[PATCH bpf-next 0/6] bpf: Add syscall common attrs support for xdp link_create

[PATCH bpf-next 0/6] bpf: Add syscall common attrs support for xdp link_create

[Leon Hwang]

I'm planning to add syscall common attrs support for LINK_CREATE cmd.

This is the first series for the plan, that adds syscall common attrs
support for xdp LINK_CREATE.

Thereafter, retire the tracepoint bpf_xdp_link_attach_failed, because
the underlying driver's error can be back-propagated to user space via
the syscall common attrs.

Leon Hwang (6):
  bpf: Add syscall common attrs support for link_create
  bpf: Add syscall common attrs support for xdp link_create
  bpf: Retire tracepoint bpf_xdp_link_attach_failed
  libbpf: Factor out __bpf_sys_fd helper
  libbpf: Add bpf_link_create_log API
  selftests/bpf: Add tests to verify link_create logs

 include/linux/netdevice.h                     |   3 +-
 include/trace/events/xdp.h                    |  17 ---
 kernel/bpf/syscall.c                          |  36 +++--
 net/core/dev.c                                |   7 +-
 tools/lib/bpf/bpf.c                           |  59 +++++---
 tools/lib/bpf/bpf.h                           |   5 +
 tools/lib/bpf/libbpf.map                      |   1 +
 .../selftests/bpf/prog_tests/xdp_attach.c     |  65 ---------
 .../selftests/bpf/prog_tests/xdp_link.c       | 132 ++++++++++++++++++
 .../bpf/progs/test_xdp_attach_fail.c          |  54 -------
 10 files changed, 215 insertions(+), 164 deletions(-)
 delete mode 100644 tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c

-- 
2.55.0

[PATCH bpf-next 1/6] bpf: Add syscall common attrs support for link_create

[Leon Hwang]

Similar to the syscall common attrs support for map_create [1], add the
syscall common attrs support for link_create.

Create and finalize the internal verifier log instance.

Then, report the error messages for invalid prog fd and invalid attach
type.

Links:
[1] https://lore.kernel.org/bpf/20260514004634.3DA09C19425@smtp.kernel.org/

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 kernel/bpf/syscall.c | 34 +++++++++++++++++++++++++++-------
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 0f27604a54aa..252b479937a4 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -5839,10 +5839,13 @@ static int bpf_map_do_batch(const union bpf_attr *attr,
 }
 
 #define BPF_LINK_CREATE_LAST_FIELD link_create.uprobe_multi.path_fd
-static int link_create(union bpf_attr *attr, bpfptr_t uattr)
+static int link_create(union bpf_attr *attr, bpfptr_t uattr, struct bpf_common_attr *attr_common,
+		       bpfptr_t uattr_common, u32 size_common)
 {
+	struct bpf_verifier_log *log;
+	struct bpf_log_attr attr_log;
 	struct bpf_prog *prog;
-	int ret;
+	int ret, err;
 
 	if (CHECK_ATTR(BPF_LINK_CREATE))
 		return -EINVAL;
@@ -5850,14 +5853,24 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr)
 	if (attr->link_create.attach_type == BPF_STRUCT_OPS)
 		return bpf_struct_ops_link_create(attr);
 
+	log = bpf_log_attr_create_vlog(&attr_log, attr_common, uattr_common, size_common);
+	if (IS_ERR(log))
+		return PTR_ERR(log);
+
 	prog = bpf_prog_get(attr->link_create.prog_fd);
-	if (IS_ERR(prog))
-		return PTR_ERR(prog);
+	if (IS_ERR(prog)) {
+		bpf_log(log, "Invalid prog_fd.\n");
+		ret = PTR_ERR(prog);
+		prog = NULL;
+		goto out;
+	}
 
 	ret = bpf_prog_attach_check_attach_type(prog,
 						attr->link_create.attach_type);
-	if (ret)
+	if (ret) {
+		bpf_log(log, "Invalid attach_type.\n");
 		goto out;
+	}
 
 	switch (prog->type) {
 	case BPF_PROG_TYPE_CGROUP_SKB:
@@ -5940,7 +5953,14 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr)
 	}
 
 out:
-	if (ret < 0)
+	/* preserve original error even if log finalization is successful */
+	err = bpf_log_attr_finalize(&attr_log, log);
+	if (err)
+		ret = err;
+
+	kfree(log);
+
+	if (ret < 0 && prog)
 		bpf_prog_put(prog);
 	return ret;
 }
@@ -6513,7 +6533,7 @@ static int __sys_bpf(enum bpf_cmd cmd, bpfptr_t uattr, unsigned int size,
 		err = bpf_map_do_batch(&attr, uattr.user, BPF_MAP_DELETE_BATCH);
 		break;
 	case BPF_LINK_CREATE:
-		err = link_create(&attr, uattr);
+		err = link_create(&attr, uattr, &attr_common, uattr_common, size_common);
 		break;
 	case BPF_LINK_UPDATE:
 		err = link_update(&attr);
-- 
2.55.0

[PATCH bpf-next 2/6] bpf: Add syscall common attrs support for xdp link_create

[Leon Hwang]

With the syscall common attrs support for link_create, add syscall common
attrs support for xdp link_create in order to report the invalid target
ifindex error and the underlying driver's error.

