1 // SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
4 * common eBPF ELF operations.
8 * Copyright (C) 2015 Huawei Inc.
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU Lesser General Public
12 * License as published by the Free Software Foundation;
13 * version 2.1 of the License (not later!)
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU Lesser General Public License for more details.
20 * You should have received a copy of the GNU Lesser General Public
21 * License along with this program; if not, see <http://www.gnu.org/licenses>
28 #include <asm/unistd.h>
30 #include <linux/bpf.h>
31 #include <linux/filter.h>
32 #include <linux/kernel.h>
34 #include <sys/resource.h>
37 #include "libbpf_internal.h"
40 * When building perf, unistd.h is overridden. __NR_bpf is
41 * required to be defined explicitly.
44 # if defined(__i386__)
46 # elif defined(__x86_64__)
48 # elif defined(__aarch64__)
50 # elif defined(__sparc__)
52 # elif defined(__s390__)
54 # elif defined(__arc__)
56 # elif defined(__mips__) && defined(_ABIO32)
57 # define __NR_bpf 4355
58 # elif defined(__mips__) && defined(_ABIN32)
59 # define __NR_bpf 6319
60 # elif defined(__mips__) && defined(_ABI64)
61 # define __NR_bpf 5315
63 # error __NR_bpf not defined. libbpf does not support your arch.
67 static inline __u64 ptr_to_u64(const void *ptr)
69 return (__u64) (unsigned long) ptr;
72 static inline int sys_bpf(enum bpf_cmd cmd, union bpf_attr *attr,
75 return syscall(__NR_bpf, cmd, attr, size);
78 static inline int sys_bpf_fd(enum bpf_cmd cmd, union bpf_attr *attr,
83 fd = sys_bpf(cmd, attr, size);
84 return ensure_good_fd(fd);
87 int sys_bpf_prog_load(union bpf_attr *attr, unsigned int size, int attempts)
92 fd = sys_bpf_fd(BPF_PROG_LOAD, attr, size);
93 } while (fd < 0 && errno == EAGAIN && --attempts > 0);
98 /* Probe whether kernel switched from memlock-based (RLIMIT_MEMLOCK) to
99 * memcg-based memory accounting for BPF maps and progs. This was done in [0].
100 * We use the support for bpf_ktime_get_coarse_ns() helper, which was added in
101 * the same 5.11 Linux release ([1]), to detect memcg-based accounting for BPF.
104 * [1] d05512618056 ("bpf: Add bpf_ktime_get_coarse_ns helper")
106 int probe_memcg_account(void)
108 const size_t attr_sz = offsetofend(union bpf_attr, attach_btf_obj_fd);
109 struct bpf_insn insns[] = {
110 BPF_EMIT_CALL(BPF_FUNC_ktime_get_coarse_ns),
113 size_t insn_cnt = ARRAY_SIZE(insns);
117 /* attempt loading freplace trying to use custom BTF */
118 memset(&attr, 0, attr_sz);
119 attr.prog_type = BPF_PROG_TYPE_SOCKET_FILTER;
120 attr.insns = ptr_to_u64(insns);
121 attr.insn_cnt = insn_cnt;
122 attr.license = ptr_to_u64("GPL");
124 prog_fd = sys_bpf_fd(BPF_PROG_LOAD, &attr, attr_sz);
132 static bool memlock_bumped;
133 static rlim_t memlock_rlim = RLIM_INFINITY;
135 int libbpf_set_memlock_rlim(size_t memlock_bytes)
138 return libbpf_err(-EBUSY);
140 memlock_rlim = memlock_bytes;
144 int bump_rlimit_memlock(void)
148 /* if kernel supports memcg-based accounting, skip bumping RLIMIT_MEMLOCK */
149 if (memlock_bumped || kernel_supports(NULL, FEAT_MEMCG_ACCOUNT))
152 memlock_bumped = true;
154 /* zero memlock_rlim_max disables auto-bumping RLIMIT_MEMLOCK */
155 if (memlock_rlim == 0)
158 rlim.rlim_cur = rlim.rlim_max = memlock_rlim;
159 if (setrlimit(RLIMIT_MEMLOCK, &rlim))
165 int bpf_map_create(enum bpf_map_type map_type,
166 const char *map_name,
170 const struct bpf_map_create_opts *opts)
172 const size_t attr_sz = offsetofend(union bpf_attr, map_extra);
176 bump_rlimit_memlock();
178 memset(&attr, 0, attr_sz);
180 if (!OPTS_VALID(opts, bpf_map_create_opts))
181 return libbpf_err(-EINVAL);
183 attr.map_type = map_type;
184 if (map_name && kernel_supports(NULL, FEAT_PROG_NAME))
185 libbpf_strlcpy(attr.map_name, map_name, sizeof(attr.map_name));
186 attr.key_size = key_size;
187 attr.value_size = value_size;
188 attr.max_entries = max_entries;
190 attr.btf_fd = OPTS_GET(opts, btf_fd, 0);
