", "WorthFuzzing": false } Instruction: You are an expert Linux kernel maintainer and security engineer. Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on internal assumptions. You must actively use your code access tools to inspect the actual source code, callers, and surrounding context. ================================================================================ 1. CORE TRIAGE PHILOSOPHY ================================================================================ The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs, and newly triggered assertions introduced by the patch series. - REACHABILITY IS THE PRIMARY GATE: Fuzzing can only discover bugs in code that can actually execute in standard virtualized environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap). If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed, regardless of whether it adds assertions or complex logic. - DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS: Patch authors routinely label changes as "cleanups", "refactorings", or state "No functional change intended". Do NOT take these claims at face value. Code refactorings that rearrange logic, introduce helper functions, or alter state management in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs. If reachable executable code is modified or refactored, it MUST be fuzzed. - NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED: When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON, VM_WARN_ON, BUG_ON, lockdep_assert) in reachable code paths, it enforces new or stricter invariants. Even if the author believes the invariant always holds, fuzzing is essential to verify whether an unusual sequence of operations can violate it. ================================================================================ 2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA) ================================================================================ Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories: - Non-kernel and non-executable changes: * Modifications to Documentation/, comments, or spelling fixes. * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/) that do not affect the compiled kernel image (vmlinux) or kernel modules. * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints that do not alter control flow or data structures. * Build system or Kconfig changes that do not alter compiled C logic. - Structurally unreachable hardware: * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU. - Unreachable execution paths: * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during physical PCI hot-unplug or manual sysfs driver unbinding. * Code paths exclusive to architectures other than the target architecture. ================================================================================ 3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA) ================================================================================ Return WorthFuzzing=true whenever the patch touches reachable executable code, including: - Core Subsystems: * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/), BPF, scheduler, core networking, VFS, or syscall handling. - Refactorings and Code Cleanups: * Any restructuring of reachable data structures, helper abstractions, or algorithm flows. - Runtime Assertions and Defensive Checks: * Any introduction or alteration of assertions (WARN_ON, VM_WARN_ON, BUG_ON, etc.) in reachable paths. - Reachable Drivers and Protocols: Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.). ================================================================================ 4. EXTRACTING FocusSymbols (PREVENTING DILUTION) ================================================================================ When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer: - AVOID UBIQUITOUS LIFECYCLE HOT-PATHS: Do NOT list generic, ubiquitous functions called by almost every program in the corpus (including, but not limited to: general memory allocators and deallocators, page fault and trap handlers, or core synchronization primitives; this is not an exhaustive list). Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused", which severely dilutes fuzzing effort away from the actual changes. - TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS: List functions that specifically implement the logic being added or altered, or direct API entrypoints for the subsystem feature under review. - HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h): Compiler-inlined static functions (such as static inlines in mm/.h or include/linux/.h) lack distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters. If the changes are primarily in static inline helpers, identify non-static, feature-specific caller functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers). ================================================================================ 5. IDENTIFYING EnableConfigs ================================================================================ Identify any specific CONFIG_ options required to properly compile and reach the modified code: - Inspect Kconfig files and #ifdef guards; do not make assumptions. - Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed. - Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit bdb56f341f227275b28d1a12610b1ead5b724702 Author: syz-cluster <triage@syzkaller.com> Date: Mon Sep 7 00:53:30 2026 +0000 syz-cluster: applied patch under review diff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst index 5daf3de5c7446..c135338600e8f 100644 --- a/tools/bpf/bpftool/Documentation/bpftool-map.rst +++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst @@ -16,7 +16,7 @@ SYNOPSIS bpftool [OPTIONS] map COMMAND -OPTIONS := { \|COMMON_OPTIONS\| \| { -f \| --bpffs } \| { -n \| --nomount } } +OPTIONS := { \|COMMON_OPTIONS\| \| { -f \| --bpffs } \| { -n \| --nomount } \| { -r \| --recursive } } COMMANDS := { show \| list \| create \| dump \| update \| lookup \| getnext \| @@ -170,6 +170,23 @@ OPTIONS Do not automatically attempt to mount any virtual file system (such as tracefs or BPF virtual file system) when necessary. +-r, --recursive + Also dump the inner maps referenced by array_of_maps and hash_of_maps + entries when running map dump. Each map is dumped once, even if several + entries refer to it. Selected maps are followed by their inner maps. + + Plain output includes a header identifying each map. On success, JSON output + is always an array of map objects, each containing an id and an + elements array, including when only one map is dumped. Outer map entries + retain their inner_map_id field, which identifies the corresponding inner + map object. + + The dump is not a snapshot: concurrent updates can change map contents. + Failure to open a referenced inner map stops the dump and returns a nonzero + exit status. Output may contain maps or entries printed before the error. + In JSON mode, an error during traversal is included in the output and the + enclosing arrays and objects are closed. + EXAMPLES ======== # bpftool map show diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool index 75cbcb512ebae..45c336d63be0a 100644 --- a/tools/bpf/bpftool/bash-completion/bpftool +++ b/tools/bpf/bpftool/bash-completion/bpftool @@ -261,7 +261,7 @@ _bpftool() # Deal with options if [[ ${words[cword]} == -* ]]; then - local c='--version --json --pretty --bpffs --mapcompat --debug \ + local c='--version --json --pretty --recursive --bpffs --mapcompat --debug \ --use-loader --base-btf --sign -i -k' COMPREPLY=( $( compgen -W "$c" -- "$cur" ) ) return 0 diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c index c91e1a6e1a1ec..29021f4dd4518 100644 --- a/tools/bpf/bpftool/main.c +++ b/tools/bpf/bpftool/main.c @@ -26,6 +26,7 @@ static int (last_do_help)(int argc, char argv); json_writer_t json_wtr; bool pretty_output; bool json_output; +bool recursive; bool show_pinned; bool block_mount; bool verifier_logs; @@ -452,6 +453,7 @@ int main(int argc, char argv) { "json", no_argument, NULL, 'j' }, { "help", no_argument, NULL, 'h' }, { "pretty", no_argument, NULL, 'p' }, + { "recursive", no_argument, NULL, 'r' }, { "version", no_argument, NULL, 'V' }, { "bpffs", no_argument, NULL, 'f' }, { "mapcompat", no_argument, NULL, 'm' }, @@ -485,7 +487,7 @@ int main(int argc, char argv) bin_name = "bpftool"; opterr = 0; - while ((opt = getopt_long(argc, argv, "VhpjfLmndSi:k:B:l", + while ((opt = getopt_long(argc, argv, "VhpjrfLmndSi:k:B:l", options, NULL)) >= 0) { switch (opt) { case 'V': @@ -507,6 +509,9 @@ int main(int argc, char *argv) } jsonw_pretty(json_wtr, pretty_output); break; + case 'r': + recursive = true; + break; case 'f': show_pinned = true; break; diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h index 78b6e0ebb85d8..b5dc7960cf682 100644 --- a/tools/bpf/bpftool/main.h +++ b/tools/bpf/bpftool/main.h @@ -83,6 +83,7 @@ extern const char bin_name; extern json_writer_t json_wtr; extern bool json_output; +extern bool recursive; extern bool show_pinned; extern bool show_pids; extern bool block_mount; diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c index 684a8fb724146..853f775b7d529 100644 --- a/tools/bpf/bpftool/map.c +++ b/tools/bpf/bpftool/map.c @@ -745,8 +745,10 @@ static int dump_map_elem(int fd, void key, void value, json_writer_t btf_wtr) { if (bpf_map_lookup_elem(fd, key, value)) { - print_entry_error(map_info, key, errno); - return -1; + int lookup_errno = errno; + + print_entry_error(map_info, key, lookup_errno); + return -lookup_errno; } if (json_output) { @@ -826,12 +828,53 @@ static void free_map_kv_btf(struct btf btf) btf__free(btf); } +struct map_dump_ctx { + struct hashmap seen; + int *fds; + int nb_fds; +}; + +static int collect_inner_map(struct map_dump_ctx ctx, __u32 id) +{ + LIBBPF_OPTS(bpf_get_fd_by_id_opts, opts, + .open_flags = BPF_F_RDONLY, + ); + int fds, fd, err; + + if (hashmap__find(ctx->seen, id, NULL)) + return 0; + + fd = bpf_map_get_fd_by_id_opts(id, &opts); + if (fd < 0) { + p_err("can't open inner map id %u: %s", id, strerror(errno)); + return -1; + } + + fds = realloc(ctx->fds, (ctx->nb_fds + 1ULL) * sizeof(fds)); + if (!fds) { + p_err("mem alloc failed"); + close(fd); + return -1; + } + ctx->fds = fds; + + err = hashmap__add(ctx->seen, id, 0); + if (err) { + p_err("failed to record inner map id %u: %s", id, strerror(-err)); + close(fd); + return -1; + } + fds[(ctx->nb_fds)++] = fd; + return 0; +} + static int map_dump(int fd, struct bpf_map_info info, json_writer_t wtr, - bool show_header) + bool show_header, struct map_dump_ctx ctx) { void key, value, prev_key; unsigned int num_elems = 0; + json_writer_t plain_btf_wtr = NULL; struct btf btf = NULL; int err; @@ -845,6 +888,17 @@ map_dump(int fd, struct bpf_map_info info, json_writer_t wtr, prev_key = NULL; + if (ctx && !wtr && (info->btf_value_type_id \|\| + info->btf_vmlinux_value_type_id)) { + plain_btf_wtr = get_btf_writer(); + if (plain_btf_wtr) { + if (show_header) + show_map_header_plain(info); + show_header = false; + wtr = plain_btf_wtr; + } + } + if (wtr) { err = get_map_kv_btf(info, &btf); if (err) { @@ -874,10 +928,22 @@ map_dump(int fd, struct bpf_map_info info, json_writer_t wtr, if (err) { if (errno == ENOENT) err = 0; + else if (ctx) + p_err("can't get next key for map id %u: %s", + info->id, strerror(errno)); break; } - if (!dump_map_elem(fd, key, value, info, btf, wtr)) + err = dump_map_elem(fd, key, value, info, btf, wtr); + if (!err) { num_elems++; + if (ctx && map_is_map_of_maps(info->type)) { + err = collect_inner_map(ctx, (__u32 )value); + if (err) + break; + } + } else if (ctx && err != -ENOENT) { + break; + } prev_key = key; } @@ -894,6 +960,8 @@ map_dump(int fd, struct bpf_map_info info, json_writer_t wtr, free(key); free(value); free_map_kv_btf(btf); + if (plain_btf_wtr) + jsonw_destroy(&plain_btf_wtr); return err; } @@ -902,6 +970,7 @@ static int do_dump(int argc, char argv) { json_writer_t wtr = NULL, btf_wtr = NULL; struct bpf_map_info info = {}; + struct map_dump_ctx ctx = {}; int nb_fds, i = 0; __u32 len = sizeof(info); int fds = NULL; @@ -919,9 +988,36 @@ static int do_dump(int argc, char *argv) if (nb_fds < 1) goto exit_free; + if (recursive) { + ctx.seen = hashmap__new(hash_fn_for_key_as_id, + equal_fn_for_key_as_id, NULL); + if (IS_ERR(ctx.seen)) { + ctx.seen = NULL; + p_err("failed to create hashmap for recursive dump"); + goto exit_close; + } + ctx.fds = &fds; + ctx.nb_fds = &nb_fds; + / Record the selected maps before discovering any inner maps. / + for (i = 0; i < nb_fds; i++) { + len = sizeof(info); + if (bpf_map_get_info_by_fd(fds[i], &info, &len)) { + p_err("can't get map info: %s", strerror(errno)); + err = -1; + goto exit_close; + } + err = hashmap__add(ctx.seen, info.id, 0); + if (err) { + p_err("failed to record map id %u: %s", info.id, + strerror(-err)); + goto exit_close; + } + } + } + if (json_output) { wtr = json_wtr; - } else { + } else if (!recursive) { int do_plain_btf; do_plain_btf = maps_have_btf(fds, nb_fds); @@ -936,7 +1032,7 @@ static int do_dump(int argc, char argv) } } - if (wtr && nb_fds > 1) + if (wtr && (nb_fds > 1 \|\| recursive)) jsonw_start_array(wtr); / root array / for (i = 0; i < nb_fds; i++) { if (bpf_map_get_info_by_fd(fds[i], &info, &len)) { @@ -944,22 +1040,28 @@ static int do_dump(int argc, char argv) err = -1; break; } - err = map_dump(fds[i], &info, wtr, nb_fds > 1); + err = map_dump(fds[i], &info, wtr, nb_fds > 1 \|\| recursive, + recursive ? &ctx : NULL); if (!wtr && i != nb_fds - 1) printf("\n"); if (err) break; - close(fds[i]); + / Keep discovered maps alive until the recursive dump is complete. / + if (!recursive) + close(fds[i]); } - if (wtr && nb_fds > 1) + if (wtr && (nb_fds > 1 \|\| recursive)) jsonw_end_array(wtr); / root array / if (btf_wtr) jsonw_destroy(&btf_wtr); exit_close: + if (recursive) + i = 0; for (; i < nb_fds; i++) close(fds[i]); + hashmap__free(ctx.seen); exit_free: free(fds); free_btf_vmlinux(); @@ -1484,7 +1586,7 @@ static int do_help(int argc, char argv) " task_storage \| bloom_filter \| user_ringbuf \| cgrp_storage \| arena \|\n" " insn_array \| rhash }\n" " " HELP_SPEC_OPTIONS " \|\n" - " {-f\|--bpffs} \| {-n\|--nomount} }\n" + " {-f\|--bpffs} \| {-n\|--nomount} \| {-r\|--recursive} }\n" "", bin_name, argv[-2]); diff --git a/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c new file mode 100644 index 0000000000000..3c425dbe2d9d4 --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c @@ -0,0 +1,252 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include <test_progs.h> +#include <bpftool_helpers.h> +#include <bpf/btf.h> + +#define OUTPUT_SIZE 8192 + +static bool dump_map(__u32 id, const char options, char output) +{ + char command[MAX_BPFTOOL_CMD_LEN]; + + snprintf(command, sizeof(command), "%s map dump id %u", options, id); + memset(output, 0, OUTPUT_SIZE); + if (!ASSERT_OK(get_bpftool_command_output(command, output, OUTPUT_SIZE - 1), + "dump_map")) + return false; + / The helper doesn't terminate or strip the output. / + output[strcspn(output, "\n")] = '\0'; + return true; +} + +static __u32 map_id(int fd) +{ + struct bpf_map_info info = {}; + __u32 len = sizeof(info); + + if (!ASSERT_OK(bpf_map_get_info_by_fd(fd, &info, &len), "map_info")) + return 0; + return info.id; +} + +static int count_token(const char output, const char token) +{ + int count = 0; + + while ((output = strstr(output, token))) { + count++; + output += strlen(token); + } + return count; +} + +static void check_plain(__u32 root_id, __u32 inner_id, const char type, + int entries, bool typed) +{ + char command[MAX_BPFTOOL_CMD_LEN], header[128]; + char output[OUTPUT_SIZE] = {}; + const char root, inner; + + snprintf(command, sizeof(command), "--recursive map dump id %u", root_id); + if (!ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1), + "plain_dump")) + return; + snprintf(header, sizeof(header), "%u: %s name dump_outer ", root_id, type); + root = strstr(output, header); + if (!ASSERT_OK_PTR(root, "plain_root_header")) + return; + ASSERT_EQ(root - output, 0, "plain_root_first"); + ASSERT_EQ(count_token(output, "inner_map_id:"), entries, "plain_references"); + if (entries) { + snprintf(header, sizeof(header), "%u: hash name dump_inner ", inner_id); + inner = strstr(output, header); + if (ASSERT_OK_PTR(inner, "plain_inner_header")) + ASSERT_GT(inner - root, 0, "plain_inner_after_root"); + ASSERT_EQ(count_token(output, header), 1, "plain_inner_once"); + } + ASSERT_EQ(count_token(output, "Found "), entries && !typed ? 