aboutsummaryrefslogtreecommitdiff
path: root/sys/linux/bpf.txt
diff options
context:
space:
mode:
Diffstat (limited to 'sys/linux/bpf.txt')
-rw-r--r--sys/linux/bpf.txt339
1 files changed, 34 insertions, 305 deletions
diff --git a/sys/linux/bpf.txt b/sys/linux/bpf.txt
index ead408d1d..3a7ef85a4 100644
--- a/sys/linux/bpf.txt
+++ b/sys/linux/bpf.txt
@@ -5,25 +5,12 @@
# net.core.bpf_jit_enable = { 0, 1, 2 }
# net.core.bpf_jit_harden = { 0, 1, 2 }
-include <uapi/linux/bpf.h>
-include <uapi/linux/btf.h>
+include <linux/bpf.h>
resource fd_bpf_map[fd]: BPF_PSEUDO_MAP_FD
resource fd_bpf_prog[fd]
-resource fd_rawtp[fd_perf_base]
-resource fd_btf[fd]
resource bpf_prog_id[int32]: 0, -1
resource bpf_map_id[int32]: 0, -1
-resource bpf_btf_id[int32]: 0, -1
-
-# NEED: this is a random index in btf_header:types. We can't express this, so we just use a small index.
-type btf_type_id int32[1:5]
-# NEED: opt modified on typedefs, this could be btf_type_id[opt]
-type btf_opt_type_id int32[0:5]
-
-# NEED: offset in bpf_btf_program:strings. We can't express this, so we just use a small index.
-type btf_name_off int32[1:16]
-type btf_opt_name_off int32[0:16]
bpf$MAP_CREATE(cmd const[BPF_MAP_CREATE], arg ptr[in, bpf_map_create_arg], size len[arg]) fd_bpf_map
bpf$MAP_LOOKUP_ELEM(cmd const[BPF_MAP_LOOKUP_ELEM], arg ptr[in, bpf_map_lookup_arg], size len[arg])
@@ -44,28 +31,18 @@ bpf$BPF_PROG_GET_FD_BY_ID(cmd const[BPF_PROG_GET_FD_BY_ID], arg ptr[in, bpf_prog
bpf$BPF_MAP_GET_FD_BY_ID(cmd const[BPF_MAP_GET_FD_BY_ID], arg ptr[in, bpf_map_get_fd_by_id_arg], size len[arg]) fd_bpf_map
bpf$BPF_GET_PROG_INFO(cmd const[BPF_OBJ_GET_INFO_BY_FD], arg ptr[in, bpf_get_prog_info_arg], size len[arg])
bpf$BPF_GET_MAP_INFO(cmd const[BPF_OBJ_GET_INFO_BY_FD], arg ptr[in, bpf_get_map_info_arg], size len[arg])
-bpf$BPF_GET_BTF_INFO(cmd const[BPF_OBJ_GET_INFO_BY_FD], arg ptr[in, bpf_get_btf_info_arg], size len[arg])
bpf$BPF_PROG_QUERY(cmd const[BPF_PROG_QUERY], arg ptr[in, bpf_prog_query], size len[arg])
-bpf$BPF_RAW_TRACEPOINT_OPEN(cmd const[BPF_RAW_TRACEPOINT_OPEN], arg ptr[in, bpf_raw_tracepoint], size len[arg]) fd_rawtp
-bpf$BPF_BTF_LOAD(cmd const[BPF_BTF_LOAD], arg ptr[in, bpf_btf_load], size len[arg]) fd_btf
-bpf$BPF_BTF_GET_FD_BY_ID(cmd const[BPF_BTF_GET_FD_BY_ID], arg ptr[in, bpf_btf_id], size len[arg]) fd_btf
-bpf$BPF_TASK_FD_QUERY(cmd const[BPF_TASK_FD_QUERY], arg ptr[inout, bpf_task_fd_query], size len[arg])
-bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(cmd const[BPF_MAP_LOOKUP_AND_DELETE_ELEM], arg ptr[in, bpf_map_lookup_arg], size len[arg])
-bpf$BPF_MAP_FREEZE(cmd const[BPF_MAP_FREEZE], arg ptr[in, fd_bpf_map], size len[arg])