191 attr.btf_key_type_id = OPTS_GET(opts, btf_key_type_id, 0);
192 attr.btf_value_type_id = OPTS_GET(opts, btf_value_type_id, 0);
193 attr.btf_vmlinux_value_type_id = OPTS_GET(opts, btf_vmlinux_value_type_id, 0);
195 attr.inner_map_fd = OPTS_GET(opts, inner_map_fd, 0);
196 attr.map_flags = OPTS_GET(opts, map_flags, 0);
197 attr.map_extra = OPTS_GET(opts, map_extra, 0);
198 attr.numa_node = OPTS_GET(opts, numa_node, 0);
199 attr.map_ifindex = OPTS_GET(opts, map_ifindex, 0);
201 fd = sys_bpf_fd(BPF_MAP_CREATE, &attr, attr_sz);
202 return libbpf_err_errno(fd);
206 alloc_zero_tailing_info(const void *orecord, __u32 cnt,
207 __u32 actual_rec_size, __u32 expected_rec_size)
209 __u64 info_len = (__u64)actual_rec_size * cnt;
210 void *info, *nrecord;
213 info = malloc(info_len);
217 /* zero out bytes kernel does not understand */
219 for (i = 0; i < cnt; i++) {
220 memcpy(nrecord, orecord, expected_rec_size);
221 memset(nrecord + expected_rec_size, 0,
222 actual_rec_size - expected_rec_size);
223 orecord += actual_rec_size;
224 nrecord += actual_rec_size;
230 int bpf_prog_load(enum bpf_prog_type prog_type,
231 const char *prog_name, const char *license,
232 const struct bpf_insn *insns, size_t insn_cnt,
233 struct bpf_prog_load_opts *opts)
235 const size_t attr_sz = offsetofend(union bpf_attr, log_true_size);
236 void *finfo = NULL, *linfo = NULL;
237 const char *func_info, *line_info;
238 __u32 log_size, log_level, attach_prog_fd, attach_btf_obj_fd;
239 __u32 func_info_rec_size, line_info_rec_size;
244 bump_rlimit_memlock();
246 if (!OPTS_VALID(opts, bpf_prog_load_opts))
247 return libbpf_err(-EINVAL);
249 attempts = OPTS_GET(opts, attempts, 0);
251 return libbpf_err(-EINVAL);
253 attempts = PROG_LOAD_ATTEMPTS;
255 memset(&attr, 0, attr_sz);
257 attr.prog_type = prog_type;
258 attr.expected_attach_type = OPTS_GET(opts, expected_attach_type, 0);
260 attr.prog_btf_fd = OPTS_GET(opts, prog_btf_fd, 0);
261 attr.prog_flags = OPTS_GET(opts, prog_flags, 0);
262 attr.prog_ifindex = OPTS_GET(opts, prog_ifindex, 0);
263 attr.kern_version = OPTS_GET(opts, kern_version, 0);
265 if (prog_name && kernel_supports(NULL, FEAT_PROG_NAME))
266 libbpf_strlcpy(attr.prog_name, prog_name, sizeof(attr.prog_name));
267 attr.license = ptr_to_u64(license);
269 if (insn_cnt > UINT_MAX)
270 return libbpf_err(-E2BIG);
272 attr.insns = ptr_to_u64(insns);
273 attr.insn_cnt = (__u32)insn_cnt;
275 attach_prog_fd = OPTS_GET(opts, attach_prog_fd, 0);
276 attach_btf_obj_fd = OPTS_GET(opts, attach_btf_obj_fd, 0);
278 if (attach_prog_fd && attach_btf_obj_fd)
279 return libbpf_err(-EINVAL);
281 attr.attach_btf_id = OPTS_GET(opts, attach_btf_id, 0);
283 attr.attach_prog_fd = attach_prog_fd;
285 attr.attach_btf_obj_fd = attach_btf_obj_fd;
287 log_buf = OPTS_GET(opts, log_buf, NULL);
288 log_size = OPTS_GET(opts, log_size, 0);
289 log_level = OPTS_GET(opts, log_level, 0);
291 if (!!log_buf != !!log_size)
292 return libbpf_err(-EINVAL);
294 func_info_rec_size = OPTS_GET(opts, func_info_rec_size, 0);
295 func_info = OPTS_GET(opts, func_info, NULL);
296 attr.func_info_rec_size = func_info_rec_size;
297 attr.func_info = ptr_to_u64(func_info);
298 attr.func_info_cnt = OPTS_GET(opts, func_info_cnt, 0);
300 line_info_rec_size = OPTS_GET(opts, line_info_rec_size, 0);
301 line_info = OPTS_GET(opts, line_info, NULL);
302 attr.line_info_rec_size = line_info_rec_size;
303 attr.line_info = ptr_to_u64(line_info);
304 attr.line_info_cnt = OPTS_GET(opts, line_info_cnt, 0);
306 attr.fd_array = ptr_to_u64(OPTS_GET(opts, fd_array, NULL));
309 attr.log_buf = ptr_to_u64(log_buf);
310 attr.log_size = log_size;
311 attr.log_level = log_level;
314 fd = sys_bpf_prog_load(&attr, attr_sz, attempts);
315 OPTS_SET(opts, log_true_size, attr.log_true_size);
319 /* After bpf_prog_load, the kernel may modify certain attributes
320 * to give user space a hint how to deal with loading failure.
321 * Check to see whether we can make some changes and load again.
