1.. SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) 2 3.. _program_types_and_elf: 4 5Program Types and ELF Sections 6============================== 7 8The table below lists the program types, their attach types where relevant and the ELF section 9names supported by libbpf for them. The ELF section names follow these rules: 10 11- ``type`` is an exact match, e.g. ``SEC("socket")`` 12- ``type+`` means it can be either exact ``SEC("type")`` or well-formed ``SEC("type/extras")`` 13 with a '``/``' separator between ``type`` and ``extras``. 14 15When ``extras`` are specified, they provide details of how to auto-attach the BPF program. The 16format of ``extras`` depends on the program type, e.g. ``SEC("tracepoint/<category>/<name>")`` 17for tracepoints or ``SEC("usdt/<path>:<provider>:<name>")`` for USDT probes. The extras are 18described in more detail in the footnotes. 19 20 21+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 22| Program Type | Attach Type | ELF Section Name | Sleepable | 23+===========================================+========================================+==================================+===========+ 24| ``BPF_PROG_TYPE_CGROUP_DEVICE`` | ``BPF_CGROUP_DEVICE`` | ``cgroup/dev`` | | 25+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 26| ``BPF_PROG_TYPE_CGROUP_SKB`` | | ``cgroup/skb`` | | 27+ +----------------------------------------+----------------------------------+-----------+ 28| | ``BPF_CGROUP_INET_EGRESS`` | ``cgroup_skb/egress`` | | 29+ +----------------------------------------+----------------------------------+-----------+ 30| | ``BPF_CGROUP_INET_INGRESS`` | ``cgroup_skb/ingress`` | | 31+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 32| ``BPF_PROG_TYPE_CGROUP_SOCKOPT`` | ``BPF_CGROUP_GETSOCKOPT`` | ``cgroup/getsockopt`` | | 33+ +----------------------------------------+----------------------------------+-----------+ 34| | ``BPF_CGROUP_SETSOCKOPT`` | ``cgroup/setsockopt`` | | 35+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 36| ``BPF_PROG_TYPE_CGROUP_SOCK_ADDR`` | ``BPF_CGROUP_INET4_BIND`` | ``cgroup/bind4`` | | 37+ +----------------------------------------+----------------------------------+-----------+ 38| | ``BPF_CGROUP_INET4_CONNECT`` | ``cgroup/connect4`` | | 39+ +----------------------------------------+----------------------------------+-----------+ 40| | ``BPF_CGROUP_INET4_GETPEERNAME`` | ``cgroup/getpeername4`` | | 41+ +----------------------------------------+----------------------------------+-----------+ 42| | ``BPF_CGROUP_INET4_GETSOCKNAME`` | ``cgroup/getsockname4`` | | 43+ +----------------------------------------+----------------------------------+-----------+ 44| | ``BPF_CGROUP_INET6_BIND`` | ``cgroup/bind6`` | | 45+ +----------------------------------------+----------------------------------+-----------+ 46| | ``BPF_CGROUP_INET6_CONNECT`` | ``cgroup/connect6`` | | 47+ +----------------------------------------+----------------------------------+-----------+ 48| | ``BPF_CGROUP_INET6_GETPEERNAME`` | ``cgroup/getpeername6`` | | 49+ +----------------------------------------+----------------------------------+-----------+ 50| | ``BPF_CGROUP_INET6_GETSOCKNAME`` | ``cgroup/getsockname6`` | | 51+ +----------------------------------------+----------------------------------+-----------+ 52| | ``BPF_CGROUP_UDP4_RECVMSG`` | ``cgroup/recvmsg4`` | | 53+ +----------------------------------------+----------------------------------+-----------+ 54| | ``BPF_CGROUP_UDP4_SENDMSG`` | ``cgroup/sendmsg4`` | | 55+ +----------------------------------------+----------------------------------+-----------+ 56| | ``BPF_CGROUP_UDP6_RECVMSG`` | ``cgroup/recvmsg6`` | | 57+ +----------------------------------------+----------------------------------+-----------+ 58| | ``BPF_CGROUP_UDP6_SENDMSG`` | ``cgroup/sendmsg6`` | | 59| +----------------------------------------+----------------------------------+-----------+ 60| | ``BPF_CGROUP_UNIX_CONNECT`` | ``cgroup/connect_unix`` | | 61| +----------------------------------------+----------------------------------+-----------+ 62| | ``BPF_CGROUP_UNIX_SENDMSG`` | ``cgroup/sendmsg_unix`` | | 63| +----------------------------------------+----------------------------------+-----------+ 64| | ``BPF_CGROUP_UNIX_RECVMSG`` | ``cgroup/recvmsg_unix`` | | 65| +----------------------------------------+----------------------------------+-----------+ 66| | ``BPF_CGROUP_UNIX_GETPEERNAME`` | ``cgroup/getpeername_unix`` | | 