FILE
program_types.rst

File preview with syntax highlighting.
linux-6.19.14/Documentation/bpf/libbpf/program_types.rst RESTRUCTUREDTEXT
  1.. SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
  2
  3.. _program_types_and_elf:
  4
  5Program Types and ELF Sections
  6==============================
  7
  8The table below lists the program types, their attach types where relevant and the ELF section
  9names supported by libbpf for them. The ELF section names follow these rules:
 10
 11- ``type`` is an exact match, e.g. ``SEC("socket")``
 12- ``type+`` means it can be either exact ``SEC("type")`` or well-formed ``SEC("type/extras")``
 13  with a '``/``' separator between ``type`` and ``extras``.
 14
 15When ``extras`` are specified, they provide details of how to auto-attach the BPF program.  The
 16format of ``extras`` depends on the program type, e.g. ``SEC("tracepoint/<category>/<name>")``
 17for tracepoints or ``SEC("usdt/<path>:<provider>:<name>")`` for USDT probes. The extras are
 18described in more detail in the footnotes.
 19
 20
 21+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 22| Program Type                              | Attach Type                            | ELF Section Name                 | Sleepable |
 23+===========================================+========================================+==================================+===========+
 24| ``BPF_PROG_TYPE_CGROUP_DEVICE``           | ``BPF_CGROUP_DEVICE``                  | ``cgroup/dev``                   |           |
 25+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 26| ``BPF_PROG_TYPE_CGROUP_SKB``              |                                        | ``cgroup/skb``                   |           |
 27+                                           +----------------------------------------+----------------------------------+-----------+
 28|                                           | ``BPF_CGROUP_INET_EGRESS``             | ``cgroup_skb/egress``            |           |
 29+                                           +----------------------------------------+----------------------------------+-----------+
 30|                                           | ``BPF_CGROUP_INET_INGRESS``            | ``cgroup_skb/ingress``           |           |
 31+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 32| ``BPF_PROG_TYPE_CGROUP_SOCKOPT``          | ``BPF_CGROUP_GETSOCKOPT``              | ``cgroup/getsockopt``            |           |
 33+                                           +----------------------------------------+----------------------------------+-----------+
 34|                                           | ``BPF_CGROUP_SETSOCKOPT``              | ``cgroup/setsockopt``            |           |
 35+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 36| ``BPF_PROG_TYPE_CGROUP_SOCK_ADDR``        | ``BPF_CGROUP_INET4_BIND``              | ``cgroup/bind4``                 |           |
 37+                                           +----------------------------------------+----------------------------------+-----------+
 38|                                           | ``BPF_CGROUP_INET4_CONNECT``           | ``cgroup/connect4``              |           |
 39+                                           +----------------------------------------+----------------------------------+-----------+
 40|                                           | ``BPF_CGROUP_INET4_GETPEERNAME``       | ``cgroup/getpeername4``          |           |
 41+                                           +----------------------------------------+----------------------------------+-----------+
 42|                                           | ``BPF_CGROUP_INET4_GETSOCKNAME``       | ``cgroup/getsockname4``          |           |
 43+                                           +----------------------------------------+----------------------------------+-----------+
 44|                                           | ``BPF_CGROUP_INET6_BIND``              | ``cgroup/bind6``                 |           |
 45+                                           +----------------------------------------+----------------------------------+-----------+
 46|                                           | ``BPF_CGROUP_INET6_CONNECT``           | ``cgroup/connect6``              |           |
 47+                                           +----------------------------------------+----------------------------------+-----------+
 48|                                           | ``BPF_CGROUP_INET6_GETPEERNAME``       | ``cgroup/getpeername6``          |           |
 49+                                           +----------------------------------------+----------------------------------+-----------+
 50|                                           | ``BPF_CGROUP_INET6_GETSOCKNAME``       | ``cgroup/getsockname6``          |           |
 51+                                           +----------------------------------------+----------------------------------+-----------+
 52|                                           | ``BPF_CGROUP_UDP4_RECVMSG``            | ``cgroup/recvmsg4``              |           |
 53+                                           +----------------------------------------+----------------------------------+-----------+
 54|                                           | ``BPF_CGROUP_UDP4_SENDMSG``            | ``cgroup/sendmsg4``              |           |
 55+                                           +----------------------------------------+----------------------------------+-----------+
 56|                                           | ``BPF_CGROUP_UDP6_RECVMSG``            | ``cgroup/recvmsg6``              |           |