323 while (errno == E2BIG && (!finfo || !linfo)) {
324 if (!finfo && attr.func_info_cnt &&
325 attr.func_info_rec_size < func_info_rec_size) {
326 /* try with corrected func info records */
327 finfo = alloc_zero_tailing_info(func_info,
330 attr.func_info_rec_size);
336 attr.func_info = ptr_to_u64(finfo);
337 attr.func_info_rec_size = func_info_rec_size;
338 } else if (!linfo && attr.line_info_cnt &&
339 attr.line_info_rec_size < line_info_rec_size) {
340 linfo = alloc_zero_tailing_info(line_info,
343 attr.line_info_rec_size);
349 attr.line_info = ptr_to_u64(linfo);
350 attr.line_info_rec_size = line_info_rec_size;
355 fd = sys_bpf_prog_load(&attr, attr_sz, attempts);
356 OPTS_SET(opts, log_true_size, attr.log_true_size);
361 if (log_level == 0 && log_buf) {
362 /* log_level == 0 with non-NULL log_buf requires retrying on error
363 * with log_level == 1 and log_buf/log_buf_size set, to get details of
366 attr.log_buf = ptr_to_u64(log_buf);
367 attr.log_size = log_size;
370 fd = sys_bpf_prog_load(&attr, attr_sz, attempts);
371 OPTS_SET(opts, log_true_size, attr.log_true_size);
374 /* free() doesn't affect errno, so we don't need to restore it */
377 return libbpf_err_errno(fd);
380 int bpf_map_update_elem(int fd, const void *key, const void *value,
383 const size_t attr_sz = offsetofend(union bpf_attr, flags);
387 memset(&attr, 0, attr_sz);
389 attr.key = ptr_to_u64(key);
390 attr.value = ptr_to_u64(value);
393 ret = sys_bpf(BPF_MAP_UPDATE_ELEM, &attr, attr_sz);
394 return libbpf_err_errno(ret);
397 int bpf_map_lookup_elem(int fd, const void *key, void *value)
399 const size_t attr_sz = offsetofend(union bpf_attr, flags);
403 memset(&attr, 0, attr_sz);
405 attr.key = ptr_to_u64(key);
406 attr.value = ptr_to_u64(value);
408 ret = sys_bpf(BPF_MAP_LOOKUP_ELEM, &attr, attr_sz);
409 return libbpf_err_errno(ret);
412 int bpf_map_lookup_elem_flags(int fd, const void *key, void *value, __u64 flags)
414 const size_t attr_sz = offsetofend(union bpf_attr, flags);
418 memset(&attr, 0, attr_sz);
420 attr.key = ptr_to_u64(key);
421 attr.value = ptr_to_u64(value);
424 ret = sys_bpf(BPF_MAP_LOOKUP_ELEM, &attr, attr_sz);
425 return libbpf_err_errno(ret);
428 int bpf_map_lookup_and_delete_elem(int fd, const void *key, void *value)
430 const size_t attr_sz = offsetofend(union bpf_attr, flags);
434 memset(&attr, 0, attr_sz);
436 attr.key = ptr_to_u64(key);
437 attr.value = ptr_to_u64(value);
439 ret = sys_bpf(BPF_MAP_LOOKUP_AND_DELETE_ELEM, &attr, attr_sz);
440 return libbpf_err_errno(ret);
443 int bpf_map_lookup_and_delete_elem_flags(int fd, const void *key, void *value, __u64 flags)
445 const size_t attr_sz = offsetofend(union bpf_attr, flags);
449 memset(&attr, 0, attr_sz);
451 attr.key = ptr_to_u64(key);
452 attr.value = ptr_to_u64(value);
455 ret = sys_bpf(BPF_MAP_LOOKUP_AND_DELETE_ELEM, &attr, attr_sz);
456 return libbpf_err_errno(ret);
459 int bpf_map_delete_elem(int fd, const void *key)
461 const size_t attr_sz = offsetofend(union bpf_attr, flags);
465 memset(&attr, 0, attr_sz);
467 attr.key = ptr_to_u64(key);
469 ret = sys_bpf(BPF_MAP_DELETE_ELEM, &attr, attr_sz);
470 return libbpf_err_errno(ret);
473 int bpf_map_delete_elem_flags(int fd, const void *key, __u64 flags)
475 const size_t attr_sz = offsetofend(union bpf_attr, flags);
479 memset(&attr, 0, attr_sz);
481 attr.key = ptr_to_u64(key);
484 ret = sys_bpf(BPF_MAP_DELETE_ELEM, &attr, attr_sz);
485 return libbpf_err_errno(ret);
488 int bpf_map_get_next_key(int fd, const void *key, void *next_key)
490 const size_t attr_sz = offsetofend(union bpf_attr, next_key);
494 memset(&attr, 0, attr_sz);
496 attr.key = ptr_to_u64(key);
497 attr.next_key = ptr_to_u64(next_key);
499 ret = sys_bpf(BPF_MAP_GET_NEXT_KEY, &attr, attr_sz);
500 return libbpf_err_errno(ret);
503 int bpf_map_freeze(int fd)
