Changes in libbpf.h

1315c28e - libbpf: Split bpf object load into prepare/load

Mon, 03 Mar 2025 13:57:51 +0000

libbpf: Split bpf object load into prepare/loadIntroduce bpf_object__prepare API: additional intermediate preparationstep that performs ELF processing, relocations, prepares final state ofBPF program instructions (accessible with bpf_program__insns()), createsand (potentially) pins maps, and stops short of loading BPF programs.We anticipate few use cases for this API, such as:* Use prepare to initialize bpf_token, without loading freplaceprograms, unlocking possibility to lookup BTF of other programs.* Execute prepare to obtain finalized BPF program instructions withoutloading programs, enabling tools like veristat to process one program ata time, without incurring cost of ELF parsing and processing.Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250303135752.158343-4-mykyta.yatsenko5@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux-6.15/tools/lib/bpf/libbpf.h

e2b0bda6 - libbpf: Add unique_match option for multi kprobe

Thu, 09 Jan 2025 17:40:23 +0000

libbpf: Add unique_match option for multi kprobeJordan reported an issue in Meta production environment where functry_to_wake_up() is renamed to try_to_wake_up.llvm.() by clangcompiler at lto mode. The original 'kprobe/try_to_wake_up' does notwork any more since try_to_wake_up() does not match the actual funcname in /proc/kallsyms.There are a couple of ways to resolve this issue. For example, inattach_kprobe(), we could do lookup in /proc/kallsyms so try_to_wake_up()can be replaced by try_to_wake_up.llvm.(). Or we can force usersto use bpf_program__attach_kprobe() where they need to lookup/proc/kallsyms to find out try_to_wake_up.llvm.(). But these twoapproaches requires extra work by either libbpf or user.Luckily, suggested by Andrii, multi kprobe already supports wildcard ('*')for symbol matching. In the above example, 'try_to_wake_up*' can matchto try_to_wake_up() or try_to_wake_up.llvm.() and this allowsbpf prog works for different kernels as some kernels may havetry_to_wake_up() and some others may have try_to_wake_up.llvm.().The original intention is to kprobe try_to_wake_up() only, so an optionalfield unique_match is added to struct bpf_kprobe_multi_opts. If thefield is set to true, the number of matched functions must be one.Otherwise, the attachment will fail. In the above case, multi kprobewith 'try_to_wake_up*' and unique_match preserves user functionality.Reported-by: Jordan Rome Suggested-by: Andrii Nakryiko Signed-off-by: Yonghong Song Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250109174023.3368432-1-yonghong.song@linux.dev List of files: /linux-6.15/tools/lib/bpf/libbpf.h

6d5e5e5d - libbpf: Extend linker API to support in-memory ELF files

Wed, 11 Dec 2024 16:40:30 +0000

libbpf: Extend linker API to support in-memory ELF filesThe new_fd and add_fd functions correspond to the original new andadd_file functions, but accept an FD instead of a file name. Thisgives API consumers the option of using anonymous files/memfds toavoid writing ELFs to disk.This new API will be useful for performing linking as part ofbpftrace's JIT compilation.The add_buf function is a convenience wrapper that does the work ofcreating a memfd for the caller.Signed-off-by: Alastair Robertson Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20241211164030.573042-3-ajor@meta.com List of files: /linux-6.15/tools/lib/bpf/libbpf.h

022367ec - libbpf: Add support for uprobe multi session attach

Fri, 08 Nov 2024 13:45:36 +0000

libbpf: Add support for uprobe multi session attachAdding support to attach program in uprobe session modewith bpf_program__attach_uprobe_multi function.Adding session bool to bpf_uprobe_multi_opts struct that allowsto load and attach the bpf program via uprobe session.the attachment to create uprobe multi session.Also adding new program loader section that allows: SEC("uprobe.session/bpf_fentry_test*")and loads/attaches uprobe program as uprobe session.Adding sleepable hook (uprobe.session.s) as well.Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20241108134544.480660-6-jolsa@kernel.org List of files: /linux-6.15/tools/lib/bpf/libbpf.h