+bpf$BPF_RAW_TRACEPOINT_OPEN(cmd const[BPF_RAW_TRACEPOINT_OPEN], arg ptr[in, bpf_raw_tracepoint], size len[arg]) fd
bpf_map_create_arg {
- type flags[bpf_map_type, int32]
- ksize int32
- vsize int32
- max int32
- flags flags[map_flags, int32]
- inner fd_bpf_map[opt]
- node int32
- map_name array[const[0, int8], BPF_OBJ_NAME_LEN]
- map_ifindex ifindex[opt]
- btf_fd fd_btf[opt]
- btf_key_type_id btf_opt_type_id
- btf_value_type_id btf_opt_type_id
+ type flags[bpf_map_type, int32]
+ ksize int32
+ vsize int32
+ max int32
+ flags flags[map_flags, int32]
+ inner fd_bpf_map[opt]
+ node int32
+ map_name array[const[0, int8], BPF_OBJ_NAME_LEN]
}
bpf_map_get_fd_by_id_arg {
@@ -98,9 +75,6 @@ bpf_map_get_next_arg {
next ptr64[out, array[int8]]
}
-define BPF_LINE_INFO_SIZE sizeof(struct bpf_line_info)
-define BPF_FUNC_INFO_SIZE sizeof(struct bpf_func_info)
-
bpf_prog {
type flags[bpf_prog_type, int32]
ninsn bytesize8[insns, int32]
@@ -114,35 +88,14 @@ bpf_prog {
prog_name array[const[0, int8], BPF_OBJ_NAME_LEN]
prog_ifindex ifindex[opt]
expected_attach_type flags[bpf_attach_type, int32]
- btf_fd fd_btf[opt]
- func_info_rec_size const[BPF_FUNC_INFO_SIZE, int32]
- func_info ptr64[in, bpf_func_info]
- func_info_cnt len[func_info, int32]
- line_info_rec_size const[BPF_LINE_INFO_SIZE, int32]
- line_info ptr64[in, bpf_line_info]
- line_info_cnt len[line_info, int32]
}
bpf_licenses = "GPL", "syzkaller"
bpf_kern_version = 0x40f00, 0x41000, 0x41100
-bpf_func_info {
-# This is instruction index, so should not be too large.
- insn_off int32[0:10]
- type_id btf_type_id
-}
-
-bpf_line_info {
-# This is instruction index, so should not be too large.
- insn_off int32[0:5]
- file_name_off btf_opt_name_off
- line_off int32
- line_col int32
-}
-
bpf_instructions [
- raw array[bpf_insn]
framed bpf_framed_program
+ raw array[bpf_insn]
] [varlen]
bpf_framed_program {
@@ -160,12 +113,11 @@ bpf_insn [
exit bpf_insn_exit
initr0 bpf_insn_init_r0
map bpf_insn_map
-] [varlen]
+]
bpf_insn_generic {
code int8
- dst int8:4
- src int8:4
+ regs int8
off int16
imm int32
}
@@ -297,11 +249,9 @@ define bpf_insn_load_imm_dw BPF_LD | BPF_DW | BPF_IMM
# Slightly prune state space, these values frequently must be 0.
bpf_insn_offsets = 0, 1, 2, 4, 6, 8, 12, 16, 24, 32, 48, 64, 80, 128, 256, -1, -2, -4, -8, -12, -16, -32, -64
bpf_insn_immediates = 0, 1, 4, 8, 16, -1, -4, -16
-bpf_reg = BPF_REG_0, BPF_REG_1, BPF_REG_2, BPF_REG_3, BPF_REG_4, BPF_REG_5, BPF_REG_6, BPF_REG_7, BPF_REG_8, BPF_REG_9, BPF_REG_10, __MAX_BPF_REG
+bpf_reg = BPF_REG_0, BPF_REG_1, BPF_REG_2, BPF_REG_3, BPF_REG_4, BPF_REG_5, BPF_REG_6, BPF_REG_7, BPF_REG_8, BPF_REG_9, BPF_REG_10
-define MAX_BPF_REG __MAX_BPF_REG
-
-# NEED: these filenames must be on bpf filesystem, can we do it somehow?