2 : 1, + "plain_map_count"); + if (typed) { + ASSERT_HAS_SUBSTR(output, "\"key\": 0", "plain_btf_key"); + ASSERT_HAS_SUBSTR(output, "\"value\": 16843009", "plain_btf_value"); + } +} + +static void test_outer(enum bpf_map_type type, int entries, bool empty_inner, + bool typed) +{ + LIBBPF_OPTS(bpf_map_create_opts, opts); + LIBBPF_OPTS(bpf_map_create_opts, inner_opts); + struct btf btf = NULL; + char outer[OUTPUT_SIZE], inner[OUTPUT_SIZE], output[OUTPUT_SIZE]; + char expected[OUTPUT_SIZE 3], reference[64]; + const char type_name = libbpf_bpf_map_type_str(type); + int inner_fd = -1, outer_fd = -1; + __u32 root_id, inner_id, key, value = 0x01010101; + + if (typed) { + btf = btf__new_empty(); + if (!ASSERT_OK_PTR(btf, "create_btf") \|\| + !ASSERT_EQ(btf__add_int(btf, "unsigned int", 4, 0), 1, "btf_int") \|\| + !ASSERT_OK(btf__load_into_kernel(btf), "load_btf")) + goto out; + inner_opts.btf_fd = btf__fd(btf); + inner_opts.btf_key_type_id = 1; + inner_opts.btf_value_type_id = 1; + } + inner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, "dump_inner", sizeof(key), + sizeof(value), 2, &inner_opts); + if (!ASSERT_OK_FD(inner_fd, "create_inner")) + goto out; + key = 0; + if (!empty_inner && + !ASSERT_OK(bpf_map_update_elem(inner_fd, &key, &value, BPF_ANY), + "populate_inner")) + goto out; + opts.inner_map_fd = inner_fd; + outer_fd = bpf_map_create(type, "dump_outer", sizeof(key), sizeof(__u32), + 3, &opts); + if (!ASSERT_OK_FD(outer_fd, "create_outer")) + goto out; + / The unused third array slot also exercises failed lookups. / + for (key = 0; key < entries; key++) + if (!ASSERT_OK(bpf_map_update_elem(outer_fd, &key, &inner_fd, BPF_ANY), + "populate_outer")) + goto out; + root_id = map_id(outer_fd); + inner_id = map_id(inner_fd); + if (!root_id \|\| !inner_id \|\| !dump_map(root_id, "-j", outer) \|\| + !dump_map(inner_id, "-j", inner)) + goto out; + + ASSERT_EQ(outer[0], '[', "default_array"); + ASSERT_EQ(count_token(outer, "\"elements\":"), 0, "default_no_wrapper"); + ASSERT_EQ(count_token(outer, "\"id\":"), 0, "default_no_header"); + snprintf(reference, sizeof(reference), "\"inner_map_id\":%u", inner_id); + ASSERT_EQ(count_token(outer, reference), entries, "default_references"); + if (!entries) + ASSERT_STREQ(outer, "[]", "empty_outer_default"); + if (empty_inner) + ASSERT_STREQ(inner, "[]", "empty_inner_default"); + else if (typed) + ASSERT_HAS_SUBSTR(inner, "\"formatted\":{\"key\":0,\"value\":16843009}", + "typed_inner"); + else + ASSERT_STREQ(inner, + "[{\"key\":[\"0x00\",\"0x00\",\"0x00\",\"0x00\"]," + "\"value\":[\"0x01\",\"0x01\",\"0x01\",\"0x01\"]}]", + "ordinary_default"); + + / Compare the complete JSON document: a flat array with the root first, + * one copy of the shared inner map, and unchanged entry representations. + / + if (entries) + snprintf(expected, sizeof(expected), + "[{\"id\":%u,\"type\":\"%s\",\"name\":\"dump_outer\"," + "\"flags\":0,\"elements\":%s},{\"id\":%u,\"type\":\"hash\"," + "\"name\":\"dump_inner\",\"flags\":0,\"elements\":%s}]", + root_id, type_name, outer, inner_id, inner); + else + snprintf(expected, sizeof(expected), + "[{\"id\":%u,\"type\":\"%s\",\"name\":\"dump_outer\"," + "\"flags\":0,\"elements\":[]}]", root_id, type_name); + if (dump_map(root_id, "-j -r", output)) + ASSERT_STREQ(output, expected, "recursive_json"); + if (dump_map(root_id, "--json --recursive", output)) + ASSERT_STREQ(output, expected, "recursive_long_options"); + check_plain(root_id, inner_id, type_name, entries, typed); + + / Recursion on an ordinary map still emits a single map object. / + snprintf(expected, sizeof(expected), + "[{\"id\":%u,\"type\":\"hash\",\"name\":\"dump_inner\"," + "\"flags\":0,\"elements\":%s}]", inner_id, inner); + if (dump_map(inner_id, "-j -r", output)) + ASSERT_STREQ(output, expected, "ordinary_recursive"); +out: + if (outer_fd >= 0) + close(outer_fd); + if (inner_fd >= 0) + close(inner_fd); + btf__free(btf); +} + +static void test_multiple_roots(void) +{ + LIBBPF_OPTS(bpf_map_create_opts, opts); + char command[MAX_BPFTOOL_CMD_LEN], name[BPF_OBJ_NAME_LEN]; + char output[OUTPUT_SIZE] = {}, expected[OUTPUT_SIZE 4], elements[OUTPUT_SIZE]; + static const char * const types[] = { "hash", "array_of_maps", "hash_of_maps", "hash" }; + int fds[] = { -1, -1, -1, -1 }; + __u32 ids[4], key; + int i, len = 0; + + /* Select the first inner map and both outers as roots. The other inner + * map must be appended after all three roots, even though it is found + * while dumping the first outer. A process-specific name avoids other + * tests' maps joining the selection. + */ + snprintf(name, sizeof(name), "dump_%u", getpid()); + fds[0] = bpf_map_create(BPF_MAP_TYPE_HASH, name, 4, 4, 1, NULL); + if (!ASSERT_OK_FD(fds[0], "create_selected_inner")) + goto out; + fds[3] = bpf_map_create(BPF_MAP_TYPE_HASH, "dump_discovered", 4, 4, 1, NULL); + if (!ASSERT_OK_FD(fds[3], "create_discovered_inner")) + goto out; + opts.inner_map_fd = fds[0]; + fds[1] = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, name, 4, 4, 2, &opts); + if (!ASSERT_OK_FD(fds[1], "create_array_root")) + goto out; + fds[2] = bpf_map_create(BPF_MAP_TYPE_HASH_OF_MAPS, name, 4, 4, 2, &opts); + if (!ASSERT_OK_FD(fds[2], "create_hash_root")) + goto out; + for (i = 1; i <= 2; i++) { + key = 0; + if (!ASSERT_OK(bpf_map_update_elem(fds[i], &key, &fds[0], BPF_ANY), + "reference_selected_inner")) + goto out; + key = 1; + if (!ASSERT_OK(bpf_map_update_elem(fds[i], &key, &fds[3], BPF_ANY), + "reference_discovered_inner")) + goto out; + } + for (i = 0; i < ARRAY_SIZE(fds); i++) { + ids[i] = map_id(fds[i]); + if (!ids[i] \|\| !dump_map(ids[i], "-j", elements)) + goto out; + len += snprintf(expected + len, sizeof(expected) - len, + "%s{\"id\":%u,\"type\":\"%s\",\"name\":\"%s\"," + "\"flags\":0,\"elements\":%s}%s", + i ? "," : "[", ids[i], types[i], + i == 3 ? "dump_discovered" : name, elements, i == 3 ? "]" : ""); + } + snprintf(command, sizeof(command), "-j -r map dump name %s", name); + if (ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1), + "dump_multiple_roots")) { + output[strcspn(output, "\n")] = '\0'; + ASSERT_STREQ(output, expected, "roots_first_and_seed_dedup"); + } +out: + for (i = 0; i < ARRAY_SIZE(fds); i++) + if (fds[i] >= 0) + close(fds[i]); +} + +void test_bpftool_map_dump(void) +{ + if (test__start_subtest("multiple_roots")) + test_multiple_roots(); + if (test__start_subtest("array_of_maps")) + test_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 1, false, false); + if (test__start_subtest("hash_of_maps")) + test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, false); + if (test__start_subtest("shared_inner")) + test_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 2, false, false); + if (test__start_subtest("empty_array_of_maps")) + test_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 0, false, false); + if (test__start_subtest("empty_hash_of_maps")) + test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 0, false, false); + if (test__start_subtest("btf_inner")) + test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, true); + if (test__start_subtest("empty_inner")) + test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, true, false); +}
3/2	2026/09/07 00:53	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 10869 output: 33 thoughts: 372 Thoughts: Analyzing the Patch: WorthFuzzing=false? Okay, let's break this down. The instructions are clear: the changes are already in my workspace as the HEAD commit. My task is to determine if this patch warrants fuzzing or if it can be safely ignored (i.e., `WorthFuzzing=false`). Section 2 dictates when we can bypass fuzzing. The key criteria for `WorthFuzzing=false` are non-kernel, non-executable changes that don't impact the compiled kernel image. This includes documentation, comments, user-space tools, build system changes that don't alter the C logic, unreachable hardware, and unreachable execution paths. Now, let's look at the diff. I see the modified files are all located in `tools/`, specifically within `tools/bpf/bpftool/` and `tools/testing/selftests/bpf/`. Nothing jumps out as kernel-level code. We have documentation (`bpftool-map.rst`), shell completion scripts (`bpftool` within `bash-completion`), the main source files (`main.c`, `main.h`, and `map.c`), and a selftest (`bpftool_map_dump.c`). It's all BPF tooling, which confirms my initial impression. None of these files directly modify kernel code or the kernel image itself (`vmlinux`) or kernel modules. Just to be absolutely sure, I'll quickly double-check that this HEAD commit only contains these files; no sneaky kernel code creeped in. Barring that, I'm confident in classifying this as `WorthFuzzing=false`. This patch is safe to ignore in terms of fuzzing.
4/2	2026/09/07 00:53	tool	grepper	0m Args: { "Expression": ".", "PathPrefix": "tools/bpf/bpftool/map.c" } Results:* { "Output": "\nFull output is too long, showing 500 out of 1620 lines.\nUse more precise expression if possible.\n\ntools/bpf/bpftool/map.c:1:// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)\ntools/bpf/bpftool/map.c:2:/* Copyright (C) 2017-2018 Netronome Systems, Inc. /\ntools/bpf/bpftool/map.c:3:\ntools/bpf/bpftool/map.c:4:#include \u003cerrno.h\u003e\ntools/bpf/bpftool/map.c:5:#include \u003cfcntl.h\u003e\ntools/bpf/bpftool/map.c:6:#include \u003clinux/err.h\u003e\ntools/bpf/bpftool/map.c:7:#include \u003clinux/kernel.h\u003e\ntools/bpf/bpftool/map.c:8:#include \u003cnet/if.h\u003e\ntools/bpf/bpftool/map.c:9:#include \u003cstdbool.h\u003e\ntools/bpf/bpftool/map.c:10:#include \u003cstdio.h\u003e\ntools/bpf/bpftool/map.c:11:#include \u003cstdlib.h\u003e\ntools/bpf/bpftool/map.c:12:#include \u003cstring.h\u003e\ntools/bpf/bpftool/map.c:13:#include \u003cunistd.h\u003e\ntools/bpf/bpftool/map.c:14:#include \u003csys/types.h\u003e\ntools/bpf/bpftool/map.c:15:#include \u003csys/stat.h\u003e\ntools/bpf/bpftool/map.c:16:\ntools/bpf/bpftool/map.c:17:#include \u003cbpf/bpf.h\u003e\ntools/bpf/bpftool/map.c:18:#include \u003cbpf/btf.h\u003e\ntools/bpf/bpftool/map.c:19:#include \u003cbpf/hashmap.h\u003e\ntools/bpf/bpftool/map.c:20:\ntools/bpf/bpftool/map.c:21:#include \"json_writer.h\"\ntools/bpf/bpftool/map.c:22:#include \"main.h\"\ntools/bpf/bpftool/map.c:23:\ntools/bpf/bpftool/map.c:24:static struct hashmap map_table;\ntools/bpf/bpftool/map.c:25:\ntools/bpf/bpftool/map.c:26:static bool map_is_per_cpu(__u32 type)\ntools/bpf/bpftool/map.c:27:{\ntools/bpf/bpftool/map.c:28:\treturn type == BPF_MAP_TYPE_PERCPU_HASH \|\|\ntools/bpf/bpftool/map.c:29:\t type == BPF_MAP_TYPE_PERCPU_ARRAY \|\|\ntools/bpf/bpftool/map.c:30:\t type == BPF_MAP_TYPE_LRU_PERCPU_HASH \|\|\ntools/bpf/bpftool/map.c:31:\t type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE;\ntools/bpf/bpftool/map.c:32:}\ntools/bpf/bpftool/map.c:33:\ntools/bpf/bpftool/map.c:34:static bool map_is_map_of_maps(__u32 type)\ntools/bpf/bpftool/map.c:35:{\ntools/bpf/bpftool/map.c:36:\treturn type == BPF_MAP_TYPE_ARRAY_OF_MAPS \|\|\ntools/bpf/bpftool/map.c:37:\t type == BPF_MAP_TYPE_HASH_OF_MAPS;\ntools/bpf/bpftool/map.c:38:}\ntools/bpf/bpftool/map.c:39:\ntools/bpf/bpftool/map.c:40:static bool map_is_map_of_progs(__u32 type)\ntools/bpf/bpftool/map.c:41:{\ntools/bpf/bpftool/map.c:42:\treturn type == BPF_MAP_TYPE_PROG_ARRAY;\ntools/bpf/bpftool/map.c:43:}\ntools/bpf/bpftool/map.c:44:\ntools/bpf/bpftool/map.c:45:static int map_type_from_str(const char type)\ntools/bpf/bpftool/map.c:46:{\ntools/bpf/bpftool/map.c:47:\tconst char map_type_str;\ntools/bpf/bpftool/map.c:48:\tunsigned int i;\ntools/bpf/bpftool/map.c:49:\ntools/bpf/bpftool/map.c:50:\tfor (i = 0; ; i++) {\ntools/bpf/bpftool/map.c:51:\t\tmap_type_str = libbpf_bpf_map_type_str(i);\ntools/bpf/bpftool/map.c:52:\t\tif (!map_type_str)\ntools/bpf/bpftool/map.c:53:\t\t\tbreak;\ntools/bpf/bpftool/map.c:54:\ntools/bpf/bpftool/map.c:55:\t\t/* Don't allow prefixing in case of possible future shadowing /\ntools/bpf/bpftool/map.c:56:\t\tif (!strcmp(map_type_str, type))\ntools/bpf/bpftool/map.c:57:\t\t\treturn i;\ntools/bpf/bpftool/map.c:58:\t}\ntools/bpf/bpftool/map.c:59:\treturn -1;\ntools/bpf/bpftool/map.c:60:}\ntools/bpf/bpftool/map.c:61:\ntools/bpf/bpftool/map.c:62:static void alloc_value(struct bpf_map_info info)\ntools/bpf/bpftool/map.c:63:{\ntools/bpf/bpftool/map.c:64:\tif (map_is_per_cpu(info-\u003etype))\ntools/bpf/bpftool/map.c:65:\t\treturn malloc(round_up(info-\u003evalue_size, 8) \ntools/bpf/bpftool/map.c:66:\t\t\t get_possible_cpus());\ntools/bpf/bpftool/map.c:67:\telse\ntools/bpf/bpftool/map.c:68:\t\treturn malloc(info-\u003evalue_size);\ntools/bpf/bpftool/map.c:69:}\ntools/bpf/bpftool/map.c:70:\ntools/bpf/bpftool/map.c:71:static int do_dump_btf(const struct btf_dumper d,\ntools/bpf/bpftool/map.c:72:\t\t struct bpf_map_info map_info, void key,\ntools/bpf/bpftool/map.c:73:\t\t void value)\ntools/bpf/bpftool/map.c:74:{\ntools/bpf/bpftool/map.c:75:\t__u32 value_id;\ntools/bpf/bpftool/map.c:76:\tint ret = 0;\ntools/bpf/bpftool/map.c:77:\ntools/bpf/bpftool/map.c:78:\t/* start of key-value pair /\ntools/bpf/bpftool/map.c:79:\tjsonw_start_object(d-\u003ejw);\ntools/bpf/bpftool/map.c:80:\ntools/bpf/bpftool/map.c:81:\tif (map_info-\u003ebtf_key_type_id) {\ntools/bpf/bpftool/map.c:82:\t\tjsonw_name(d-\u003ejw, \"key\");\ntools/bpf/bpftool/map.c:83:\ntools/bpf/bpftool/map.c:84:\t\tret = btf_dumper_type(d, map_info-\u003ebtf_key_type_id, key);\ntools/bpf/bpftool/map.c:85:\t\tif (ret)\ntools/bpf/bpftool/map.c:86:\t\t\tgoto err_end_obj;\ntools/bpf/bpftool/map.c:87:\t}\ntools/bpf/bpftool/map.c:88:\ntools/bpf/bpftool/map.c:89:\tvalue_id = map_info-\u003ebtf_vmlinux_value_type_id ?\ntools/bpf/bpftool/map.c:90:\t\t: map_info-\u003ebtf_value_type_id;\ntools/bpf/bpftool/map.c:91:\ntools/bpf/bpftool/map.c:92:\tif (!map_is_per_cpu(map_info-\u003etype)) {\ntools/bpf/bpftool/map.c:93:\t\tjsonw_name(d-\u003ejw, \"value\");\ntools/bpf/bpftool/map.c:94:\t\tret = btf_dumper_type(d, value_id, value);\ntools/bpf/bpftool/map.c:95:\t} else {\ntools/bpf/bpftool/map.c:96:\t\tunsigned int i, n, step;\ntools/bpf/bpftool/map.c:97:\ntools/bpf/bpftool/map.c:98:\t\tjsonw_name(d-\u003ejw, \"values\");\ntools/bpf/bpftool/map.c:99:\t\tjsonw_start_array(d-\u003ejw);\ntools/bpf/bpftool/map.c:100:\t\tn = get_possible_cpus();\ntools/bpf/bpftool/map.c:101:\t\tstep = round_up(map_info-\u003evalue_size, 8);\ntools/bpf/bpftool/map.c:102:\t\tfor (i = 0; i \u003c n; i++) {\ntools/bpf/bpftool/map.c:103:\t\t\tjsonw_start_object(d-\u003ejw);\ntools/bpf/bpftool/map.c:104:\t\t\tjsonw_int_field(d-\u003ejw, \"cpu\", i);\ntools/bpf/bpftool/map.c:105:\t\t\tjsonw_name(d-\u003ejw, \"value\");\ntools/bpf/bpftool/map.c:106:\t\t\tret = btf_dumper_type(d, value_id, value + i step);\ntools/bpf/bpftool/map.c:107:\t\t\tjsonw_end_object(d-\u003ejw);\ntools/bpf/bpftool/map.c:108:\t\t\tif (ret)\ntools/bpf/bpftool/map.c:109:\t\t\t\tbreak;\ntools/bpf/bpftool/map.c:110:\t\t}\ntools/bpf/bpftool/map.c:111:\t\tjsonw_end_array(d-\u003ejw);\ntools/bpf/bpftool/map.c:112:\t}\ntools/bpf/bpftool/map.c:113:\ntools/bpf/bpftool/map.c:114:err_end_obj:\ntools/bpf/bpftool/map.c:115:\t/* end of key-value pair /\ntools/bpf/bpftool/map.c:116:\tjsonw_end_object(d-\u003ejw);\ntools/bpf/bpftool/map.c:117:\ntools/bpf/bpftool/map.c:118:\treturn ret;\ntools/bpf/bpftool/map.c:119:}\ntools/bpf/bpftool/map.c:120:\ntools/bpf/bpftool/map.c:121:static json_writer_t get_btf_writer(void)\ntools/bpf/bpftool/map.c:122:{\ntools/bpf/bpftool/map.c:123:\tjson_writer_t jw = jsonw_new(stdout);\ntools/bpf/bpftool/map.c:124:\ntools/bpf/bpftool/map.c:125:\tif (!jw)\ntools/bpf/bpftool/map.c:126:\t\treturn NULL;\ntools/bpf/bpftool/map.c:127:\tjsonw_pretty(jw, true);\ntools/bpf/bpftool/map.c:128:\ntools/bpf/bpftool/map.c:129:\treturn jw;\ntools/bpf/bpftool/map.c:130:}\ntools/bpf/bpftool/map.c:131:\ntools/bpf/bpftool/map.c:132:static void print_entry_json(struct bpf_map_info info, unsigned char key,\ntools/bpf/bpftool/map.c:133:\t\t\t unsigned char value, struct btf btf)\ntools/bpf/bpftool/map.c:134:{\ntools/bpf/bpftool/map.c:135:\tjsonw_start_object(json_wtr);\ntools/bpf/bpftool/map.c:136:\ntools/bpf/bpftool/map.c:137:\tif (!map_is_per_cpu(info-\u003etype)) {\ntools/bpf/bpftool/map.c:138:\t\tjsonw_name(json_wtr, \"key\");\ntools/bpf/bpftool/map.c:139:\t\tprint_hex_data_json(key, info-\u003ekey_size);\ntools/bpf/bpftool/map.c:140:\t\tjsonw_name(json_wtr, \"value\");\ntools/bpf/bpftool/map.c:141:\t\tprint_hex_data_json(value, info-\u003evalue_size);\ntools/bpf/bpftool/map.c:142:\t\tif (map_is_map_of_maps(info-\u003etype))\ntools/bpf/bpftool/map.c:143:\t\t\tjsonw_uint_field(json_wtr, \"inner_map_id\",\ntools/bpf/bpftool/map.c:144:\t\t\t\t\t (unsigned int )value);\ntools/bpf/bpftool/map.c:145:\t\tif (btf) {\ntools/bpf/bpftool/map.c:146:\t\t\tstruct btf_dumper d = {\ntools/bpf/bpftool/map.c:147:\t\t\t\t.btf = btf,\ntools/bpf/bpftool/map.c:148:\t\t\t\t.jw = json_wtr,\ntools/bpf/bpftool/map.c:149:\t\t\t\t.is_plain_text = false,\ntools/bpf/bpftool/map.c:150:\t\t\t};\ntools/bpf/bpftool/map.c:151:\ntools/bpf/bpftool/map.c:152:\t\t\tjsonw_name(json_wtr, \"formatted\");\ntools/bpf/bpftool/map.c:153:\t\t\tdo_dump_btf(\u0026d, info, key, value);\ntools/bpf/bpftool/map.c:154:\t\t}\ntools/bpf/bpftool/map.c:155:\t} else {\ntools/bpf/bpftool/map.c:156:\t\tunsigned int i, n, step;\ntools/bpf/bpftool/map.c:157:\ntools/bpf/bpftool/map.c:158:\t\tn = get_possible_cpus();\ntools/bpf/bpftool/map.c:159:\t\tstep = round_up(info-\u003evalue_size, 8);\ntools/bpf/bpftool/map.c:160:\ntools/bpf/bpftool/map.c:161:\t\tjsonw_name(json_wtr, \"key\");\ntools/bpf/bpftool/map.c:162:\t\tprint_hex_data_json(key, info-\u003ekey_size);\ntools/bpf/bpftool/map.c:163:\ntools/bpf/bpftool/map.c:164:\t\tjsonw_name(json_wtr, \"values\");\ntools/bpf/bpftool/map.c:165:\t\tjsonw_start_array(json_wtr);\ntools/bpf/bpftool/map.c:166:\t\tfor (i = 0; i \u003c n; i++) {\ntools/bpf/bpftool/map.c:167:\t\t\tjsonw_start_object(json_wtr);\ntools/bpf/bpftool/map.c:168:\ntools/bpf/bpftool/map.c:169:\t\t\tjsonw_int_field(json_wtr, \"cpu\", i);\ntools/bpf/bpftool/map.c:170:\ntools/bpf/bpftool/map.c:171:\t\t\tjsonw_name(json_wtr, \"value\");\ntools/bpf/bpftool/map.c:172:\t\t\tprint_hex_data_json(value + i step,\ntools/bpf/bpftool/map.c:173:\t\t\t\t\t info-\u003evalue_size);\ntools/bpf/bpftool/map.c:174:\ntools/bpf/bpftool/map.c:175:\t\t\tjsonw_end_object(json_wtr);\ntools/bpf/bpftool/map.c:176:\t\t}\ntools/bpf/bpftool/map.c:177:\t\tjsonw_end_array(json_wtr);\ntools/bpf/bpftool/map.c:178:\t\tif (btf) {\ntools/bpf/bpftool/map.c:179:\t\t\tstruct btf_dumper d = {\ntools/bpf/bpftool/map.c:180:\t\t\t\t.btf = btf,\ntools/bpf/bpftool/map.c:181:\t\t\t\t.jw = json_wtr,\ntools/bpf/bpftool/map.c:182:\t\t\t\t.is_plain_text = false,\ntools/bpf/bpftool/map.c:183:\t\t\t};\ntools/bpf/bpftool/map.c:184:\ntools/bpf/bpftool/map.c:185:\t\t\tjsonw_name(json_wtr, \"formatted\");\ntools/bpf/bpftool/map.c:186:\t\t\tdo_dump_btf(\u0026d, info, key, value);\ntools/bpf/bpftool/map.c:187:\t\t}\ntools/bpf/bpftool/map.c:188:\t}\ntools/bpf/bpftool/map.c:189:\ntools/bpf/bpftool/map.c:190:\tjsonw_end_object(json_wtr);\ntools/bpf/bpftool/map.c:191:}\ntools/bpf/bpftool/map.c:192:\ntools/bpf/bpftool/map.c:193:static void\ntools/bpf/bpftool/map.c:194:print_entry_error_msg(struct bpf_map_info info, unsigned char key,\ntools/bpf/bpftool/map.c:195:\t\t const char error_msg)\ntools/bpf/bpftool/map.c:196:{\ntools/bpf/bpftool/map.c:197:\tint msg_size = strlen(error_msg);\ntools/bpf/bpftool/map.c:198:\tbool single_line, break_names;\ntools/bpf/bpftool/map.c:199:\ntools/bpf/bpftool/map.c:200:\tbreak_names = info-\u003ekey_size \u003e 16 \|\| msg_size \u003e 16;\ntools/bpf/bpftool/map.c:201:\tsingle_line = info-\u003ekey_size + msg_size \u003c= 24 \u0026\u0026 !break_names;\ntools/bpf/bpftool/map.c:202:\ntools/bpf/bpftool/map.c:203:\tprintf(\"key:%c\", break_names ? '\\n' : ' ');\ntools/bpf/bpftool/map.c:204:\tfprint_hex(stdout, key, info-\u003ekey_size, \" \");\ntools/bpf/bpftool/map.c:205:\ntools/bpf/bpftool/map.c:206:\tprintf(single_line ? \" \" : \"\\n\");\ntools/bpf/bpftool/map.c:207:\ntools/bpf/bpftool/map.c:208:\tprintf(\"value:%c%s\", break_names ? '\\n' : ' ', error_msg);\ntools/bpf/bpftool/map.c:209:\ntools/bpf/bpftool/map.c:210:\tprintf(\"\\n\");\ntools/bpf/bpftool/map.c:211:}\ntools/bpf/bpftool/map.c:212:\ntools/bpf/bpftool/map.c:213:static void\ntools/bpf/bpftool/map.c:214:print_entry_error(struct bpf_map_info map_info, void key, int lookup_errno)\ntools/bpf/bpftool/map.c:215:{\ntools/bpf/bpftool/map.c:216:\t/ For prog_array maps or arrays of maps, failure to lookup the value\ntools/bpf/bpftool/map.c:217:\t * means there is no entry for that key. Do not print an error message\ntools/bpf/bpftool/map.c:218:\t * in that case.