ea02a946 - libbpf: Add bpf_object__token_fd accessor

Fri, 13 Sep 2024 00:19:02 +0000

libbpf: Add bpf_object__token_fd accessorAdd a LIBBPF_API function to retrieve the token_fd from a bpf_object.Without this accessor, if user needs a token FD they have to get itmanually via bpf_token_create, even though a token might have beenalready created by bpf_object__load.Suggested-by: Andrii Nakryiko Signed-off-by: Ihor Solodrai Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20240913001858.3345583-1-ihor.solodrai@pm.me List of files: /linux-6.15/tools/lib/bpf/libbpf.h

41d0c467 - libbpf: Fix some typos in comments

Mon, 09 Sep 2024 22:59:52 +0000

libbpf: Fix some typos in commentsFix some spelling errors in the code comments of libbpf:betwen -> betweenparemeters -> parametersknowning -> knowingdefiniton -> definitioncompatiblity -> compatibilityoverriden -> overriddenoccured -> occurredproccess -> processmanagment -> managementnessary -> necessarySigned-off-by: Yusheng Zheng Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20240909225952.30324-1-yunwei356@gmail.com List of files: /linux-6.15/tools/lib/bpf/libbpf.h

08ac454e - libbpf: Auto-attach struct_ops BPF maps in BPF skeleton

Wed, 05 Jun 2024 17:51:35 +0000

libbpf: Auto-attach struct_ops BPF maps in BPF skeletonSimilarly to `bpf_program`, support `bpf_map` automatic attachment in`bpf_object__attach_skeleton`. Currently only struct_ops maps could beattached.On bpftool side, code-generate links in skeleton struct for struct_ops maps.Similarly to `bpf_program_skeleton`, set links in `bpf_map_skeleton`.On libbpf side, extend `bpf_map` with new `autoattach` field to supportenabling or disabling autoattach functionality, introducinggetter/setter for this field.`bpf_object__(attach|detach)_skeleton` is extended withattaching/detaching struct_ops maps logic.Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20240605175135.117127-1-yatsenko@meta.com List of files: /linux-6.15/tools/lib/bpf/libbpf.h

eb4e7726 - libbpf: Configure log verbosity with env variable

Fri, 24 May 2024 13:18:40 +0000

libbpf: Configure log verbosity with env variableConfigure logging verbosity by setting LIBBPF_LOG_LEVEL environmentvariable, which is applied only to default logger. Once user set theircustom logging callback, it is up to them to handle filtering.Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20240524131840.114289-1-yatsenko@meta.com List of files: /linux-6.15/tools/lib/bpf/libbpf.h

2ca178f0 - libbpf: Add support for kprobe session attach

Tue, 30 Apr 2024 11:28:27 +0000

libbpf: Add support for kprobe session attachAdding support to attach program in kprobe session modewith bpf_program__attach_kprobe_multi_opts function.Adding session bool to bpf_kprobe_multi_opts struct that allowsto load and attach the bpf program via kprobe session.the attachment to create kprobe multi session.Also adding new program loader section that allows: SEC("kprobe.session/bpf_fentry_test*")and loads/attaches kprobe program as kprobe session.Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20240430112830.1184228-5-jolsa@kernel.org List of files: /linux-6.15/tools/lib/bpf/libbpf.h

849989af - libbpf: Add bpf_link support for BPF_PROG_TYPE_SOCKMAP

Wed, 10 Apr 2024 04:35:32 +0000

libbpf: Add bpf_link support for BPF_PROG_TYPE_SOCKMAPIntroduce a libbpf API function bpf_program__attach_sockmap()which allow user to get a bpf_link for their corresponding programs.Acked-by: Andrii Nakryiko Acked-by: Eduard Zingerman Reviewed-by: John Fastabend Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20240410043532.3737722-1-yonghong.song@linux.devSigned-off-by: Alexei Starovoitov List of files: /linux-6.15/tools/lib/bpf/libbpf.h