+# TODO: these filenames must be on bpf filesystem
bpf_obj_pin_map {
path ptr64[in, filename]
fd fd_bpf_map
@@ -351,38 +301,18 @@ bpf_get_prog_info_arg {
}
bpf_prog_info {
- type int32
- id bpf_prog_id
- tag int64
- jited_prog_len int32
- xlated_prog_len int32
- jited_prog_insns int64
- xlated_prog_insns int64
- load_time int64
- created_by_uid int32
- nr_map_ids int32
- map_ids int64
- name array[int8, BPF_OBJ_NAME_LEN]
- ifindex int32
- gpl_compatible int32:1
- netns_dev int64
- netns_ino int64
- nr_jited_ksyms int32
- nr_jited_func_lens int32
- jited_ksyms ptr64[in, int64]
- jited_func_lens int64
- btf_id bpf_btf_id
- func_info_rec_size int32
- func_info ptr64[in, bpf_func_info]
- nr_func_info int32
- nr_line_info int32
- line_info ptr64[in, bpf_line_info]
- jited_line_info ptr64[in, int64]
- nr_jited_line_info int32
- line_info_rec_size int32
- jited_line_info_rec_size int32
- nr_prog_tags int32
- prog_tags ptr64[in, int64]
+ type int32
+ id bpf_prog_id
+ tag int64
+ jited_prog_len int32
+ xlated_prog_len int32
+ jited_prog_insns int64
+ xlated_prog_insns int64
+ load_time int64
+ created_by_uid int32
+ nr_map_ids int32
+ map_ids int64
+ name array[int8, BPF_OBJ_NAME_LEN]
} [align_8]
bpf_get_map_info_arg {
@@ -401,18 +331,6 @@ bpf_map_info {
name array[int8, BPF_OBJ_NAME_LEN]
} [align_8]
-bpf_get_btf_info_arg {
- btf fd_btf
- len len[info, int32]
- info ptr64[inout, bpf_btf_info]
-}
-
-bpf_btf_info {
- btf ptr64[out, array[int8]]
- btf_size bytesize[btf, int32]
- id bpf_btf_id[opt]
-} [align_8]
-
bpf_prog_query {
target_fd fd_cgroup
attach_type flags[bpf_prog_query_attach_type, int32]
@@ -427,202 +345,13 @@ bpf_raw_tracepoint {
prog_fd fd_bpf_prog
} [align_8]
-bpf_btf_load {
- btf ptr64[in, bpf_btf_program]
- btf_log_buf ptr64[out, array[int8]]
- btf_size bytesize[btf, int32]
- btf_log_size bytesize[btf_log_buf, int32]
- btf_log_level bool32
-} [align_8]
-
-bpf_btf_program {
- header btf_header
- strings bpf_btf_strings
-} [packed]
-
-btf_header {
- magic const[BTF_MAGIC, int16]
- version const[BTF_VERSION, int8]
- flags const[0, int8]
- hdr_len const[0x18, int32]
- type_off const[0, int32]
- type_len bytesize[types, int32]
- str_off bytesize[types, int32]
- str_len bytesize[bpf_btf_program:strings, int32]
- types array[btf_type]
-} [align_4]
-
-btf_type [
- int btf_type_int
- ptr btf_type_ref_t[BTF_KIND_PTR]
- array btf_type_array
- struct btf_type_struct_t[BTF_KIND_STRUCT]
- union btf_type_struct_t[BTF_KIND_UNION]
- enum btf_type_enum
- fwd btf_type_fwd
- typedef btf_type_ref_t[BTF_KIND_TYPEDEF]
- volatile btf_type_ref_t[BTF_KIND_VOLATILE]
- const btf_type_ref_t[BTF_KIND_CONST]
- restrict btf_type_ref_t[BTF_KIND_RESTRICT]
- func btf_type_func
- func_proto btf_type_func_proto
- var btf_type_var
- datasec btf_type_datasec
-] [varlen]
-
-btf_type_int {