67| +----------------------------------------+----------------------------------+-----------+ 68| | ``BPF_CGROUP_UNIX_GETSOCKNAME`` | ``cgroup/getsockname_unix`` | | 69+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 70| ``BPF_PROG_TYPE_CGROUP_SOCK`` | ``BPF_CGROUP_INET4_POST_BIND`` | ``cgroup/post_bind4`` | | 71+ +----------------------------------------+----------------------------------+-----------+ 72| | ``BPF_CGROUP_INET6_POST_BIND`` | ``cgroup/post_bind6`` | | 73+ +----------------------------------------+----------------------------------+-----------+ 74| | ``BPF_CGROUP_INET_SOCK_CREATE`` | ``cgroup/sock_create`` | | 75+ + +----------------------------------+-----------+ 76| | | ``cgroup/sock`` | | 77+ +----------------------------------------+----------------------------------+-----------+ 78| | ``BPF_CGROUP_INET_SOCK_RELEASE`` | ``cgroup/sock_release`` | | 79+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 80| ``BPF_PROG_TYPE_CGROUP_SYSCTL`` | ``BPF_CGROUP_SYSCTL`` | ``cgroup/sysctl`` | | 81+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 82| ``BPF_PROG_TYPE_EXT`` | | ``freplace+`` [#fentry]_ | | 83+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 84| ``BPF_PROG_TYPE_FLOW_DISSECTOR`` | ``BPF_FLOW_DISSECTOR`` | ``flow_dissector`` | | 85+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 86| ``BPF_PROG_TYPE_KPROBE`` | | ``kprobe+`` [#kprobe]_ | | 87+ + +----------------------------------+-----------+ 88| | | ``kretprobe+`` [#kprobe]_ | | 89+ + +----------------------------------+-----------+ 90| | | ``ksyscall+`` [#ksyscall]_ | | 91+ + +----------------------------------+-----------+ 92| | | ``kretsyscall+`` [#ksyscall]_ | | 93+ + +----------------------------------+-----------+ 94| | | ``uprobe+`` [#uprobe]_ | | 95+ + +----------------------------------+-----------+ 96| | | ``uprobe.s+`` [#uprobe]_ | Yes | 97+ + +----------------------------------+-----------+ 98| | | ``uretprobe+`` [#uprobe]_ | | 99+ + +----------------------------------+-----------+ 100| | | ``uretprobe.s+`` [#uprobe]_ | Yes | 101+ + +----------------------------------+-----------+ 102| | | ``usdt+`` [#usdt]_ | | 103+ +----------------------------------------+----------------------------------+-----------+ 104| | ``BPF_TRACE_KPROBE_MULTI`` | ``kprobe.multi+`` [#kpmulti]_ | | 105+ + +----------------------------------+-----------+ 106| | | ``kretprobe.multi+`` [#kpmulti]_ | | 107+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 108| ``BPF_PROG_TYPE_LIRC_MODE2`` | ``BPF_LIRC_MODE2`` | ``lirc_mode2`` | | 109+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 110| ``BPF_PROG_TYPE_LSM`` | ``BPF_LSM_CGROUP`` | ``lsm_cgroup+`` | | 111+ +----------------------------------------+----------------------------------+-----------+ 112| | ``BPF_LSM_MAC`` | ``lsm+`` [#lsm]_ | | 113+ + +----------------------------------+-----------+ 114| | | ``lsm.s+`` [#lsm]_ | Yes | 115+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 116| ``BPF_PROG_TYPE_LWT_IN`` | | ``lwt_in`` | | 117+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 118| ``BPF_PROG_TYPE_LWT_OUT`` | | ``lwt_out`` | | 119+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 120| ``BPF_PROG_TYPE_LWT_SEG6LOCAL`` | | ``lwt_seg6local`` | | 121+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 122| ``BPF_PROG_TYPE_LWT_XMIT`` | | ``lwt_xmit`` | | 123+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 124| ``BPF_PROG_TYPE_PERF_EVENT`` | | ``perf_event`` | | 125+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 126| ``BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`` | | ``raw_tp.w+`` [#rawtp]_ | | 127+ + +----------------------------------+-----------+ 128| | | ``raw_tracepoint.w+`` | | 129+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 130| ``BPF_PROG_TYPE_RAW_TRACEPOINT`` | | ``raw_tp+`` [#rawtp]_ | | 131+ + +----------------------------------+-----------+ 132| | | ``raw_tracepoint+`` | | 133+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 134| ``BPF_PROG_TYPE_SCHED_ACT`` | | ``action`` | | 135+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 136| ``BPF_PROG_TYPE_SCHED_CLS`` | | ``classifier`` | | 137+ + +----------------------------------+-----------+ 138| | | ``tc`` | | 139+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 140| ``BPF_PROG_TYPE_SK_LOOKUP`` | ``BPF_SK_LOOKUP`` | ``sk_lookup`` | | 141+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 