\ntools/bpf/bpftool/map.c:219:\t /\ntools/bpf/bpftool/map.c:220:\tif ((map_is_map_of_maps(map_info-\u003etype) \|\|\ntools/bpf/bpftool/map.c:221:\t map_is_map_of_progs(map_info-\u003etype)) \u0026\u0026 lookup_errno == ENOENT)\ntools/bpf/bpftool/map.c:222:\t\treturn;\ntools/bpf/bpftool/map.c:223:\ntools/bpf/bpftool/map.c:224:\tif (json_output) {\ntools/bpf/bpftool/map.c:225:\t\tjsonw_start_object(json_wtr);\t/ entry /\ntools/bpf/bpftool/map.c:226:\t\tjsonw_name(json_wtr, \"key\");\ntools/bpf/bpftool/map.c:227:\t\tprint_hex_data_json(key, map_info-\u003ekey_size);\ntools/bpf/bpftool/map.c:228:\t\tjsonw_name(json_wtr, \"value\");\ntools/bpf/bpftool/map.c:229:\t\tjsonw_start_object(json_wtr);\t/ error /\ntools/bpf/bpftool/map.c:230:\t\tjsonw_string_field(json_wtr, \"error\", strerror(lookup_errno));\ntools/bpf/bpftool/map.c:231:\t\tjsonw_end_object(json_wtr);\t/ error /\ntools/bpf/bpftool/map.c:232:\t\tjsonw_end_object(json_wtr);\t/ entry /\ntools/bpf/bpftool/map.c:233:\t} else {\ntools/bpf/bpftool/map.c:234:\t\tconst char msg = NULL;\ntools/bpf/bpftool/map.c:235:\ntools/bpf/bpftool/map.c:236:\t\tif (lookup_errno == ENOENT)\ntools/bpf/bpftool/map.c:237:\t\t\tmsg = \"\u003cno entry\u003e\";\ntools/bpf/bpftool/map.c:238:\t\telse if (lookup_errno == ENOSPC \u0026\u0026\ntools/bpf/bpftool/map.c:239:\t\t\t map_info-\u003etype == BPF_MAP_TYPE_REUSEPORT_SOCKARRAY)\ntools/bpf/bpftool/map.c:240:\t\t\tmsg = \"\u003ccannot read\u003e\";\ntools/bpf/bpftool/map.c:241:\ntools/bpf/bpftool/map.c:242:\t\tprint_entry_error_msg(map_info, key,\ntools/bpf/bpftool/map.c:243:\t\t\t\t msg ? : strerror(lookup_errno));\ntools/bpf/bpftool/map.c:244:\t}\ntools/bpf/bpftool/map.c:245:}\ntools/bpf/bpftool/map.c:246:\ntools/bpf/bpftool/map.c:247:static void print_entry_plain(struct bpf_map_info info, unsigned char key,\ntools/bpf/bpftool/map.c:248:\t\t\t unsigned char value)\ntools/bpf/bpftool/map.c:249:{\ntools/bpf/bpftool/map.c:250:\tif (!map_is_per_cpu(info-\u003etype)) {\ntools/bpf/bpftool/map.c:251:\t\tbool single_line, break_names;\ntools/bpf/bpftool/map.c:252:\ntools/bpf/bpftool/map.c:253:\t\tbreak_names = info-\u003ekey_size \u003e 16 \|\| info-\u003evalue_size \u003e 16;\ntools/bpf/bpftool/map.c:254:\t\tsingle_line = info-\u003ekey_size + info-\u003evalue_size \u003c= 24 \u0026\u0026\ntools/bpf/bpftool/map.c:255:\t\t\t!break_names;\ntools/bpf/bpftool/map.c:256:\ntools/bpf/bpftool/map.c:257:\t\tif (info-\u003ekey_size) {\ntools/bpf/bpftool/map.c:258:\t\t\tprintf(\"key:%c\", break_names ? '\\n' : ' ');\ntools/bpf/bpftool/map.c:259:\t\t\tfprint_hex(stdout, key, info-\u003ekey_size, \" \");\ntools/bpf/bpftool/map.c:260:\ntools/bpf/bpftool/map.c:261:\t\t\tprintf(single_line ? \" \" : \"\\n\");\ntools/bpf/bpftool/map.c:262:\t\t}\ntools/bpf/bpftool/map.c:263:\ntools/bpf/bpftool/map.c:264:\t\tif (info-\u003evalue_size) {\ntools/bpf/bpftool/map.c:265:\t\t\tif (map_is_map_of_maps(info-\u003etype)) {\ntools/bpf/bpftool/map.c:266:\t\t\t\tprintf(\"inner_map_id:%c\", break_names ? '\\n' : ' ');\ntools/bpf/bpftool/map.c:267:\t\t\t\tprintf(\"%u \", (unsigned int )value);\ntools/bpf/bpftool/map.c:268:\t\t\t} else {\ntools/bpf/bpftool/map.c:269:\t\t\t\tprintf(\"value:%c\", break_names ? '\\n' : ' ');\ntools/bpf/bpftool/map.c:270:\t\t\t\tfprint_hex(stdout, value, info-\u003evalue_size, \" \");\ntools/bpf/bpftool/map.c:271:\t\t\t}\ntools/bpf/bpftool/map.c:272:\t\t}\ntools/bpf/bpftool/map.c:273:\ntools/bpf/bpftool/map.c:274:\t\tprintf(\"\\n\");\ntools/bpf/bpftool/map.c:275:\t} else {\ntools/bpf/bpftool/map.c:276:\t\tunsigned int i, n, step;\ntools/bpf/bpftool/map.c:277:\ntools/bpf/bpftool/map.c:278:\t\tn = get_possible_cpus();\ntools/bpf/bpftool/map.c:279:\t\tstep = round_up(info-\u003evalue_size, 8);\ntools/bpf/bpftool/map.c:280:\ntools/bpf/bpftool/map.c:281:\t\tif (info-\u003ekey_size) {\ntools/bpf/bpftool/map.c:282:\t\t\tprintf(\"key:\\n\");\ntools/bpf/bpftool/map.c:283:\t\t\tfprint_hex(stdout, key, info-\u003ekey_size, \" \");\ntools/bpf/bpftool/map.c:284:\t\t\tprintf(\"\\n\");\ntools/bpf/bpftool/map.c:285:\t\t}\ntools/bpf/bpftool/map.c:286:\t\tif (info-\u003evalue_size) {\ntools/bpf/bpftool/map.c:287:\t\t\tfor (i = 0; i \u003c n; i++) {\ntools/bpf/bpftool/map.c:288:\t\t\t\tprintf(\"value (CPU %02u):%c\",\ntools/bpf/bpftool/map.c:289:\t\t\t\t i, info-\u003evalue_size \u003e 16 ? '\\n' : ' ');\ntools/bpf/bpftool/map.c:290:\t\t\t\tfprint_hex(stdout, value + i step,\ntools/bpf/bpftool/map.c:291:\t\t\t\t\t info-\u003evalue_size, \" \");\ntools/bpf/bpftool/map.c:292:\t\t\t\tprintf(\"\\n\");\ntools/bpf/bpftool/map.c:293:\t\t\t}\ntools/bpf/bpftool/map.c:294:\t\t}\ntools/bpf/bpftool/map.c:295:\t}\ntools/bpf/bpftool/map.c:296:}\ntools/bpf/bpftool/map.c:297:\ntools/bpf/bpftool/map.c:298:static char parse_bytes(char argv, const char name, unsigned char val,\ntools/bpf/bpftool/map.c:299:\t\t\t unsigned int n)\ntools/bpf/bpftool/map.c:300:{\ntools/bpf/bpftool/map.c:301:\tunsigned int i = 0, base = 0;\ntools/bpf/bpftool/map.c:302:\tchar endptr;\ntools/bpf/bpftool/map.c:303:\ntools/bpf/bpftool/map.c:304:\tif (is_prefix(argv, \"hex\")) {\ntools/bpf/bpftool/map.c:305:\t\tbase = 16;\ntools/bpf/bpftool/map.c:306:\t\targv++;\ntools/bpf/bpftool/map.c:307:\t}\ntools/bpf/bpftool/map.c:308:\ntools/bpf/bpftool/map.c:309:\twhile (i \u003c n \u0026\u0026 argv[i]) {\ntools/bpf/bpftool/map.c:310:\t\tval[i] = strtoul(argv[i], \u0026endptr, base);\ntools/bpf/bpftool/map.c:311:\t\tif (endptr) {\ntools/bpf/bpftool/map.c:312:\t\t\tp_err(\"error parsing byte: %s\", argv[i]);\ntools/bpf/bpftool/map.c:313:\t\t\treturn NULL;\ntools/bpf/bpftool/map.c:314:\t\t}\ntools/bpf/bpftool/map.c:315:\t\ti++;\ntools/bpf/bpftool/map.c:316:\t}\ntools/bpf/bpftool/map.c:317:\ntools/bpf/bpftool/map.c:318:\tif (i != n) {\ntools/bpf/bpftool/map.c:319:\t\tp_err(\"%s expected %u bytes got %u\", name, n, i);\ntools/bpf/bpftool/map.c:320:\t\treturn NULL;\ntools/bpf/bpftool/map.c:321:\t}\ntools/bpf/bpftool/map.c:322:\ntools/bpf/bpftool/map.c:323:\treturn argv + i;\ntools/bpf/bpftool/map.c:324:}\ntools/bpf/bpftool/map.c:325:\ntools/bpf/bpftool/map.c:326:/ on per cpu maps we must copy the provided value on all value instances /\ntools/bpf/bpftool/map.c:327:static void fill_per_cpu_value(struct bpf_map_info info, void value)\ntools/bpf/bpftool/map.c:328:{\ntools/bpf/bpftool/map.c:329:\tunsigned int i, n, step;\ntools/bpf/bpftool/map.c:330:\ntools/bpf/bpftool/map.c:331:\tif (!map_is_per_cpu(info-\u003etype))\ntools/bpf/bpftool/map.c:332:\t\treturn;\ntools/bpf/bpftool/map.c:333:\ntools/bpf/bpftool/map.c:334:\tn = get_possible_cpus();\ntools/bpf/bpftool/map.c:335:\tstep = round_up(info-\u003evalue_size, 8);\ntools/bpf/bpftool/map.c:336:\tfor (i = 1; i \u003c n; i++)\ntools/bpf/bpftool/map.c:337:\t\tmemcpy(value + i step, value, info-\u003evalue_size);\ntools/bpf/bpftool/map.c:338:}\ntools/bpf/bpftool/map.c:339:\ntools/bpf/bpftool/map.c:340:static int parse_elem(char *argv, struct bpf_map_info info, void key,\ntools/bpf/bpftool/map.c:341:\t\t void value, __u32 key_size, __u32 value_size,\ntools/bpf/bpftool/map.c:342:\t\t __u32 flags, __u32 value_fd, __u32 open_flags)\ntools/bpf/bpftool/map.c:343:{\ntools/bpf/bpftool/map.c:344:\tif (!argv) {\ntools/bpf/bpftool/map.c:345:\t\tif (!key \u0026\u0026 !value)\ntools/bpf/bpftool/map.c:346:\t\t\treturn 0;\ntools/bpf/bpftool/map.c:347:\t\tp_err(\"did not find %s\", key ? \"key\" : \"value\");\ntools/bpf/bpftool/map.c:348:\t\treturn -1;\ntools/bpf/bpftool/map.c:349:\t}\ntools/bpf/bpftool/map.c:350:\ntools/bpf/bpftool/map.c:351:\tif (is_prefix(argv, \"key\")) {\ntools/bpf/bpftool/map.c:352:\t\tif (!key) {\ntools/bpf/bpftool/map.c:353:\t\t\tif (key_size)\ntools/bpf/bpftool/map.c:354:\t\t\t\tp_err(\"duplicate key\");\ntools/bpf/bpftool/map.c:355:\t\t\telse\ntools/bpf/bpftool/map.c:356:\t\t\t\tp_err(\"unnecessary key\");\ntools/bpf/bpftool/map.c:357:\t\t\treturn -1;\ntools/bpf/bpftool/map.c:358:\t\t}\ntools/bpf/bpftool/map.c:359:\ntools/bpf/bpftool/map.c:360:\t\targv = parse_bytes(argv + 1, \"key\", key, key_size);\ntools/bpf/bpftool/map.c:361:\t\tif (!argv)\ntools/bpf/bpftool/map.c:362:\t\t\treturn -1;\ntools/bpf/bpftool/map.c:363:\ntools/bpf/bpftool/map.c:364:\t\treturn parse_elem(argv, info, NULL, value, key_size, value_size,\ntools/bpf/bpftool/map.c:365:\t\t\t\t flags, value_fd, open_flags);\ntools/bpf/bpftool/map.c:366:\t} else if (is_prefix(argv, \"value\")) {\ntools/bpf/bpftool/map.c:367:\t\tint fd;\ntools/bpf/bpftool/map.c:368:\ntools/bpf/bpftool/map.c:369:\t\tif (!value) {\ntools/bpf/bpftool/map.c:370:\t\t\tif (value_size)\ntools/bpf/bpftool/map.c:371:\t\t\t\tp_err(\"duplicate value\");\ntools/bpf/bpftool/map.c:372:\t\t\telse\ntools/bpf/bpftool/map.c:373:\t\t\t\tp_err(\"unnecessary value\");\ntools/bpf/bpftool/map.c:374:\t\t\treturn -1;\ntools/bpf/bpftool/map.c:375:\t\t}\ntools/bpf/bpftool/map.c:376:\ntools/bpf/bpftool/map.c:377:\t\targv++;\ntools/bpf/bpftool/map.c:378:\ntools/bpf/bpftool/map.c:379:\t\tif (map_is_map_of_maps(info-\u003etype)) {\ntools/bpf/bpftool/map.c:380:\t\t\tint argc = 2;\ntools/bpf/bpftool/map.c:381:\ntools/bpf/bpftool/map.c:382:\t\t\tif (value_size != 4) {\ntools/bpf/bpftool/map.c:383:\t\t\t\tp_err(\"value smaller than 4B for map in map?\");\ntools/bpf/bpftool/map.c:384:\t\t\t\treturn -1;\ntools/bpf/bpftool/map.c:385:\t\t\t}\ntools/bpf/bpftool/map.c:386:\t\t\tif (!argv[0] \|\| !argv[1]) {\ntools/bpf/bpftool/map.c:387:\t\t\t\tp_err(\"not enough value arguments for map in map\");\ntools/bpf/bpftool/map.c:388:\t\t\t\treturn -1;\ntools/bpf/bpftool/map.c:389:\t\t\t}\ntools/bpf/bpftool/map.c:390:\ntools/bpf/bpftool/map.c:391:\t\t\tfd = map_parse_fd(\u0026argc, \u0026argv, open_flags);\ntools/bpf/bpftool/map.c:392:\t\t\tif (fd \u003c 0)\ntools/bpf/bpftool/map.c:393:\t\t\t\treturn -1;\ntools/bpf/bpftool/map.c:394:\ntools/bpf/bpftool/map.c:395:\t\t\tvalue_fd = value;\ntools/bpf/bpftool/map.c:396:\t\t\tvalue_fd = fd;\ntools/bpf/bpftool/map.c:397:\t\t} else if (map_is_map_of_progs(info-\u003etype)) {\ntools/bpf/bpftool/map.c:398:\t\t\tint argc = 2;\ntools/bpf/bpftool/map.c:399:\ntools/bpf/bpftool/map.c:400:\t\t\tif (value_size != 4) {\ntools/bpf/bpftool/map.c:401:\t\t\t\tp_err(\"value smaller than 4B for map of progs?\");\ntools/bpf/bpftool/map.c:402:\t\t\t\treturn -1;\ntools/bpf/bpftool/map.c:403:\t\t\t}\ntools/bpf/bpftool/map.c:404:\t\t\tif (!argv[0] \|\| !argv[1]) {\ntools/bpf/bpftool/map.c:405:\t\t\t\tp_err(\"not enough value arguments for map of progs\");\ntools/bpf/bpftool/map.c:406:\t\t\t\treturn -1;\ntools/bpf/bpftool/map.c:407:\t\t\t}\ntools/bpf/bpftool/map.c:408:\t\t\tif (is_prefix(argv, \"id\"))\ntools/bpf/bpftool/map.c:409:\t\t\t\tp_info(\"Warning: updating program array via MAP_ID, make sure this map is kept open\\n\"\ntools/bpf/bpftool/map.c:410:\t\t\t\t \" by some process or pinned otherwise update will be lost\");\ntools/bpf/bpftool/map.c:411:\ntools/bpf/bpftool/map.c:412:\t\t\tfd = prog_parse_fd(\u0026argc, \u0026argv);\ntools/bpf/bpftool/map.c:413:\t\t\tif (fd \u003c 0)\ntools/bpf/bpftool/map.c:414:\t\t\t\treturn -1;\ntools/bpf/bpftool/map.c:415:\ntools/bpf/bpftool/map.c:416:\t\t\tvalue_fd = value;\ntools/bpf/bpftool/map.c:417:\t\t\tvalue_fd = fd;\ntools/bpf/bpftool/map.c:418:\t\t} else {\ntools/bpf/bpftool/map.c:419:\t\t\targv = parse_bytes(argv, \"value\", value, value_size);\ntools/bpf/bpftool/map.c:420:\t\t\tif (!argv)\ntools/bpf/bpftool/map.c:421:\t\t\t\treturn -1;\ntools/bpf/bpftool/map.c:422:\ntools/bpf/bpftool/map.c:423:\t\t\tfill_per_cpu_value(info, value);\ntools/bpf/bpftool/map.c:424:\t\t}\ntools/bpf/bpftool/map.c:425:\ntools/bpf/bpftool/map.c:426:\t\treturn parse_elem(argv, info, key, NULL, key_size, value_size,\ntools/bpf/bpftool/map.c:427:\t\t\t\t flags, NULL, open_flags);\ntools/bpf/bpftool/map.c:428:\t} else if (is_prefix(argv, \"any\") \|\| is_prefix(argv, \"noexist\") \|\|\ntools/bpf/bpftool/map.c:429:\t\t is_prefix(argv, \"exist\")) {\ntools/bpf/bpftool/map.c:430:\t\tif (!flags) {\ntools/bpf/bpftool/map.c:431:\t\t\tp_err(\"flags specified multiple times: %s\", argv);\ntools/bpf/bpftool/map.c:432:\t\t\treturn -1;\ntools/bpf/bpftool/map.c:433:\t\t}\ntools/bpf/bpftool/map.c:434:\ntools/bpf/bpftool/map.c:435:\t\tif (is_prefix(argv, \"any\"))\ntools/bpf/bpftool/map.c:436:\t\t\tflags = BPF_ANY;\ntools/bpf/bpftool/map.c:437:\t\telse if (is_prefix(argv, \"noexist\"))\ntools/bpf/bpftool/map.c:438:\t\t\tflags = BPF_NOEXIST;\ntools/bpf/bpftool/map.c:439:\t\telse if (is_prefix(argv, \"exist\"))\ntools/bpf/bpftool/map.c:440:\t\t\tflags = BPF_EXIST;\ntools/bpf/bpftool/map.c:441:\ntools/bpf/bpftool/map.c:442:\t\treturn parse_elem(argv + 1, info, key, value, key_size,\ntools/bpf/bpftool/map.c:443:\t\t\t\t value_size, NULL, value_fd, open_flags);\ntools/bpf/bpftool/map.c:444:\t}\ntools/bpf/bpftool/map.c:445:\ntools/bpf/bpftool/map.c:446:\tp_err(\"expected key or value, got: %s\", argv);\ntools/bpf/bpftool/map.c:447:\treturn -1;\ntools/bpf/bpftool/map.c:448:}\ntools/bpf/bpftool/map.c:449:\ntools/bpf/bpftool/map.c:450:static void show_map_header_json(struct bpf_map_info info, json_writer_t wtr)\ntools/bpf/bpftool/map.c:451:{\ntools/bpf/bpftool/map.c:452:\tconst char map_type_str;\ntools/bpf/bpftool/map.c:453:\ntools/bpf/bpftool/map.c:454:\tjsonw_uint_field(wtr, \"id\", info-\u003eid);\ntools/bpf/bpftool/map.c:455:\tmap_type_str = libbpf_bpf_map_type_str(info-\u003etype);\ntools/bpf/bpftool/map.c:456:\tif (map_type_str)\ntools/bpf/bpftool/map.c:457:\t\tjsonw_string_field(wtr, \"type\", map_type_str);\ntools/bpf/bpftool/map.c:458:\telse\ntools/bpf/bpftool/map.c:459:\t\tjsonw_uint_field(wtr, \"type\", info-\u003etype);\ntools/bpf/bpftool/map.c:460:\ntools/bpf/bpftool/map.c:461:\tif (info-\u003ename)\ntools/bpf/bpftool/map.c:462:\t\tjsonw_string_field(wtr, \"name\", info-\u003ename);\ntools/bpf/bpftool/map.c:463:\ntools/bpf/bpftool/map.c:464:\tjsonw_name(wtr, \"flags\");\ntools/bpf/bpftool/map.c:465:\tjsonw_printf(wtr, \"%u\", info-\u003emap_flags);\ntools/bpf/bpftool/map.c:466:}\ntools/bpf/bpftool/map.c:467:\ntools/bpf/bpftool/map.c:468:static int show_map_close_json(int fd, struct bpf_map_info info)\ntools/bpf/bpftool/map.c:469:{\ntools/bpf/bpftool/map.c:470:\tchar memlock, frozen_str;\ntools/bpf/bpftool/map.c:471:\tint frozen = 0;\ntools/bpf/bpftool/map.c:472:\ntools/bpf/bpftool/map.c:473:\tmemlock = get_fdinfo(fd, \"memlock\");\ntools/bpf/bpftool/map.c:474:\tfrozen_str = get_fdinfo(fd, \"frozen\");\ntools/bpf/bpftool/map.c:475:\ntools/bpf/bpftool/map.c:476:\tjsonw_start_object(json_wtr);\ntools/bpf/bpftool/map.c:477:\ntools/bpf/bpftool/map.c:478:\tshow_map_header_json(info, json_wtr);\ntools/bpf/bpftool/map.c:479:\ntools/bpf/bpftool/map.c:480:\tprint_dev_json(info-\u003eifindex, info-\u003enetns_dev, info-\u003enetns_ino);\ntools/bpf/bpftool/map.c:481:\ntools/bpf/bpftool/map.c:482:\tjsonw_uint_field(json_wtr, \"bytes_key\", info-\u003ekey_size);\ntools/bpf/bpftool/map.c:483:\tjsonw_uint_field(json_wtr, \"bytes_value\", info-\u003evalue_size);\ntools/bpf/bpftool/map.c:484:\tjsonw_uint_field(json_wtr, \"max_entries\", info-\u003emax_entries);\ntools/bpf/bpftool/map.c:485:\ntools/bpf/bpftool/map.c:486:\tif (memlock)\ntools/bpf/bpftool/map.c:487:\t\tjsonw_int_field(json_wtr, \"bytes_memlock\", atoll(memlock));\ntools/bpf/bpftool/map.c:488:\tfree(memlock);\ntools/bpf/bpftool/map.c:489:\ntools/bpf/bpftool/map.c:490:\tif (info-\u003etype == BPF_MAP_TYPE_PROG_ARRAY) {\ntools/bpf/bpftool/map.c:491:\t\tchar owner_prog_type = get_fdinfo(fd, \"owner_prog_type\");\ntools/bpf/bpftool/map.c:492:\t\tchar owner_jited = get_fdinfo(fd, \"owner_jited\");\ntools/bpf/bpftool/map.c:493:\ntools/bpf/bpftool/map.c:494:\t\tif (owner_prog_type) {\ntools/bpf/bpftool/map.c:495:\t\t\tunsigned int prog_type = atoi(owner_prog_type);\ntools/bpf/bpftool/map.c:496:\t\t\tconst char prog_type_str;\ntools/bpf/bpftool/map.c:497:\ntools/bpf/bpftool/map.c:498:\t\t\tprog_type_str = libbpf_bpf_prog_type_str(prog_type);\ntools/bpf/bpftool/map.c:499:\t\t\tif (prog_type_str)\ntools/bpf/bpftool/map.c:500:\t\t\t\tjsonw_string_field(json_wtr, \"owner_prog_type\",\n\n" }
5/2	2026/09/07 00:53	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 24953 output: 89 thoughts: 435 Thoughts: Analysis of the BPF Tool Changes Okay, let's break this down. My initial assessment is that these changes are isolated to the `bpftool` utility and related testing infrastructure. Specifically, I'm looking at modifications within: 1. `tools/bpf/bpftool/Documentation/bpftool-map.rst` 2. `tools/bpf/bpftool/bash-completion/bpftool` 3. `tools/bpf/bpftool/main.c` 4. `tools/bpf/bpftool/main.h` 5. `tools/bpf/bpftool/map.c` 6. `tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c` Based on the established guidelines, this is pretty clear-cut. The criteria for returning `WorthFuzzing=false` is met because all the changes are confined to user-space utilities and self-tests within the `tools/` directory. They are not touching anything that directly affects the kernel image (`vmlinux`) or any loadable kernel modules. These are modifications to the `bpftool` utility itself and the associated self-tests. Therefore, the fuzzing-worthiness is low. I will set the parameters for `set-results` accordingly. I will ensure that: * `WorthFuzzing` is set to `false`. * `FocusSymbols` is set to an empty/null list ( `[]` ). * `EnableConfigs` is also set to an empty/null list ( `[]` ). * The `Reasoning` should explicitly state that the changes are isolated to user-space `bpftool` utility and self-tests located within the `tools/` directory, and that these do not impact the compiled kernel image or runtime kernel code. This should be very clear and concise to prevent any confusion.
6/2	2026/09/07 00:53	tool	set-results	0m Args: { "EnableConfigs": [], "FocusSymbols": [], "Reasoning": "The patch only modifies user-space code in tools/bpf/bpftool and tools/testing/selftests/bpf. It does not affect the compiled kernel image (vmlinux) or kernel modules, and is therefore not relevant for syzkaller fuzzing.", "WorthFuzzing": false } Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch only modifies user-space code in tools/bpf/bpftool and tools/testing/selftests/bpf. It does not affect the compiled kernel image (vmlinux) or kernel modules, and is therefore not relevant for syzkaller fuzzing.", "WorthFuzzing": false }
7/1	2026/09/07 00:53	action	If	0m Args: { "WorthFuzzing": false } Results: null