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 include/linux/netdevice.h | 3 ++-
 kernel/bpf/syscall.c      | 2 +-
 net/core/dev.c            | 6 +++++-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3cff2174dc03..4548b0fd824d 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -4417,7 +4417,8 @@ struct sk_buff *validate_xmit_skb_list(struct sk_buff *skb, struct net_device *d
 struct sk_buff *dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
 				    struct netdev_queue *txq, int *ret);
 
-int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog);
+int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog,
+			struct bpf_verifier_log *log);
 u8 dev_xdp_prog_count(struct net_device *dev);
 int netif_xdp_propagate(struct net_device *dev, struct netdev_bpf *bpf);
 int dev_xdp_propagate(struct net_device *dev, struct netdev_bpf *bpf);
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 252b479937a4..e96d5f09486f 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -5921,7 +5921,7 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr, struct bpf_common_a
 		break;
 #ifdef CONFIG_NET
 	case BPF_PROG_TYPE_XDP:
-		ret = bpf_xdp_link_attach(attr, prog);
+		ret = bpf_xdp_link_attach(attr, prog, log);
 		break;
 	case BPF_PROG_TYPE_SCHED_CLS:
 		if (attr->link_create.attach_type == BPF_TCX_INGRESS ||
diff --git a/net/core/dev.c b/net/core/dev.c
index 18dc88990510..fdc1de21f358 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -97,6 +97,7 @@
 #include <linux/kthread.h>
 #include <linux/bpf.h>
 #include <linux/bpf_trace.h>
+#include <linux/bpf_verifier.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <net/busy_poll.h>
@@ -10771,7 +10772,8 @@ static const struct bpf_link_ops bpf_xdp_link_lops = {
 	.update_prog = bpf_xdp_link_update,
 };
 
-int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
+int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog,
+			struct bpf_verifier_log *log)
 {
 	struct net *net = current->nsproxy->net_ns;
 	struct bpf_link_primer link_primer;
@@ -10784,6 +10786,7 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
 	dev = dev_get_by_index(net, attr->link_create.target_ifindex);
 	if (!dev) {
 		rtnl_unlock();
+		bpf_log(log, "Invalid target_ifindex.\n");
 		return -EINVAL;
 	}
 
@@ -10812,6 +10815,7 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
 	if (err) {
 		link->dev = NULL;
 		bpf_link_cleanup(&link_primer);
+		bpf_log(log, extack._msg);
 		trace_bpf_xdp_link_attach_failed(extack._msg);
 		goto out_put_dev;
 	}
-- 
2.55.0

[PATCH bpf-next 3/6] bpf: Retire tracepoint bpf_xdp_link_attach_failed

[Leon Hwang]

In the previous patch, it has a proper way to back-propagate the
underlying driver error message to user space via the BPF syscall common
attributes.

The tracepoint bpf_xdp_link_attach_failed seems redundant to report the
error message. And, the tracepoint doesn't report the ifindex alongside
the error message [1].

So, retire the tracepoint bpf_xdp_link_attach_failed and its selftest.

According to the tracepoint change discussion [2], please revert this
patch if users complain about the disappeared tracepoint
bpf_xdp_link_attach_failed in the future.

Links:
[1] https://lore.kernel.org/bpf/CAFk-A4mE9Jweo2hfX7y_85xbPyt0FqpMT1EvqX1OcYZ=LTLgRA@mail.gmail.com/
[2] https://lore.kernel.org/linux-mm/CY8PR11MB7134346A3E4BB28ECA28D6E989132@CY8PR11MB7134.namprd11.prod.outlook.com/

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 include/trace/events/xdp.h                    | 17 -----
 net/core/dev.c                                |  1 -
 .../selftests/bpf/prog_tests/xdp_attach.c     | 65 -------------------
 .../bpf/progs/test_xdp_attach_fail.c          | 54 ---------------
 4 files changed, 137 deletions(-)
 delete mode 100644 tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c

diff --git a/include/trace/events/xdp.h b/include/trace/events/xdp.h
index 18c0ac514fcb..f1d4d0702884 100644
--- a/include/trace/events/xdp.h
+++ b/include/trace/events/xdp.h
@@ -362,23 +362,6 @@ TRACE_EVENT(mem_connect,
 	)
 );
 