4d22ea94 - libbpf: Add ring__consume_n / ring_buffer__consume_n

Sat, 06 Apr 2024 09:15:43 +0000

libbpf: Add ring__consume_n / ring_buffer__consume_nIntroduce a new API to consume items from a ring buffer, limited to aspecified amount, and return to the caller the actual number of itemsconsumed.Signed-off-by: Andrea Righi Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/lkml/20240310154726.734289-1-andrea.righi@canonical.com/TLink: https://lore.kernel.org/bpf/20240406092005.92399-4-andrea.righi@canonical.com List of files: /linux-6.15/tools/lib/bpf/libbpf.h

36ffb202 - libbpf: add support for BPF cookie for raw_tp/tp_btf programs

Tue, 19 Mar 2024 23:38:51 +0000

libbpf: add support for BPF cookie for raw_tp/tp_btf programsWire up BPF cookie passing or raw_tp and tp_btf programs, both inlow-level and high-level APIs.Acked-by: Stanislav Fomichev Acked-by: Eduard Zingerman Signed-off-by: Andrii Nakryiko Message-ID: <20240319233852.1977493-5-andrii@kernel.org>Signed-off-by: Alexei Starovoitov List of files: /linux-6.15/tools/lib/bpf/libbpf.h

2e7ba4f8 - libbpf: Recognize __arena global variables.

Fri, 08 Mar 2024 01:08:08 +0000

libbpf: Recognize __arena global variables.LLVM automatically places __arena variables into ".arena.1" ELF section.In order to use such global variables bpf program must include definitionof arena map in ".maps" section, like:struct { __uint(type, BPF_MAP_TYPE_ARENA); __uint(map_flags, BPF_F_MMAPABLE); __uint(max_entries, 1000); /* number of pages */ __ulong(map_extra, 2ull << 44); /* start of mmap() region */} arena SEC(".maps");libbpf recognizes both uses of arena and creates single `struct bpf_map *`instance in libbpf APIs.".arena.1" ELF section data is used as initial data image, which is exposedthrough skeleton and bpf_map__initial_value() to the user, if they need to tuneit before the load phase. During load phase, this initial image is copied overinto mmap()'ed region corresponding to arena, and discarded.Few small checks here and there had to be added to make sure thisapproach works with bpf_map__initial_value(), mostly due to hard-codedassumption that map->mmaped is set up with mmap() syscall and should bemunmap()'ed. For arena, .arena.1 can be (much) smaller than maximumarena size, so this smaller data size has to be tracked separately.Given it is enforced that there is only one arena for entire bpf_objectinstance, we just keep it in a separate field. This can be generalizedif necessary later.All global variables from ".arena.1" section are accessible from user spacevia skel->arena->name_of_var.For bss/data/rodata the skeleton/libbpf perform the following sequence:1. addr = mmap(MAP_ANONYMOUS)2. user space optionally modifies global vars3. map_fd = bpf_create_map()4. bpf_update_map_elem(map_fd, addr) // to store values into the kernel5. mmap(addr, MAP_FIXED, map_fd)after step 5 user spaces see the values it wrote at step 2 at the same addressesarena doesn't support update_map_elem. Hence skeleton/libbpf do:1. addr = malloc(sizeof SEC ".arena.1")2. user space optionally modifies global vars3. map_fd = bpf_create_map(MAP_TYPE_ARENA)4. real_addr = mmap(map->map_extra, MAP_SHARED | MAP_FIXED, map_fd)5. memcpy(real_addr, addr) // this will fault-in and allocate pagesAt the end look and feel of global data vs __arena global data is the same frombpf prog pov.Another complication is:struct { __uint(type, BPF_MAP_TYPE_ARENA);} arena SEC(".maps");int __arena foo;int bar; ptr1 = &foo; // relocation against ".arena.1" section ptr2 = &arena; // relocation against ".maps" section ptr3 = &bar; // relocation against ".bss" sectionFo the kernel ptr1 and ptr2 has point to the same arena's map_fdwhile ptr3 points to a different global array's map_fd.For the verifier:ptr1->type == unknown_scalarptr2->type == const_ptr_to_mapptr3->type == ptr_to_map_valueAfter verification, from JIT pov all 3 ptr-s are normal ld_imm64 insns.Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Acked-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20240308010812.89848-11-alexei.starovoitov@gmail.com List of files: /linux-6.15/tools/lib/bpf/libbpf.h

cac270ad - libbpf: Support BPF token path setting through LIBBPF_BPF_TOKEN_PATH envvar

