Documentation/bpf/libbpf/program_types.rst

   1 .. SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
   2
   3 .. _program_types_and_elf:
   4
   5 Program Types and ELF Sections
   6 ==============================
   7
   8 The table below lists the program types, their attach types where relevant and the ELF section
   9 names supported by libbpf for them. The ELF section names follow these rules:
  10
  11 - ``type`` is an exact match, e.g. ``SEC("socket")``
  12 - ``type+`` means it can be either exact ``SEC("type")`` or well-formed ``SEC("type/extras")``
  13   with a '``/``' separator between ``type`` and ``extras``.
  14
  15 When ``extras`` are specified, they provide details of how to auto-attach the BPF program.  The
  16 format of ``extras`` depends on the program type, e.g. ``SEC("tracepoint/<category>/<name>")``
  17 for tracepoints or ``SEC("usdt/<path>:<provider>:<name>")`` for USDT probes. The extras are
  18 described in more detail in the footnotes.
  19
  20
  21 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
  22 | Program Type                              | Attach Type                            | ELF Section Name                 | Sleepable |
  23 +===========================================+========================================+==================================+===========+
  24 | ``BPF_PROG_TYPE_CGROUP_DEVICE``           | ``BPF_CGROUP_DEVICE``                  | ``cgroup/dev``                   |           |
  25 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
  26 | ``BPF_PROG_TYPE_CGROUP_SKB``              |                                        | ``cgroup/skb``                   |           |
  27 +                                           +----------------------------------------+----------------------------------+-----------+
  28 |                                           | ``BPF_CGROUP_INET_EGRESS``             | ``cgroup_skb/egress``            |           |
  29 +                                           +----------------------------------------+----------------------------------+-----------+
  30 |                                           | ``BPF_CGROUP_INET_INGRESS``            | ``cgroup_skb/ingress``           |           |
  31 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
  32 | ``BPF_PROG_TYPE_CGROUP_SOCKOPT``          | ``BPF_CGROUP_GETSOCKOPT``              | ``cgroup/getsockopt``            |           |
  33 +                                           +----------------------------------------+----------------------------------+-----------+
  34 |                                           | ``BPF_CGROUP_SETSOCKOPT``              | ``cgroup/setsockopt``            |           |
  35 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
  36 | ``BPF_PROG_TYPE_CGROUP_SOCK_ADDR``        | ``BPF_CGROUP_INET4_BIND``              | ``cgroup/bind4``                 |           |
  37 +                                           +----------------------------------------+----------------------------------+-----------+
  38 |                                           | ``BPF_CGROUP_INET4_CONNECT``           | ``cgroup/connect4``              |           |
  39 +                                           +----------------------------------------+----------------------------------+-----------+
  40 |                                           | ``BPF_CGROUP_INET4_GETPEERNAME``       | ``cgroup/getpeername4``          |           |
  41 +                                           +----------------------------------------+----------------------------------+-----------+
  42 |                                           | ``BPF_CGROUP_INET4_GETSOCKNAME``       | ``cgroup/getsockname4``          |           |
  43 +                                           +----------------------------------------+----------------------------------+-----------+
  44 |                                           | ``BPF_CGROUP_INET6_BIND``              | ``cgroup/bind6``                 |           |
  45 +                                           +----------------------------------------+----------------------------------+-----------+
  46 |                                           | ``BPF_CGROUP_INET6_CONNECT``           | ``cgroup/connect6``              |           |
  47 +                                           +----------------------------------------+----------------------------------+-----------+
  48 |                                           | ``BPF_CGROUP_INET6_GETPEERNAME``       | ``cgroup/getpeername6``          |           |
  49 +                                           +----------------------------------------+----------------------------------+-----------+
  50 |                                           | ``BPF_CGROUP_INET6_GETSOCKNAME``       | ``cgroup/getsockname6``          |           |
  51 +                                           +----------------------------------------+----------------------------------+-----------+
  52 |                                           | ``BPF_CGROUP_UDP4_RECVMSG``            | ``cgroup/recvmsg4``              |           |
  53 +                                           +----------------------------------------+----------------------------------+-----------+
  54 |                                           | ``BPF_CGROUP_UDP4_SENDMSG``            | ``cgroup/sendmsg4``              |           |
  55 +                                           +----------------------------------------+----------------------------------+-----------+
  56 |                                           | ``BPF_CGROUP_UDP6_RECVMSG``            | ``cgroup/recvmsg6``              |           |
  57 +                                           +----------------------------------------+----------------------------------+-----------+
  58 |                                           | ``BPF_CGROUP_UDP6_SENDMSG``            | ``cgroup/sendmsg6``              |           |