-TRACE_EVENT(bpf_xdp_link_attach_failed,
-
-	TP_PROTO(const char *msg),
-
-	TP_ARGS(msg),
-
-	TP_STRUCT__entry(
-		__string(msg, msg)
-	),
-
-	TP_fast_assign(
-		__assign_str(msg);
-	),
-
-	TP_printk("errmsg=%s", __get_str(msg))
-);
-
 #endif /* _TRACE_XDP_H */
 
 #include <trace/define_trace.h>
diff --git a/net/core/dev.c b/net/core/dev.c
index fdc1de21f358..266b510abd53 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -10816,7 +10816,6 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog,
 		link->dev = NULL;
 		bpf_link_cleanup(&link_primer);
 		bpf_log(log, extack._msg);
-		trace_bpf_xdp_link_attach_failed(extack._msg);
 		goto out_put_dev;
 	}
 
diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_attach.c b/tools/testing/selftests/bpf/prog_tests/xdp_attach.c
index e6bcb6051402..fa3cac5488f5 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_attach.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_attach.c
@@ -1,6 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <test_progs.h>
-#include "test_xdp_attach_fail.skel.h"
 
 #define IFINDEX_LO 1
 #define XDP_FLAGS_REPLACE		(1U << 4)
@@ -86,74 +85,10 @@ static void test_xdp_attach(const char *file)
 	bpf_object__close(obj1);
 }
 
-#define ERRMSG_LEN 64
-
-struct xdp_errmsg {
-	char msg[ERRMSG_LEN];
-};
-
-static void on_xdp_errmsg(void *ctx, int cpu, void *data, __u32 size)
-{
-	struct xdp_errmsg *ctx_errmg = ctx, *tp_errmsg = data;
-
-	memcpy(&ctx_errmg->msg, &tp_errmsg->msg, ERRMSG_LEN);
-}
-
-static const char tgt_errmsg[] = "Invalid XDP flags for BPF link attachment";
-
-static void test_xdp_attach_fail(const char *file)
-{
-	struct test_xdp_attach_fail *skel = NULL;
-	struct xdp_errmsg errmsg = {};
-	struct perf_buffer *pb = NULL;
-	struct bpf_object *obj = NULL;
-	int err, fd_xdp;
-
-	LIBBPF_OPTS(bpf_link_create_opts, opts);
-
-	skel = test_xdp_attach_fail__open_and_load();
-	if (!ASSERT_OK_PTR(skel, "test_xdp_attach_fail__open_and_load"))
-		goto out_close;
-
-	err = test_xdp_attach_fail__attach(skel);
-	if (!ASSERT_EQ(err, 0, "test_xdp_attach_fail__attach"))
-		goto out_close;
-
-	/* set up perf buffer */
-	pb = perf_buffer__new(bpf_map__fd(skel->maps.xdp_errmsg_pb), 1,
-			      on_xdp_errmsg, NULL, &errmsg, NULL);
-	if (!ASSERT_OK_PTR(pb, "perf_buffer__new"))
-		goto out_close;
-
-	err = bpf_prog_test_load(file, BPF_PROG_TYPE_XDP, &obj, &fd_xdp);
-	if (!ASSERT_EQ(err, 0, "bpf_prog_test_load"))
-		goto out_close;
-
-	opts.flags = 0xFF; // invalid flags to fail to attach XDP prog
-	err = bpf_link_create(fd_xdp, IFINDEX_LO, BPF_XDP, &opts);
-	if (!ASSERT_EQ(err, -EINVAL, "bpf_link_create"))
-		goto out_close;
-
-	/* read perf buffer */
-	err = perf_buffer__poll(pb, 100);
-	if (!ASSERT_GT(err, -1, "perf_buffer__poll"))
-		goto out_close;
-
-	ASSERT_STRNEQ((const char *) errmsg.msg, tgt_errmsg,
-		      42 /* strlen(tgt_errmsg) */, "check error message");
-
-out_close:
-	perf_buffer__free(pb);
-	bpf_object__close(obj);
-	test_xdp_attach_fail__destroy(skel);
-}
-
 void serial_test_xdp_attach(void)
 {
 	if (test__start_subtest("xdp_attach"))
 		test_xdp_attach("./test_xdp.bpf.o");
 	if (test__start_subtest("xdp_attach_dynptr"))
 		test_xdp_attach("./test_xdp_dynptr.bpf.o");
-	if (test__start_subtest("xdp_attach_failed"))
-		test_xdp_attach_fail("./xdp_dummy.bpf.o");
 }
diff --git a/tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c b/tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c
deleted file mode 100644
index 2ff1b596e87e..000000000000
--- a/tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c
+++ /dev/null
@@ -1,54 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/* Copyright Leon Hwang */
-
-#include <linux/bpf.h>
-#include <bpf/bpf_helpers.h>
-
-#define ERRMSG_LEN 64
-
-struct xdp_errmsg {
-	char msg[ERRMSG_LEN];
-};
-
-struct {
-	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
-	__type(key, int);
-	__type(value, int);
-} xdp_errmsg_pb SEC(".maps");
-
-struct xdp_attach_error_ctx {
-	unsigned long unused;
-
-	/*
-	 * bpf does not support tracepoint __data_loc directly.
-	 *
-	 * Actually, this field is a 32 bit integer whose value encodes
-	 * information on where to find the actual data. The first 2 bytes is
-	 * the size of the data. The last 2 bytes is the offset from the start
-	 * of the tracepoint struct where the data begins.
-	 * -- https://github.com/iovisor/bpftrace/pull/1542
-	 */
-	__u32 msg; // __data_loc char[] msg;
-};
-
-/*
- * Catch the error message at the tracepoint.
- */
-
-SEC("tp/xdp/bpf_xdp_link_attach_failed")
-int tp__xdp__bpf_xdp_link_attach_failed(struct xdp_attach_error_ctx *ctx)
-{
-	char *msg = (void *)(__u64) ((void *) ctx + (__u16) ctx->msg);
-	struct xdp_errmsg errmsg = {};
-
-	bpf_probe_read_kernel_str(&errmsg.msg, ERRMSG_LEN, msg);
-	bpf_perf_event_output(ctx, &xdp_errmsg_pb, BPF_F_CURRENT_CPU, &errmsg,
-			      ERRMSG_LEN);
-	return 0;
-}
-
-/*
- * Reuse the XDP program in xdp_dummy.c.
- */
-
-char LICENSE[] SEC("license") = "GPL";
-- 
2.55.0