Wed, 24 Jan 2024 02:21:25 +0000

libbpf: Support BPF token path setting through LIBBPF_BPF_TOKEN_PATH envvarTo allow external admin authority to override default BPF FS location(/sys/fs/bpf) for implicit BPF token creation, teach libbpf to recognizeLIBBPF_BPF_TOKEN_PATH envvar. If it is specified and user applicationdidn't explicitly specify bpf_token_path option, it will be treatedexactly like bpf_token_path option, overriding default /sys/fs/bpflocation and making BPF token mandatory.Suggested-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20240124022127.2379740-29-andrii@kernel.org List of files: /linux-6.15/tools/lib/bpf/libbpf.h

6b434b61 - libbpf: Wire up BPF token support at BPF object level

Wed, 24 Jan 2024 02:21:22 +0000

libbpf: Wire up BPF token support at BPF object levelAdd BPF token support to BPF object-level functionality.BPF token is supported by BPF object logic either as an explicitlyprovided BPF token from outside (through BPF FS path), or implicitly(unless prevented through bpf_object_open_opts).Implicit mode is assumed to be the most common one for user namespacedunprivileged workloads. The assumption is that privileged containermanager sets up default BPF FS mount point at /sys/fs/bpf with BPF tokendelegation options (delegate_{cmds,maps,progs,attachs} mount options).BPF object during loading will attempt to create BPF token from/sys/fs/bpf location, and pass it for all relevant operations(currently, map creation, BTF load, and program load).In this implicit mode, if BPF token creation fails due to whateverreason (BPF FS is not mounted, or kernel doesn't support BPF token,etc), this is not considered an error. BPF object loading sequence willproceed with no BPF token.In explicit BPF token mode, user provides explicitly custom BPF FS mountpoint path. In such case, BPF object will attempt to create BPF tokenfrom provided BPF FS location. If BPF token creation fails, that isconsidered a critical error and BPF object load fails with an error.Libbpf provides a way to disable implicit BPF token creation, if itcauses any troubles (BPF token is designed to be completely optional andshouldn't cause any problems even if provided, but in the world of BPFLSM, custom security logic can be installed that might change outcomedepending on the presence of BPF token). To disable libbpf's default BPFtoken creation behavior user should provide either invalid BPF token FD(negative), or empty bpf_token_path option.BPF token presence can influence libbpf's feature probing, so if BPFobject has associated BPF token, feature probing is instructed to useBPF object-specific feature detection cache and token FD.Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20240124022127.2379740-26-andrii@kernel.org List of files: /linux-6.15/tools/lib/bpf/libbpf.h

d17aff80 - Revert BPF token-related functionality

Tue, 19 Dec 2023 15:37:35 +0000

Revert BPF token-related functionalityThis patch includes the following revert (one conflicting BPF FSpatch and three token patch sets, represented by merge commits): - revert 0f5d5454c723 "Merge branch 'bpf-fs-mount-options-parsing-follow-ups'"; - revert 750e785796bb "bpf: Support uid and gid when mounting bpffs"; - revert 733763285acf "Merge branch 'bpf-token-support-in-libbpf-s-bpf-object'"; - revert c35919dcce28 "Merge branch 'bpf-token-and-bpf-fs-based-delegation'".Link: https://lore.kernel.org/bpf/CAHk-=wg7JuFYwGy=GOMbRCtOL+jwSQsdUaBsRWkDVYbxipbM5A@mail.gmail.comSigned-off-by: Andrii Nakryiko List of files: /linux-6.15/tools/lib/bpf/libbpf.h

ed54124b - libbpf: support BPF token path setting through LIBBPF_BPF_TOKEN_PATH envvar