Trajectory: (Expand/Collapse All)

Seq

Timestamp

Type

Name

Duration

0/0

2026/09/07 00:53

flow

patch-triage

Args:

null

Results:

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch only modifies user-space code in tools/bpf/bpftool and tools/testing/selftests/bpf. It does not affect the compiled kernel image (vmlinux) or kernel modules, and is therefore not relevant for syzkaller fuzzing.",
  "WorthFuzzing": false
}

1/1

2026/09/07 00:53

action

read-patch-diff

Args:

null

Results:

{
  "PatchDiff": "commit bdb56f341f227275b28d1a12610b1ead5b724702\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Sep 7 00:53:30 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst\nindex 5daf3de5c7446..c135338600e8f 100644\n--- a/tools/bpf/bpftool/Documentation/bpftool-map.rst\n+++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst\n@@ -16,7 +16,7 @@ SYNOPSIS\n \n **bpftool** [*OPTIONS*] **map** *COMMAND*\n \n-*OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } | { **-n** | **--nomount** } }\n+*OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } | { **-n** | **--nomount** } | { **-r** | **--recursive** } }\n \n *COMMANDS* :=\n { **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** |\n@@ -170,6 +170,23 @@ OPTIONS\n     Do not automatically attempt to mount any virtual file system (such as\n     tracefs or BPF virtual file system) when necessary.\n \n+-r, --recursive\n+    Also dump the inner maps referenced by **array_of_maps** and **hash_of_maps**\n+    entries when running **map dump**. Each map is dumped once, even if several\n+    entries refer to it. Selected maps are followed by their inner maps.\n+\n+    Plain output includes a header identifying each map. On success, JSON output\n+    is always an array of map objects, each containing an **id** and an\n+    **elements** array, including when only one map is dumped. Outer map entries\n+    retain their **inner_map_id** field, which identifies the corresponding inner\n+    map object.\n+\n+    The dump is not a snapshot: concurrent updates can change map contents.\n+    Failure to open a referenced inner map stops the dump and returns a nonzero\n+    exit status. Output may contain maps or entries printed before the error.\n+    In JSON mode, an error during traversal is included in the output and the\n+    enclosing arrays and objects are closed.\n+\n EXAMPLES\n ========\n **# bpftool map show**\ndiff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool\nindex 75cbcb512ebae..45c336d63be0a 100644\n--- a/tools/bpf/bpftool/bash-completion/bpftool\n+++ b/tools/bpf/bpftool/bash-completion/bpftool\n@@ -261,7 +261,7 @@ _bpftool()\n \n     # Deal with options\n     if [[ ${words[cword]} == -* ]]; then\n-        local c='--version --json --pretty --bpffs --mapcompat --debug \\\n+        local c='--version --json --pretty --recursive --bpffs --mapcompat --debug \\\n             --use-loader --base-btf --sign -i -k'\n         COMPREPLY=( $( compgen -W \"$c\" -- \"$cur\" ) )\n         return 0\ndiff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c\nindex c91e1a6e1a1ec..29021f4dd4518 100644\n--- a/tools/bpf/bpftool/main.c\n+++ b/tools/bpf/bpftool/main.c\n@@ -26,6 +26,7 @@ static int (*last_do_help)(int argc, char **argv);\n json_writer_t *json_wtr;\n bool pretty_output;\n bool json_output;\n+bool recursive;\n bool show_pinned;\n bool block_mount;\n bool verifier_logs;\n@@ -452,6 +453,7 @@ int main(int argc, char **argv)\n \t\t{ \"json\",\tno_argument,\tNULL,\t'j' },\n \t\t{ \"help\",\tno_argument,\tNULL,\t'h' },\n \t\t{ \"pretty\",\tno_argument,\tNULL,\t'p' },\n+\t\t{ \"recursive\",\tno_argument,\tNULL,\t'r' },\n \t\t{ \"version\",\tno_argument,\tNULL,\t'V' },\n \t\t{ \"bpffs\",\tno_argument,\tNULL,\t'f' },\n \t\t{ \"mapcompat\",\tno_argument,\tNULL,\t'm' },\n@@ -485,7 +487,7 @@ int main(int argc, char **argv)\n \tbin_name = \"bpftool\";\n \n \topterr = 0;\n-\twhile ((opt = getopt_long(argc, argv, \"VhpjfLmndSi:k:B:l\",\n+\twhile ((opt = getopt_long(argc, argv, \"VhpjrfLmndSi:k:B:l\",\n \t\t\t\t  options, NULL)) \u003e= 0) {\n \t\tswitch (opt) {\n \t\tcase 'V':\n@@ -507,6 +509,9 @@ int main(int argc, char **argv)\n \t\t\t}\n \t\t\tjsonw_pretty(json_wtr, pretty_output);\n \t\t\tbreak;\n+\t\tcase 'r':\n+\t\t\trecursive = true;\n+\t\t\tbreak;\n \t\tcase 'f':\n \t\t\tshow_pinned = true;\n \t\t\tbreak;\ndiff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h\nindex 78b6e0ebb85d8..b5dc7960cf682 100644\n--- a/tools/bpf/bpftool/main.h\n+++ b/tools/bpf/bpftool/main.h\n@@ -83,6 +83,7 @@ extern const char *bin_name;\n \n extern json_writer_t *json_wtr;\n extern bool json_output;\n+extern bool recursive;\n extern bool show_pinned;\n extern bool show_pids;\n extern bool block_mount;\ndiff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c\nindex 684a8fb724146..853f775b7d529 100644\n--- a/tools/bpf/bpftool/map.c\n+++ b/tools/bpf/bpftool/map.c\n@@ -745,8 +745,10 @@ static int dump_map_elem(int fd, void *key, void *value,\n \t\t\t json_writer_t *btf_wtr)\n {\n \tif (bpf_map_lookup_elem(fd, key, value)) {\n-\t\tprint_entry_error(map_info, key, errno);\n-\t\treturn -1;\n+\t\tint lookup_errno = errno;\n+\n+\t\tprint_entry_error(map_info, key, lookup_errno);\n+\t\treturn -lookup_errno;\n \t}\n \n \tif (json_output) {\n@@ -826,12 +828,53 @@ static void free_map_kv_btf(struct btf *btf)\n \t\tbtf__free(btf);\n }\n \n+struct map_dump_ctx {\n+\tstruct hashmap *seen;\n+\tint **fds;\n+\tint *nb_fds;\n+};\n+\n+static int collect_inner_map(struct map_dump_ctx *ctx, __u32 id)\n+{\n+\tLIBBPF_OPTS(bpf_get_fd_by_id_opts, opts,\n+\t\t.open_flags = BPF_F_RDONLY,\n+\t);\n+\tint *fds, fd, err;\n+\n+\tif (hashmap__find(ctx-\u003eseen, id, NULL))\n+\t\treturn 0;\n+\n+\tfd = bpf_map_get_fd_by_id_opts(id, \u0026opts);\n+\tif (fd \u003c 0) {\n+\t\tp_err(\"can't open inner map id %u: %s\", id, strerror(errno));\n+\t\treturn -1;\n+\t}\n+\n+\tfds = realloc(*ctx-\u003efds, (*ctx-\u003enb_fds + 1ULL) * sizeof(*fds));\n+\tif (!fds) {\n+\t\tp_err(\"mem alloc failed\");\n+\t\tclose(fd);\n+\t\treturn -1;\n+\t}\n+\t*ctx-\u003efds = fds;\n+\n+\terr = hashmap__add(ctx-\u003eseen, id, 0);\n+\tif (err) {\n+\t\tp_err(\"failed to record inner map id %u: %s\", id, strerror(-err));\n+\t\tclose(fd);\n+\t\treturn -1;\n+\t}\n+\tfds[(*ctx-\u003enb_fds)++] = fd;\n+\treturn 0;\n+}\n+\n static int\n map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,\n-\t bool show_header)\n+\t bool show_header, struct map_dump_ctx *ctx)\n {\n \tvoid *key, *value, *prev_key;\n \tunsigned int num_elems = 0;\n+\tjson_writer_t *plain_btf_wtr = NULL;\n \tstruct btf *btf = NULL;\n \tint err;\n \n@@ -845,6 +888,17 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,\n \n \tprev_key = NULL;\n \n+\tif (ctx \u0026\u0026 !wtr \u0026\u0026 (info-\u003ebtf_value_type_id ||\n+\t\t\t    info-\u003ebtf_vmlinux_value_type_id)) {\n+\t\tplain_btf_wtr = get_btf_writer();\n+\t\tif (plain_btf_wtr) {\n+\t\t\tif (show_header)\n+\t\t\t\tshow_map_header_plain(info);\n+\t\t\tshow_header = false;\n+\t\t\twtr = plain_btf_wtr;\n+\t\t}\n+\t}\n+\n \tif (wtr) {\n \t\terr = get_map_kv_btf(info, \u0026btf);\n \t\tif (err) {\n@@ -874,10 +928,22 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,\n \t\tif (err) {\n \t\t\tif (errno == ENOENT)\n \t\t\t\terr = 0;\n+\t\t\telse if (ctx)\n+\t\t\t\tp_err(\"can't get next key for map id %u: %s\",\n+\t\t\t\t      info-\u003eid, strerror(errno));\n \t\t\tbreak;\n \t\t}\n-\t\tif (!dump_map_elem(fd, key, value, info, btf, wtr))\n+\t\terr = dump_map_elem(fd, key, value, info, btf, wtr);\n+\t\tif (!err) {\n \t\t\tnum_elems++;\n+\t\t\tif (ctx \u0026\u0026 map_is_map_of_maps(info-\u003etype)) {\n+\t\t\t\terr = collect_inner_map(ctx, *(__u32 *)value);\n+\t\t\t\tif (err)\n+\t\t\t\t\tbreak;\n+\t\t\t}\n+\t\t} else if (ctx \u0026\u0026 err != -ENOENT) {\n+\t\t\tbreak;\n+\t\t}\n \t\tprev_key = key;\n \t}\n \n@@ -894,6 +960,8 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,\n \tfree(key);\n \tfree(value);\n \tfree_map_kv_btf(btf);\n+\tif (plain_btf_wtr)\n+\t\tjsonw_destroy(\u0026plain_btf_wtr);\n \n \treturn err;\n }\n@@ -902,6 +970,7 @@ static int do_dump(int argc, char **argv)\n {\n \tjson_writer_t *wtr = NULL, *btf_wtr = NULL;\n \tstruct bpf_map_info info = {};\n+\tstruct map_dump_ctx ctx = {};\n \tint nb_fds, i = 0;\n \t__u32 len = sizeof(info);\n \tint *fds = NULL;\n@@ -919,9 +988,36 @@ static int do_dump(int argc, char **argv)\n \tif (nb_fds \u003c 1)\n \t\tgoto exit_free;\n \n+\tif (recursive) {\n+\t\tctx.seen = hashmap__new(hash_fn_for_key_as_id,\n+\t\t\t\t\tequal_fn_for_key_as_id, NULL);\n+\t\tif (IS_ERR(ctx.seen)) {\n+\t\t\tctx.seen = NULL;\n+\t\t\tp_err(\"failed to create hashmap for recursive dump\");\n+\t\t\tgoto exit_close;\n+\t\t}\n+\t\tctx.fds = \u0026fds;\n+\t\tctx.nb_fds = \u0026nb_fds;\n+\t\t/* Record the selected maps before discovering any inner maps. */\n+\t\tfor (i = 0; i \u003c nb_fds; i++) {\n+\t\t\tlen = sizeof(info);\n+\t\t\tif (bpf_map_get_info_by_fd(fds[i], \u0026info, \u0026len)) {\n+\t\t\t\tp_err(\"can't get map info: %s\", strerror(errno));\n+\t\t\t\terr = -1;\n+\t\t\t\tgoto exit_close;\n+\t\t\t}\n+\t\t\terr = hashmap__add(ctx.seen, info.id, 0);\n+\t\t\tif (err) {\n+\t\t\t\tp_err(\"failed to record map id %u: %s\", info.id,\n+\t\t\t\t      strerror(-err));\n+\t\t\t\tgoto exit_close;\n+\t\t\t}\n+\t\t}\n+\t}\n+\n \tif (json_output) {\n \t\twtr = json_wtr;\n-\t} else {\n+\t} else if (!recursive) {\n \t\tint do_plain_btf;\n \n \t\tdo_plain_btf = maps_have_btf(fds, nb_fds);\n@@ -936,7 +1032,7 @@ static int do_dump(int argc, char **argv)\n \t\t}\n \t}\n \n-\tif (wtr \u0026\u0026 nb_fds \u003e 1)\n+\tif (wtr \u0026\u0026 (nb_fds \u003e 1 || recursive))\n \t\tjsonw_start_array(wtr);\t/* root array */\n \tfor (i = 0; i \u003c nb_fds; i++) {\n \t\tif (bpf_map_get_info_by_fd(fds[i], \u0026info, \u0026len)) {\n@@ -944,22 +1040,28 @@ static int do_dump(int argc, char **argv)\n \t\t\terr = -1;\n \t\t\tbreak;\n \t\t}\n-\t\terr = map_dump(fds[i], \u0026info, wtr, nb_fds \u003e 1);\n+\t\terr = map_dump(fds[i], \u0026info, wtr, nb_fds \u003e 1 || recursive,\n+\t\t\t       recursive ? \u0026ctx : NULL);\n \t\tif (!wtr \u0026\u0026 i != nb_fds - 1)\n \t\t\tprintf(\"\\n\");\n \n \t\tif (err)\n \t\t\tbreak;\n-\t\tclose(fds[i]);\n+\t\t/* Keep discovered maps alive until the recursive dump is complete. */\n+\t\tif (!recursive)\n+\t\t\tclose(fds[i]);\n \t}\n-\tif (wtr \u0026\u0026 nb_fds \u003e 1)\n+\tif (wtr \u0026\u0026 (nb_fds \u003e 1 || recursive))\n \t\tjsonw_end_array(wtr);\t/* root array */\n \n \tif (btf_wtr)\n \t\tjsonw_destroy(\u0026btf_wtr);\n exit_close:\n+\tif (recursive)\n+\t\ti = 0;\n \tfor (; i \u003c nb_fds; i++)\n \t\tclose(fds[i]);\n+\thashmap__free(ctx.seen);\n exit_free:\n \tfree(fds);\n \tfree_btf_vmlinux();\n@@ -1484,7 +1586,7 @@ static int do_help(int argc, char **argv)\n \t\t\"                 task_storage | bloom_filter | user_ringbuf | cgrp_storage | arena |\\n\"\n \t\t\"                 insn_array | rhash }\\n\"\n \t\t\"       \" HELP_SPEC_OPTIONS \" |\\n\"\n-\t\t\"                    {-f|--bpffs} | {-n|--nomount} }\\n\"\n+\t\t\"                    {-f|--bpffs} | {-n|--nomount} | {-r|--recursive} }\\n\"\n \t\t\"\",\n \t\tbin_name, argv[-2]);\n \ndiff --git a/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c\nnew file mode 100644\nindex 0000000000000..3c425dbe2d9d4\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c\n@@ -0,0 +1,252 @@\n+// SPDX-License-Identifier: GPL-2.0-only\n+#include \u003ctest_progs.h\u003e\n+#include \u003cbpftool_helpers.h\u003e\n+#include \u003cbpf/btf.h\u003e\n+\n+#define OUTPUT_SIZE 8192\n+\n+static bool dump_map(__u32 id, const char *options, char *output)\n+{\n+\tchar command[MAX_BPFTOOL_CMD_LEN];\n+\n+\tsnprintf(command, sizeof(command), \"%s map dump id %u\", options, id);\n+\tmemset(output, 0, OUTPUT_SIZE);\n+\tif (!ASSERT_OK(get_bpftool_command_output(command, output, OUTPUT_SIZE - 1),\n+\t\t       \"dump_map\"))\n+\t\treturn false;\n+\t/* The helper doesn't terminate or strip the output. */\n+\toutput[strcspn(output, \"\\n\")] = '\\0';\n+\treturn true;\n+}\n+\n+static __u32 map_id(int fd)\n+{\n+\tstruct bpf_map_info info = {};\n+\t__u32 len = sizeof(info);\n+\n+\tif (!ASSERT_OK(bpf_map_get_info_by_fd(fd, \u0026info, \u0026len), \"map_info\"))\n+\t\treturn 0;\n+\treturn info.id;\n+}\n+\n+static int count_token(const char *output, const char *token)\n+{\n+\tint count = 0;\n+\n+\twhile ((output = strstr(output, token))) {\n+\t\tcount++;\n+\t\toutput += strlen(token);\n+\t}\n+\treturn count;\n+}\n+\n+static void check_plain(__u32 root_id, __u32 inner_id, const char *type,\n+\t\t\tint entries, bool typed)\n+{\n+\tchar command[MAX_BPFTOOL_CMD_LEN], header[128];\n+\tchar output[OUTPUT_SIZE] = {};\n+\tconst char *root, *inner;\n+\n+\tsnprintf(command, sizeof(command), \"--recursive map dump id %u\", root_id);\n+\tif (!ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),\n+\t\t       \"plain_dump\"))\n+\t\treturn;\n+\tsnprintf(header, sizeof(header), \"%u: %s  name dump_outer  \", root_id, type);\n+\troot = strstr(output, header);\n+\tif (!ASSERT_OK_PTR(root, \"plain_root_header\"))\n+\t\treturn;\n+\tASSERT_EQ(root - output, 0, \"plain_root_first\");\n+\tASSERT_EQ(count_token(output, \"inner_map_id:\"), entries, \"plain_references\");\n+\tif (entries) {\n+\t\tsnprintf(header, sizeof(header), \"%u: hash  name dump_inner  \", inner_id);\n+\t\tinner = strstr(output, header);\n+\t\tif (ASSERT_OK_PTR(inner, \"plain_inner_header\"))\n+\t\t\tASSERT_GT(inner - root, 0, \"plain_inner_after_root\");\n+\t\tASSERT_EQ(count_token(output, header), 1, \"plain_inner_once\");\n+\t}\n+\tASSERT_EQ(count_token(output, \"Found \"), entries \u0026\u0026 !typed ? 2 : 1,\n+\t\t  \"plain_map_count\");\n+\tif (typed) {\n+\t\tASSERT_HAS_SUBSTR(output, \"\\\"key\\\": 0\", \"plain_btf_key\");\n+\t\tASSERT_HAS_SUBSTR(output, \"\\\"value\\\": 16843009\", \"plain_btf_value\");\n+\t}\n+}\n+\n+static void test_outer(enum bpf_map_type type, int entries, bool empty_inner,\n+\t\t       bool typed)\n+{\n+\tLIBBPF_OPTS(bpf_map_create_opts, opts);\n+\tLIBBPF_OPTS(bpf_map_create_opts, inner_opts);\n+\tstruct btf *btf = NULL;\n+\tchar outer[OUTPUT_SIZE], inner[OUTPUT_SIZE], output[OUTPUT_SIZE];\n+\tchar expected[OUTPUT_SIZE * 3], reference[64];\n+\tconst char *type_name = libbpf_bpf_map_type_str(type);\n+\tint inner_fd = -1, outer_fd = -1;\n+\t__u32 root_id, inner_id, key, value = 0x01010101;\n+\n+\tif (typed) {\n+\t\tbtf = btf__new_empty();\n+\t\tif (!ASSERT_OK_PTR(btf, \"create_btf\") ||\n+\t\t    !ASSERT_EQ(btf__add_int(btf, \"unsigned int\", 4, 0), 1, \"btf_int\") ||\n+\t\t    !ASSERT_OK(btf__load_into_kernel(btf), \"load_btf\"))\n+\t\t\tgoto out;\n+\t\tinner_opts.btf_fd = btf__fd(btf);\n+\t\tinner_opts.btf_key_type_id = 1;\n+\t\tinner_opts.btf_value_type_id = 1;\n+\t}\n+\tinner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, \"dump_inner\", sizeof(key),\n+\t\t\t\t  sizeof(value), 2, \u0026inner_opts);\n+\tif (!ASSERT_OK_FD(inner_fd, \"create_inner\"))\n+\t\tgoto out;\n+\tkey = 0;\n+\tif (!empty_inner \u0026\u0026\n+\t    !ASSERT_OK(bpf_map_update_elem(inner_fd, \u0026key, \u0026value, BPF_ANY),\n+\t\t       \"populate_inner\"))\n+\t\tgoto out;\n+\topts.inner_map_fd = inner_fd;\n+\touter_fd = bpf_map_create(type, \"dump_outer\", sizeof(key), sizeof(__u32),\n+\t\t\t\t 3, \u0026opts);\n+\tif (!ASSERT_OK_FD(outer_fd, \"create_outer\"))\n+\t\tgoto out;\n+\t/* The unused third array slot also exercises failed lookups. */\n+\tfor (key = 0; key \u003c entries; key++)\n+\t\tif (!ASSERT_OK(bpf_map_update_elem(outer_fd, \u0026key, \u0026inner_fd, BPF_ANY),\n+\t\t\t       \"populate_outer\"))\n+\t\t\tgoto out;\n+\troot_id = map_id(outer_fd);\n+\tinner_id = map_id(inner_fd);\n+\tif (!root_id || !inner_id || !dump_map(root_id, \"-j\", outer) ||\n+\t    !dump_map(inner_id, \"-j\", inner))\n+\t\tgoto out;\n+\n+\tASSERT_EQ(outer[0], '[', \"default_array\");\n+\tASSERT_EQ(count_token(outer, \"\\\"elements\\\":\"), 0, \"default_no_wrapper\");\n+\tASSERT_EQ(count_token(outer, \"\\\"id\\\":\"), 0, \"default_no_header\");\n+\tsnprintf(reference, sizeof(reference), \"\\\"inner_map_id\\\":%u\", inner_id);\n+\tASSERT_EQ(count_token(outer, reference), entries, \"default_references\");\n+\tif (!entries)\n+\t\tASSERT_STREQ(outer, \"[]\", \"empty_outer_default\");\n+\tif (empty_inner)\n+\t\tASSERT_STREQ(inner, \"[]\", \"empty_inner_default\");\n+\telse if (typed)\n+\t\tASSERT_HAS_SUBSTR(inner, \"\\\"formatted\\\":{\\\"key\\\":0,\\\"value\\\":16843009}\",\n+\t\t\t\t  \"typed_inner\");\n+\telse\n+\t\tASSERT_STREQ(inner,\n+\t\t\t     \"[{\\\"key\\\":[\\\"0x00\\\",\\\"0x00\\\",\\\"0x00\\\",\\\"0x00\\\"],\"\n+\t\t\t     \"\\\"value\\\":[\\\"0x01\\\",\\\"0x01\\\",\\\"0x01\\\",\\\"0x01\\\"]}]\",\n+\t\t\t     \"ordinary_default\");\n+\n+\t/* Compare the complete JSON document: a flat array with the root first,\n+\t * one copy of the shared inner map, and unchanged entry representations.\n+\t */\n+\tif (entries)\n+\t\tsnprintf(expected, sizeof(expected),\n+\t\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"%s\\\",\\\"name\\\":\\\"dump_outer\\\",\"\n+\t\t\t \"\\\"flags\\\":0,\\\"elements\\\":%s},{\\\"id\\\":%u,\\\"type\\\":\\\"hash\\\",\"\n+\t\t\t \"\\\"name\\\":\\\"dump_inner\\\",\\\"flags\\\":0,\\\"elements\\\":%s}]\",\n+\t\t\t root_id, type_name, outer, inner_id, inner);\n+\telse\n+\t\tsnprintf(expected, sizeof(expected),\n+\t\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"%s\\\",\\\"name\\\":\\\"dump_outer\\\",\"\n+\t\t\t \"\\\"flags\\\":0,\\\"elements\\\":[]}]\", root_id, type_name);\n+\tif (dump_map(root_id, \"-j -r\", output))\n+\t\tASSERT_STREQ(output, expected, \"recursive_json\");\n+\tif (dump_map(root_id, \"--json --recursive\", output))\n+\t\tASSERT_STREQ(output, expected, \"recursive_long_options\");\n+\tcheck_plain(root_id, inner_id, type_name, entries, typed);\n+\n+\t/* Recursion on an ordinary map still emits a single map object. */\n+\tsnprintf(expected, sizeof(expected),\n+\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"hash\\\",\\\"name\\\":\\\"dump_inner\\\",\"\n+\t\t \"\\\"flags\\\":0,\\\"elements\\\":%s}]\", inner_id, inner);\n+\tif (dump_map(inner_id, \"-j -r\", output))\n+\t\tASSERT_STREQ(output, expected, \"ordinary_recursive\");\n+out:\n+\tif (outer_fd \u003e= 0)\n+\t\tclose(outer_fd);\n+\tif (inner_fd \u003e= 0)\n+\t\tclose(inner_fd);\n+\tbtf__free(btf);\n+}\n+\n+static void test_multiple_roots(void)\n+{\n+\tLIBBPF_OPTS(bpf_map_create_opts, opts);\n+\tchar command[MAX_BPFTOOL_CMD_LEN], name[BPF_OBJ_NAME_LEN];\n+\tchar output[OUTPUT_SIZE] = {}, expected[OUTPUT_SIZE * 4], elements[OUTPUT_SIZE];\n+\tstatic const char * const types[] = { \"hash\", \"array_of_maps\", \"hash_of_maps\", \"hash\" };\n+\tint fds[] = { -1, -1, -1, -1 };\n+\t__u32 ids[4], key;\n+\tint i, len = 0;\n+\n+\t/* Select the first inner map and both outers as roots. The other inner\n+\t * map must be appended after all three roots, even though it is found\n+\t * while dumping the first outer. A process-specific name avoids other\n+\t * tests' maps joining the selection.\n+\t */\n+\tsnprintf(name, sizeof(name), \"dump_%u\", getpid());\n+\tfds[0] = bpf_map_create(BPF_MAP_TYPE_HASH, name, 4, 4, 1, NULL);\n+\tif (!ASSERT_OK_FD(fds[0], \"create_selected_inner\"))\n+\t\tgoto out;\n+\tfds[3] = bpf_map_create(BPF_MAP_TYPE_HASH, \"dump_discovered\", 4, 4, 1, NULL);\n+\tif (!ASSERT_OK_FD(fds[3], \"create_discovered_inner\"))\n+\t\tgoto out;\n+\topts.inner_map_fd = fds[0];\n+\tfds[1] = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, name, 4, 4, 2, \u0026opts);\n+\tif (!ASSERT_OK_FD(fds[1], \"create_array_root\"))\n+\t\tgoto out;\n+\tfds[2] = bpf_map_create(BPF_MAP_TYPE_HASH_OF_MAPS, name, 4, 4, 2, \u0026opts);\n+\tif (!ASSERT_OK_FD(fds[2], \"create_hash_root\"))\n+\t\tgoto out;\n+\tfor (i = 1; i \u003c= 2; i++) {\n+\t\tkey = 0;\n+\t\tif (!ASSERT_OK(bpf_map_update_elem(fds[i], \u0026key, \u0026fds[0], BPF_ANY),\n+\t\t\t       \"reference_selected_inner\"))\n+\t\t\tgoto out;\n+\t\tkey = 1;\n+\t\tif (!ASSERT_OK(bpf_map_update_elem(fds[i], \u0026key, \u0026fds[3], BPF_ANY),\n+\t\t\t       \"reference_discovered_inner\"))\n+\t\t\tgoto out;\n+\t}\n+\tfor (i = 0; i \u003c ARRAY_SIZE(fds); i++) {\n+\t\tids[i] = map_id(fds[i]);\n+\t\tif (!ids[i] || !dump_map(ids[i], \"-j\", elements))\n+\t\t\tgoto out;\n+\t\tlen += snprintf(expected + len, sizeof(expected) - len,\n+\t\t\t\t\"%s{\\\"id\\\":%u,\\\"type\\\":\\\"%s\\\",\\\"name\\\":\\\"%s\\\",\"\n+\t\t\t\t\"\\\"flags\\\":0,\\\"elements\\\":%s}%s\",\n+\t\t\t\ti ? \",\" : \"[\", ids[i], types[i],\n+\t\t\t\ti == 3 ? \"dump_discovered\" : name, elements, i == 3 ? \"]\" : \"\");\n+\t}\n+\tsnprintf(command, sizeof(command), \"-j -r map dump name %s\", name);\n+\tif (ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),\n+\t\t      \"dump_multiple_roots\")) {\n+\t\toutput[strcspn(output, \"\\n\")] = '\\0';\n+\t\tASSERT_STREQ(output, expected, \"roots_first_and_seed_dedup\");\n+\t}\n+out:\n+\tfor (i = 0; i \u003c ARRAY_SIZE(fds); i++)\n+\t\tif (fds[i] \u003e= 0)\n+\t\t\tclose(fds[i]);\n+}\n+\n+void test_bpftool_map_dump(void)\n+{\n+\tif (test__start_subtest(\"multiple_roots\"))\n+\t\ttest_multiple_roots();\n+\tif (test__start_subtest(\"array_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 1, false, false);\n+\tif (test__start_subtest(\"hash_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, false);\n+\tif (test__start_subtest(\"shared_inner\"))\n+\t\ttest_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 2, false, false);\n+\tif (test__start_subtest(\"empty_array_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 0, false, false);\n+\tif (test__start_subtest(\"empty_hash_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 0, false, false);\n+\tif (test__start_subtest(\"btf_inner\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, true);\n+\tif (test__start_subtest(\"empty_inner\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, true, false);\n+}\n"
}

2/1

2026/09/07 00:53

agent

patch-evaluator

Model:

core

Args:

null

Results:

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies user-space code in tools/bpf/bpftool and tools/testing/selftests/bpf. It does not affect the compiled kernel image (vmlinux) or kernel modules, and is therefore not relevant for syzkaller fuzzing.",
  "WorthFuzzing": false
}

Instruction:

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt:

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit bdb56f341f227275b28d1a12610b1ead5b724702
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Sep 7 00:53:30 2026 +0000

    syz-cluster: applied patch under review

diff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst
index 5daf3de5c7446..c135338600e8f 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-map.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst
@@ -16,7 +16,7 @@ SYNOPSIS
 
 **bpftool** [*OPTIONS*] **map** *COMMAND*
 
-*OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } | { **-n** | **--nomount** } }
+*OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } | { **-n** | **--nomount** } | { **-r** | **--recursive** } }
 
 *COMMANDS* :=
 { **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** |
@@ -170,6 +170,23 @@ OPTIONS
     Do not automatically attempt to mount any virtual file system (such as
     tracefs or BPF virtual file system) when necessary.
 
+-r, --recursive
+    Also dump the inner maps referenced by **array_of_maps** and **hash_of_maps**
+    entries when running **map dump**. Each map is dumped once, even if several
+    entries refer to it. Selected maps are followed by their inner maps.
+
+    Plain output includes a header identifying each map. On success, JSON output
+    is always an array of map objects, each containing an **id** and an
+    **elements** array, including when only one map is dumped. Outer map entries
+    retain their **inner_map_id** field, which identifies the corresponding inner
+    map object.
+
+    The dump is not a snapshot: concurrent updates can change map contents.
+    Failure to open a referenced inner map stops the dump and returns a nonzero
+    exit status. Output may contain maps or entries printed before the error.
+    In JSON mode, an error during traversal is included in the output and the
+    enclosing arrays and objects are closed.
+
 EXAMPLES
 ========
 **# bpftool map show**
diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool
index 75cbcb512ebae..45c336d63be0a 100644
--- a/tools/bpf/bpftool/bash-completion/bpftool
+++ b/tools/bpf/bpftool/bash-completion/bpftool
@@ -261,7 +261,7 @@ _bpftool()
 
     # Deal with options
     if [[ ${words[cword]} == -* ]]; then
-        local c='--version --json --pretty --bpffs --mapcompat --debug \
+        local c='--version --json --pretty --recursive --bpffs --mapcompat --debug \
             --use-loader --base-btf --sign -i -k'
         COMPREPLY=( $( compgen -W "$c" -- "$cur" ) )
         return 0
diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c
index c91e1a6e1a1ec..29021f4dd4518 100644
--- a/tools/bpf/bpftool/main.c
+++ b/tools/bpf/bpftool/main.c
@@ -26,6 +26,7 @@ static int (*last_do_help)(int argc, char **argv);
 json_writer_t *json_wtr;
 bool pretty_output;
 bool json_output;
+bool recursive;
 bool show_pinned;
 bool block_mount;
 bool verifier_logs;
@@ -452,6 +453,7 @@ int main(int argc, char **argv)
 		{ "json",	no_argument,	NULL,	'j' },
 		{ "help",	no_argument,	NULL,	'h' },
 		{ "pretty",	no_argument,	NULL,	'p' },
+		{ "recursive",	no_argument,	NULL,	'r' },
 		{ "version",	no_argument,	NULL,	'V' },
 		{ "bpffs",	no_argument,	NULL,	'f' },
 		{ "mapcompat",	no_argument,	NULL,	'm' },
@@ -485,7 +487,7 @@ int main(int argc, char **argv)
 	bin_name = "bpftool";
 
 	opterr = 0;
-	while ((opt = getopt_long(argc, argv, "VhpjfLmndSi:k:B:l",
+	while ((opt = getopt_long(argc, argv, "VhpjrfLmndSi:k:B:l",
 				  options, NULL)) >= 0) {
 		switch (opt) {
 		case 'V':
@@ -507,6 +509,9 @@ int main(int argc, char **argv)
 			}
 			jsonw_pretty(json_wtr, pretty_output);
 			break;
+		case 'r':
+			recursive = true;
+			break;
 		case 'f':
 			show_pinned = true;
 			break;
diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
index 78b6e0ebb85d8..b5dc7960cf682 100644
--- a/tools/bpf/bpftool/main.h
+++ b/tools/bpf/bpftool/main.h
@@ -83,6 +83,7 @@ extern const char *bin_name;
 
 extern json_writer_t *json_wtr;
 extern bool json_output;
+extern bool recursive;
 extern bool show_pinned;
 extern bool show_pids;
 extern bool block_mount;
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 684a8fb724146..853f775b7d529 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -745,8 +745,10 @@ static int dump_map_elem(int fd, void *key, void *value,
 			 json_writer_t *btf_wtr)
 {
 	if (bpf_map_lookup_elem(fd, key, value)) {
-		print_entry_error(map_info, key, errno);
-		return -1;
+		int lookup_errno = errno;
+
+		print_entry_error(map_info, key, lookup_errno);
+		return -lookup_errno;
 	}
 
 	if (json_output) {
@@ -826,12 +828,53 @@ static void free_map_kv_btf(struct btf *btf)
 		btf__free(btf);
 }
 
+struct map_dump_ctx {
+	struct hashmap *seen;
+	int **fds;
+	int *nb_fds;
+};
+
+static int collect_inner_map(struct map_dump_ctx *ctx, __u32 id)
+{
+	LIBBPF_OPTS(bpf_get_fd_by_id_opts, opts,
+		.open_flags = BPF_F_RDONLY,
+	);
+	int *fds, fd, err;
+
+	if (hashmap__find(ctx->seen, id, NULL))
+		return 0;
+
+	fd = bpf_map_get_fd_by_id_opts(id, &opts);
+	if (fd < 0) {
+		p_err("can't open inner map id %u: %s", id, strerror(errno));
+		return -1;
+	}
+
+	fds = realloc(*ctx->fds, (*ctx->nb_fds + 1ULL) * sizeof(*fds));
+	if (!fds) {
+		p_err("mem alloc failed");
+		close(fd);
+		return -1;
+	}
+	*ctx->fds = fds;
+
+	err = hashmap__add(ctx->seen, id, 0);
+	if (err) {
+		p_err("failed to record inner map id %u: %s", id, strerror(-err));
+		close(fd);
+		return -1;
+	}
+	fds[(*ctx->nb_fds)++] = fd;
+	return 0;
+}
+
 static int
 map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
-	 bool show_header)
+	 bool show_header, struct map_dump_ctx *ctx)
 {
 	void *key, *value, *prev_key;
 	unsigned int num_elems = 0;
+	json_writer_t *plain_btf_wtr = NULL;
 	struct btf *btf = NULL;
 	int err;
 