[PATCH bpf-next 4/6] libbpf: Factor out __bpf_sys_fd helper

[Leon Hwang]

In the next patch, it also needs to use the extended BPF syscall to
receive the reported log.

So, factor out __bpf_sys_fd helper.

No functional changes intended.

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 tools/lib/bpf/bpf.c | 35 ++++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index b49822d212ae..17e73e443bc7 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -203,6 +203,27 @@ int bump_rlimit_memlock(void)
 	return 0;
 }
 
+static int __sys_bpf_fd(union bpf_attr *attr, const size_t attr_sz, enum bpf_cmd cmd,
+			struct bpf_log_opts *log_opts)
+{
+	const size_t attr_common_sz = sizeof(struct bpf_common_attr);
+	struct bpf_common_attr attr_common;
+	int fd;
+
+	if (log_opts && feat_supported(NULL, FEAT_BPF_SYSCALL_COMMON_ATTRS)) {
+		memset(&attr_common, 0, attr_common_sz);
+		attr_common.log_buf = ptr_to_u64(OPTS_GET(log_opts, buf, NULL));
+		attr_common.log_size = OPTS_GET(log_opts, size, 0);
+		attr_common.log_level = OPTS_GET(log_opts, level, 0);
+		fd = sys_bpf_ext_fd(cmd, attr, attr_sz, &attr_common, attr_common_sz);
+		OPTS_SET(log_opts, true_size, attr_common.log_true_size);
+	} else {
+		fd = sys_bpf_fd(cmd, attr, attr_sz);
+		OPTS_SET(log_opts, true_size, 0);
+	}
+	return fd;
+}
+
 int bpf_map_create(enum bpf_map_type map_type,
 		   const char *map_name,
 		   __u32 key_size,
@@ -211,8 +232,6 @@ int bpf_map_create(enum bpf_map_type map_type,
 		   const struct bpf_map_create_opts *opts)
 {
 	const size_t attr_sz = offsetofend(union bpf_attr, excl_prog_hash_size);
-	const size_t attr_common_sz = sizeof(struct bpf_common_attr);
-	struct bpf_common_attr attr_common;
 	struct bpf_log_opts *log_opts;
 	union bpf_attr attr;
 	int fd;
@@ -251,17 +270,7 @@ int bpf_map_create(enum bpf_map_type map_type,
 	if (!OPTS_VALID(log_opts, bpf_log_opts))
 		return libbpf_err(-EINVAL);
 
-	if (log_opts && feat_supported(NULL, FEAT_BPF_SYSCALL_COMMON_ATTRS)) {
-		memset(&attr_common, 0, attr_common_sz);
-		attr_common.log_buf = ptr_to_u64(OPTS_GET(log_opts, buf, NULL));
-		attr_common.log_size = OPTS_GET(log_opts, size, 0);
-		attr_common.log_level = OPTS_GET(log_opts, level, 0);
-		fd = sys_bpf_ext_fd(BPF_MAP_CREATE, &attr, attr_sz, &attr_common, attr_common_sz);
-		OPTS_SET(log_opts, true_size, attr_common.log_true_size);
-	} else {
-		fd = sys_bpf_fd(BPF_MAP_CREATE, &attr, attr_sz);
-		OPTS_SET(log_opts, true_size, 0);
-	}
+	fd = __sys_bpf_fd(&attr, attr_sz, BPF_MAP_CREATE, log_opts);
 	return libbpf_err_errno(fd);
 }
 
-- 
2.55.0

[PATCH bpf-next 5/6] libbpf: Add bpf_link_create_log API

[Leon Hwang]

Add a new API to accept the log opts, instead of extending the existing
struct bpf_link_create_opts.