Wed, 13 Dec 2023 19:08:41 +0000

libbpf: support BPF token path setting through LIBBPF_BPF_TOKEN_PATH envvarTo allow external admin authority to override default BPF FS location(/sys/fs/bpf) for implicit BPF token creation, teach libbpf to recognizeLIBBPF_BPF_TOKEN_PATH envvar. If it is specified and user applicationdidn't explicitly specify neither bpf_token_path nor bpf_token_fdoption, it will be treated exactly like bpf_token_path option,overriding default /sys/fs/bpf location and making BPF token mandatory.Suggested-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20231213190842.3844987-10-andrii@kernel.orgSigned-off-by: Alexei Starovoitov List of files: /linux-6.15/tools/lib/bpf/libbpf.h

1d0dd6ea - libbpf: wire up BPF token support at BPF object level

Wed, 13 Dec 2023 19:08:38 +0000

libbpf: wire up BPF token support at BPF object levelAdd BPF token support to BPF object-level functionality.BPF token is supported by BPF object logic either as an explicitlyprovided BPF token from outside (through BPF FS path or explicit BPFtoken FD), or implicitly (unless prevented throughbpf_object_open_opts).Implicit mode is assumed to be the most common one for user namespacedunprivileged workloads. The assumption is that privileged containermanager sets up default BPF FS mount point at /sys/fs/bpf with BPF tokendelegation options (delegate_{cmds,maps,progs,attachs} mount options).BPF object during loading will attempt to create BPF token from/sys/fs/bpf location, and pass it for all relevant operations(currently, map creation, BTF load, and program load).In this implicit mode, if BPF token creation fails due to whateverreason (BPF FS is not mounted, or kernel doesn't support BPF token,etc), this is not considered an error. BPF object loading sequence willproceed with no BPF token.In explicit BPF token mode, user provides explicitly either custom BPFFS mount point path or creates BPF token on their own and just passestoken FD directly. In such case, BPF object will either dup() token FD(to not require caller to hold onto it for entire duration of BPF objectlifetime) or will attempt to create BPF token from provided BPF FSlocation. If BPF token creation fails, that is considered a criticalerror and BPF object load fails with an error.Libbpf provides a way to disable implicit BPF token creation, if itcauses any troubles (BPF token is designed to be completely optional andshouldn't cause any problems even if provided, but in the world of BPFLSM, custom security logic can be installed that might change outcomedependin on the presence of BPF token). To disable libbpf's default BPFtoken creation behavior user should provide either invalid BPF token FD(negative), or empty bpf_token_path option.BPF token presence can influence libbpf's feature probing, so if BPFobject has associated BPF token, feature probing is instructed to useBPF object-specific feature detection cache and token FD.Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20231213190842.3844987-7-andrii@kernel.orgSigned-off-by: Alexei Starovoitov List of files: /linux-6.15/tools/lib/bpf/libbpf.h

05c31b4a - libbpf: Add link-based API for netkit

Tue, 24 Oct 2023 21:49:00 +0000

libbpf: Add link-based API for netkitThis adds bpf_program__attach_netkit() API to libbpf. Overall it is verysimilar to tcx. The API looks as following: LIBBPF_API struct bpf_link * bpf_program__attach_netkit(const struct bpf_program *prog, int ifindex, const struct bpf_netkit_opts *opts);The struct bpf_netkit_opts is done in similar way as struct bpf_tcx_optsfor supporting bpf_mprog control parameters. The attach location for theprimary and peer device is derived from the program section "netkit/primary"and "netkit/peer", respectively.Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20231024214904.29825-4-daniel@iogearbox.netSigned-off-by: Martin KaFai Lau List of files: /linux-6.15/tools/lib/bpf/libbpf.h

16058ff2 - libbpf: Add ring__consume

Mon, 25 Sep 2023 21:50:44 +0000

libbpf: Add ring__consumeAdd ring__consume to consume a single ringbuffer, analogous toring_buffer__consume.Signed-off-by: Martin Kelly Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230925215045.2375758-14-martin.kelly@crowdstrike.com List of files: /linux-6.15/tools/lib/bpf/libbpf.h