 57+                                           +----------------------------------------+----------------------------------+-----------+
 58|                                           | ``BPF_CGROUP_UDP6_SENDMSG``            | ``cgroup/sendmsg6``              |           |
 59|                                           +----------------------------------------+----------------------------------+-----------+
 60|                                           | ``BPF_CGROUP_UNIX_CONNECT``            | ``cgroup/connect_unix``          |           |
 61|                                           +----------------------------------------+----------------------------------+-----------+
 62|                                           | ``BPF_CGROUP_UNIX_SENDMSG``            | ``cgroup/sendmsg_unix``          |           |
 63|                                           +----------------------------------------+----------------------------------+-----------+
 64|                                           | ``BPF_CGROUP_UNIX_RECVMSG``            | ``cgroup/recvmsg_unix``          |           |
 65|                                           +----------------------------------------+----------------------------------+-----------+
 66|                                           | ``BPF_CGROUP_UNIX_GETPEERNAME``        | ``cgroup/getpeername_unix``      |           |
 67|                                           +----------------------------------------+----------------------------------+-----------+
 68|                                           | ``BPF_CGROUP_UNIX_GETSOCKNAME``        | ``cgroup/getsockname_unix``      |           |
 69+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 70| ``BPF_PROG_TYPE_CGROUP_SOCK``             | ``BPF_CGROUP_INET4_POST_BIND``         | ``cgroup/post_bind4``            |           |
 71+                                           +----------------------------------------+----------------------------------+-----------+
 72|                                           | ``BPF_CGROUP_INET6_POST_BIND``         | ``cgroup/post_bind6``            |           |
 73+                                           +----------------------------------------+----------------------------------+-----------+
 74|                                           | ``BPF_CGROUP_INET_SOCK_CREATE``        | ``cgroup/sock_create``           |           |
 75+                                           +                                        +----------------------------------+-----------+
 76|                                           |                                        | ``cgroup/sock``                  |           |
 77+                                           +----------------------------------------+----------------------------------+-----------+
 78|                                           | ``BPF_CGROUP_INET_SOCK_RELEASE``       | ``cgroup/sock_release``          |           |
 79+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 80| ``BPF_PROG_TYPE_CGROUP_SYSCTL``           | ``BPF_CGROUP_SYSCTL``                  | ``cgroup/sysctl``                |           |
 81+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 82| ``BPF_PROG_TYPE_EXT``                     |                                        | ``freplace+`` [#fentry]_         |           |
 83+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 84| ``BPF_PROG_TYPE_FLOW_DISSECTOR``          | ``BPF_FLOW_DISSECTOR``                 | ``flow_dissector``               |           |
 85+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 86| ``BPF_PROG_TYPE_KPROBE``                  |                                        | ``kprobe+`` [#kprobe]_           |           |
 87+                                           +                                        +----------------------------------+-----------+
 88|                                           |                                        | ``kretprobe+`` [#kprobe]_        |           |
 89+                                           +                                        +----------------------------------+-----------+
 90|                                           |                                        | ``ksyscall+`` [#ksyscall]_       |           |
 91+                                           +                                        +----------------------------------+-----------+
 92|                                           |                                        |  ``kretsyscall+`` [#ksyscall]_   |           |
 93+                                           +                                        +----------------------------------+-----------+
 94|                                           |                                        | ``uprobe+`` [#uprobe]_           |           |
 95+                                           +                                        +----------------------------------+-----------+
 96|                                           |                                        | ``uprobe.s+`` [#uprobe]_         | Yes       |
 97+                                           +                                        +----------------------------------+-----------+
 98|                                           |                                        | ``uretprobe+`` [#uprobe]_        |           |
 99+                                           +                                        +----------------------------------+-----------+
100|                                           |                                        | ``uretprobe.s+`` [#uprobe]_      | Yes       |
101+                                           +                                        +----------------------------------+-----------+