505 const size_t attr_sz = offsetofend(union bpf_attr, map_fd);
509 memset(&attr, 0, attr_sz);
512 ret = sys_bpf(BPF_MAP_FREEZE, &attr, attr_sz);
513 return libbpf_err_errno(ret);
516 static int bpf_map_batch_common(int cmd, int fd, void *in_batch,
517 void *out_batch, void *keys, void *values,
519 const struct bpf_map_batch_opts *opts)
521 const size_t attr_sz = offsetofend(union bpf_attr, batch);
525 if (!OPTS_VALID(opts, bpf_map_batch_opts))
526 return libbpf_err(-EINVAL);
528 memset(&attr, 0, attr_sz);
529 attr.batch.map_fd = fd;
530 attr.batch.in_batch = ptr_to_u64(in_batch);
531 attr.batch.out_batch = ptr_to_u64(out_batch);
532 attr.batch.keys = ptr_to_u64(keys);
533 attr.batch.values = ptr_to_u64(values);
534 attr.batch.count = *count;
535 attr.batch.elem_flags = OPTS_GET(opts, elem_flags, 0);
536 attr.batch.flags = OPTS_GET(opts, flags, 0);
538 ret = sys_bpf(cmd, &attr, attr_sz);
539 *count = attr.batch.count;
541 return libbpf_err_errno(ret);
544 int bpf_map_delete_batch(int fd, const void *keys, __u32 *count,
545 const struct bpf_map_batch_opts *opts)
547 return bpf_map_batch_common(BPF_MAP_DELETE_BATCH, fd, NULL,
548 NULL, (void *)keys, NULL, count, opts);
551 int bpf_map_lookup_batch(int fd, void *in_batch, void *out_batch, void *keys,
552 void *values, __u32 *count,
553 const struct bpf_map_batch_opts *opts)
555 return bpf_map_batch_common(BPF_MAP_LOOKUP_BATCH, fd, in_batch,
556 out_batch, keys, values, count, opts);
559 int bpf_map_lookup_and_delete_batch(int fd, void *in_batch, void *out_batch,
560 void *keys, void *values, __u32 *count,
561 const struct bpf_map_batch_opts *opts)
563 return bpf_map_batch_common(BPF_MAP_LOOKUP_AND_DELETE_BATCH,
564 fd, in_batch, out_batch, keys, values,
568 int bpf_map_update_batch(int fd, const void *keys, const void *values, __u32 *count,
569 const struct bpf_map_batch_opts *opts)
571 return bpf_map_batch_common(BPF_MAP_UPDATE_BATCH, fd, NULL, NULL,
572 (void *)keys, (void *)values, count, opts);
575 int bpf_obj_pin_opts(int fd, const char *pathname, const struct bpf_obj_pin_opts *opts)
577 const size_t attr_sz = offsetofend(union bpf_attr, path_fd);
581 if (!OPTS_VALID(opts, bpf_obj_pin_opts))
582 return libbpf_err(-EINVAL);
584 memset(&attr, 0, attr_sz);
585 attr.path_fd = OPTS_GET(opts, path_fd, 0);
586 attr.pathname = ptr_to_u64((void *)pathname);
587 attr.file_flags = OPTS_GET(opts, file_flags, 0);
590 ret = sys_bpf(BPF_OBJ_PIN, &attr, attr_sz);
591 return libbpf_err_errno(ret);
594 int bpf_obj_pin(int fd, const char *pathname)
596 return bpf_obj_pin_opts(fd, pathname, NULL);
599 int bpf_obj_get(const char *pathname)
601 return bpf_obj_get_opts(pathname, NULL);
604 int bpf_obj_get_opts(const char *pathname, const struct bpf_obj_get_opts *opts)
606 const size_t attr_sz = offsetofend(union bpf_attr, path_fd);
610 if (!OPTS_VALID(opts, bpf_obj_get_opts))
611 return libbpf_err(-EINVAL);
613 memset(&attr, 0, attr_sz);
614 attr.path_fd = OPTS_GET(opts, path_fd, 0);
615 attr.pathname = ptr_to_u64((void *)pathname);
616 attr.file_flags = OPTS_GET(opts, file_flags, 0);
618 fd = sys_bpf_fd(BPF_OBJ_GET, &attr, attr_sz);
619 return libbpf_err_errno(fd);
622 int bpf_prog_attach(int prog_fd, int target_fd, enum bpf_attach_type type,
625 DECLARE_LIBBPF_OPTS(bpf_prog_attach_opts, opts,
629 return bpf_prog_attach_opts(prog_fd, target_fd, type, &opts);
632 int bpf_prog_attach_opts(int prog_fd, int target_fd,
633 enum bpf_attach_type type,
634 const struct bpf_prog_attach_opts *opts)
636 const size_t attr_sz = offsetofend(union bpf_attr, replace_bpf_fd);
640 if (!OPTS_VALID(opts, bpf_prog_attach_opts))
641 return libbpf_err(-EINVAL);
643 memset(&attr, 0, attr_sz);
644 attr.target_fd = target_fd;
645 attr.attach_bpf_fd = prog_fd;
646 attr.attach_type = type;
647 attr.attach_flags = OPTS_GET(opts, flags, 0);
