bpf_xdp_adjust_meta() returns errcode -13 (permission denied)

Question

Problem:

bpf_xdp_adjust_meta(ctx, -delta); is returning error code -13 (permission denied) when delta > 32.
But BPF and XDP Reference Guide states that there are 256 bytes headroom for metadata.
So did I misunderstand something or how can I use 256 bytes for metadata?

Program:

int xdp_prog_simple(struct xdp_md *ctx)
{   
    bpf_printk("---BPF DEBUG--- adjust_meta: %d\n", bpf_xdp_adjust_meta(ctx, -36));
    return XDP_PASS;
}

Setup:

Kernel:
uname -rv
5.8.0-63-generic #71-Ubuntu SMP Tue Jul 13 15:59:12 UTC 2021
Device:
veth from xdp-tutorial/testenv, because my hardware driver don't support native xdp mode.
Loaded with:

• ip link set dev test xdp obj xdp_pass_kern.o sec xdp and checked that the program is attached in xdp native mode.
• bpf_set_link_xdp_fd() from userspace program

I also tried to use different compilation environments (with their default Makefile):

1. linux/samples/bpf
2. xdp-tutorial/basic01

Background:

I'm trying to pass data via the xdp_md->data_meta field to make the data accessible for tail-called eBPF programs. To adjust the data_meta pointer I call the eBPF helper function bpf_xdp_adjust_meta(ctx, -delta); where delta is the size of the struct holding the metadata. This is working fine, as long as delta is <= 32. If it's bigger, the helper function returns -13 (Permission denied). That's why I guess that the headroom for metadata is 32 bytes in my case instead of 256 bytes as stated in BPF and XDP Reference Guide.

Answer 1

The maximum room space for metadata is only 32 bytes, so what you observe is expected.

You can check this by reading the relevant kernel code, or the logs for the commit that introduced the feature.

The documentation that you cited refers to the room size for encapsulation headers that you can modify with bpf_xdp_adjust_head(), not to the size for metadata. Admittedly it's not clear from the text (but PRs are welcome!).