142| ``BPF_PROG_TYPE_SK_MSG`` | ``BPF_SK_MSG_VERDICT`` | ``sk_msg`` | | 143+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 144| ``BPF_PROG_TYPE_SK_REUSEPORT`` | ``BPF_SK_REUSEPORT_SELECT_OR_MIGRATE`` | ``sk_reuseport/migrate`` | | 145+ +----------------------------------------+----------------------------------+-----------+ 146| | ``BPF_SK_REUSEPORT_SELECT`` | ``sk_reuseport`` | | 147+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 148| ``BPF_PROG_TYPE_SK_SKB`` | | ``sk_skb`` | | 149+ +----------------------------------------+----------------------------------+-----------+ 150| | ``BPF_SK_SKB_STREAM_PARSER`` | ``sk_skb/stream_parser`` | | 151+ +----------------------------------------+----------------------------------+-----------+ 152| | ``BPF_SK_SKB_STREAM_VERDICT`` | ``sk_skb/stream_verdict`` | | 153+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 154| ``BPF_PROG_TYPE_SOCKET_FILTER`` | | ``socket`` | | 155+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 156| ``BPF_PROG_TYPE_SOCK_OPS`` | ``BPF_CGROUP_SOCK_OPS`` | ``sockops`` | | 157+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 158| ``BPF_PROG_TYPE_STRUCT_OPS`` | | ``struct_ops+`` | | 159+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 160| ``BPF_PROG_TYPE_SYSCALL`` | | ``syscall`` | Yes | 161+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 162| ``BPF_PROG_TYPE_TRACEPOINT`` | | ``tp+`` [#tp]_ | | 163+ + +----------------------------------+-----------+ 164| | | ``tracepoint+`` [#tp]_ | | 165+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 166| ``BPF_PROG_TYPE_TRACING`` | ``BPF_MODIFY_RETURN`` | ``fmod_ret+`` [#fentry]_ | | 167+ + +----------------------------------+-----------+ 168| | | ``fmod_ret.s+`` [#fentry]_ | Yes | 169+ +----------------------------------------+----------------------------------+-----------+ 170| | ``BPF_TRACE_FENTRY`` | ``fentry+`` [#fentry]_ | | 171+ + +----------------------------------+-----------+ 172| | | ``fentry.s+`` [#fentry]_ | Yes | 173+ +----------------------------------------+----------------------------------+-----------+ 174| | ``BPF_TRACE_FEXIT`` | ``fexit+`` [#fentry]_ | | 175+ + +----------------------------------+-----------+ 176| | | ``fexit.s+`` [#fentry]_ | Yes | 177+ +----------------------------------------+----------------------------------+-----------+ 178| | ``BPF_TRACE_ITER`` | ``iter+`` [#iter]_ | | 179+ + +----------------------------------+-----------+ 180| | | ``iter.s+`` [#iter]_ | Yes | 181+ +----------------------------------------+----------------------------------+-----------+ 182| | ``BPF_TRACE_RAW_TP`` | ``tp_btf+`` [#fentry]_ | | 183+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 184| ``BPF_PROG_TYPE_XDP`` | ``BPF_XDP_CPUMAP`` | ``xdp.frags/cpumap`` | | 185+ + +----------------------------------+-----------+ 186| | | ``xdp/cpumap`` | | 187+ +----------------------------------------+----------------------------------+-----------+ 188| | ``BPF_XDP_DEVMAP`` | ``xdp.frags/devmap`` | | 189+ + +----------------------------------+-----------+ 190| | | ``xdp/devmap`` | | 191+ +----------------------------------------+----------------------------------+-----------+ 192| | ``BPF_XDP`` | ``xdp.frags`` | | 193+ + +----------------------------------+-----------+ 194| | | ``xdp`` | | 195+-------------------------------------------+----------------------------------------+----------------------------------+-----------+ 196 197 198.. rubric:: Footnotes 199 200.. [#fentry] The ``fentry`` attach format is ``fentry[.s]/<function>``. 201.. [#kprobe] The ``kprobe`` attach format is ``kprobe/<function>[+<offset>]``. Valid 202 characters for ``function`` are ``a-zA-Z0-9_.`` and ``offset`` must be a valid 203 non-negative integer. 204.. [#ksyscall] The ``ksyscall`` attach format is ``ksyscall/<syscall>``. 205.. [#uprobe] The ``uprobe`` attach format is ``uprobe[.s]/<path>:<function>[+<offset>]``. 206.. [#usdt] The ``usdt`` attach format is ``usdt/<path>:<provider>:<name>``. 207.. [#kpmulti] The ``kprobe.multi`` attach format is ``kprobe.multi/<pattern>`` where ``pattern`` 208 supports ``*`` and ``?`` wildcards. Valid characters for pattern are 209 ``a-zA-Z0-9_.*?``. 210.. [#lsm] The ``lsm`` attachment format is ``lsm[.s]/<hook>``. 211.. [#rawtp] The ``raw_tp`` attach format is ``raw_tracepoint[.w]/<tracepoint>``. 212.. [#tp] The ``tracepoint`` attach format is ``tracepoint/<category>/<name>``. 213.. [#iter] The ``iter`` attach format is ``iter[.s]/<struct-name>``. 214