  59 |                                           +----------------------------------------+----------------------------------+-----------+
  60 |                                           | ``BPF_CGROUP_UNIX_CONNECT``            | ``cgroup/connect_unix``          |           |
  61 |                                           +----------------------------------------+----------------------------------+-----------+
  62 |                                           | ``BPF_CGROUP_UNIX_SENDMSG``            | ``cgroup/sendmsg_unix``          |           |
  63 |                                           +----------------------------------------+----------------------------------+-----------+
  64 |                                           | ``BPF_CGROUP_UNIX_RECVMSG``            | ``cgroup/recvmsg_unix``          |           |
  65 |                                           +----------------------------------------+----------------------------------+-----------+
  66 |                                           | ``BPF_CGROUP_UNIX_GETPEERNAME``        | ``cgroup/getpeername_unix``      |           |
  67 |                                           +----------------------------------------+----------------------------------+-----------+
  68 |                                           | ``BPF_CGROUP_UNIX_GETSOCKNAME``        | ``cgroup/getsockname_unix``      |           |
  69 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
  70 | ``BPF_PROG_TYPE_CGROUP_SOCK``             | ``BPF_CGROUP_INET4_POST_BIND``         | ``cgroup/post_bind4``            |           |
  71 +                                           +----------------------------------------+----------------------------------+-----------+
  72 |                                           | ``BPF_CGROUP_INET6_POST_BIND``         | ``cgroup/post_bind6``            |           |
  73 +                                           +----------------------------------------+----------------------------------+-----------+
  74 |                                           | ``BPF_CGROUP_INET_SOCK_CREATE``        | ``cgroup/sock_create``           |           |
  75 +                                           +                                        +----------------------------------+-----------+
  76 |                                           |                                        | ``cgroup/sock``                  |           |
  77 +                                           +----------------------------------------+----------------------------------+-----------+
  78 |                                           | ``BPF_CGROUP_INET_SOCK_RELEASE``       | ``cgroup/sock_release``          |           |
  79 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
  80 | ``BPF_PROG_TYPE_CGROUP_SYSCTL``           | ``BPF_CGROUP_SYSCTL``                  | ``cgroup/sysctl``                |           |
  81 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
  82 | ``BPF_PROG_TYPE_EXT``                     |                                        | ``freplace+`` [#fentry]_         |           |
  83 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
  84 | ``BPF_PROG_TYPE_FLOW_DISSECTOR``          | ``BPF_FLOW_DISSECTOR``                 | ``flow_dissector``               |           |
  85 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
  86 | ``BPF_PROG_TYPE_KPROBE``                  |                                        | ``kprobe+`` [#kprobe]_           |           |
  87 +                                           +                                        +----------------------------------+-----------+
  88 |                                           |                                        | ``kretprobe+`` [#kprobe]_        |           |
  89 +                                           +                                        +----------------------------------+-----------+
  90 |                                           |                                        | ``ksyscall+`` [#ksyscall]_       |           |
  91 +                                           +                                        +----------------------------------+-----------+
  92 |                                           |                                        |  ``kretsyscall+`` [#ksyscall]_   |           |
  93 +                                           +                                        +----------------------------------+-----------+
  94 |                                           |                                        | ``uprobe+`` [#uprobe]_           |           |
  95 +                                           +                                        +----------------------------------+-----------+
  96 |                                           |                                        | ``uprobe.s+`` [#uprobe]_         | Yes       |
  97 +                                           +                                        +----------------------------------+-----------+
  98 |                                           |                                        | ``uretprobe+`` [#uprobe]_        |           |
  99 +                                           +                                        +----------------------------------+-----------+
 100 |                                           |                                        | ``uretprobe.s+`` [#uprobe]_      | Yes       |
 101 +                                           +                                        +----------------------------------+-----------+
 102 |                                           |                                        | ``usdt+`` [#usdt]_               |           |
 103 +                                           +----------------------------------------+----------------------------------+-----------+
 104 |                                           | ``BPF_TRACE_KPROBE_MULTI``             | ``kprobe.multi+`` [#kpmulti]_    |           |
