Loading...
1.. SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
2
3.. _program_types_and_elf:
4
5Program Types and ELF Sections
6==============================
7
8The table below lists the program types, their attach types where relevant and the ELF section
9names supported by libbpf for them. The ELF section names follow these rules:
10
11- ``type`` is an exact match, e.g. ``SEC("socket")``
12- ``type+`` means it can be either exact ``SEC("type")`` or well-formed ``SEC("type/extras")``
13 with a '``/``' separator between ``type`` and ``extras``.
14
15When ``extras`` are specified, they provide details of how to auto-attach the BPF program. The
16format of ``extras`` depends on the program type, e.g. ``SEC("tracepoint/<category>/<name>")``
17for tracepoints or ``SEC("usdt/<path>:<provider>:<name>")`` for USDT probes. The extras are
18described in more detail in the footnotes.
19
20
21+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
22| Program Type | Attach Type | ELF Section Name | Sleepable |
23+===========================================+========================================+==================================+===========+
24| ``BPF_PROG_TYPE_CGROUP_DEVICE`` | ``BPF_CGROUP_DEVICE`` | ``cgroup/dev`` | |
25+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
26| ``BPF_PROG_TYPE_CGROUP_SKB`` | | ``cgroup/skb`` | |
27+ +----------------------------------------+----------------------------------+-----------+
28| | ``BPF_CGROUP_INET_EGRESS`` | ``cgroup_skb/egress`` | |
29+ +----------------------------------------+----------------------------------+-----------+
30| | ``BPF_CGROUP_INET_INGRESS`` | ``cgroup_skb/ingress`` | |
31+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
32| ``BPF_PROG_TYPE_CGROUP_SOCKOPT`` | ``BPF_CGROUP_GETSOCKOPT`` | ``cgroup/getsockopt`` | |
33+ +----------------------------------------+----------------------------------+-----------+
34| | ``BPF_CGROUP_SETSOCKOPT`` | ``cgroup/setsockopt`` | |
35+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
36| ``BPF_PROG_TYPE_CGROUP_SOCK_ADDR`` | ``BPF_CGROUP_INET4_BIND`` | ``cgroup/bind4`` | |
37+ +----------------------------------------+----------------------------------+-----------+
38| | ``BPF_CGROUP_INET4_CONNECT`` | ``cgroup/connect4`` | |
39+ +----------------------------------------+----------------------------------+-----------+
40| | ``BPF_CGROUP_INET4_GETPEERNAME`` | ``cgroup/getpeername4`` | |
41+ +----------------------------------------+----------------------------------+-----------+
42| | ``BPF_CGROUP_INET4_GETSOCKNAME`` | ``cgroup/getsockname4`` | |
43+ +----------------------------------------+----------------------------------+-----------+
44| | ``BPF_CGROUP_INET6_BIND`` | ``cgroup/bind6`` | |
45+ +----------------------------------------+----------------------------------+-----------+
46| | ``BPF_CGROUP_INET6_CONNECT`` | ``cgroup/connect6`` | |
47+ +----------------------------------------+----------------------------------+-----------+
48| | ``BPF_CGROUP_INET6_GETPEERNAME`` | ``cgroup/getpeername6`` | |
49+ +----------------------------------------+----------------------------------+-----------+
50| | ``BPF_CGROUP_INET6_GETSOCKNAME`` | ``cgroup/getsockname6`` | |
51+ +----------------------------------------+----------------------------------+-----------+
52| | ``BPF_CGROUP_UDP4_RECVMSG`` | ``cgroup/recvmsg4`` | |
53+ +----------------------------------------+----------------------------------+-----------+
54| | ``BPF_CGROUP_UDP4_SENDMSG`` | ``cgroup/sendmsg4`` | |
55+ +----------------------------------------+----------------------------------+-----------+
56| | ``BPF_CGROUP_UDP6_RECVMSG`` | ``cgroup/recvmsg6`` | |
57+ +----------------------------------------+----------------------------------+-----------+
58| | ``BPF_CGROUP_UDP6_SENDMSG`` | ``cgroup/sendmsg6`` | |
59| +----------------------------------------+----------------------------------+-----------+
60| | ``BPF_CGROUP_UNIX_CONNECT`` | ``cgroup/connect_unix`` | |
61| +----------------------------------------+----------------------------------+-----------+
62| | ``BPF_CGROUP_UNIX_SENDMSG`` | ``cgroup/sendmsg_unix`` | |
63| +----------------------------------------+----------------------------------+-----------+
64| | ``BPF_CGROUP_UNIX_RECVMSG`` | ``cgroup/recvmsg_unix`` | |
65| +----------------------------------------+----------------------------------+-----------+