648 attr.replace_bpf_fd = OPTS_GET(opts, replace_prog_fd, 0);
650 ret = sys_bpf(BPF_PROG_ATTACH, &attr, attr_sz);
651 return libbpf_err_errno(ret);
654 int bpf_prog_detach(int target_fd, enum bpf_attach_type type)
656 const size_t attr_sz = offsetofend(union bpf_attr, replace_bpf_fd);
660 memset(&attr, 0, attr_sz);
661 attr.target_fd = target_fd;
662 attr.attach_type = type;
664 ret = sys_bpf(BPF_PROG_DETACH, &attr, attr_sz);
665 return libbpf_err_errno(ret);
668 int bpf_prog_detach2(int prog_fd, int target_fd, enum bpf_attach_type type)
670 const size_t attr_sz = offsetofend(union bpf_attr, replace_bpf_fd);
674 memset(&attr, 0, attr_sz);
675 attr.target_fd = target_fd;
676 attr.attach_bpf_fd = prog_fd;
677 attr.attach_type = type;
679 ret = sys_bpf(BPF_PROG_DETACH, &attr, attr_sz);
680 return libbpf_err_errno(ret);
683 int bpf_link_create(int prog_fd, int target_fd,
684 enum bpf_attach_type attach_type,
685 const struct bpf_link_create_opts *opts)
687 const size_t attr_sz = offsetofend(union bpf_attr, link_create);
688 __u32 target_btf_id, iter_info_len;
692 if (!OPTS_VALID(opts, bpf_link_create_opts))
693 return libbpf_err(-EINVAL);
695 iter_info_len = OPTS_GET(opts, iter_info_len, 0);
696 target_btf_id = OPTS_GET(opts, target_btf_id, 0);
698 /* validate we don't have unexpected combinations of non-zero fields */
699 if (iter_info_len || target_btf_id) {
700 if (iter_info_len && target_btf_id)
701 return libbpf_err(-EINVAL);
702 if (!OPTS_ZEROED(opts, target_btf_id))
703 return libbpf_err(-EINVAL);
706 memset(&attr, 0, attr_sz);
707 attr.link_create.prog_fd = prog_fd;
708 attr.link_create.target_fd = target_fd;
709 attr.link_create.attach_type = attach_type;
710 attr.link_create.flags = OPTS_GET(opts, flags, 0);
713 attr.link_create.target_btf_id = target_btf_id;
717 switch (attach_type) {
719 attr.link_create.iter_info = ptr_to_u64(OPTS_GET(opts, iter_info, (void *)0));
720 attr.link_create.iter_info_len = iter_info_len;
723 attr.link_create.perf_event.bpf_cookie = OPTS_GET(opts, perf_event.bpf_cookie, 0);
724 if (!OPTS_ZEROED(opts, perf_event))
725 return libbpf_err(-EINVAL);
727 case BPF_TRACE_KPROBE_MULTI:
728 attr.link_create.kprobe_multi.flags = OPTS_GET(opts, kprobe_multi.flags, 0);
729 attr.link_create.kprobe_multi.cnt = OPTS_GET(opts, kprobe_multi.cnt, 0);
730 attr.link_create.kprobe_multi.syms = ptr_to_u64(OPTS_GET(opts, kprobe_multi.syms, 0));
731 attr.link_create.kprobe_multi.addrs = ptr_to_u64(OPTS_GET(opts, kprobe_multi.addrs, 0));
732 attr.link_create.kprobe_multi.cookies = ptr_to_u64(OPTS_GET(opts, kprobe_multi.cookies, 0));
733 if (!OPTS_ZEROED(opts, kprobe_multi))
734 return libbpf_err(-EINVAL);
736 case BPF_TRACE_FENTRY:
737 case BPF_TRACE_FEXIT:
738 case BPF_MODIFY_RETURN:
740 attr.link_create.tracing.cookie = OPTS_GET(opts, tracing.cookie, 0);
741 if (!OPTS_ZEROED(opts, tracing))
742 return libbpf_err(-EINVAL);
745 if (!OPTS_ZEROED(opts, flags))
746 return libbpf_err(-EINVAL);
750 fd = sys_bpf_fd(BPF_LINK_CREATE, &attr, attr_sz);
753 /* we'll get EINVAL if LINK_CREATE doesn't support attaching fentry
754 * and other similar programs
758 return libbpf_err(err);
760 /* if user used features not supported by
761 * BPF_RAW_TRACEPOINT_OPEN command, then just give up immediately
763 if (attr.link_create.target_fd || attr.link_create.target_btf_id)
764 return libbpf_err(err);
765 if (!OPTS_ZEROED(opts, sz))
766 return libbpf_err(err);
768 /* otherwise, for few select kinds of programs that can be
769 * attached using BPF_RAW_TRACEPOINT_OPEN command, try that as
770 * a fallback for older kernels
772 switch (attach_type) {
773 case BPF_TRACE_RAW_TP:
775 case BPF_TRACE_FENTRY:
776 case BPF_TRACE_FEXIT:
777 case BPF_MODIFY_RETURN:
778 return bpf_raw_tracepoint_open(NULL, prog_fd);
780 return libbpf_err(err);