 105 +                                           +                                        +----------------------------------+-----------+
 106 |                                           |                                        | ``kretprobe.multi+`` [#kpmulti]_ |           |
 107 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 108 | ``BPF_PROG_TYPE_LIRC_MODE2``              | ``BPF_LIRC_MODE2``                     | ``lirc_mode2``                   |           |
 109 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 110 | ``BPF_PROG_TYPE_LSM``                     | ``BPF_LSM_CGROUP``                     | ``lsm_cgroup+``                  |           |
 111 +                                           +----------------------------------------+----------------------------------+-----------+
 112 |                                           | ``BPF_LSM_MAC``                        | ``lsm+`` [#lsm]_                 |           |
 113 +                                           +                                        +----------------------------------+-----------+
 114 |                                           |                                        | ``lsm.s+`` [#lsm]_               | Yes       |
 115 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 116 | ``BPF_PROG_TYPE_LWT_IN``                  |                                        | ``lwt_in``                       |           |
 117 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 118 | ``BPF_PROG_TYPE_LWT_OUT``                 |                                        | ``lwt_out``                      |           |
 119 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 120 | ``BPF_PROG_TYPE_LWT_SEG6LOCAL``           |                                        | ``lwt_seg6local``                |           |
 121 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 122 | ``BPF_PROG_TYPE_LWT_XMIT``                |                                        | ``lwt_xmit``                     |           |
 123 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 124 | ``BPF_PROG_TYPE_PERF_EVENT``              |                                        | ``perf_event``                   |           |
 125 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 126 | ``BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`` |                                        | ``raw_tp.w+`` [#rawtp]_          |           |
 127 +                                           +                                        +----------------------------------+-----------+
 128 |                                           |                                        | ``raw_tracepoint.w+``            |           |
 129 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 130 | ``BPF_PROG_TYPE_RAW_TRACEPOINT``          |                                        | ``raw_tp+`` [#rawtp]_            |           |
 131 +                                           +                                        +----------------------------------+-----------+
 132 |                                           |                                        | ``raw_tracepoint+``              |           |
 133 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 134 | ``BPF_PROG_TYPE_SCHED_ACT``               |                                        | ``action``                       |           |
 135 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 136 | ``BPF_PROG_TYPE_SCHED_CLS``               |                                        | ``classifier``                   |           |
 137 +                                           +                                        +----------------------------------+-----------+
 138 |                                           |                                        | ``tc``                           |           |
 139 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 140 | ``BPF_PROG_TYPE_SK_LOOKUP``               | ``BPF_SK_LOOKUP``                      | ``sk_lookup``                    |           |
 141 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 142 | ``BPF_PROG_TYPE_SK_MSG``                  | ``BPF_SK_MSG_VERDICT``                 | ``sk_msg``                       |           |
 143 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 144 | ``BPF_PROG_TYPE_SK_REUSEPORT``            | ``BPF_SK_REUSEPORT_SELECT_OR_MIGRATE`` | ``sk_reuseport/migrate``         |           |
 145 +                                           +----------------------------------------+----------------------------------+-----------+
 146 |                                           | ``BPF_SK_REUSEPORT_SELECT``            | ``sk_reuseport``                 |           |
 147 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 148 | ``BPF_PROG_TYPE_SK_SKB``                  |                                        | ``sk_skb``                       |           |
 149 +                                           +----------------------------------------+----------------------------------+-----------+
 150 |                                           | ``BPF_SK_SKB_STREAM_PARSER``           | ``sk_skb/stream_parser``         |           |
 151 +                                           +----------------------------------------+----------------------------------+-----------+
 152 |                                           | ``BPF_SK_SKB_STREAM_VERDICT``          | ``sk_skb/stream_verdict``        |           |
 153 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 154 | ``BPF_PROG_TYPE_SOCKET_FILTER``           |                                        | ``socket``                       |           |
 155 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 156 | ``BPF_PROG_TYPE_SOCK_OPS``                | ``BPF_CGROUP_SOCK_OPS``                | ``sockops``                      |           |
 157 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 158 | ``BPF_PROG_TYPE_STRUCT_OPS``              |                                        | ``struct_ops+``                  |           |