-# Note: this is an offset in bpf_btf_program:strings
- name_off btf_opt_name_off
- info_vlen const[0, int16]
- info_pad const[0, int8]
- info_typ const[BTF_KIND_INT, int8]
- size const[0, int32]
- bits int8[0:128]
- pad const[0, int8]
- offset int8[0:128]
- encoding flags[btf_type_int_encoding, int8]
-}
-
-btf_type_int_encoding = 0, BTF_INT_SIGNED, BTF_INT_CHAR, BTF_INT_BOOL
-
-type btf_type_ref_t[TYP] {
- name_off btf_opt_name_off
- info_vlen const[0, int16]
- info_pad const[0, int8]
- info_typ const[TYP, int8]
- type btf_opt_type_id
-}
-
-btf_type_array {
- name_off const[0, int32]
- info_vlen const[0, int16]
- info_pad const[0, int8]
- info_typ const[BTF_KIND_ARRAY, int8]
- size const[0, int32]
- data btf_array
-}
-
-btf_array {
- type btf_type_id
- index_type btf_type_id
- nelems int32
-}
-
-type btf_type_struct_t[TYP] {
- name_off btf_opt_name_off
- info_vlen len[fields, int16]
- info_pad const[0, int8]
- info_typ const[TYP, int8:7]
- info_kflag int8:1
- size int32
- fields array[btf_member]
-}
-
-btf_member {
- name_off btf_opt_name_off
- type btf_opt_type_id
- offset int32
-}
-
-btf_type_enum {
- name_off btf_opt_name_off
- info_vlen len[values, int16]
- info_pad const[0, int8]
- info_typ const[BTF_KIND_ENUM, int8]
- size const[4, int32]
- values array[btf_enum]
-}
-
-btf_enum {
- name_off btf_opt_name_off
- val int32
-}
-
-btf_type_fwd {
- name_off btf_name_off
- info_vlen const[0, int16]
- info_pad const[0, int8]
- info_typ const[BTF_KIND_FWD, int8]
- size const[0, int32]
-}
-
-btf_type_func {
- name_off btf_name_off
- info_vlen const[0, int16]
- info_pad const[0, int8]
- info_typ const[BTF_KIND_FUNC, int8]
- type btf_type_id
-}
-
-btf_type_func_proto {
- name_off const[0, int32]
- info_vlen len[params, int16]
- info_pad const[0, int8]
- info_typ const[BTF_KIND_FUNC_PROTO, int8]
- size const[0, int32]
- params array[btf_param]
-}
-
-btf_param {
- name_off btf_opt_name_off
- type btf_opt_type_id
-}
-
-btf_type_var {
- name_off btf_name_off
- info_vlen const[0, int16]
- info_pad const[0, int8]
- info_typ const[BTF_KIND_VAR, int8]
- type btf_type_id
- linkage bool32
-}
-
-btf_type_datasec {
- name_off btf_name_off
- info_vlen len[secinfo, int16]
- info_pad const[0, int8]
- info_typ const[BTF_KIND_DATASEC, int8]
- size bytesize[data, int32]
- secinfo array[btf_var_secinfo]
- data array[int8, 1:3]
-} [packed]
-
-btf_var_secinfo {
- type btf_type_id
-# NEED: offset/size are for btf_type_datasec:data and must be increasing and within bounds (see btf_datasec_check_meta)
- offset int32
- size int32
-}
-
-bpf_btf_strings {
- z0 const[0, int8]
- data array[flags[bpf_btf_strings_elem, int8]]
- z1 const[0, int8]
-} [packed]
-
-bpf_btf_strings_elem = 'a', '0', '_', '.', 0
-
-bpf_task_fd_query {
-# NEED: part of fields are input here and part are output. We can't express this yet (#245).