784 int bpf_link_detach(int link_fd)
786 const size_t attr_sz = offsetofend(union bpf_attr, link_detach);
790 memset(&attr, 0, attr_sz);
791 attr.link_detach.link_fd = link_fd;
793 ret = sys_bpf(BPF_LINK_DETACH, &attr, attr_sz);
794 return libbpf_err_errno(ret);
797 int bpf_link_update(int link_fd, int new_prog_fd,
798 const struct bpf_link_update_opts *opts)
800 const size_t attr_sz = offsetofend(union bpf_attr, link_update);
804 if (!OPTS_VALID(opts, bpf_link_update_opts))
805 return libbpf_err(-EINVAL);
807 if (OPTS_GET(opts, old_prog_fd, 0) && OPTS_GET(opts, old_map_fd, 0))
808 return libbpf_err(-EINVAL);
810 memset(&attr, 0, attr_sz);
811 attr.link_update.link_fd = link_fd;
812 attr.link_update.new_prog_fd = new_prog_fd;
813 attr.link_update.flags = OPTS_GET(opts, flags, 0);
814 if (OPTS_GET(opts, old_prog_fd, 0))
815 attr.link_update.old_prog_fd = OPTS_GET(opts, old_prog_fd, 0);
816 else if (OPTS_GET(opts, old_map_fd, 0))
817 attr.link_update.old_map_fd = OPTS_GET(opts, old_map_fd, 0);
819 ret = sys_bpf(BPF_LINK_UPDATE, &attr, attr_sz);
820 return libbpf_err_errno(ret);
823 int bpf_iter_create(int link_fd)
825 const size_t attr_sz = offsetofend(union bpf_attr, iter_create);
829 memset(&attr, 0, attr_sz);
830 attr.iter_create.link_fd = link_fd;
832 fd = sys_bpf_fd(BPF_ITER_CREATE, &attr, attr_sz);
833 return libbpf_err_errno(fd);
836 int bpf_prog_query_opts(int target_fd,
837 enum bpf_attach_type type,
838 struct bpf_prog_query_opts *opts)
840 const size_t attr_sz = offsetofend(union bpf_attr, query);
844 if (!OPTS_VALID(opts, bpf_prog_query_opts))
845 return libbpf_err(-EINVAL);
847 memset(&attr, 0, attr_sz);
849 attr.query.target_fd = target_fd;
850 attr.query.attach_type = type;
851 attr.query.query_flags = OPTS_GET(opts, query_flags, 0);
852 attr.query.prog_cnt = OPTS_GET(opts, prog_cnt, 0);
853 attr.query.prog_ids = ptr_to_u64(OPTS_GET(opts, prog_ids, NULL));
854 attr.query.prog_attach_flags = ptr_to_u64(OPTS_GET(opts, prog_attach_flags, NULL));
856 ret = sys_bpf(BPF_PROG_QUERY, &attr, attr_sz);
858 OPTS_SET(opts, attach_flags, attr.query.attach_flags);
859 OPTS_SET(opts, prog_cnt, attr.query.prog_cnt);
861 return libbpf_err_errno(ret);
864 int bpf_prog_query(int target_fd, enum bpf_attach_type type, __u32 query_flags,
865 __u32 *attach_flags, __u32 *prog_ids, __u32 *prog_cnt)
867 LIBBPF_OPTS(bpf_prog_query_opts, opts);
870 opts.query_flags = query_flags;
871 opts.prog_ids = prog_ids;
872 opts.prog_cnt = *prog_cnt;
874 ret = bpf_prog_query_opts(target_fd, type, &opts);
877 *attach_flags = opts.attach_flags;
878 *prog_cnt = opts.prog_cnt;
880 return libbpf_err_errno(ret);
883 int bpf_prog_test_run_opts(int prog_fd, struct bpf_test_run_opts *opts)
885 const size_t attr_sz = offsetofend(union bpf_attr, test);
889 if (!OPTS_VALID(opts, bpf_test_run_opts))
890 return libbpf_err(-EINVAL);
892 memset(&attr, 0, attr_sz);
893 attr.test.prog_fd = prog_fd;
894 attr.test.batch_size = OPTS_GET(opts, batch_size, 0);
895 attr.test.cpu = OPTS_GET(opts, cpu, 0);
896 attr.test.flags = OPTS_GET(opts, flags, 0);
897 attr.test.repeat = OPTS_GET(opts, repeat, 0);
898 attr.test.duration = OPTS_GET(opts, duration, 0);
899 attr.test.ctx_size_in = OPTS_GET(opts, ctx_size_in, 0);
900 attr.test.ctx_size_out = OPTS_GET(opts, ctx_size_out, 0);
901 attr.test.data_size_in = OPTS_GET(opts, data_size_in, 0);
902 attr.test.data_size_out = OPTS_GET(opts, data_size_out, 0);
903 attr.test.ctx_in = ptr_to_u64(OPTS_GET(opts, ctx_in, NULL));
904 attr.test.ctx_out = ptr_to_u64(OPTS_GET(opts, ctx_out, NULL));
905 attr.test.data_in = ptr_to_u64(OPTS_GET(opts, data_in, NULL));
906 attr.test.data_out = ptr_to_u64(OPTS_GET(opts, data_out, NULL));
908 ret = sys_bpf(BPF_PROG_TEST_RUN, &attr, attr_sz);
910 OPTS_SET(opts, data_size_out, attr.test.data_size_out);