102|                                           |                                        | ``usdt+`` [#usdt]_               |           |
103+                                           +                                        +----------------------------------+-----------+
104|                                           |                                        | ``usdt.s+`` [#usdt]_             | Yes       |
105+                                           +----------------------------------------+----------------------------------+-----------+
106|                                           | ``BPF_TRACE_KPROBE_MULTI``             | ``kprobe.multi+`` [#kpmulti]_    |           |
107+                                           +                                        +----------------------------------+-----------+
108|                                           |                                        | ``kretprobe.multi+`` [#kpmulti]_ |           |
109+                                           +----------------------------------------+----------------------------------+-----------+
110|                                           | ``BPF_TRACE_KPROBE_SESSION``           | ``kprobe.session+`` [#kpmulti]_  |           |
111+                                           +----------------------------------------+----------------------------------+-----------+
112|                                           | ``BPF_TRACE_UPROBE_MULTI``             | ``uprobe.multi+`` [#upmul]_      |           |
113+                                           +                                        +----------------------------------+-----------+
114|                                           |                                        | ``uprobe.multi.s+`` [#upmul]_    | Yes       |
115+                                           +                                        +----------------------------------+-----------+
116|                                           |                                        | ``uretprobe.multi+`` [#upmul]_   |           |
117+                                           +                                        +----------------------------------+-----------+
118|                                           |                                        | ``uretprobe.multi.s+`` [#upmul]_ | Yes       |
119+                                           +----------------------------------------+----------------------------------+-----------+
120|                                           | ``BPF_TRACE_UPROBE_SESSION``           | ``uprobe.session+`` [#upmul]_    |           |
121+                                           +                                        +----------------------------------+-----------+
122|                                           |                                        | ``uprobe.session.s+`` [#upmul]_  | Yes       |
123+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
124| ``BPF_PROG_TYPE_LIRC_MODE2``              | ``BPF_LIRC_MODE2``                     | ``lirc_mode2``                   |           |
125+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
126| ``BPF_PROG_TYPE_LSM``                     | ``BPF_LSM_CGROUP``                     | ``lsm_cgroup+``                  |           |
127+                                           +----------------------------------------+----------------------------------+-----------+
128|                                           | ``BPF_LSM_MAC``                        | ``lsm+`` [#lsm]_                 |           |
129+                                           +                                        +----------------------------------+-----------+
130|                                           |                                        | ``lsm.s+`` [#lsm]_               | Yes       |
131+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
132| ``BPF_PROG_TYPE_LWT_IN``                  |                                        | ``lwt_in``                       |           |
133+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
134| ``BPF_PROG_TYPE_LWT_OUT``                 |                                        | ``lwt_out``                      |           |
135+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
136| ``BPF_PROG_TYPE_LWT_SEG6LOCAL``           |                                        | ``lwt_seg6local``                |           |
137+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
138| ``BPF_PROG_TYPE_LWT_XMIT``                |                                        | ``lwt_xmit``                     |           |
139+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
140| ``BPF_PROG_TYPE_NETFILTER``               |                                        | ``netfilter``                    |           |
141+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
142| ``BPF_PROG_TYPE_PERF_EVENT``              |                                        | ``perf_event``                   |           |
143+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
144| ``BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`` |                                        | ``raw_tp.w+`` [#rawtp]_          |           |
145+                                           +                                        +----------------------------------+-----------+
146|                                           |                                        | ``raw_tracepoint.w+``            |           |
147+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
148| ``BPF_PROG_TYPE_RAW_TRACEPOINT``          |                                        | ``raw_tp+`` [#rawtp]_            |           |