@@ -845,6 +888,17 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
 
 	prev_key = NULL;
 
+	if (ctx && !wtr && (info->btf_value_type_id ||
+			    info->btf_vmlinux_value_type_id)) {
+		plain_btf_wtr = get_btf_writer();
+		if (plain_btf_wtr) {
+			if (show_header)
+				show_map_header_plain(info);
+			show_header = false;
+			wtr = plain_btf_wtr;
+		}
+	}
+
 	if (wtr) {
 		err = get_map_kv_btf(info, &btf);
 		if (err) {
@@ -874,10 +928,22 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
 		if (err) {
 			if (errno == ENOENT)
 				err = 0;
+			else if (ctx)
+				p_err("can't get next key for map id %u: %s",
+				      info->id, strerror(errno));
 			break;
 		}
-		if (!dump_map_elem(fd, key, value, info, btf, wtr))
+		err = dump_map_elem(fd, key, value, info, btf, wtr);
+		if (!err) {
 			num_elems++;
+			if (ctx && map_is_map_of_maps(info->type)) {
+				err = collect_inner_map(ctx, *(__u32 *)value);
+				if (err)
+					break;
+			}
+		} else if (ctx && err != -ENOENT) {
+			break;
+		}
 		prev_key = key;
 	}
 
@@ -894,6 +960,8 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
 	free(key);
 	free(value);
 	free_map_kv_btf(btf);
+	if (plain_btf_wtr)
+		jsonw_destroy(&plain_btf_wtr);
 
 	return err;
 }
@@ -902,6 +970,7 @@ static int do_dump(int argc, char **argv)
 {
 	json_writer_t *wtr = NULL, *btf_wtr = NULL;
 	struct bpf_map_info info = {};
+	struct map_dump_ctx ctx = {};
 	int nb_fds, i = 0;
 	__u32 len = sizeof(info);
 	int *fds = NULL;
@@ -919,9 +988,36 @@ static int do_dump(int argc, char **argv)
 	if (nb_fds < 1)
 		goto exit_free;
 
+	if (recursive) {
+		ctx.seen = hashmap__new(hash_fn_for_key_as_id,
+					equal_fn_for_key_as_id, NULL);
+		if (IS_ERR(ctx.seen)) {
+			ctx.seen = NULL;
+			p_err("failed to create hashmap for recursive dump");
+			goto exit_close;
+		}
+		ctx.fds = &fds;
+		ctx.nb_fds = &nb_fds;
+		/* Record the selected maps before discovering any inner maps. */
+		for (i = 0; i < nb_fds; i++) {
+			len = sizeof(info);
+			if (bpf_map_get_info_by_fd(fds[i], &info, &len)) {
+				p_err("can't get map info: %s", strerror(errno));
+				err = -1;
+				goto exit_close;
+			}
+			err = hashmap__add(ctx.seen, info.id, 0);
+			if (err) {
+				p_err("failed to record map id %u: %s", info.id,
+				      strerror(-err));
+				goto exit_close;
+			}
+		}
+	}
+
 	if (json_output) {
 		wtr = json_wtr;
-	} else {
+	} else if (!recursive) {
 		int do_plain_btf;
 
 		do_plain_btf = maps_have_btf(fds, nb_fds);
@@ -936,7 +1032,7 @@ static int do_dump(int argc, char **argv)
 		}
 	}
 
-	if (wtr && nb_fds > 1)
+	if (wtr && (nb_fds > 1 || recursive))
 		jsonw_start_array(wtr);	/* root array */
 	for (i = 0; i < nb_fds; i++) {
 		if (bpf_map_get_info_by_fd(fds[i], &info, &len)) {
@@ -944,22 +1040,28 @@ static int do_dump(int argc, char **argv)
 			err = -1;
 			break;
 		}
-		err = map_dump(fds[i], &info, wtr, nb_fds > 1);
+		err = map_dump(fds[i], &info, wtr, nb_fds > 1 || recursive,
+			       recursive ? &ctx : NULL);
 		if (!wtr && i != nb_fds - 1)
 			printf("\n");
 
 		if (err)
 			break;
-		close(fds[i]);
+		/* Keep discovered maps alive until the recursive dump is complete. */
+		if (!recursive)
+			close(fds[i]);
 	}
-	if (wtr && nb_fds > 1)
+	if (wtr && (nb_fds > 1 || recursive))
 		jsonw_end_array(wtr);	/* root array */
 
 	if (btf_wtr)
 		jsonw_destroy(&btf_wtr);
 exit_close:
+	if (recursive)
+		i = 0;
 	for (; i < nb_fds; i++)
 		close(fds[i]);
+	hashmap__free(ctx.seen);
 exit_free:
 	free(fds);
 	free_btf_vmlinux();
@@ -1484,7 +1586,7 @@ static int do_help(int argc, char **argv)
 		"                 task_storage | bloom_filter | user_ringbuf | cgrp_storage | arena |\n"
 		"                 insn_array | rhash }\n"
 		"       " HELP_SPEC_OPTIONS " |\n"
-		"                    {-f|--bpffs} | {-n|--nomount} }\n"
+		"                    {-f|--bpffs} | {-n|--nomount} | {-r|--recursive} }\n"
 		"",
 		bin_name, argv[-2]);
 
diff --git a/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c
new file mode 100644
index 0000000000000..3c425dbe2d9d4
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c
@@ -0,0 +1,252 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#include <test_progs.h>
+#include <bpftool_helpers.h>
+#include <bpf/btf.h>
+
+#define OUTPUT_SIZE 8192
+
+static bool dump_map(__u32 id, const char *options, char *output)
+{
+	char command[MAX_BPFTOOL_CMD_LEN];
+
+	snprintf(command, sizeof(command), "%s map dump id %u", options, id);
+	memset(output, 0, OUTPUT_SIZE);
+	if (!ASSERT_OK(get_bpftool_command_output(command, output, OUTPUT_SIZE - 1),
+		       "dump_map"))
+		return false;
+	/* The helper doesn't terminate or strip the output. */
+	output[strcspn(output, "\n")] = '\0';
+	return true;
+}
+
+static __u32 map_id(int fd)
+{
+	struct bpf_map_info info = {};
+	__u32 len = sizeof(info);
+
+	if (!ASSERT_OK(bpf_map_get_info_by_fd(fd, &info, &len), "map_info"))
+		return 0;
+	return info.id;
+}
+
+static int count_token(const char *output, const char *token)
+{
+	int count = 0;
+
+	while ((output = strstr(output, token))) {
+		count++;
+		output += strlen(token);
+	}
+	return count;
+}
+
+static void check_plain(__u32 root_id, __u32 inner_id, const char *type,
+			int entries, bool typed)
+{
+	char command[MAX_BPFTOOL_CMD_LEN], header[128];
+	char output[OUTPUT_SIZE] = {};
+	const char *root, *inner;
+
+	snprintf(command, sizeof(command), "--recursive map dump id %u", root_id);
+	if (!ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),
+		       "plain_dump"))
+		return;
+	snprintf(header, sizeof(header), "%u: %s  name dump_outer  ", root_id, type);
+	root = strstr(output, header);
+	if (!ASSERT_OK_PTR(root, "plain_root_header"))
+		return;
+	ASSERT_EQ(root - output, 0, "plain_root_first");
+	ASSERT_EQ(count_token(output, "inner_map_id:"), entries, "plain_references");
+	if (entries) {
+		snprintf(header, sizeof(header), "%u: hash  name dump_inner  ", inner_id);
+		inner = strstr(output, header);
+		if (ASSERT_OK_PTR(inner, "plain_inner_header"))
+			ASSERT_GT(inner - root, 0, "plain_inner_after_root");
+		ASSERT_EQ(count_token(output, header), 1, "plain_inner_once");
+	}
+	ASSERT_EQ(count_token(output, "Found "), entries && !typed ? 2 : 1,
+		  "plain_map_count");
+	if (typed) {
+		ASSERT_HAS_SUBSTR(output, "\"key\": 0", "plain_btf_key");
+		ASSERT_HAS_SUBSTR(output, "\"value\": 16843009", "plain_btf_value");
+	}
+}
+
+static void test_outer(enum bpf_map_type type, int entries, bool empty_inner,
+		       bool typed)
+{
+	LIBBPF_OPTS(bpf_map_create_opts, opts);
+	LIBBPF_OPTS(bpf_map_create_opts, inner_opts);
+	struct btf *btf = NULL;
+	char outer[OUTPUT_SIZE], inner[OUTPUT_SIZE], output[OUTPUT_SIZE];
+	char expected[OUTPUT_SIZE * 3], reference[64];
+	const char *type_name = libbpf_bpf_map_type_str(type);
+	int inner_fd = -1, outer_fd = -1;
+	__u32 root_id, inner_id, key, value = 0x01010101;
+
+	if (typed) {
+		btf = btf__new_empty();
+		if (!ASSERT_OK_PTR(btf, "create_btf") ||
+		    !ASSERT_EQ(btf__add_int(btf, "unsigned int", 4, 0), 1, "btf_int") ||
+		    !ASSERT_OK(btf__load_into_kernel(btf), "load_btf"))
+			goto out;
+		inner_opts.btf_fd = btf__fd(btf);
+		inner_opts.btf_key_type_id = 1;
+		inner_opts.btf_value_type_id = 1;
+	}
+	inner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, "dump_inner", sizeof(key),
+				  sizeof(value), 2, &inner_opts);
+	if (!ASSERT_OK_FD(inner_fd, "create_inner"))
+		goto out;
+	key = 0;
+	if (!empty_inner &&
+	    !ASSERT_OK(bpf_map_update_elem(inner_fd, &key, &value, BPF_ANY),
+		       "populate_inner"))
+		goto out;
+	opts.inner_map_fd = inner_fd;
+	outer_fd = bpf_map_create(type, "dump_outer", sizeof(key), sizeof(__u32),
+				 3, &opts);
+	if (!ASSERT_OK_FD(outer_fd, "create_outer"))
+		goto out;
+	/* The unused third array slot also exercises failed lookups. */
+	for (key = 0; key < entries; key++)
+		if (!ASSERT_OK(bpf_map_update_elem(outer_fd, &key, &inner_fd, BPF_ANY),
+			       "populate_outer"))
+			goto out;
+	root_id = map_id(outer_fd);
+	inner_id = map_id(inner_fd);
+	if (!root_id || !inner_id || !dump_map(root_id, "-j", outer) ||
+	    !dump_map(inner_id, "-j", inner))
+		goto out;
+
+	ASSERT_EQ(outer[0], '[', "default_array");
+	ASSERT_EQ(count_token(outer, "\"elements\":"), 0, "default_no_wrapper");
+	ASSERT_EQ(count_token(outer, "\"id\":"), 0, "default_no_header");
+	snprintf(reference, sizeof(reference), "\"inner_map_id\":%u", inner_id);
+	ASSERT_EQ(count_token(outer, reference), entries, "default_references");
+	if (!entries)
+		ASSERT_STREQ(outer, "[]", "empty_outer_default");
+	if (empty_inner)
+		ASSERT_STREQ(inner, "[]", "empty_inner_default");
+	else if (typed)
+		ASSERT_HAS_SUBSTR(inner, "\"formatted\":{\"key\":0,\"value\":16843009}",
+				  "typed_inner");
+	else
+		ASSERT_STREQ(inner,
+			     "[{\"key\":[\"0x00\",\"0x00\",\"0x00\",\"0x00\"],"
+			     "\"value\":[\"0x01\",\"0x01\",\"0x01\",\"0x01\"]}]",
+			     "ordinary_default");
+
+	/* Compare the complete JSON document: a flat array with the root first,
+	 * one copy of the shared inner map, and unchanged entry representations.
+	 */
+	if (entries)
+		snprintf(expected, sizeof(expected),
+			 "[{\"id\":%u,\"type\":\"%s\",\"name\":\"dump_outer\","
+			 "\"flags\":0,\"elements\":%s},{\"id\":%u,\"type\":\"hash\","
+			 "\"name\":\"dump_inner\",\"flags\":0,\"elements\":%s}]",
+			 root_id, type_name, outer, inner_id, inner);
+	else
+		snprintf(expected, sizeof(expected),
+			 "[{\"id\":%u,\"type\":\"%s\",\"name\":\"dump_outer\","
+			 "\"flags\":0,\"elements\":[]}]", root_id, type_name);
+	if (dump_map(root_id, "-j -r", output))
+		ASSERT_STREQ(output, expected, "recursive_json");
+	if (dump_map(root_id, "--json --recursive", output))
+		ASSERT_STREQ(output, expected, "recursive_long_options");
+	check_plain(root_id, inner_id, type_name, entries, typed);
+
+	/* Recursion on an ordinary map still emits a single map object. */
+	snprintf(expected, sizeof(expected),
+		 "[{\"id\":%u,\"type\":\"hash\",\"name\":\"dump_inner\","
+		 "\"flags\":0,\"elements\":%s}]", inner_id, inner);
+	if (dump_map(inner_id, "-j -r", output))
+		ASSERT_STREQ(output, expected, "ordinary_recursive");
+out:
+	if (outer_fd >= 0)
+		close(outer_fd);
+	if (inner_fd >= 0)
+		close(inner_fd);
+	btf__free(btf);
+}
+
+static void test_multiple_roots(void)
+{
+	LIBBPF_OPTS(bpf_map_create_opts, opts);
+	char command[MAX_BPFTOOL_CMD_LEN], name[BPF_OBJ_NAME_LEN];
+	char output[OUTPUT_SIZE] = {}, expected[OUTPUT_SIZE * 4], elements[OUTPUT_SIZE];
+	static const char * const types[] = { "hash", "array_of_maps", "hash_of_maps", "hash" };
+	int fds[] = { -1, -1, -1, -1 };
+	__u32 ids[4], key;
+	int i, len = 0;
+
+	/* Select the first inner map and both outers as roots. The other inner
+	 * map must be appended after all three roots, even though it is found
+	 * while dumping the first outer. A process-specific name avoids other
+	 * tests' maps joining the selection.
+	 */
+	snprintf(name, sizeof(name), "dump_%u", getpid());
+	fds[0] = bpf_map_create(BPF_MAP_TYPE_HASH, name, 4, 4, 1, NULL);
+	if (!ASSERT_OK_FD(fds[0], "create_selected_inner"))
+		goto out;
+	fds[3] = bpf_map_create(BPF_MAP_TYPE_HASH, "dump_discovered", 4, 4, 1, NULL);
+	if (!ASSERT_OK_FD(fds[3], "create_discovered_inner"))
+		goto out;
+	opts.inner_map_fd = fds[0];
+	fds[1] = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, name, 4, 4, 2, &opts);
+	if (!ASSERT_OK_FD(fds[1], "create_array_root"))
+		goto out;
+	fds[2] = bpf_map_create(BPF_MAP_TYPE_HASH_OF_MAPS, name, 4, 4, 2, &opts);
+	if (!ASSERT_OK_FD(fds[2], "create_hash_root"))
+		goto out;
+	for (i = 1; i <= 2; i++) {
+		key = 0;
+		if (!ASSERT_OK(bpf_map_update_elem(fds[i], &key, &fds[0], BPF_ANY),
+			       "reference_selected_inner"))
+			goto out;
+		key = 1;
+		if (!ASSERT_OK(bpf_map_update_elem(fds[i], &key, &fds[3], BPF_ANY),
+			       "reference_discovered_inner"))
+			goto out;
+	}
+	for (i = 0; i < ARRAY_SIZE(fds); i++) {
+		ids[i] = map_id(fds[i]);
+		if (!ids[i] || !dump_map(ids[i], "-j", elements))
+			goto out;
+		len += snprintf(expected + len, sizeof(expected) - len,
+				"%s{\"id\":%u,\"type\":\"%s\",\"name\":\"%s\","
+				"\"flags\":0,\"elements\":%s}%s",
+				i ? "," : "[", ids[i], types[i],
+				i == 3 ? "dump_discovered" : name, elements, i == 3 ? "]" : "");
+	}
+	snprintf(command, sizeof(command), "-j -r map dump name %s", name);
+	if (ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),
+		      "dump_multiple_roots")) {
+		output[strcspn(output, "\n")] = '\0';
+		ASSERT_STREQ(output, expected, "roots_first_and_seed_dedup");
+	}
+out:
+	for (i = 0; i < ARRAY_SIZE(fds); i++)
+		if (fds[i] >= 0)
+			close(fds[i]);
+}
+
+void test_bpftool_map_dump(void)
+{
+	if (test__start_subtest("multiple_roots"))
+		test_multiple_roots();
+	if (test__start_subtest("array_of_maps"))
+		test_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 1, false, false);
+	if (test__start_subtest("hash_of_maps"))
+		test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, false);
+	if (test__start_subtest("shared_inner"))
+		test_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 2, false, false);
+	if (test__start_subtest("empty_array_of_maps"))
+		test_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 0, false, false);
+	if (test__start_subtest("empty_hash_of_maps"))
+		test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 0, false, false);
+	if (test__start_subtest("btf_inner"))
+		test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, true);
+	if (test__start_subtest("empty_inner"))
+		test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, true, false);
+}

3/2

2026/09/07 00:53

llm

patch-evaluator

Model:

gemini-3.7-flash

Args:

null

Results:

null

Tokens:

							input: 10869
							output: 33
							thoughts: 372

Thoughts:

**Analyzing the Patch: WorthFuzzing=false?**

Okay, let's break this down. The instructions are clear: the changes are *already* in my workspace as the HEAD commit. My task is to determine if this patch warrants fuzzing or if it can be safely ignored (i.e., `WorthFuzzing=false`). Section 2 dictates when we can bypass fuzzing. The key criteria for `WorthFuzzing=false` are non-kernel, non-executable changes that don't impact the compiled kernel image. This includes documentation, comments, user-space tools, build system changes that don't alter the C logic, unreachable hardware, and unreachable execution paths.

Now, let's look at the diff. I see the modified files are all located in `tools/`, specifically within `tools/bpf/bpftool/` and `tools/testing/selftests/bpf/`. Nothing jumps out as kernel-level code.  We have documentation (`bpftool-map.rst`), shell completion scripts (`bpftool` within `bash-completion`), the main source files (`main.c`, `main.h`, and `map.c`), and a selftest (`bpftool_map_dump.c`). It's all BPF tooling, which confirms my initial impression. None of these files directly modify kernel code or the kernel image itself (`vmlinux`) or kernel modules.

Just to be absolutely sure, I'll quickly double-check that this HEAD commit *only* contains these files; no sneaky kernel code creeped in. Barring that, I'm confident in classifying this as `WorthFuzzing=false`. This patch is safe to ignore in terms of fuzzing.