911 OPTS_SET(opts, ctx_size_out, attr.test.ctx_size_out);
912 OPTS_SET(opts, duration, attr.test.duration);
913 OPTS_SET(opts, retval, attr.test.retval);
915 return libbpf_err_errno(ret);
918 static int bpf_obj_get_next_id(__u32 start_id, __u32 *next_id, int cmd)
920 const size_t attr_sz = offsetofend(union bpf_attr, open_flags);
924 memset(&attr, 0, attr_sz);
925 attr.start_id = start_id;
927 err = sys_bpf(cmd, &attr, attr_sz);
929 *next_id = attr.next_id;
931 return libbpf_err_errno(err);
934 int bpf_prog_get_next_id(__u32 start_id, __u32 *next_id)
936 return bpf_obj_get_next_id(start_id, next_id, BPF_PROG_GET_NEXT_ID);
939 int bpf_map_get_next_id(__u32 start_id, __u32 *next_id)
941 return bpf_obj_get_next_id(start_id, next_id, BPF_MAP_GET_NEXT_ID);
944 int bpf_btf_get_next_id(__u32 start_id, __u32 *next_id)
946 return bpf_obj_get_next_id(start_id, next_id, BPF_BTF_GET_NEXT_ID);
949 int bpf_link_get_next_id(__u32 start_id, __u32 *next_id)
951 return bpf_obj_get_next_id(start_id, next_id, BPF_LINK_GET_NEXT_ID);
954 int bpf_prog_get_fd_by_id_opts(__u32 id,
955 const struct bpf_get_fd_by_id_opts *opts)
957 const size_t attr_sz = offsetofend(union bpf_attr, open_flags);
961 if (!OPTS_VALID(opts, bpf_get_fd_by_id_opts))
962 return libbpf_err(-EINVAL);
964 memset(&attr, 0, attr_sz);
966 attr.open_flags = OPTS_GET(opts, open_flags, 0);
968 fd = sys_bpf_fd(BPF_PROG_GET_FD_BY_ID, &attr, attr_sz);
969 return libbpf_err_errno(fd);
972 int bpf_prog_get_fd_by_id(__u32 id)
974 return bpf_prog_get_fd_by_id_opts(id, NULL);
977 int bpf_map_get_fd_by_id_opts(__u32 id,
978 const struct bpf_get_fd_by_id_opts *opts)
980 const size_t attr_sz = offsetofend(union bpf_attr, open_flags);
984 if (!OPTS_VALID(opts, bpf_get_fd_by_id_opts))
985 return libbpf_err(-EINVAL);
987 memset(&attr, 0, attr_sz);
989 attr.open_flags = OPTS_GET(opts, open_flags, 0);
991 fd = sys_bpf_fd(BPF_MAP_GET_FD_BY_ID, &attr, attr_sz);
992 return libbpf_err_errno(fd);
995 int bpf_map_get_fd_by_id(__u32 id)
997 return bpf_map_get_fd_by_id_opts(id, NULL);
1000 int bpf_btf_get_fd_by_id_opts(__u32 id,
1001 const struct bpf_get_fd_by_id_opts *opts)
1003 const size_t attr_sz = offsetofend(union bpf_attr, open_flags);
1004 union bpf_attr attr;
1007 if (!OPTS_VALID(opts, bpf_get_fd_by_id_opts))
1008 return libbpf_err(-EINVAL);
1010 memset(&attr, 0, attr_sz);
1012 attr.open_flags = OPTS_GET(opts, open_flags, 0);
1014 fd = sys_bpf_fd(BPF_BTF_GET_FD_BY_ID, &attr, attr_sz);
1015 return libbpf_err_errno(fd);
1018 int bpf_btf_get_fd_by_id(__u32 id)
1020 return bpf_btf_get_fd_by_id_opts(id, NULL);
1023 int bpf_link_get_fd_by_id_opts(__u32 id,
1024 const struct bpf_get_fd_by_id_opts *opts)
1026 const size_t attr_sz = offsetofend(union bpf_attr, open_flags);
1027 union bpf_attr attr;
1030 if (!OPTS_VALID(opts, bpf_get_fd_by_id_opts))
1031 return libbpf_err(-EINVAL);
1033 memset(&attr, 0, attr_sz);
1035 attr.open_flags = OPTS_GET(opts, open_flags, 0);
1037 fd = sys_bpf_fd(BPF_LINK_GET_FD_BY_ID, &attr, attr_sz);
1038 return libbpf_err_errno(fd);
1041 int bpf_link_get_fd_by_id(__u32 id)
1043 return bpf_link_get_fd_by_id_opts(id, NULL);
1046 int bpf_obj_get_info_by_fd(int bpf_fd, void *info, __u32 *info_len)
1048 const size_t attr_sz = offsetofend(union bpf_attr, info);
1049 union bpf_attr attr;
1052 memset(&attr, 0, attr_sz);
1053 attr.info.bpf_fd = bpf_fd;
1054 attr.info.info_len = *info_len;
1055 attr.info.info = ptr_to_u64(info);
1057 err = sys_bpf(BPF_OBJ_GET_INFO_BY_FD, &attr, attr_sz);
1059 *info_len = attr.info.info_len;
1060 return libbpf_err_errno(err);
1063 int bpf_prog_get_info_by_fd(int prog_fd, struct bpf_prog_info *info, __u32 *info_len)
1065 return bpf_obj_get_info_by_fd(prog_fd, info, info_len);
1068 int bpf_map_get_info_by_fd(int map_fd, struct bpf_map_info *info, __u32 *info_len)