 159 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 160 | ``BPF_PROG_TYPE_SYSCALL``                 |                                        | ``syscall``                      | Yes       |
 161 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 162 | ``BPF_PROG_TYPE_TRACEPOINT``              |                                        | ``tp+`` [#tp]_                   |           |
 163 +                                           +                                        +----------------------------------+-----------+
 164 |                                           |                                        | ``tracepoint+`` [#tp]_           |           |
 165 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 166 | ``BPF_PROG_TYPE_TRACING``                 | ``BPF_MODIFY_RETURN``                  | ``fmod_ret+`` [#fentry]_         |           |
 167 +                                           +                                        +----------------------------------+-----------+
 168 |                                           |                                        | ``fmod_ret.s+`` [#fentry]_       | Yes       |
 169 +                                           +----------------------------------------+----------------------------------+-----------+
 170 |                                           | ``BPF_TRACE_FENTRY``                   | ``fentry+`` [#fentry]_           |           |
 171 +                                           +                                        +----------------------------------+-----------+
 172 |                                           |                                        | ``fentry.s+`` [#fentry]_         | Yes       |
 173 +                                           +----------------------------------------+----------------------------------+-----------+
 174 |                                           | ``BPF_TRACE_FEXIT``                    | ``fexit+`` [#fentry]_            |           |
 175 +                                           +                                        +----------------------------------+-----------+
 176 |                                           |                                        | ``fexit.s+`` [#fentry]_          | Yes       |
 177 +                                           +----------------------------------------+----------------------------------+-----------+
 178 |                                           | ``BPF_TRACE_ITER``                     | ``iter+`` [#iter]_               |           |
 179 +                                           +                                        +----------------------------------+-----------+
 180 |                                           |                                        | ``iter.s+`` [#iter]_             | Yes       |
 181 +                                           +----------------------------------------+----------------------------------+-----------+
 182 |                                           | ``BPF_TRACE_RAW_TP``                   | ``tp_btf+`` [#fentry]_           |           |
 183 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 184 | ``BPF_PROG_TYPE_XDP``                     | ``BPF_XDP_CPUMAP``                     | ``xdp.frags/cpumap``             |           |
 185 +                                           +                                        +----------------------------------+-----------+
 186 |                                           |                                        | ``xdp/cpumap``                   |           |
 187 +                                           +----------------------------------------+----------------------------------+-----------+
 188 |                                           | ``BPF_XDP_DEVMAP``                     | ``xdp.frags/devmap``             |           |
 189 +                                           +                                        +----------------------------------+-----------+
 190 |                                           |                                        | ``xdp/devmap``                   |           |
 191 +                                           +----------------------------------------+----------------------------------+-----------+
 192 |                                           | ``BPF_XDP``                            | ``xdp.frags``                    |           |
 193 +                                           +                                        +----------------------------------+-----------+
 194 |                                           |                                        | ``xdp``                          |           |
 195 +-------------------------------------------+----------------------------------------+----------------------------------+-----------+
 196
 197
 198 .. rubric:: Footnotes
 199
 200 .. [#fentry] The ``fentry`` attach format is ``fentry[.s]/<function>``.
 201 .. [#kprobe] The ``kprobe`` attach format is ``kprobe/<function>[+<offset>]``. Valid
 202              characters for ``function`` are ``a-zA-Z0-9_.`` and ``offset`` must be a valid
 203              non-negative integer.
 204 .. [#ksyscall] The ``ksyscall`` attach format is ``ksyscall/<syscall>``.
 205 .. [#uprobe] The ``uprobe`` attach format is ``uprobe[.s]/<path>:<function>[+<offset>]``.
 206 .. [#usdt] The ``usdt`` attach format is ``usdt/<path>:<provider>:<name>``.
 207 .. [#kpmulti] The ``kprobe.multi`` attach format is ``kprobe.multi/<pattern>`` where ``pattern``
 208               supports ``*`` and ``?`` wildcards. Valid characters for pattern are
 209               ``a-zA-Z0-9_.*?``.
 210 .. [#lsm] The ``lsm`` attachment format is ``lsm[.s]/<hook>``.
 211 .. [#rawtp] The ``raw_tp`` attach format is ``raw_tracepoint[.w]/<tracepoint>``.
 212 .. [#tp] The ``tracepoint`` attach format is ``tracepoint/<category>/<name>``.
 213 .. [#iter] The ``iter`` attach format is ``iter[.s]/<struct-name>``.