66| | ``BPF_CGROUP_UNIX_GETPEERNAME`` | ``cgroup/getpeername_unix`` | |
67| +----------------------------------------+----------------------------------+-----------+
68| | ``BPF_CGROUP_UNIX_GETSOCKNAME`` | ``cgroup/getsockname_unix`` | |
69+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
70| ``BPF_PROG_TYPE_CGROUP_SOCK`` | ``BPF_CGROUP_INET4_POST_BIND`` | ``cgroup/post_bind4`` | |
71+ +----------------------------------------+----------------------------------+-----------+
72| | ``BPF_CGROUP_INET6_POST_BIND`` | ``cgroup/post_bind6`` | |
73+ +----------------------------------------+----------------------------------+-----------+
74| | ``BPF_CGROUP_INET_SOCK_CREATE`` | ``cgroup/sock_create`` | |
75+ + +----------------------------------+-----------+
76| | | ``cgroup/sock`` | |
77+ +----------------------------------------+----------------------------------+-----------+
78| | ``BPF_CGROUP_INET_SOCK_RELEASE`` | ``cgroup/sock_release`` | |
79+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
80| ``BPF_PROG_TYPE_CGROUP_SYSCTL`` | ``BPF_CGROUP_SYSCTL`` | ``cgroup/sysctl`` | |
81+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
82| ``BPF_PROG_TYPE_EXT`` | | ``freplace+`` [#fentry]_ | |
83+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
84| ``BPF_PROG_TYPE_FLOW_DISSECTOR`` | ``BPF_FLOW_DISSECTOR`` | ``flow_dissector`` | |
85+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
86| ``BPF_PROG_TYPE_KPROBE`` | | ``kprobe+`` [#kprobe]_ | |
87+ + +----------------------------------+-----------+
88| | | ``kretprobe+`` [#kprobe]_ | |
89+ + +----------------------------------+-----------+
90| | | ``ksyscall+`` [#ksyscall]_ | |
91+ + +----------------------------------+-----------+
92| | | ``kretsyscall+`` [#ksyscall]_ | |
93+ + +----------------------------------+-----------+
94| | | ``uprobe+`` [#uprobe]_ | |
95+ + +----------------------------------+-----------+
96| | | ``uprobe.s+`` [#uprobe]_ | Yes |
97+ + +----------------------------------+-----------+
98| | | ``uretprobe+`` [#uprobe]_ | |
99+ + +----------------------------------+-----------+
100| | | ``uretprobe.s+`` [#uprobe]_ | Yes |
101+ + +----------------------------------+-----------+
102| | | ``usdt+`` [#usdt]_ | |
103+ +----------------------------------------+----------------------------------+-----------+
104| | ``BPF_TRACE_KPROBE_MULTI`` | ``kprobe.multi+`` [#kpmulti]_ | |
105+ + +----------------------------------+-----------+
106| | | ``kretprobe.multi+`` [#kpmulti]_ | |
107+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
108| ``BPF_PROG_TYPE_LIRC_MODE2`` | ``BPF_LIRC_MODE2`` | ``lirc_mode2`` | |
109+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
110| ``BPF_PROG_TYPE_LSM`` | ``BPF_LSM_CGROUP`` | ``lsm_cgroup+`` | |
111+ +----------------------------------------+----------------------------------+-----------+
112| | ``BPF_LSM_MAC`` | ``lsm+`` [#lsm]_ | |
113+ + +----------------------------------+-----------+
114| | | ``lsm.s+`` [#lsm]_ | Yes |
115+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
116| ``BPF_PROG_TYPE_LWT_IN`` | | ``lwt_in`` | |
117+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
118| ``BPF_PROG_TYPE_LWT_OUT`` | | ``lwt_out`` | |
119+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
120| ``BPF_PROG_TYPE_LWT_SEG6LOCAL`` | | ``lwt_seg6local`` | |
121+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
122| ``BPF_PROG_TYPE_LWT_XMIT`` | | ``lwt_xmit`` | |
123+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
124| ``BPF_PROG_TYPE_PERF_EVENT`` | | ``perf_event`` | |
125+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
126| ``BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`` | | ``raw_tp.w+`` [#rawtp]_ | |
127+ + +----------------------------------+-----------+
128| | | ``raw_tracepoint.w+`` | |
129+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
130| ``BPF_PROG_TYPE_RAW_TRACEPOINT`` | | ``raw_tp+`` [#rawtp]_ | |
131+ + +----------------------------------+-----------+
132| | | ``raw_tracepoint+`` | |
133+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
134| ``BPF_PROG_TYPE_SCHED_ACT`` | | ``action`` | |
135+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
136| ``BPF_PROG_TYPE_SCHED_CLS`` | | ``classifier`` | |
137+ + +----------------------------------+-----------+
138| | | ``tc`` | |
139+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
140| ``BPF_PROG_TYPE_SK_LOOKUP`` | ``BPF_SK_LOOKUP`` | ``sk_lookup`` | |
141+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