4/2

2026/09/07 00:53

tool

grepper

Args:

{
  "Expression": ".*",
  "PathPrefix": "tools/bpf/bpftool/map.c"
}

Results:

{
  "Output": "\nFull output is too long, showing 500 out of 1620 lines.\nUse more precise expression if possible.\n\ntools/bpf/bpftool/map.c:1:// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)\ntools/bpf/bpftool/map.c:2:/* Copyright (C) 2017-2018 Netronome Systems, Inc. */\ntools/bpf/bpftool/map.c:3:\ntools/bpf/bpftool/map.c:4:#include \u003cerrno.h\u003e\ntools/bpf/bpftool/map.c:5:#include \u003cfcntl.h\u003e\ntools/bpf/bpftool/map.c:6:#include \u003clinux/err.h\u003e\ntools/bpf/bpftool/map.c:7:#include \u003clinux/kernel.h\u003e\ntools/bpf/bpftool/map.c:8:#include \u003cnet/if.h\u003e\ntools/bpf/bpftool/map.c:9:#include \u003cstdbool.h\u003e\ntools/bpf/bpftool/map.c:10:#include \u003cstdio.h\u003e\ntools/bpf/bpftool/map.c:11:#include \u003cstdlib.h\u003e\ntools/bpf/bpftool/map.c:12:#include \u003cstring.h\u003e\ntools/bpf/bpftool/map.c:13:#include \u003cunistd.h\u003e\ntools/bpf/bpftool/map.c:14:#include \u003csys/types.h\u003e\ntools/bpf/bpftool/map.c:15:#include \u003csys/stat.h\u003e\ntools/bpf/bpftool/map.c:16:\ntools/bpf/bpftool/map.c:17:#include \u003cbpf/bpf.h\u003e\ntools/bpf/bpftool/map.c:18:#include \u003cbpf/btf.h\u003e\ntools/bpf/bpftool/map.c:19:#include \u003cbpf/hashmap.h\u003e\ntools/bpf/bpftool/map.c:20:\ntools/bpf/bpftool/map.c:21:#include \"json_writer.h\"\ntools/bpf/bpftool/map.c:22:#include \"main.h\"\ntools/bpf/bpftool/map.c:23:\ntools/bpf/bpftool/map.c:24:static struct hashmap *map_table;\ntools/bpf/bpftool/map.c:25:\ntools/bpf/bpftool/map.c:26:static bool map_is_per_cpu(__u32 type)\ntools/bpf/bpftool/map.c:27:{\ntools/bpf/bpftool/map.c:28:\treturn type == BPF_MAP_TYPE_PERCPU_HASH ||\ntools/bpf/bpftool/map.c:29:\t       type == BPF_MAP_TYPE_PERCPU_ARRAY ||\ntools/bpf/bpftool/map.c:30:\t       type == BPF_MAP_TYPE_LRU_PERCPU_HASH ||\ntools/bpf/bpftool/map.c:31:\t       type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE;\ntools/bpf/bpftool/map.c:32:}\ntools/bpf/bpftool/map.c:33:\ntools/bpf/bpftool/map.c:34:static bool map_is_map_of_maps(__u32 type)\ntools/bpf/bpftool/map.c:35:{\ntools/bpf/bpftool/map.c:36:\treturn type == BPF_MAP_TYPE_ARRAY_OF_MAPS ||\ntools/bpf/bpftool/map.c:37:\t       type == BPF_MAP_TYPE_HASH_OF_MAPS;\ntools/bpf/bpftool/map.c:38:}\ntools/bpf/bpftool/map.c:39:\ntools/bpf/bpftool/map.c:40:static bool map_is_map_of_progs(__u32 type)\ntools/bpf/bpftool/map.c:41:{\ntools/bpf/bpftool/map.c:42:\treturn type == BPF_MAP_TYPE_PROG_ARRAY;\ntools/bpf/bpftool/map.c:43:}\ntools/bpf/bpftool/map.c:44:\ntools/bpf/bpftool/map.c:45:static int map_type_from_str(const char *type)\ntools/bpf/bpftool/map.c:46:{\ntools/bpf/bpftool/map.c:47:\tconst char *map_type_str;\ntools/bpf/bpftool/map.c:48:\tunsigned int i;\ntools/bpf/bpftool/map.c:49:\ntools/bpf/bpftool/map.c:50:\tfor (i = 0; ; i++) {\ntools/bpf/bpftool/map.c:51:\t\tmap_type_str = libbpf_bpf_map_type_str(i);\ntools/bpf/bpftool/map.c:52:\t\tif (!map_type_str)\ntools/bpf/bpftool/map.c:53:\t\t\tbreak;\ntools/bpf/bpftool/map.c:54:\ntools/bpf/bpftool/map.c:55:\t\t/* Don't allow prefixing in case of possible future shadowing */\ntools/bpf/bpftool/map.c:56:\t\tif (!strcmp(map_type_str, type))\ntools/bpf/bpftool/map.c:57:\t\t\treturn i;\ntools/bpf/bpftool/map.c:58:\t}\ntools/bpf/bpftool/map.c:59:\treturn -1;\ntools/bpf/bpftool/map.c:60:}\ntools/bpf/bpftool/map.c:61:\ntools/bpf/bpftool/map.c:62:static void *alloc_value(struct bpf_map_info *info)\ntools/bpf/bpftool/map.c:63:{\ntools/bpf/bpftool/map.c:64:\tif (map_is_per_cpu(info-\u003etype))\ntools/bpf/bpftool/map.c:65:\t\treturn malloc(round_up(info-\u003evalue_size, 8) *\ntools/bpf/bpftool/map.c:66:\t\t\t      get_possible_cpus());\ntools/bpf/bpftool/map.c:67:\telse\ntools/bpf/bpftool/map.c:68:\t\treturn malloc(info-\u003evalue_size);\ntools/bpf/bpftool/map.c:69:}\ntools/bpf/bpftool/map.c:70:\ntools/bpf/bpftool/map.c:71:static int do_dump_btf(const struct btf_dumper *d,\ntools/bpf/bpftool/map.c:72:\t\t       struct bpf_map_info *map_info, void *key,\ntools/bpf/bpftool/map.c:73:\t\t       void *value)\ntools/bpf/bpftool/map.c:74:{\ntools/bpf/bpftool/map.c:75:\t__u32 value_id;\ntools/bpf/bpftool/map.c:76:\tint ret = 0;\ntools/bpf/bpftool/map.c:77:\ntools/bpf/bpftool/map.c:78:\t/* start of key-value pair */\ntools/bpf/bpftool/map.c:79:\tjsonw_start_object(d-\u003ejw);\ntools/bpf/bpftool/map.c:80:\ntools/bpf/bpftool/map.c:81:\tif (map_info-\u003ebtf_key_type_id) {\ntools/bpf/bpftool/map.c:82:\t\tjsonw_name(d-\u003ejw, \"key\");\ntools/bpf/bpftool/map.c:83:\ntools/bpf/bpftool/map.c:84:\t\tret = btf_dumper_type(d, map_info-\u003ebtf_key_type_id, key);\ntools/bpf/bpftool/map.c:85:\t\tif (ret)\ntools/bpf/bpftool/map.c:86:\t\t\tgoto err_end_obj;\ntools/bpf/bpftool/map.c:87:\t}\ntools/bpf/bpftool/map.c:88:\ntools/bpf/bpftool/map.c:89:\tvalue_id = map_info-\u003ebtf_vmlinux_value_type_id ?\ntools/bpf/bpftool/map.c:90:\t\t: map_info-\u003ebtf_value_type_id;\ntools/bpf/bpftool/map.c:91:\ntools/bpf/bpftool/map.c:92:\tif (!map_is_per_cpu(map_info-\u003etype)) {\ntools/bpf/bpftool/map.c:93:\t\tjsonw_name(d-\u003ejw, \"value\");\ntools/bpf/bpftool/map.c:94:\t\tret = btf_dumper_type(d, value_id, value);\ntools/bpf/bpftool/map.c:95:\t} else {\ntools/bpf/bpftool/map.c:96:\t\tunsigned int i, n, step;\ntools/bpf/bpftool/map.c:97:\ntools/bpf/bpftool/map.c:98:\t\tjsonw_name(d-\u003ejw, \"values\");\ntools/bpf/bpftool/map.c:99:\t\tjsonw_start_array(d-\u003ejw);\ntools/bpf/bpftool/map.c:100:\t\tn = get_possible_cpus();\ntools/bpf/bpftool/map.c:101:\t\tstep = round_up(map_info-\u003evalue_size, 8);\ntools/bpf/bpftool/map.c:102:\t\tfor (i = 0; i \u003c n; i++) {\ntools/bpf/bpftool/map.c:103:\t\t\tjsonw_start_object(d-\u003ejw);\ntools/bpf/bpftool/map.c:104:\t\t\tjsonw_int_field(d-\u003ejw, \"cpu\", i);\ntools/bpf/bpftool/map.c:105:\t\t\tjsonw_name(d-\u003ejw, \"value\");\ntools/bpf/bpftool/map.c:106:\t\t\tret = btf_dumper_type(d, value_id, value + i * step);\ntools/bpf/bpftool/map.c:107:\t\t\tjsonw_end_object(d-\u003ejw);\ntools/bpf/bpftool/map.c:108:\t\t\tif (ret)\ntools/bpf/bpftool/map.c:109:\t\t\t\tbreak;\ntools/bpf/bpftool/map.c:110:\t\t}\ntools/bpf/bpftool/map.c:111:\t\tjsonw_end_array(d-\u003ejw);\ntools/bpf/bpftool/map.c:112:\t}\ntools/bpf/bpftool/map.c:113:\ntools/bpf/bpftool/map.c:114:err_end_obj:\ntools/bpf/bpftool/map.c:115:\t/* end of key-value pair */\ntools/bpf/bpftool/map.c:116:\tjsonw_end_object(d-\u003ejw);\ntools/bpf/bpftool/map.c:117:\ntools/bpf/bpftool/map.c:118:\treturn ret;\ntools/bpf/bpftool/map.c:119:}\ntools/bpf/bpftool/map.c:120:\ntools/bpf/bpftool/map.c:121:static json_writer_t *get_btf_writer(void)\ntools/bpf/bpftool/map.c:122:{\ntools/bpf/bpftool/map.c:123:\tjson_writer_t *jw = jsonw_new(stdout);\ntools/bpf/bpftool/map.c:124:\ntools/bpf/bpftool/map.c:125:\tif (!jw)\ntools/bpf/bpftool/map.c:126:\t\treturn NULL;\ntools/bpf/bpftool/map.c:127:\tjsonw_pretty(jw, true);\ntools/bpf/bpftool/map.c:128:\ntools/bpf/bpftool/map.c:129:\treturn jw;\ntools/bpf/bpftool/map.c:130:}\ntools/bpf/bpftool/map.c:131:\ntools/bpf/bpftool/map.c:132:static void print_entry_json(struct bpf_map_info *info, unsigned char *key,\ntools/bpf/bpftool/map.c:133:\t\t\t     unsigned char *value, struct btf *btf)\ntools/bpf/bpftool/map.c:134:{\ntools/bpf/bpftool/map.c:135:\tjsonw_start_object(json_wtr);\ntools/bpf/bpftool/map.c:136:\ntools/bpf/bpftool/map.c:137:\tif (!map_is_per_cpu(info-\u003etype)) {\ntools/bpf/bpftool/map.c:138:\t\tjsonw_name(json_wtr, \"key\");\ntools/bpf/bpftool/map.c:139:\t\tprint_hex_data_json(key, info-\u003ekey_size);\ntools/bpf/bpftool/map.c:140:\t\tjsonw_name(json_wtr, \"value\");\ntools/bpf/bpftool/map.c:141:\t\tprint_hex_data_json(value, info-\u003evalue_size);\ntools/bpf/bpftool/map.c:142:\t\tif (map_is_map_of_maps(info-\u003etype))\ntools/bpf/bpftool/map.c:143:\t\t\tjsonw_uint_field(json_wtr, \"inner_map_id\",\ntools/bpf/bpftool/map.c:144:\t\t\t\t\t *(unsigned int *)value);\ntools/bpf/bpftool/map.c:145:\t\tif (btf) {\ntools/bpf/bpftool/map.c:146:\t\t\tstruct btf_dumper d = {\ntools/bpf/bpftool/map.c:147:\t\t\t\t.btf = btf,\ntools/bpf/bpftool/map.c:148:\t\t\t\t.jw = json_wtr,\ntools/bpf/bpftool/map.c:149:\t\t\t\t.is_plain_text = false,\ntools/bpf/bpftool/map.c:150:\t\t\t};\ntools/bpf/bpftool/map.c:151:\ntools/bpf/bpftool/map.c:152:\t\t\tjsonw_name(json_wtr, \"formatted\");\ntools/bpf/bpftool/map.c:153:\t\t\tdo_dump_btf(\u0026d, info, key, value);\ntools/bpf/bpftool/map.c:154:\t\t}\ntools/bpf/bpftool/map.c:155:\t} else {\ntools/bpf/bpftool/map.c:156:\t\tunsigned int i, n, step;\ntools/bpf/bpftool/map.c:157:\ntools/bpf/bpftool/map.c:158:\t\tn = get_possible_cpus();\ntools/bpf/bpftool/map.c:159:\t\tstep = round_up(info-\u003evalue_size, 8);\ntools/bpf/bpftool/map.c:160:\ntools/bpf/bpftool/map.c:161:\t\tjsonw_name(json_wtr, \"key\");\ntools/bpf/bpftool/map.c:162:\t\tprint_hex_data_json(key, info-\u003ekey_size);\ntools/bpf/bpftool/map.c:163:\ntools/bpf/bpftool/map.c:164:\t\tjsonw_name(json_wtr, \"values\");\ntools/bpf/bpftool/map.c:165:\t\tjsonw_start_array(json_wtr);\ntools/bpf/bpftool/map.c:166:\t\tfor (i = 0; i \u003c n; i++) {\ntools/bpf/bpftool/map.c:167:\t\t\tjsonw_start_object(json_wtr);\ntools/bpf/bpftool/map.c:168:\ntools/bpf/bpftool/map.c:169:\t\t\tjsonw_int_field(json_wtr, \"cpu\", i);\ntools/bpf/bpftool/map.c:170:\ntools/bpf/bpftool/map.c:171:\t\t\tjsonw_name(json_wtr, \"value\");\ntools/bpf/bpftool/map.c:172:\t\t\tprint_hex_data_json(value + i * step,\ntools/bpf/bpftool/map.c:173:\t\t\t\t\t    info-\u003evalue_size);\ntools/bpf/bpftool/map.c:174:\ntools/bpf/bpftool/map.c:175:\t\t\tjsonw_end_object(json_wtr);\ntools/bpf/bpftool/map.c:176:\t\t}\ntools/bpf/bpftool/map.c:177:\t\tjsonw_end_array(json_wtr);\ntools/bpf/bpftool/map.c:178:\t\tif (btf) {\ntools/bpf/bpftool/map.c:179:\t\t\tstruct btf_dumper d = {\ntools/bpf/bpftool/map.c:180:\t\t\t\t.btf = btf,\ntools/bpf/bpftool/map.c:181:\t\t\t\t.jw = json_wtr,\ntools/bpf/bpftool/map.c:182:\t\t\t\t.is_plain_text = false,\ntools/bpf/bpftool/map.c:183:\t\t\t};\ntools/bpf/bpftool/map.c:184:\ntools/bpf/bpftool/map.c:185:\t\t\tjsonw_name(json_wtr, \"formatted\");\ntools/bpf/bpftool/map.c:186:\t\t\tdo_dump_btf(\u0026d, info, key, value);\ntools/bpf/bpftool/map.c:187:\t\t}\ntools/bpf/bpftool/map.c:188:\t}\ntools/bpf/bpftool/map.c:189:\ntools/bpf/bpftool/map.c:190:\tjsonw_end_object(json_wtr);\ntools/bpf/bpftool/map.c:191:}\ntools/bpf/bpftool/map.c:192:\ntools/bpf/bpftool/map.c:193:static void\ntools/bpf/bpftool/map.c:194:print_entry_error_msg(struct bpf_map_info *info, unsigned char *key,\ntools/bpf/bpftool/map.c:195:\t\t      const char *error_msg)\ntools/bpf/bpftool/map.c:196:{\ntools/bpf/bpftool/map.c:197:\tint msg_size = strlen(error_msg);\ntools/bpf/bpftool/map.c:198:\tbool single_line, break_names;\ntools/bpf/bpftool/map.c:199:\ntools/bpf/bpftool/map.c:200:\tbreak_names = info-\u003ekey_size \u003e 16 || msg_size \u003e 16;\ntools/bpf/bpftool/map.c:201:\tsingle_line = info-\u003ekey_size + msg_size \u003c= 24 \u0026\u0026 !break_names;\ntools/bpf/bpftool/map.c:202:\ntools/bpf/bpftool/map.c:203:\tprintf(\"key:%c\", break_names ? '\\n' : ' ');\ntools/bpf/bpftool/map.c:204:\tfprint_hex(stdout, key, info-\u003ekey_size, \" \");\ntools/bpf/bpftool/map.c:205:\ntools/bpf/bpftool/map.c:206:\tprintf(single_line ? \"  \" : \"\\n\");\ntools/bpf/bpftool/map.c:207:\ntools/bpf/bpftool/map.c:208:\tprintf(\"value:%c%s\", break_names ? '\\n' : ' ', error_msg);\ntools/bpf/bpftool/map.c:209:\ntools/bpf/bpftool/map.c:210:\tprintf(\"\\n\");\ntools/bpf/bpftool/map.c:211:}\ntools/bpf/bpftool/map.c:212:\ntools/bpf/bpftool/map.c:213:static void\ntools/bpf/bpftool/map.c:214:print_entry_error(struct bpf_map_info *map_info, void *key, int lookup_errno)\ntools/bpf/bpftool/map.c:215:{\ntools/bpf/bpftool/map.c:216:\t/* For prog_array maps or arrays of maps, failure to lookup the value\ntools/bpf/bpftool/map.c:217:\t * means there is no entry for that key. Do not print an error message\ntools/bpf/bpftool/map.c:218:\t * in that case.