- pid pid
- fd fd_perf_base
- flags const[0, int32]
- buf_len bytesize[buf, int32]
- buf ptr64[in, string]
-# These are output fields:
- prog_id bpf_prog_id[opt]
- fd_type const[0, int32]
- probe_offset const[0, int64]
- probe_addr const[0, int64]
-}
-
-bpf_map_type = BPF_MAP_TYPE_HASH, BPF_MAP_TYPE_ARRAY, BPF_MAP_TYPE_PROG_ARRAY, BPF_MAP_TYPE_PERF_EVENT_ARRAY, BPF_MAP_TYPE_STACK_TRACE, BPF_MAP_TYPE_CGROUP_ARRAY, BPF_MAP_TYPE_PERCPU_HASH, BPF_MAP_TYPE_PERCPU_ARRAY, BPF_MAP_TYPE_LRU_HASH, BPF_MAP_TYPE_LRU_PERCPU_HASH, BPF_MAP_TYPE_LPM_TRIE, BPF_MAP_TYPE_ARRAY_OF_MAPS, BPF_MAP_TYPE_HASH_OF_MAPS, BPF_MAP_TYPE_DEVMAP, BPF_MAP_TYPE_SOCKMAP, BPF_MAP_TYPE_CPUMAP, BPF_MAP_TYPE_XSKMAP, BPF_MAP_TYPE_SOCKHASH, BPF_MAP_TYPE_CGROUP_STORAGE, BPF_MAP_TYPE_REUSEPORT_SOCKARRAY, BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE, BPF_MAP_TYPE_QUEUE, BPF_MAP_TYPE_STACK, BPF_MAP_TYPE_SK_STORAGE
-bpf_map_flags = BPF_ANY, BPF_NOEXIST, BPF_EXIST, BPF_F_LOCK
-bpf_prog_type = BPF_PROG_TYPE_SOCKET_FILTER, BPF_PROG_TYPE_KPROBE, BPF_PROG_TYPE_SCHED_CLS, BPF_PROG_TYPE_SCHED_ACT, BPF_PROG_TYPE_TRACEPOINT, BPF_PROG_TYPE_XDP, BPF_PROG_TYPE_PERF_EVENT, BPF_PROG_TYPE_CGROUP_SKB, BPF_PROG_TYPE_CGROUP_SOCK, BPF_PROG_TYPE_LWT_IN, BPF_PROG_TYPE_LWT_OUT, BPF_PROG_TYPE_LWT_XMIT, BPF_PROG_TYPE_SOCK_OPS, BPF_PROG_TYPE_SK_SKB, BPF_PROG_TYPE_CGROUP_DEVICE, BPF_PROG_TYPE_SK_MSG, BPF_PROG_TYPE_RAW_TRACEPOINT, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_PROG_TYPE_LWT_SEG6LOCAL, BPF_PROG_TYPE_LIRC_MODE2, BPF_PROG_TYPE_SK_REUSEPORT, BPF_PROG_TYPE_FLOW_DISSECTOR, BPF_PROG_TYPE_CGROUP_SYSCTL, BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE, BPF_PROG_TYPE_CGROUP_SOCKOPT
-map_flags = BPF_F_NO_PREALLOC, BPF_F_NO_COMMON_LRU, BPF_F_NUMA_NODE, BPF_F_RDONLY, BPF_F_WRONLY, BPF_F_STACK_BUILD_ID, BPF_F_ZERO_SEED, BPF_F_RDONLY_PROG, BPF_F_WRONLY_PROG
-bpf_attach_type = BPF_CGROUP_INET_INGRESS, BPF_CGROUP_INET_EGRESS, BPF_CGROUP_INET_SOCK_CREATE, BPF_CGROUP_SOCK_OPS, BPF_SK_SKB_STREAM_PARSER, BPF_SK_SKB_STREAM_VERDICT, BPF_CGROUP_DEVICE, BPF_SK_MSG_VERDICT, BPF_CGROUP_INET4_BIND, BPF_CGROUP_INET6_BIND, BPF_CGROUP_INET4_CONNECT, BPF_CGROUP_INET6_CONNECT, BPF_CGROUP_INET4_POST_BIND, BPF_CGROUP_INET6_POST_BIND, BPF_CGROUP_UDP4_SENDMSG, BPF_CGROUP_UDP6_SENDMSG, BPF_LIRC_MODE2, BPF_FLOW_DISSECTOR, BPF_CGROUP_SYSCTL, BPF_CGROUP_UDP4_RECVMSG, BPF_CGROUP_UDP6_RECVMSG, BPF_CGROUP_GETSOCKOPT, BPF_CGROUP_SETSOCKOPT
