Skip to content

BPF Syscall BPF_BTF_LOAD command

v4.18

This command loads a BTF object into the kernel.

Return value

This command will return a file descriptor to the created BTF object on success (positive integer) or an error number (negative integer) if something went wrong.

Attributes

union bpf_attr {
    struct {
        __aligned_u64   btf;
        __aligned_u64   btf_log_buf;
        __u32           btf_size;
        __u32           btf_log_size;
        __u32           btf_log_level;
        __u32           btf_log_true_size;
        __u32           btf_flags;
        __s32           btf_token_fd;
    };
};

btf

v4.18

This field is a pointer to the BTF information to be loaded.

btf_log_buf

v4.18

This field is a pointer to a reserved piece of memory where the kernel will write the log to, if enabled.

btf_size

v4.18

This field is the size of the info indicated by btf.

btf_log_size

v4.18

This field is the size of the memory region indicated by btf_log_buf

btf_log_level

v4.18

The lower 2 bits of this value are the log level:

  • 0 = no log
  • 1 = basic logging (BPF_LOG_LEVEL1)
  • 2 = verbose logging (BPF_LOG_LEVEL2)

The remaining bits are flags:

  • 1 << 3 (BPF_LOG_STATS) If set the kernel will output statistics to the log. Flags can be used since v5.2

  • 1 << 4 (BPF_LOG_FIXED) since v6.4, the verifier log rotates instead of truncating. When log_size is exceeded. Setting this flag preserves the old behavior of truncating the log to log_size bytes.

btf_flags

v6.9

This field is a bitmask of flags that control the behavior of the BTF loading process. See the Flags section for more information.

btf_token_fd

v6.9

The file descriptor of a BPF token can be passed to this attribute. If the BPF token grants permission to create a BTF object, the kernel will allow the program to be loaded for a user without CAP_BPF.

Flags

BPF_F_TOKEN_FD

v6.9

This flag indicates that the btf_token_fd attribute is being used. If this flag is not set, the kernel will ignore the btf_token_fd attribute.