\ntools/bpf/bpftool/map.c:219:\t */\ntools/bpf/bpftool/map.c:220:\tif ((map_is_map_of_maps(map_info-\u003etype) ||\ntools/bpf/bpftool/map.c:221:\t     map_is_map_of_progs(map_info-\u003etype)) \u0026\u0026 lookup_errno == ENOENT)\ntools/bpf/bpftool/map.c:222:\t\treturn;\ntools/bpf/bpftool/map.c:223:\ntools/bpf/bpftool/map.c:224:\tif (json_output) {\ntools/bpf/bpftool/map.c:225:\t\tjsonw_start_object(json_wtr);\t/* entry */\ntools/bpf/bpftool/map.c:226:\t\tjsonw_name(json_wtr, \"key\");\ntools/bpf/bpftool/map.c:227:\t\tprint_hex_data_json(key, map_info-\u003ekey_size);\ntools/bpf/bpftool/map.c:228:\t\tjsonw_name(json_wtr, \"value\");\ntools/bpf/bpftool/map.c:229:\t\tjsonw_start_object(json_wtr);\t/* error */\ntools/bpf/bpftool/map.c:230:\t\tjsonw_string_field(json_wtr, \"error\", strerror(lookup_errno));\ntools/bpf/bpftool/map.c:231:\t\tjsonw_end_object(json_wtr);\t/* error */\ntools/bpf/bpftool/map.c:232:\t\tjsonw_end_object(json_wtr);\t/* entry */\ntools/bpf/bpftool/map.c:233:\t} else {\ntools/bpf/bpftool/map.c:234:\t\tconst char *msg = NULL;\ntools/bpf/bpftool/map.c:235:\ntools/bpf/bpftool/map.c:236:\t\tif (lookup_errno == ENOENT)\ntools/bpf/bpftool/map.c:237:\t\t\tmsg = \"\u003cno entry\u003e\";\ntools/bpf/bpftool/map.c:238:\t\telse if (lookup_errno == ENOSPC \u0026\u0026\ntools/bpf/bpftool/map.c:239:\t\t\t map_info-\u003etype == BPF_MAP_TYPE_REUSEPORT_SOCKARRAY)\ntools/bpf/bpftool/map.c:240:\t\t\tmsg = \"\u003ccannot read\u003e\";\ntools/bpf/bpftool/map.c:241:\ntools/bpf/bpftool/map.c:242:\t\tprint_entry_error_msg(map_info, key,\ntools/bpf/bpftool/map.c:243:\t\t\t\t      msg ? : strerror(lookup_errno));\ntools/bpf/bpftool/map.c:244:\t}\ntools/bpf/bpftool/map.c:245:}\ntools/bpf/bpftool/map.c:246:\ntools/bpf/bpftool/map.c:247:static void print_entry_plain(struct bpf_map_info *info, unsigned char *key,\ntools/bpf/bpftool/map.c:248:\t\t\t      unsigned char *value)\ntools/bpf/bpftool/map.c:249:{\ntools/bpf/bpftool/map.c:250:\tif (!map_is_per_cpu(info-\u003etype)) {\ntools/bpf/bpftool/map.c:251:\t\tbool single_line, break_names;\ntools/bpf/bpftool/map.c:252:\ntools/bpf/bpftool/map.c:253:\t\tbreak_names = info-\u003ekey_size \u003e 16 || info-\u003evalue_size \u003e 16;\ntools/bpf/bpftool/map.c:254:\t\tsingle_line = info-\u003ekey_size + info-\u003evalue_size \u003c= 24 \u0026\u0026\ntools/bpf/bpftool/map.c:255:\t\t\t!break_names;\ntools/bpf/bpftool/map.c:256:\ntools/bpf/bpftool/map.c:257:\t\tif (info-\u003ekey_size) {\ntools/bpf/bpftool/map.c:258:\t\t\tprintf(\"key:%c\", break_names ? '\\n' : ' ');\ntools/bpf/bpftool/map.c:259:\t\t\tfprint_hex(stdout, key, info-\u003ekey_size, \" \");\ntools/bpf/bpftool/map.c:260:\ntools/bpf/bpftool/map.c:261:\t\t\tprintf(single_line ? \"  \" : \"\\n\");\ntools/bpf/bpftool/map.c:262:\t\t}\ntools/bpf/bpftool/map.c:263:\ntools/bpf/bpftool/map.c:264:\t\tif (info-\u003evalue_size) {\ntools/bpf/bpftool/map.c:265:\t\t\tif (map_is_map_of_maps(info-\u003etype)) {\ntools/bpf/bpftool/map.c:266:\t\t\t\tprintf(\"inner_map_id:%c\", break_names ? '\\n' : ' ');\ntools/bpf/bpftool/map.c:267:\t\t\t\tprintf(\"%u \", *(unsigned int *)value);\ntools/bpf/bpftool/map.c:268:\t\t\t} else {\ntools/bpf/bpftool/map.c:269:\t\t\t\tprintf(\"value:%c\", break_names ? '\\n' : ' ');\ntools/bpf/bpftool/map.c:270:\t\t\t\tfprint_hex(stdout, value, info-\u003evalue_size, \" \");\ntools/bpf/bpftool/map.c:271:\t\t\t}\ntools/bpf/bpftool/map.c:272:\t\t}\ntools/bpf/bpftool/map.c:273:\ntools/bpf/bpftool/map.c:274:\t\tprintf(\"\\n\");\ntools/bpf/bpftool/map.c:275:\t} else {\ntools/bpf/bpftool/map.c:276:\t\tunsigned int i, n, step;\ntools/bpf/bpftool/map.c:277:\ntools/bpf/bpftool/map.c:278:\t\tn = get_possible_cpus();\ntools/bpf/bpftool/map.c:279:\t\tstep = round_up(info-\u003evalue_size, 8);\ntools/bpf/bpftool/map.c:280:\ntools/bpf/bpftool/map.c:281:\t\tif (info-\u003ekey_size) {\ntools/bpf/bpftool/map.c:282:\t\t\tprintf(\"key:\\n\");\ntools/bpf/bpftool/map.c:283:\t\t\tfprint_hex(stdout, key, info-\u003ekey_size, \" \");\ntools/bpf/bpftool/map.c:284:\t\t\tprintf(\"\\n\");\ntools/bpf/bpftool/map.c:285:\t\t}\ntools/bpf/bpftool/map.c:286:\t\tif (info-\u003evalue_size) {\ntools/bpf/bpftool/map.c:287:\t\t\tfor (i = 0; i \u003c n; i++) {\ntools/bpf/bpftool/map.c:288:\t\t\t\tprintf(\"value (CPU %02u):%c\",\ntools/bpf/bpftool/map.c:289:\t\t\t\t       i, info-\u003evalue_size \u003e 16 ? '\\n' : ' ');\ntools/bpf/bpftool/map.c:290:\t\t\t\tfprint_hex(stdout, value + i * step,\ntools/bpf/bpftool/map.c:291:\t\t\t\t\t   info-\u003evalue_size, \" \");\ntools/bpf/bpftool/map.c:292:\t\t\t\tprintf(\"\\n\");\ntools/bpf/bpftool/map.c:293:\t\t\t}\ntools/bpf/bpftool/map.c:294:\t\t}\ntools/bpf/bpftool/map.c:295:\t}\ntools/bpf/bpftool/map.c:296:}\ntools/bpf/bpftool/map.c:297:\ntools/bpf/bpftool/map.c:298:static char **parse_bytes(char **argv, const char *name, unsigned char *val,\ntools/bpf/bpftool/map.c:299:\t\t\t  unsigned int n)\ntools/bpf/bpftool/map.c:300:{\ntools/bpf/bpftool/map.c:301:\tunsigned int i = 0, base = 0;\ntools/bpf/bpftool/map.c:302:\tchar *endptr;\ntools/bpf/bpftool/map.c:303:\ntools/bpf/bpftool/map.c:304:\tif (is_prefix(*argv, \"hex\")) {\ntools/bpf/bpftool/map.c:305:\t\tbase = 16;\ntools/bpf/bpftool/map.c:306:\t\targv++;\ntools/bpf/bpftool/map.c:307:\t}\ntools/bpf/bpftool/map.c:308:\ntools/bpf/bpftool/map.c:309:\twhile (i \u003c n \u0026\u0026 argv[i]) {\ntools/bpf/bpftool/map.c:310:\t\tval[i] = strtoul(argv[i], \u0026endptr, base);\ntools/bpf/bpftool/map.c:311:\t\tif (*endptr) {\ntools/bpf/bpftool/map.c:312:\t\t\tp_err(\"error parsing byte: %s\", argv[i]);\ntools/bpf/bpftool/map.c:313:\t\t\treturn NULL;\ntools/bpf/bpftool/map.c:314:\t\t}\ntools/bpf/bpftool/map.c:315:\t\ti++;\ntools/bpf/bpftool/map.c:316:\t}\ntools/bpf/bpftool/map.c:317:\ntools/bpf/bpftool/map.c:318:\tif (i != n) {\ntools/bpf/bpftool/map.c:319:\t\tp_err(\"%s expected %u bytes got %u\", name, n, i);\ntools/bpf/bpftool/map.c:320:\t\treturn NULL;\ntools/bpf/bpftool/map.c:321:\t}\ntools/bpf/bpftool/map.c:322:\ntools/bpf/bpftool/map.c:323:\treturn argv + i;\ntools/bpf/bpftool/map.c:324:}\ntools/bpf/bpftool/map.c:325:\ntools/bpf/bpftool/map.c:326:/* on per cpu maps we must copy the provided value on all value instances */\ntools/bpf/bpftool/map.c:327:static void fill_per_cpu_value(struct bpf_map_info *info, void *value)\ntools/bpf/bpftool/map.c:328:{\ntools/bpf/bpftool/map.c:329:\tunsigned int i, n, step;\ntools/bpf/bpftool/map.c:330:\ntools/bpf/bpftool/map.c:331:\tif (!map_is_per_cpu(info-\u003etype))\ntools/bpf/bpftool/map.c:332:\t\treturn;\ntools/bpf/bpftool/map.c:333:\ntools/bpf/bpftool/map.c:334:\tn = get_possible_cpus();\ntools/bpf/bpftool/map.c:335:\tstep = round_up(info-\u003evalue_size, 8);\ntools/bpf/bpftool/map.c:336:\tfor (i = 1; i \u003c n; i++)\ntools/bpf/bpftool/map.c:337:\t\tmemcpy(value + i * step, value, info-\u003evalue_size);\ntools/bpf/bpftool/map.c:338:}\ntools/bpf/bpftool/map.c:339:\ntools/bpf/bpftool/map.c:340:static int parse_elem(char **argv, struct bpf_map_info *info, void *key,\ntools/bpf/bpftool/map.c:341:\t\t      void *value, __u32 key_size, __u32 value_size,\ntools/bpf/bpftool/map.c:342:\t\t      __u32 *flags, __u32 **value_fd, __u32 open_flags)\ntools/bpf/bpftool/map.c:343:{\ntools/bpf/bpftool/map.c:344:\tif (!*argv) {\ntools/bpf/bpftool/map.c:345:\t\tif (!key \u0026\u0026 !value)\ntools/bpf/bpftool/map.c:346:\t\t\treturn 0;\ntools/bpf/bpftool/map.c:347:\t\tp_err(\"did not find %s\", key ? \"key\" : \"value\");\ntools/bpf/bpftool/map.c:348:\t\treturn -1;\ntools/bpf/bpftool/map.c:349:\t}\ntools/bpf/bpftool/map.c:350:\ntools/bpf/bpftool/map.c:351:\tif (is_prefix(*argv, \"key\")) {\ntools/bpf/bpftool/map.c:352:\t\tif (!key) {\ntools/bpf/bpftool/map.c:353:\t\t\tif (key_size)\ntools/bpf/bpftool/map.c:354:\t\t\t\tp_err(\"duplicate key\");\ntools/bpf/bpftool/map.c:355:\t\t\telse\ntools/bpf/bpftool/map.c:356:\t\t\t\tp_err(\"unnecessary key\");\ntools/bpf/bpftool/map.c:357:\t\t\treturn -1;\ntools/bpf/bpftool/map.c:358:\t\t}\ntools/bpf/bpftool/map.c:359:\ntools/bpf/bpftool/map.c:360:\t\targv = parse_bytes(argv + 1, \"key\", key, key_size);\ntools/bpf/bpftool/map.c:361:\t\tif (!argv)\ntools/bpf/bpftool/map.c:362:\t\t\treturn -1;\ntools/bpf/bpftool/map.c:363:\ntools/bpf/bpftool/map.c:364:\t\treturn parse_elem(argv, info, NULL, value, key_size, value_size,\ntools/bpf/bpftool/map.c:365:\t\t\t\t  flags, value_fd, open_flags);\ntools/bpf/bpftool/map.c:366:\t} else if (is_prefix(*argv, \"value\")) {\ntools/bpf/bpftool/map.c:367:\t\tint fd;\ntools/bpf/bpftool/map.c:368:\ntools/bpf/bpftool/map.c:369:\t\tif (!value) {\ntools/bpf/bpftool/map.c:370:\t\t\tif (value_size)\ntools/bpf/bpftool/map.c:371:\t\t\t\tp_err(\"duplicate value\");\ntools/bpf/bpftool/map.c:372:\t\t\telse\ntools/bpf/bpftool/map.c:373:\t\t\t\tp_err(\"unnecessary value\");\ntools/bpf/bpftool/map.c:374:\t\t\treturn -1;\ntools/bpf/bpftool/map.c:375:\t\t}\ntools/bpf/bpftool/map.c:376:\ntools/bpf/bpftool/map.c:377:\t\targv++;\ntools/bpf/bpftool/map.c:378:\ntools/bpf/bpftool/map.c:379:\t\tif (map_is_map_of_maps(info-\u003etype)) {\ntools/bpf/bpftool/map.c:380:\t\t\tint argc = 2;\ntools/bpf/bpftool/map.c:381:\ntools/bpf/bpftool/map.c:382:\t\t\tif (value_size != 4) {\ntools/bpf/bpftool/map.c:383:\t\t\t\tp_err(\"value smaller than 4B for map in map?\");\ntools/bpf/bpftool/map.c:384:\t\t\t\treturn -1;\ntools/bpf/bpftool/map.c:385:\t\t\t}\ntools/bpf/bpftool/map.c:386:\t\t\tif (!argv[0] || !argv[1]) {\ntools/bpf/bpftool/map.c:387:\t\t\t\tp_err(\"not enough value arguments for map in map\");\ntools/bpf/bpftool/map.c:388:\t\t\t\treturn -1;\ntools/bpf/bpftool/map.c:389:\t\t\t}\ntools/bpf/bpftool/map.c:390:\ntools/bpf/bpftool/map.c:391:\t\t\tfd = map_parse_fd(\u0026argc, \u0026argv, open_flags);\ntools/bpf/bpftool/map.c:392:\t\t\tif (fd \u003c 0)\ntools/bpf/bpftool/map.c:393:\t\t\t\treturn -1;\ntools/bpf/bpftool/map.c:394:\ntools/bpf/bpftool/map.c:395:\t\t\t*value_fd = value;\ntools/bpf/bpftool/map.c:396:\t\t\t**value_fd = fd;\ntools/bpf/bpftool/map.c:397:\t\t} else if (map_is_map_of_progs(info-\u003etype)) {\ntools/bpf/bpftool/map.c:398:\t\t\tint argc = 2;\ntools/bpf/bpftool/map.c:399:\ntools/bpf/bpftool/map.c:400:\t\t\tif (value_size != 4) {\ntools/bpf/bpftool/map.c:401:\t\t\t\tp_err(\"value smaller than 4B for map of progs?\");\ntools/bpf/bpftool/map.c:402:\t\t\t\treturn -1;\ntools/bpf/bpftool/map.c:403:\t\t\t}\ntools/bpf/bpftool/map.c:404:\t\t\tif (!argv[0] || !argv[1]) {\ntools/bpf/bpftool/map.c:405:\t\t\t\tp_err(\"not enough value arguments for map of progs\");\ntools/bpf/bpftool/map.c:406:\t\t\t\treturn -1;\ntools/bpf/bpftool/map.c:407:\t\t\t}\ntools/bpf/bpftool/map.c:408:\t\t\tif (is_prefix(*argv, \"id\"))\ntools/bpf/bpftool/map.c:409:\t\t\t\tp_info(\"Warning: updating program array via MAP_ID, make sure this map is kept open\\n\"\ntools/bpf/bpftool/map.c:410:\t\t\t\t       \"         by some process or pinned otherwise update will be lost\");\ntools/bpf/bpftool/map.c:411:\ntools/bpf/bpftool/map.c:412:\t\t\tfd = prog_parse_fd(\u0026argc, \u0026argv);\ntools/bpf/bpftool/map.c:413:\t\t\tif (fd \u003c 0)\ntools/bpf/bpftool/map.c:414:\t\t\t\treturn -1;\ntools/bpf/bpftool/map.c:415:\ntools/bpf/bpftool/map.c:416:\t\t\t*value_fd = value;\ntools/bpf/bpftool/map.c:417:\t\t\t**value_fd = fd;\ntools/bpf/bpftool/map.c:418:\t\t} else {\ntools/bpf/bpftool/map.c:419:\t\t\targv = parse_bytes(argv, \"value\", value, value_size);\ntools/bpf/bpftool/map.c:420:\t\t\tif (!argv)\ntools/bpf/bpftool/map.c:421:\t\t\t\treturn -1;\ntools/bpf/bpftool/map.c:422:\ntools/bpf/bpftool/map.c:423:\t\t\tfill_per_cpu_value(info, value);\ntools/bpf/bpftool/map.c:424:\t\t}\ntools/bpf/bpftool/map.c:425:\ntools/bpf/bpftool/map.c:426:\t\treturn parse_elem(argv, info, key, NULL, key_size, value_size,\ntools/bpf/bpftool/map.c:427:\t\t\t\t  flags, NULL, open_flags);\ntools/bpf/bpftool/map.c:428:\t} else if (is_prefix(*argv, \"any\") || is_prefix(*argv, \"noexist\") ||\ntools/bpf/bpftool/map.c:429:\t\t   is_prefix(*argv, \"exist\")) {\ntools/bpf/bpftool/map.c:430:\t\tif (!flags) {\ntools/bpf/bpftool/map.c:431:\t\t\tp_err(\"flags specified multiple times: %s\", *argv);\ntools/bpf/bpftool/map.c:432:\t\t\treturn -1;\ntools/bpf/bpftool/map.c:433:\t\t}\ntools/bpf/bpftool/map.c:434:\ntools/bpf/bpftool/map.c:435:\t\tif (is_prefix(*argv, \"any\"))\ntools/bpf/bpftool/map.c:436:\t\t\t*flags = BPF_ANY;\ntools/bpf/bpftool/map.c:437:\t\telse if (is_prefix(*argv, \"noexist\"))\ntools/bpf/bpftool/map.c:438:\t\t\t*flags = BPF_NOEXIST;\ntools/bpf/bpftool/map.c:439:\t\telse if (is_prefix(*argv, \"exist\"))\ntools/bpf/bpftool/map.c:440:\t\t\t*flags = BPF_EXIST;\ntools/bpf/bpftool/map.c:441:\ntools/bpf/bpftool/map.c:442:\t\treturn parse_elem(argv + 1, info, key, value, key_size,\ntools/bpf/bpftool/map.c:443:\t\t\t\t  value_size, NULL, value_fd, open_flags);\ntools/bpf/bpftool/map.c:444:\t}\ntools/bpf/bpftool/map.c:445:\ntools/bpf/bpftool/map.c:446:\tp_err(\"expected key or value, got: %s\", *argv);\ntools/bpf/bpftool/map.c:447:\treturn -1;\ntools/bpf/bpftool/map.c:448:}\ntools/bpf/bpftool/map.c:449:\ntools/bpf/bpftool/map.c:450:static void show_map_header_json(struct bpf_map_info *info, json_writer_t *wtr)\ntools/bpf/bpftool/map.c:451:{\ntools/bpf/bpftool/map.c:452:\tconst char *map_type_str;\ntools/bpf/bpftool/map.c:453:\ntools/bpf/bpftool/map.c:454:\tjsonw_uint_field(wtr, \"id\", info-\u003eid);\ntools/bpf/bpftool/map.c:455:\tmap_type_str = libbpf_bpf_map_type_str(info-\u003etype);\ntools/bpf/bpftool/map.c:456:\tif (map_type_str)\ntools/bpf/bpftool/map.c:457:\t\tjsonw_string_field(wtr, \"type\", map_type_str);\ntools/bpf/bpftool/map.c:458:\telse\ntools/bpf/bpftool/map.c:459:\t\tjsonw_uint_field(wtr, \"type\", info-\u003etype);\ntools/bpf/bpftool/map.c:460:\ntools/bpf/bpftool/map.c:461:\tif (*info-\u003ename)\ntools/bpf/bpftool/map.c:462:\t\tjsonw_string_field(wtr, \"name\", info-\u003ename);\ntools/bpf/bpftool/map.c:463:\ntools/bpf/bpftool/map.c:464:\tjsonw_name(wtr, \"flags\");\ntools/bpf/bpftool/map.c:465:\tjsonw_printf(wtr, \"%u\", info-\u003emap_flags);\ntools/bpf/bpftool/map.c:466:}\ntools/bpf/bpftool/map.c:467:\ntools/bpf/bpftool/map.c:468:static int show_map_close_json(int fd, struct bpf_map_info *info)\ntools/bpf/bpftool/map.c:469:{\ntools/bpf/bpftool/map.c:470:\tchar *memlock, *frozen_str;\ntools/bpf/bpftool/map.c:471:\tint frozen = 0;\ntools/bpf/bpftool/map.c:472:\ntools/bpf/bpftool/map.c:473:\tmemlock = get_fdinfo(fd, \"memlock\");\ntools/bpf/bpftool/map.c:474:\tfrozen_str = get_fdinfo(fd, \"frozen\");\ntools/bpf/bpftool/map.c:475:\ntools/bpf/bpftool/map.c:476:\tjsonw_start_object(json_wtr);\ntools/bpf/bpftool/map.c:477:\ntools/bpf/bpftool/map.c:478:\tshow_map_header_json(info, json_wtr);\ntools/bpf/bpftool/map.c:479:\ntools/bpf/bpftool/map.c:480:\tprint_dev_json(info-\u003eifindex, info-\u003enetns_dev, info-\u003enetns_ino);\ntools/bpf/bpftool/map.c:481:\ntools/bpf/bpftool/map.c:482:\tjsonw_uint_field(json_wtr, \"bytes_key\", info-\u003ekey_size);\ntools/bpf/bpftool/map.c:483:\tjsonw_uint_field(json_wtr, \"bytes_value\", info-\u003evalue_size);\ntools/bpf/bpftool/map.c:484:\tjsonw_uint_field(json_wtr, \"max_entries\", info-\u003emax_entries);\ntools/bpf/bpftool/map.c:485:\ntools/bpf/bpftool/map.c:486:\tif (memlock)\ntools/bpf/bpftool/map.c:487:\t\tjsonw_int_field(json_wtr, \"bytes_memlock\", atoll(memlock));\ntools/bpf/bpftool/map.c:488:\tfree(memlock);\ntools/bpf/bpftool/map.c:489:\ntools/bpf/bpftool/map.c:490:\tif (info-\u003etype == BPF_MAP_TYPE_PROG_ARRAY) {\ntools/bpf/bpftool/map.c:491:\t\tchar *owner_prog_type = get_fdinfo(fd, \"owner_prog_type\");\ntools/bpf/bpftool/map.c:492:\t\tchar *owner_jited = get_fdinfo(fd, \"owner_jited\");\ntools/bpf/bpftool/map.c:493:\ntools/bpf/bpftool/map.c:494:\t\tif (owner_prog_type) {\ntools/bpf/bpftool/map.c:495:\t\t\tunsigned int prog_type = atoi(owner_prog_type);\ntools/bpf/bpftool/map.c:496:\t\t\tconst char *prog_type_str;\ntools/bpf/bpftool/map.c:497:\ntools/bpf/bpftool/map.c:498:\t\t\tprog_type_str = libbpf_bpf_prog_type_str(prog_type);\ntools/bpf/bpftool/map.c:499:\t\t\tif (prog_type_str)\ntools/bpf/bpftool/map.c:500:\t\t\t\tjsonw_string_field(json_wtr, \"owner_prog_type\",\n\n"
}