-bpf_prog_load_flags = BPF_F_STRICT_ALIGNMENT, BPF_F_ANY_ALIGNMENT, BPF_F_TEST_RND_HI32
+bpf_map_type = BPF_MAP_TYPE_HASH, BPF_MAP_TYPE_ARRAY, BPF_MAP_TYPE_PROG_ARRAY, BPF_MAP_TYPE_PERF_EVENT_ARRAY, BPF_MAP_TYPE_STACK_TRACE, BPF_MAP_TYPE_CGROUP_ARRAY, BPF_MAP_TYPE_PERCPU_HASH, BPF_MAP_TYPE_PERCPU_ARRAY, BPF_MAP_TYPE_LRU_HASH, BPF_MAP_TYPE_LRU_PERCPU_HASH, BPF_MAP_TYPE_LPM_TRIE, BPF_MAP_TYPE_ARRAY_OF_MAPS, BPF_MAP_TYPE_HASH_OF_MAPS, BPF_MAP_TYPE_DEVMAP, BPF_MAP_TYPE_SOCKMAP, BPF_MAP_TYPE_CPUMAP
+bpf_map_flags = BPF_ANY, BPF_NOEXIST, BPF_EXIST
+bpf_prog_type = BPF_PROG_TYPE_SOCKET_FILTER, BPF_PROG_TYPE_KPROBE, BPF_PROG_TYPE_SCHED_CLS, BPF_PROG_TYPE_SCHED_ACT, BPF_PROG_TYPE_TRACEPOINT, BPF_PROG_TYPE_XDP, BPF_PROG_TYPE_PERF_EVENT, BPF_PROG_TYPE_CGROUP_SKB, BPF_PROG_TYPE_CGROUP_SOCK, BPF_PROG_TYPE_LWT_IN, BPF_PROG_TYPE_LWT_OUT, BPF_PROG_TYPE_LWT_XMIT, BPF_PROG_TYPE_SOCK_OPS, BPF_PROG_TYPE_SK_SKB, BPF_PROG_TYPE_CGROUP_DEVICE, BPF_PROG_TYPE_SK_MSG, BPF_PROG_TYPE_RAW_TRACEPOINT, BPF_PROG_TYPE_CGROUP_SOCK_ADDR
+map_flags = BPF_F_NO_PREALLOC, BPF_F_NO_COMMON_LRU, BPF_F_NUMA_NODE, BPF_F_RDONLY, BPF_F_WRONLY, BPF_F_STACK_BUILD_ID
+bpf_attach_type = BPF_CGROUP_INET_INGRESS, BPF_CGROUP_INET_EGRESS, BPF_CGROUP_INET_SOCK_CREATE, BPF_CGROUP_SOCK_OPS, BPF_SK_SKB_STREAM_PARSER, BPF_SK_SKB_STREAM_VERDICT, BPF_CGROUP_DEVICE, BPF_SK_MSG_VERDICT, BPF_CGROUP_INET4_BIND, BPF_CGROUP_INET6_BIND, BPF_CGROUP_INET4_CONNECT, BPF_CGROUP_INET6_CONNECT, BPF_CGROUP_INET4_POST_BIND, BPF_CGROUP_INET6_POST_BIND
+bpf_prog_load_flags = BPF_F_STRICT_ALIGNMENT
bpf_attach_flags = BPF_F_ALLOW_OVERRIDE, BPF_F_ALLOW_MULTI
bpf_prog_query_flags = BPF_F_QUERY_EFFECTIVE
-bpf_prog_query_attach_type = BPF_CGROUP_INET_INGRESS, BPF_CGROUP_INET_EGRESS, BPF_CGROUP_INET_SOCK_CREATE, BPF_CGROUP_SOCK_OPS, BPF_CGROUP_DEVICE, BPF_CGROUP_INET4_BIND, BPF_CGROUP_INET4_CONNECT, BPF_CGROUP_INET4_POST_BIND, BPF_CGROUP_INET6_BIND, BPF_CGROUP_INET6_CONNECT, BPF_CGROUP_INET6_POST_BIND, BPF_CGROUP_UDP4_SENDMSG, BPF_CGROUP_UDP6_SENDMSG, BPF_LIRC_MODE2, BPF_CGROUP_SYSCTL, BPF_FLOW_DISSECTOR, BPF_CGROUP_UDP4_RECVMSG, BPF_CGROUP_UDP6_RECVMSG, BPF_CGROUP_GETSOCKOPT, BPF_CGROUP_SETSOCKOPT
+bpf_prog_query_attach_type = BPF_CGROUP_INET_INGRESS, BPF_CGROUP_INET_EGRESS, BPF_CGROUP_INET_SOCK_CREATE, BPF_CGROUP_SOCK_OPS, BPF_CGROUP_DEVICE
bpf_open_flags = BPF_F_RDONLY, BPF_F_WRONLY