In the struct bpf_link_create_opts, it seems not proper to append a
tailing common log field prior to those variant length fields.

Add a new API to avoid breaking the struct bpf_link_create_opts.

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 tools/lib/bpf/bpf.c      | 24 ++++++++++++++++++++----
 tools/lib/bpf/bpf.h      |  5 +++++
 tools/lib/bpf/libbpf.map |  1 +
 3 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index 17e73e443bc7..eb127d71f3c8 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -788,9 +788,10 @@ int bpf_prog_detach2(int prog_fd, int target_fd, enum bpf_attach_type type)
 	return bpf_prog_detach_opts(prog_fd, target_fd, type, NULL);
 }
 
-int bpf_link_create(int prog_fd, int target_fd,
-		    enum bpf_attach_type attach_type,
-		    const struct bpf_link_create_opts *opts)
+static int __bpf_link_create(int prog_fd, int target_fd,
+			     enum bpf_attach_type attach_type,
+			     const struct bpf_link_create_opts *opts,
+			     struct bpf_log_opts *log_opts)
 {
 	const size_t attr_sz = offsetofend(union bpf_attr, link_create);
 	__u32 target_btf_id, iter_info_len, relative_id;
@@ -965,7 +966,7 @@ int bpf_link_create(int prog_fd, int target_fd,
 		break;
 	}
 proceed:
-	fd = sys_bpf_fd(BPF_LINK_CREATE, &attr, attr_sz);
+	fd = __sys_bpf_fd(&attr, attr_sz, BPF_LINK_CREATE, log_opts);
 	if (fd >= 0)
 		return fd;
 	/* we'll get EINVAL if LINK_CREATE doesn't support attaching fentry
@@ -999,6 +1000,21 @@ int bpf_link_create(int prog_fd, int target_fd,
 	}
 }
 
+int bpf_link_create(int prog_fd, int target_fd,
+		    enum bpf_attach_type attach_type,
+		    const struct bpf_link_create_opts *opts)
+{
+	return __bpf_link_create(prog_fd, target_fd, attach_type, opts, NULL);
+}
+
+int bpf_link_create_log(int prog_fd, int target_fd,
+			enum bpf_attach_type attach_type,
+			const struct bpf_link_create_opts *opts,
+			struct bpf_log_opts *log_opts)
+{
+	return __bpf_link_create(prog_fd, target_fd, attach_type, opts, log_opts);
+}
+
 int bpf_link_detach(int link_fd)
 {
 	const size_t attr_sz = offsetofend(union bpf_attr, link_detach);
diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
index 826d9cc9ab65..dedaf8086902 100644
--- a/tools/lib/bpf/bpf.h
+++ b/tools/lib/bpf/bpf.h
@@ -484,6 +484,11 @@ LIBBPF_API int bpf_link_create(int prog_fd, int target_fd,
 			       enum bpf_attach_type attach_type,
 			       const struct bpf_link_create_opts *opts);
 
+LIBBPF_API int bpf_link_create_log(int prog_fd, int target_fd,
+				   enum bpf_attach_type attach_type,
+				   const struct bpf_link_create_opts *opts,
+				   struct bpf_log_opts *log_opts);
+
 LIBBPF_API int bpf_link_detach(int link_fd);
 
 struct bpf_link_update_opts {
diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map
index eeba4072a5da..990e2f926ecc 100644
--- a/tools/lib/bpf/libbpf.map
+++ b/tools/lib/bpf/libbpf.map
@@ -458,6 +458,7 @@ LIBBPF_1.7.0 {
 
 LIBBPF_1.8.0 {
 	global:
+		bpf_link_create_log;
 		bpf_map__attach_cgroup_opts;
 		bpf_prog_stream_open;
 		bpf_program__add_flags;
-- 
2.55.0

[PATCH bpf-next 6/6] selftests/bpf: Add tests to verify link_create logs

[Leon Hwang]

Add tests to verify the new logs in link_create and xdp link_create,
including a log reported via extack when fail to create an xdp link.

