libbpf: Clarify raw-address single kprobe attach behavior

bpf_program__attach_kprobe_opts() documents single-kprobe attach
through func_name, with an optional offset. For the PMU-based path,
func_name = NULL with an absolute address in offset already works as
well, but that is not described in the API.

This commit clarifies this existing non-legacy behavior. For PMU-based
attach, callers can use func_name = NULL with an absolute address in
offset as the raw-address form. For legacy tracefs/debugfs kprobes,
reject this form explicitly.

Signed-off-by: Hoyeon Lee <hoyeon.lee@suse.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/bpf/20260401143116.185049-3-hoyeon.lee@suse.com

authored by

Hoyeon Lee and committed by

Andrii Nakryiko 2 months ago e1621c75 f547cf79

+34 -7

2 changed files

expand all

tools

lib

bpf

libbpf.c

libbpf.h

+8 -6

tools/lib/bpf/libbpf.c

··· 11843 11843 default: 11844 11844 return libbpf_err_ptr(-EINVAL); 11845 11845 } 11846 + if (!func_name && legacy) 11847 + return libbpf_err_ptr(-EOPNOTSUPP); 11846 11848 11847 11849 if (!legacy) { 11848 11850 pfd = perf_event_open_probe(false /* uprobe */, retprobe, ··· 11865 11863 } 11866 11864 if (pfd < 0) { 11867 11865 err = pfd; 11868 - pr_warn("prog '%s': failed to create %s '%s+0x%zx' perf event: %s\n", 11866 + pr_warn("prog '%s': failed to create %s '%s%s0x%zx' perf event: %s\n", 11869 11867 prog->name, retprobe ? "kretprobe" : "kprobe", 11870 - func_name, offset, 11871 - errstr(err)); 11868 + func_name ?: "", func_name ? "+" : "", 11869 + offset, errstr(err)); 11872 11870 goto err_out; 11873 11871 } 11874 11872 link = bpf_program__attach_perf_event_opts(prog, pfd, &pe_opts); 11875 11873 err = libbpf_get_error(link); 11876 11874 if (err) { 11877 11875 close(pfd); 11878 - pr_warn("prog '%s': failed to attach to %s '%s+0x%zx': %s\n", 11876 + pr_warn("prog '%s': failed to attach to %s '%s%s0x%zx': %s\n", 11879 11877 prog->name, retprobe ? "kretprobe" : "kprobe", 11880 - func_name, offset, 11881 - errstr(err)); 11878 + func_name ?: "", func_name ? "+" : "", 11879 + offset, errstr(err)); 11882 11880 goto err_clean_legacy; 11883 11881 } 11884 11882 if (legacy) {

+26 -1

tools/lib/bpf/libbpf.h

··· 557 557 size_t sz; 558 558 /* custom user-provided value fetchable through bpf_get_attach_cookie() */ 559 559 __u64 bpf_cookie; 560 - /* function's offset to install kprobe to */ 560 + /* function offset, or raw address if func_name == NULL */ 561 561 size_t offset; 562 562 /* kprobe is return probe */ 563 563 bool retprobe; ··· 565 565 enum probe_attach_mode attach_mode; 566 566 size_t :0; 567 567 }; 568 + 568 569 #define bpf_kprobe_opts__last_field attach_mode 569 570 571 + /** 572 + * @brief **bpf_program__attach_kprobe()** attaches a BPF program to a 573 + * kernel function entry or return. 574 + * 575 + * @param prog BPF program to attach 576 + * @param retprobe Attach to function return 577 + * @param func_name Name of the kernel function to attach to 578 + * @return Reference to the newly created BPF link; or NULL is returned on 579 + * error, error code is stored in errno 580 + */ 570 581 LIBBPF_API struct bpf_link * 571 582 bpf_program__attach_kprobe(const struct bpf_program *prog, bool retprobe, 572 583 const char *func_name); 584 + 585 + /** 586 + * @brief **bpf_program__attach_kprobe_opts()** is just like 587 + * bpf_program__attach_kprobe() except with an options struct 588 + * for various configurations. 589 + * 590 + * @param prog BPF program to attach 591 + * @param func_name Name of the kernel function to attach to. If NULL, 592 + * opts->offset is treated as a raw kernel address. Raw-address attach 593 + * is supported with PROBE_ATTACH_MODE_PERF and PROBE_ATTACH_MODE_LINK. 594 + * @param opts Options for altering program attachment 595 + * @return Reference to the newly created BPF link; or NULL is returned on 596 + * error, error code is stored in errno 597 + */ 573 598 LIBBPF_API struct bpf_link * 574 599 bpf_program__attach_kprobe_opts(const struct bpf_program *prog, 575 600 const char *func_name,

Configure Feed

Configure Feed