149+                                           +                                        +----------------------------------+-----------+
150|                                           |                                        | ``raw_tracepoint+``              |           |
151+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
152| ``BPF_PROG_TYPE_SCHED_ACT``               |                                        | ``action`` [#tc_legacy]_         |           |
153+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
154| ``BPF_PROG_TYPE_SCHED_CLS``               |                                        | ``classifier`` [#tc_legacy]_     |           |
155+                                           +                                        +----------------------------------+-----------+
156|                                           |                                        | ``tc`` [#tc_legacy]_             |           |
157+                                           +----------------------------------------+----------------------------------+-----------+
158|                                           | ``BPF_NETKIT_PRIMARY``                 | ``netkit/primary``               |           |
159+                                           +----------------------------------------+----------------------------------+-----------+
160|                                           | ``BPF_NETKIT_PEER``                    | ``netkit/peer``                  |           |
161+                                           +----------------------------------------+----------------------------------+-----------+
162|                                           | ``BPF_TCX_INGRESS``                    | ``tc/ingress``                   |           |
163+                                           +----------------------------------------+----------------------------------+-----------+
164|                                           | ``BPF_TCX_EGRESS``                     | ``tc/egress``                    |           |
165+                                           +----------------------------------------+----------------------------------+-----------+
166|                                           | ``BPF_TCX_INGRESS``                    | ``tcx/ingress``                  |           |
167+                                           +----------------------------------------+----------------------------------+-----------+
168|                                           | ``BPF_TCX_EGRESS``                     | ``tcx/egress``                   |           |
169+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
170| ``BPF_PROG_TYPE_SK_LOOKUP``               | ``BPF_SK_LOOKUP``                      | ``sk_lookup``                    |           |
171+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
172| ``BPF_PROG_TYPE_SK_MSG``                  | ``BPF_SK_MSG_VERDICT``                 | ``sk_msg``                       |           |
173+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
174| ``BPF_PROG_TYPE_SK_REUSEPORT``            | ``BPF_SK_REUSEPORT_SELECT_OR_MIGRATE`` | ``sk_reuseport/migrate``         |           |
175+                                           +----------------------------------------+----------------------------------+-----------+
176|                                           | ``BPF_SK_REUSEPORT_SELECT``            | ``sk_reuseport``                 |           |
177+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
178| ``BPF_PROG_TYPE_SK_SKB``                  |                                        | ``sk_skb``                       |           |
179+                                           +----------------------------------------+----------------------------------+-----------+
180|                                           | ``BPF_SK_SKB_STREAM_PARSER``           | ``sk_skb/stream_parser``         |           |
181+                                           +----------------------------------------+----------------------------------+-----------+
182|                                           | ``BPF_SK_SKB_STREAM_VERDICT``          | ``sk_skb/stream_verdict``        |           |
183+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
184| ``BPF_PROG_TYPE_SOCKET_FILTER``           |                                        | ``socket``                       |           |
185+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
186| ``BPF_PROG_TYPE_SOCK_OPS``                | ``BPF_CGROUP_SOCK_OPS``                | ``sockops``                      |           |
187+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
188| ``BPF_PROG_TYPE_STRUCT_OPS``              |                                        | ``struct_ops+`` [#struct_ops]_   |           |
189+                                           +                                        +----------------------------------+-----------+
190|                                           |                                        | ``struct_ops.s+`` [#struct_ops]_ | Yes       |
191+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
192| ``BPF_PROG_TYPE_SYSCALL``                 |                                        | ``syscall``                      | Yes       |
193+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
194| ``BPF_PROG_TYPE_TRACEPOINT``              |                                        | ``tp+`` [#tp]_                   |           |
195+                                           +                                        +----------------------------------+-----------+
196|                                           |                                        | ``tracepoint+`` [#tp]_           |           |
197+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