142| ``BPF_PROG_TYPE_SK_MSG`` | ``BPF_SK_MSG_VERDICT`` | ``sk_msg`` | |
143+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
144| ``BPF_PROG_TYPE_SK_REUSEPORT`` | ``BPF_SK_REUSEPORT_SELECT_OR_MIGRATE`` | ``sk_reuseport/migrate`` | |
145+ +----------------------------------------+----------------------------------+-----------+
146| | ``BPF_SK_REUSEPORT_SELECT`` | ``sk_reuseport`` | |
147+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
148| ``BPF_PROG_TYPE_SK_SKB`` | | ``sk_skb`` | |
149+ +----------------------------------------+----------------------------------+-----------+
150| | ``BPF_SK_SKB_STREAM_PARSER`` | ``sk_skb/stream_parser`` | |
151+ +----------------------------------------+----------------------------------+-----------+
152| | ``BPF_SK_SKB_STREAM_VERDICT`` | ``sk_skb/stream_verdict`` | |
153+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
154| ``BPF_PROG_TYPE_SOCKET_FILTER`` | | ``socket`` | |
155+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
156| ``BPF_PROG_TYPE_SOCK_OPS`` | ``BPF_CGROUP_SOCK_OPS`` | ``sockops`` | |
157+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
158| ``BPF_PROG_TYPE_STRUCT_OPS`` | | ``struct_ops+`` | |
159+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
160| ``BPF_PROG_TYPE_SYSCALL`` | | ``syscall`` | Yes |
161+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
162| ``BPF_PROG_TYPE_TRACEPOINT`` | | ``tp+`` [#tp]_ | |
163+ + +----------------------------------+-----------+
164| | | ``tracepoint+`` [#tp]_ | |
165+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
166| ``BPF_PROG_TYPE_TRACING`` | ``BPF_MODIFY_RETURN`` | ``fmod_ret+`` [#fentry]_ | |
167+ + +----------------------------------+-----------+
168| | | ``fmod_ret.s+`` [#fentry]_ | Yes |
169+ +----------------------------------------+----------------------------------+-----------+
170| | ``BPF_TRACE_FENTRY`` | ``fentry+`` [#fentry]_ | |
171+ + +----------------------------------+-----------+
172| | | ``fentry.s+`` [#fentry]_ | Yes |
173+ +----------------------------------------+----------------------------------+-----------+
174| | ``BPF_TRACE_FEXIT`` | ``fexit+`` [#fentry]_ | |
175+ + +----------------------------------+-----------+
176| | | ``fexit.s+`` [#fentry]_ | Yes |
177+ +----------------------------------------+----------------------------------+-----------+
178| | ``BPF_TRACE_ITER`` | ``iter+`` [#iter]_ | |
179+ + +----------------------------------+-----------+
180| | | ``iter.s+`` [#iter]_ | Yes |
181+ +----------------------------------------+----------------------------------+-----------+
182| | ``BPF_TRACE_RAW_TP`` | ``tp_btf+`` [#fentry]_ | |
183+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
184| ``BPF_PROG_TYPE_XDP`` | ``BPF_XDP_CPUMAP`` | ``xdp.frags/cpumap`` | |
185+ + +----------------------------------+-----------+
186| | | ``xdp/cpumap`` | |
187+ +----------------------------------------+----------------------------------+-----------+
188| | ``BPF_XDP_DEVMAP`` | ``xdp.frags/devmap`` | |
189+ + +----------------------------------+-----------+
190| | | ``xdp/devmap`` | |
191+ +----------------------------------------+----------------------------------+-----------+
192| | ``BPF_XDP`` | ``xdp.frags`` | |
193+ + +----------------------------------+-----------+
194| | | ``xdp`` | |
195+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
196
197
198.. rubric:: Footnotes
199
200.. [#fentry] The ``fentry`` attach format is ``fentry[.s]/<function>``.
201.. [#kprobe] The ``kprobe`` attach format is ``kprobe/<function>[+<offset>]``. Valid
202 characters for ``function`` are ``a-zA-Z0-9_.`` and ``offset`` must be a valid
203 non-negative integer.
204.. [#ksyscall] The ``ksyscall`` attach format is ``ksyscall/<syscall>``.
205.. [#uprobe] The ``uprobe`` attach format is ``uprobe[.s]/<path>:<function>[+<offset>]``.
206.. [#usdt] The ``usdt`` attach format is ``usdt/<path>:<provider>:<name>``.
207.. [#kpmulti] The ``kprobe.multi`` attach format is ``kprobe.multi/<pattern>`` where ``pattern``
208 supports ``*`` and ``?`` wildcards. Valid characters for pattern are
209 ``a-zA-Z0-9_.*?``.
210.. [#lsm] The ``lsm`` attachment format is ``lsm[.s]/<hook>``.
211.. [#rawtp] The ``raw_tp`` attach format is ``raw_tracepoint[.w]/<tracepoint>``.
212.. [#tp] The ``tracepoint`` attach format is ``tracepoint/<category>/<name>``.
213.. [#iter] The ``iter`` attach format is ``iter[.s]/<struct-name>``.