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 .../selftests/bpf/prog_tests/xdp_link.c       | 132 ++++++++++++++++++
 1 file changed, 132 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_link.c b/tools/testing/selftests/bpf/prog_tests/xdp_link.c
index e7e9f3c22edf..e2b2ec3cc4e3 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_link.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_link.c
@@ -150,3 +150,135 @@ void serial_test_xdp_link(void)
 	test_xdp_link__destroy(skel1);
 	test_xdp_link__destroy(skel2);
 }
+
+static void test_link_create_invalid_prog_fd(void)
+{
+	const char *msg = "Invalid prog_fd.\n";
+	char log_buf[128] = {};
+	int fd;
+	LIBBPF_OPTS(bpf_log_opts, log_opts,
+		    .buf = log_buf,
+		    .size = sizeof(log_buf),
+		    .level = 1,
+	);
+
+	fd = bpf_link_create_log(-1, IFINDEX_LO, BPF_XDP, NULL, &log_opts);
+	if (!ASSERT_LT(fd, 0, "bpf_link_create_log")) {
+		close(fd);
+		return;
+	}
+
+	ASSERT_EQ(fd, -EBADF, "fd");
+	ASSERT_STREQ(log_buf, msg, "log_buf");
+	ASSERT_EQ(log_opts.true_size, strlen(msg) + 1, "log_size");
+}
+
+static void test_link_create_invalid_attach_type(void)
+{
+	const char *msg = "Invalid attach_type.\n";
+	struct test_xdp_link *skel;
+	char log_buf[128] = {};
+	int fd;
+	LIBBPF_OPTS(bpf_log_opts, log_opts,
+		    .buf = log_buf,
+		    .size = sizeof(log_buf),
+		    .level = 1,
+	);
+
+	skel = test_xdp_link__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "test_xdp_link__open_and_load"))
+		return;
+
+	log_opts.true_size = 0;
+	fd = bpf_link_create_log(bpf_program__fd(skel->progs.xdp_handler), IFINDEX_LO,
+				 BPF_CGROUP_INET_INGRESS, NULL, &log_opts);
+	if (!ASSERT_LT(fd, 0, "bpf_link_create_log")) {
+		close(fd);
+		goto cleanup;
+	}
+
+	ASSERT_EQ(fd, -EINVAL, "fd");
+	ASSERT_STREQ(log_buf, msg, "log_buf");
+	ASSERT_EQ(log_opts.true_size, strlen(msg) + 1, "log_size");
+
+cleanup:
+	test_xdp_link__destroy(skel);
+}
+
+static void test_link_create_xdp_invalid_target_ifindex(void)
+{
+	const char *msg = "Invalid target_ifindex.\n";
+	struct test_xdp_link *skel;
+	char log_buf[128] = {};
+	int fd;
+	LIBBPF_OPTS(bpf_log_opts, log_opts,
+		    .buf = log_buf,
+		    .size = sizeof(log_buf),
+		    .level = 1,
+	);
+
+	skel = test_xdp_link__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "test_xdp_link__open_and_load"))
+		return;
+
+	/* Interface indices are positive; zero cannot identify a device. */
+	fd = bpf_link_create_log(bpf_program__fd(skel->progs.xdp_handler), 0,
+				 BPF_XDP, NULL, &log_opts);
+	if (!ASSERT_LT(fd, 0, "bpf_link_create_log")) {
+		close(fd);
+		goto cleanup;
+	}
+
+	ASSERT_EQ(fd, -EINVAL, "fd");
+	ASSERT_STREQ(log_buf, msg, "log_buf");
+	ASSERT_EQ(log_opts.true_size, strlen(msg) + 1, "log_size");
+
+cleanup:
+	test_xdp_link__destroy(skel);
+}
+
+static void test_link_create_xdp_extack(void)
+{
+	const char *msg = "Invalid XDP flags for BPF link attachment";
+	struct test_xdp_link *skel;
+	char log_buf[128] = {};
+	int fd;
+	LIBBPF_OPTS(bpf_link_create_opts, opts,
+		    .flags = XDP_FLAGS_REPLACE,
+	);
+	LIBBPF_OPTS(bpf_log_opts, log_opts,
+		    .buf = log_buf,
+		    .size = sizeof(log_buf),
+		    .level = 1,
+	);
+
+	skel = test_xdp_link__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "test_xdp_link__open_and_load"))
+		return;
+
+	fd = bpf_link_create_log(bpf_program__fd(skel->progs.xdp_handler), IFINDEX_LO,
+				 BPF_XDP, &opts, &log_opts);
+	if (!ASSERT_LT(fd, 0, "bpf_link_create_log")) {
+		close(fd);
+		goto cleanup;
+	}
+
+	ASSERT_EQ(fd, -EINVAL, "fd");
+	ASSERT_STREQ(log_buf, msg, "log_buf");
+	ASSERT_EQ(log_opts.true_size, strlen(msg) + 1, "log_size");
+
+cleanup:
+	test_xdp_link__destroy(skel);
+}
+
+void test_link_create_log(void)
+{
+	if (test__start_subtest("invalid_prog_fd"))
+		test_link_create_invalid_prog_fd();
+	if (test__start_subtest("invalid_attach_type"))
+		test_link_create_invalid_attach_type();
+	if (test__start_subtest("xdp/invalid_target_ifindex"))
+		test_link_create_xdp_invalid_target_ifindex();
+	if (test__start_subtest("xdp/extack"))
+		test_link_create_xdp_extack();
+}
-- 
2.55.0

Re: [PATCH bpf-next 4/6] libbpf: Factor out __bpf_sys_fd helper

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1142 bytes --]

> libbpf: Factor out __bpf_sys_fd helper

TL;DR: Commit message nit only: subject and body call the new helper
__bpf_sys_fd, but the code names it __sys_bpf_fd. Should the message match?