198| ``BPF_PROG_TYPE_TRACING``                 | ``BPF_MODIFY_RETURN``                  | ``fmod_ret+`` [#fentry]_         |           |
199+                                           +                                        +----------------------------------+-----------+
200|                                           |                                        | ``fmod_ret.s+`` [#fentry]_       | Yes       |
201+                                           +----------------------------------------+----------------------------------+-----------+
202|                                           | ``BPF_TRACE_FENTRY``                   | ``fentry+`` [#fentry]_           |           |
203+                                           +                                        +----------------------------------+-----------+
204|                                           |                                        | ``fentry.s+`` [#fentry]_         | Yes       |
205+                                           +----------------------------------------+----------------------------------+-----------+
206|                                           | ``BPF_TRACE_FEXIT``                    | ``fexit+`` [#fentry]_            |           |
207+                                           +                                        +----------------------------------+-----------+
208|                                           |                                        | ``fexit.s+`` [#fentry]_          | Yes       |
209+                                           +----------------------------------------+----------------------------------+-----------+
210|                                           | ``BPF_TRACE_ITER``                     | ``iter+`` [#iter]_               |           |
211+                                           +                                        +----------------------------------+-----------+
212|                                           |                                        | ``iter.s+`` [#iter]_             | Yes       |
213+                                           +----------------------------------------+----------------------------------+-----------+
214|                                           | ``BPF_TRACE_RAW_TP``                   | ``tp_btf+`` [#fentry]_           |           |
215+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
216| ``BPF_PROG_TYPE_XDP``                     | ``BPF_XDP_CPUMAP``                     | ``xdp.frags/cpumap``             |           |
217+                                           +                                        +----------------------------------+-----------+
218|                                           |                                        | ``xdp/cpumap``                   |           |
219+                                           +----------------------------------------+----------------------------------+-----------+
220|                                           | ``BPF_XDP_DEVMAP``                     | ``xdp.frags/devmap``             |           |
221+                                           +                                        +----------------------------------+-----------+
222|                                           |                                        | ``xdp/devmap``                   |           |
223+                                           +----------------------------------------+----------------------------------+-----------+
224|                                           | ``BPF_XDP``                            | ``xdp.frags``                    |           |
225+                                           +                                        +----------------------------------+-----------+
226|                                           |                                        | ``xdp``                          |           |
227+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
228
229
230.. rubric:: Footnotes
231
232.. [#fentry] The ``fentry`` attach format is ``fentry[.s]/<function>``.
233.. [#kprobe] The ``kprobe`` attach format is ``kprobe/<function>[+<offset>]``. Valid
234             characters for ``function`` are ``a-zA-Z0-9_.`` and ``offset`` must be a valid
235             non-negative integer.
236.. [#ksyscall] The ``ksyscall`` attach format is ``ksyscall/<syscall>``.
237.. [#uprobe] The ``uprobe`` attach format is ``uprobe[.s]/<path>:<function>[+<offset>]``.
238.. [#upmul] The ``uprobe.multi`` attach format is ``uprobe.multi[.s]/<path>:<function-pattern>``
239            where ``function-pattern`` supports ``*`` and ``?`` wildcards.
240.. [#usdt] The ``usdt`` attach format is ``usdt/<path>:<provider>:<name>``.
241.. [#kpmulti] The ``kprobe.multi`` attach format is ``kprobe.multi/<pattern>`` where ``pattern``
242              supports ``*`` and ``?`` wildcards. Valid characters for pattern are
243              ``a-zA-Z0-9_.*?``.
244.. [#lsm] The ``lsm`` attachment format is ``lsm[.s]/<hook>``.
245.. [#rawtp] The ``raw_tp`` attach format is ``raw_tracepoint[.w]/<tracepoint>``.
246.. [#tc_legacy] The ``tc``, ``classifier`` and ``action`` attach types are deprecated, use
247                ``tcx/*`` instead.
248.. [#struct_ops] The ``struct_ops`` attach format supports ``struct_ops[.s]/<name>`` convention,
249                 but ``name`` is ignored and it is recommended to just use plain
250                 ``SEC("struct_ops[.s]")``. The attachments are defined in a struct initializer
251                 that is tagged with ``SEC(".struct_ops[.link]")``.
252.. [#tp] The ``tracepoint`` attach format is ``tracepoint/<category>/<name>``.
253.. [#iter] The ``iter`` attach format is ``iter[.s]/<struct-name>``.
~/ Read-only file preview.