5/2

2026/09/07 00:53

llm

patch-evaluator

Model:

gemini-3.7-flash

Args:

null

Results:

null

Tokens:

							input: 24953
							output: 89
							thoughts: 435

Thoughts:

**Analysis of the BPF Tool Changes**

Okay, let's break this down. My initial assessment is that these changes are isolated to the `bpftool` utility and related testing infrastructure. Specifically, I'm looking at modifications within:

1. `tools/bpf/bpftool/Documentation/bpftool-map.rst`
2. `tools/bpf/bpftool/bash-completion/bpftool`
3. `tools/bpf/bpftool/main.c`
4. `tools/bpf/bpftool/main.h`
5. `tools/bpf/bpftool/map.c`
6. `tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c`

Based on the established guidelines, this is pretty clear-cut. The criteria for returning `WorthFuzzing=false` is met because all the changes are confined to user-space utilities and self-tests within the `tools/` directory. They are *not* touching anything that directly affects the kernel image (`vmlinux`) or any loadable kernel modules. These are modifications to the `bpftool` utility itself and the associated self-tests.

Therefore, the fuzzing-worthiness is low. I will set the parameters for `set-results` accordingly. I will ensure that:

* `WorthFuzzing` is set to `false`.
* `FocusSymbols` is set to an empty/null list ( `[]` ).
* `EnableConfigs` is also set to an empty/null list ( `[]` ).
* The `Reasoning` should explicitly state that the changes are isolated to user-space `bpftool` utility and self-tests located within the `tools/` directory, and that these do not impact the compiled kernel image or runtime kernel code. This should be very clear and concise to prevent any confusion.

6/2

2026/09/07 00:53

tool

set-results

Args:

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies user-space code in tools/bpf/bpftool and tools/testing/selftests/bpf. It does not affect the compiled kernel image (vmlinux) or kernel modules, and is therefore not relevant for syzkaller fuzzing.",
  "WorthFuzzing": false
}

Results:

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies user-space code in tools/bpf/bpftool and tools/testing/selftests/bpf. It does not affect the compiled kernel image (vmlinux) or kernel modules, and is therefore not relevant for syzkaller fuzzing.",
  "WorthFuzzing": false
}

7/1

2026/09/07 00:53

action

Args:

{
  "WorthFuzzing": false
}

Results:

null

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)