bpf

Partial in Antinomie 0.7.0 · Syscall list

Synopsis

long bpf(int cmd, union bpf_attr *attr, unsigned int size);

Number (x86-64)	321
ABI	common
Kernel entry point	sys_bpf

This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.

Description

Creates and controls eBPF programs and maps, selected by a command with a union of attributes.

Arguments

Name	Type	Meaning
cmd (arg0)	int	bpf command (BPF_MAP_CREATE, BPF_PROG_LOAD, …).
attr (arg1)	union bpf_attr *	Pointer to an attribute structure.
size (arg2)	unsigned int	Size of that attribute block.

Return value

On success: a command-specific value, often a file descriptor.

In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.

Common errors

Raw return	Name	Meaning
-13	EACCES	Permission denied.
-22	EINVAL	An argument is invalid.
-1	EPERM	The operation is not permitted for this process.

Man page

bpf(2) on man7.org

Captured by Antinomie

Coverage mark: Partial. Known commands decode their nested buffers. An unknown command records the raw attribute block with a bpf.unknown_selector gap, PROG_LOAD’s fd_array is address only (bpf.fd_array_unbounded), and pointers inside an info structure are not followed (bpf.info_nested).

Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).

Arguments

Argument	When	How	Recorded field key	Condition
cmd (arg0)	Entry	raw scalar word	args.0, args.cmd
attr (arg1)	Entry	the pointer itself, as a raw word	args.1, args.raw[1]
↳ pointee	Entry	union bpf_attr, length min(size (arg2), sizeof(bpf_attr)); a larger zero-filled tail up to one page goes to arg1.attr.extension; “invalid extent” above one page	arg1.attr	always
↳ pointee	Entry and exit	nested buffers reached through the attribute block: keys and values of map operations, instructions, license, function and line info of PROG_LOAD, BTF data, pathnames, tracepoint names, test-run data, info and query results, and the lengths the kernel rewrote	arg1.attr.<member>	inputs at entry; outputs at exit on success; verifier and BTF logs at exit whatever the result
size (arg2)	Entry	raw scalar word	args.2, args.size

Family notes

• Selector: cmd. The attribute block is recorded at entry as arg1.attr (up to the size given, with arg1.attr.extension for a larger zero-filled tail); nested buffers (keys, values, instructions, log buffers, BTF) are copied at entry or at exit according to the command.

Filter fields

• Result: ret, syscall.errno, syscall.success, syscall.duration_ns.
• Argument words: args.cmd (arg0), args.attr (arg1), args.size (arg2); args.0 to args.5 by position.
• Structure u64[] behind attr (arg1): args.attr.<member> for value.

See Syscall Trace filter for the full syntax.

Known gaps

• PROG_LOAD’s fd_array is recorded as an address only (bpf.fd_array_unbounded); pointers inside an OBJ_GET_INFO_BY_FD structure are not followed (bpf.info_nested); an unknown command records the raw attribute block with bpf.unknown_selector.
• See the coverage mark above for the code paths that record a gap.

For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.