1070 return bpf_obj_get_info_by_fd(map_fd, info, info_len);
1073 int bpf_btf_get_info_by_fd(int btf_fd, struct bpf_btf_info *info, __u32 *info_len)
1075 return bpf_obj_get_info_by_fd(btf_fd, info, info_len);
1078 int bpf_link_get_info_by_fd(int link_fd, struct bpf_link_info *info, __u32 *info_len)
1080 return bpf_obj_get_info_by_fd(link_fd, info, info_len);
1083 int bpf_raw_tracepoint_open(const char *name, int prog_fd)
1085 const size_t attr_sz = offsetofend(union bpf_attr, raw_tracepoint);
1086 union bpf_attr attr;
1089 memset(&attr, 0, attr_sz);
1090 attr.raw_tracepoint.name = ptr_to_u64(name);
1091 attr.raw_tracepoint.prog_fd = prog_fd;
1093 fd = sys_bpf_fd(BPF_RAW_TRACEPOINT_OPEN, &attr, attr_sz);
1094 return libbpf_err_errno(fd);
1097 int bpf_btf_load(const void *btf_data, size_t btf_size, struct bpf_btf_load_opts *opts)
1099 const size_t attr_sz = offsetofend(union bpf_attr, btf_log_true_size);
1100 union bpf_attr attr;
1106 bump_rlimit_memlock();
1108 memset(&attr, 0, attr_sz);
1110 if (!OPTS_VALID(opts, bpf_btf_load_opts))
1111 return libbpf_err(-EINVAL);
1113 log_buf = OPTS_GET(opts, log_buf, NULL);
1114 log_size = OPTS_GET(opts, log_size, 0);
1115 log_level = OPTS_GET(opts, log_level, 0);
1117 if (log_size > UINT_MAX)
1118 return libbpf_err(-EINVAL);
1119 if (log_size && !log_buf)
1120 return libbpf_err(-EINVAL);
1122 attr.btf = ptr_to_u64(btf_data);
1123 attr.btf_size = btf_size;
1124 /* log_level == 0 and log_buf != NULL means "try loading without
1125 * log_buf, but retry with log_buf and log_level=1 on error", which is
1126 * consistent across low-level and high-level BTF and program loading
1127 * APIs within libbpf and provides a sensible behavior in practice
1130 attr.btf_log_buf = ptr_to_u64(log_buf);
1131 attr.btf_log_size = (__u32)log_size;
1132 attr.btf_log_level = log_level;
1135 fd = sys_bpf_fd(BPF_BTF_LOAD, &attr, attr_sz);
1136 if (fd < 0 && log_buf && log_level == 0) {
1137 attr.btf_log_buf = ptr_to_u64(log_buf);
1138 attr.btf_log_size = (__u32)log_size;
1139 attr.btf_log_level = 1;
1140 fd = sys_bpf_fd(BPF_BTF_LOAD, &attr, attr_sz);
1143 OPTS_SET(opts, log_true_size, attr.btf_log_true_size);
1144 return libbpf_err_errno(fd);
1147 int bpf_task_fd_query(int pid, int fd, __u32 flags, char *buf, __u32 *buf_len,
1148 __u32 *prog_id, __u32 *fd_type, __u64 *probe_offset,
1151 const size_t attr_sz = offsetofend(union bpf_attr, task_fd_query);
1152 union bpf_attr attr;
1155 memset(&attr, 0, attr_sz);
1156 attr.task_fd_query.pid = pid;
1157 attr.task_fd_query.fd = fd;
1158 attr.task_fd_query.flags = flags;
1159 attr.task_fd_query.buf = ptr_to_u64(buf);
1160 attr.task_fd_query.buf_len = *buf_len;
1162 err = sys_bpf(BPF_TASK_FD_QUERY, &attr, attr_sz);
1164 *buf_len = attr.task_fd_query.buf_len;
1165 *prog_id = attr.task_fd_query.prog_id;
1166 *fd_type = attr.task_fd_query.fd_type;
1167 *probe_offset = attr.task_fd_query.probe_offset;
1168 *probe_addr = attr.task_fd_query.probe_addr;
1170 return libbpf_err_errno(err);
1173 int bpf_enable_stats(enum bpf_stats_type type)
1175 const size_t attr_sz = offsetofend(union bpf_attr, enable_stats);
1176 union bpf_attr attr;
1179 memset(&attr, 0, attr_sz);
1180 attr.enable_stats.type = type;
1182 fd = sys_bpf_fd(BPF_ENABLE_STATS, &attr, attr_sz);
1183 return libbpf_err_errno(fd);
1186 int bpf_prog_bind_map(int prog_fd, int map_fd,
1187 const struct bpf_prog_bind_opts *opts)
1189 const size_t attr_sz = offsetofend(union bpf_attr, prog_bind_map);
1190 union bpf_attr attr;
1193 if (!OPTS_VALID(opts, bpf_prog_bind_opts))
1194 return libbpf_err(-EINVAL);
1196 memset(&attr, 0, attr_sz);
1197 attr.prog_bind_map.prog_fd = prog_fd;
1198 attr.prog_bind_map.map_fd = map_fd;
1199 attr.prog_bind_map.flags = OPTS_GET(opts, flags, 0);
1201 ret = sys_bpf(BPF_PROG_BIND_MAP, &attr, attr_sz);
1202 return libbpf_err_errno(ret);