> libbpf: Factor out __bpf_sys_fd helper
>
> In the next patch, it also needs to use the extended BPF syscall to
> receive the reported log.
>
> So, factor out __bpf_sys_fd helper.
>
> No functional changes intended.
>
> Signed-off-by: Leon Hwang <leon.hwang@linux.dev>

This isn't a bug, but the subject and body name the helper __bpf_sys_fd,
while the function the patch adds is:

+static int __sys_bpf_fd(union bpf_attr *attr, const size_t attr_sz, enum bpf_cmd cmd,
+			struct bpf_log_opts *log_opts)

which follows the existing sys_bpf(), sys_bpf_fd() and sys_bpf_ext_fd()
naming.

Should the subject and body say __sys_bpf_fd instead, so that searching the
log for the real function name finds this commit?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/39042048581

Re: [PATCH bpf-next 6/6] selftests/bpf: Add tests to verify link_create logs

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 2811 bytes --]

> selftests/bpf: Add tests to verify link_create logs

TL;DR: Nits only, in the new link_create log selftests in xdp_link.c: the four
subtests repeat the same setup and assertions and could share a helper, and
one has a redundant true_size = 0.

> diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_link.c b/tools/testing/selftests/bpf/prog_tests/xdp_link.c
> --- a/tools/testing/selftests/bpf/prog_tests/xdp_link.c
> +++ b/tools/testing/selftests/bpf/prog_tests/xdp_link.c

[ ... ]

> @@ -150,3 +150,135 @@ void serial_test_xdp_link(void)
>  	test_xdp_link__destroy(skel1);
>  	test_xdp_link__destroy(skel2);
>  }
> +
> +static void test_link_create_invalid_prog_fd(void)
> +{
> +	const char *msg = "Invalid prog_fd.\n";
> +	char log_buf[128] = {};
> +	int fd;
> +	LIBBPF_OPTS(bpf_log_opts, log_opts,
> +		    .buf = log_buf,
> +		    .size = sizeof(log_buf),
> +		    .level = 1,
> +	);
> +
> +	fd = bpf_link_create_log(-1, IFINDEX_LO, BPF_XDP, NULL, &log_opts);
> +	if (!ASSERT_LT(fd, 0, "bpf_link_create_log")) {
> +		close(fd);
> +		return;
> +	}
> +
> +	ASSERT_EQ(fd, -EBADF, "fd");
> +	ASSERT_STREQ(log_buf, msg, "log_buf");
> +	ASSERT_EQ(log_opts.true_size, strlen(msg) + 1, "log_size");
> +}

This isn't a bug, but the four new test_link_create_*() functions repeat the
same log_buf and LIBBPF_OPTS(bpf_log_opts, ...) setup, and the same trailing
ASSERT_EQ(fd, ...) / ASSERT_STREQ(log_buf, msg) /
ASSERT_EQ(log_opts.true_size, strlen(msg) + 1) sequence.  They differ only in
prog fd, target, attach type, expected errno and message.

This looks close to test_map_create() in map_init.c.  Could the four
link_create log tests share a small helper that takes the prog fd, target,
attach type, opts, expected errno and message?

> +
> +static void test_link_create_invalid_attach_type(void)
> +{
> +	const char *msg = "Invalid attach_type.\n";
> +	struct test_xdp_link *skel;
> +	char log_buf[128] = {};
> +	int fd;
> +	LIBBPF_OPTS(bpf_log_opts, log_opts,
> +		    .buf = log_buf,
> +		    .size = sizeof(log_buf),
> +		    .level = 1,
> +	);
> +
> +	skel = test_xdp_link__open_and_load();
> +	if (!ASSERT_OK_PTR(skel, "test_xdp_link__open_and_load"))
> +		return;
> +
> +	log_opts.true_size = 0;

This isn't a bug, but is the log_opts.true_size = 0; line needed here?
LIBBPF_OPTS() already zero-initializes log_opts, true_size is only written by
libbpf after the syscall, and the other three tests omit this line.

> +	fd = bpf_link_create_log(bpf_program__fd(skel->progs.xdp_handler), IFINDEX_LO,
> +				 BPF_CGROUP_INET_INGRESS, NULL, &log_opts);

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/39042048581

Re: [PATCH bpf-next 5/6] libbpf: Add bpf_link_create_log API

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1305 bytes --]

> libbpf: Add bpf_link_create_log API

TL;DR: Commit message only: the rationale for adding bpf_link_create_log()
instead of extending bpf_link_create_opts is vague ("it seems not proper") and
one sentence is self-contradictory; no code issues raised.

> libbpf: Add bpf_link_create_log API
>
> Add a new API to accept the log opts, instead of extending the existing
> struct bpf_link_create_opts.
>
> In the struct bpf_link_create_opts, it seems not proper to append a
> tailing common log field prior to those variant length fields.
>
> Add a new API to avoid breaking the struct bpf_link_create_opts.
>
> Signed-off-by: Leon Hwang <leon.hwang@linux.dev>

This isn't a bug, but could the changelog say more concretely why a log
field cannot be added to struct bpf_link_create_opts (for example, the
trailing union growing for future link types), rather than "it seems not
proper"?

The sentence "append a tailing common log field prior to those variant
length fields" also reads as self-contradictory, since "append" and "prior
to" point in opposite directions.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/39042048581

Re: [PATCH bpf-next 2/6] bpf: Add syscall common attrs support for xdp link_create

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 3827 bytes --]

> bpf: Add syscall common attrs support for xdp link_create

TL;DR:
- bpf_log(log, extack._msg) in bpf_xdp_link_attach() may dereference NULL when
  no extack message is set
- bpf_log() may be an undefined reference when CONFIG_BPF_SYSCALL=n

> diff --git a/net/core/dev.c b/net/core/dev.c
> index 18dc88990510..fdc1de21f358 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c

[ ... ]

> @@ -10784,6 +10786,7 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
>  	dev = dev_get_by_index(net, attr->link_create.target_ifindex);
>  	if (!dev) {
>  		rtnl_unlock();
> +		bpf_log(log, "Invalid target_ifindex.\n");
>  		return -EINVAL;
>  	}
>

Can this fail to link when CONFIG_BPF_SYSCALL is not set?

bpf_xdp_link_attach() is built whenever CONFIG_NET=y, but bpf_log() lives in
kernel/bpf/log.c, which kernel/bpf/Makefile only builds under
CONFIG_BPF_SYSCALL:

  obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o ... log.o ...

include/linux/bpf_verifier.h declares bpf_log() with no stub for the
!CONFIG_BPF_SYSCALL case, and CONFIG_NET only does "select BPF".  A config
with CONFIG_NET=y and CONFIG_BPF_SYSCALL=n looks like it would end with an
undefined reference to bpf_log from both of the new calls in this function.

include/linux/bpf.h provides static inline stubs for bpf_link_init(),
bpf_link_prime(), bpf_link_settle() and bpf_link_cleanup() so that this
function builds without the bpf() syscall.

Should bpf_log() get a similar stub, or should the calls be guarded with
IS_ENABLED(CONFIG_BPF_SYSCALL)?  None of the later patches in the series add
a stub or change the Makefile.

[ ... ]

> @@ -10812,6 +10815,7 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
>  	if (err) {
>  		link->dev = NULL;
>  		bpf_link_cleanup(&link_primer);
> +		bpf_log(log, extack._msg);
>  		trace_bpf_xdp_link_attach_failed(extack._msg);
>  		goto out_put_dev;
>  	}

Can extack._msg be NULL here?

extack is zero-initialised (struct netlink_ext_ack extack = {};), and _msg
stays NULL whenever dev_xdp_attach_link() fails without anyone calling
NL_SET_ERR_MSG().  Many ndo_bpf implementations do exactly that.  For
example, ixgbe_xdp() -> ixgbe_xdp_setup() has several -EINVAL and -ENOMEM
returns that don't set an extack message, and mlx5e_xdp_set() ->
mlx5e_xdp_allowed() returns -EINVAL with only a netdev_warn().

If the caller passed BPF_COMMON_ATTRS with log_level != 0
(bpf_verifier_log_attr_valid() accepts log_level=1 even with a NULL log_buf
and a log_size of 0), bpf_verifier_log_needed() is true and the call chain
becomes:

  bpf_log(log, NULL)
    -> bpf_verifier_vlog(log, NULL, args)
      -> vscnprintf(log->kbuf, BPF_VERIFIER_TMP_LOG_SIZE, NULL, args)
        -> vsnprintf()    /* while (*fmt.str) with fmt.str == NULL */

which dereferences NULL.  The tracepoint on the next line copes with NULL
because __assign_str() substitutes a placeholder string, and the netlink ack
path also checks extack->_msg, so this new bpf_log() call looks like the only
consumer without a NULL check.

Passing the message as the format string also means a '%' in an extack
message would be interpreted as a conversion, and unlike the other bpf_log()
messages in link_create(), this one has no trailing newline.  Would
something like this be better?

  if (extack._msg)
          bpf_log(log, "%s\n", extack._msg);

This isn't fixed later in the series.  Commit 2a63a314e533 ("bpf: Retire
tracepoint bpf_xdp_link_attach_failed") removes the tracepoint but keeps
bpf_log(log, extack._msg), so no NULL-safe consumer is left on this path.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/39042048581