tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
docs/bpf: Add table of BPF program types to libbpf docs
Extend the libbpf documentation with a table of program types,
attach points and ELF section names.
Signed-off-by: Donald Hunter <donald.hunter@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Bagas Sanjaya <bagasdotme@gmail.com>
Acked-by: David Vernet <void@manifault.com>
Link: https://lore.kernel.org/bpf/20221121121734.98329-1-donald.hunter@gmail.com
authored by
Donald Hunter
and committed by
Andrii Nakryiko
c742cb7c
beb3d47d
+209
+3
Documentation/bpf/libbpf/index.rst
+3
Documentation/bpf/libbpf/index.rst
+203
Documentation/bpf/libbpf/program_types.rst
+203
Documentation/bpf/libbpf/program_types.rst
···
1
+
.. SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
2
+
3
+
.. _program_types_and_elf:
4
+
5
+
Program Types and ELF Sections
6
+
==============================
7
+
8
+
The table below lists the program types, their attach types where relevant and the ELF section
9
+
names supported by libbpf for them. The ELF section names follow these rules:
10
+
11
+
- ``type`` is an exact match, e.g. ``SEC("socket")``
12
+
- ``type+`` means it can be either exact ``SEC("type")`` or well-formed ``SEC("type/extras")``
13
+
with a '``/``' separator between ``type`` and ``extras``.
14
+
15
+
When ``extras`` are specified, they provide details of how to auto-attach the BPF program. The
16
+
format of ``extras`` depends on the program type, e.g. ``SEC("tracepoint/<category>/<name>")``
17
+
for tracepoints or ``SEC("usdt/<path>:<provider>:<name>")`` for USDT probes. The extras are
18
+
described in more detail in the footnotes.
19
+
20
+
21
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
22
+
| Program Type | Attach Type | ELF Section Name | Sleepable |
23
+
+===========================================+========================================+==================================+===========+
24
+
| ``BPF_PROG_TYPE_CGROUP_DEVICE`` | ``BPF_CGROUP_DEVICE`` | ``cgroup/dev`` | |
25
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
26
+
| ``BPF_PROG_TYPE_CGROUP_SKB`` | | ``cgroup/skb`` | |
27
+
+ +----------------------------------------+----------------------------------+-----------+
28
+
| | ``BPF_CGROUP_INET_EGRESS`` | ``cgroup_skb/egress`` | |
29
+
+ +----------------------------------------+----------------------------------+-----------+
30
+
| | ``BPF_CGROUP_INET_INGRESS`` | ``cgroup_skb/ingress`` | |
31
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
32
+
| ``BPF_PROG_TYPE_CGROUP_SOCKOPT`` | ``BPF_CGROUP_GETSOCKOPT`` | ``cgroup/getsockopt`` | |
33
+
+ +----------------------------------------+----------------------------------+-----------+
34
+
| | ``BPF_CGROUP_SETSOCKOPT`` | ``cgroup/setsockopt`` | |
35
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
36
+
| ``BPF_PROG_TYPE_CGROUP_SOCK_ADDR`` | ``BPF_CGROUP_INET4_BIND`` | ``cgroup/bind4`` | |
37
+
+ +----------------------------------------+----------------------------------+-----------+
38
+
| | ``BPF_CGROUP_INET4_CONNECT`` | ``cgroup/connect4`` | |
39
+
+ +----------------------------------------+----------------------------------+-----------+
40
+
| | ``BPF_CGROUP_INET4_GETPEERNAME`` | ``cgroup/getpeername4`` | |
41
+
+ +----------------------------------------+----------------------------------+-----------+
42
+
| | ``BPF_CGROUP_INET4_GETSOCKNAME`` | ``cgroup/getsockname4`` | |
43
+
+ +----------------------------------------+----------------------------------+-----------+
44
+
| | ``BPF_CGROUP_INET6_BIND`` | ``cgroup/bind6`` | |
45
+
+ +----------------------------------------+----------------------------------+-----------+
46
+
| | ``BPF_CGROUP_INET6_CONNECT`` | ``cgroup/connect6`` | |
47
+
+ +----------------------------------------+----------------------------------+-----------+
48
+
| | ``BPF_CGROUP_INET6_GETPEERNAME`` | ``cgroup/getpeername6`` | |
49
+
+ +----------------------------------------+----------------------------------+-----------+
50
+
| | ``BPF_CGROUP_INET6_GETSOCKNAME`` | ``cgroup/getsockname6`` | |
51
+
+ +----------------------------------------+----------------------------------+-----------+
52
+
| | ``BPF_CGROUP_UDP4_RECVMSG`` | ``cgroup/recvmsg4`` | |
53
+
+ +----------------------------------------+----------------------------------+-----------+
54
+
| | ``BPF_CGROUP_UDP4_SENDMSG`` | ``cgroup/sendmsg4`` | |
55
+
+ +----------------------------------------+----------------------------------+-----------+
56
+
| | ``BPF_CGROUP_UDP6_RECVMSG`` | ``cgroup/recvmsg6`` | |
57
+
+ +----------------------------------------+----------------------------------+-----------+
58
+
| | ``BPF_CGROUP_UDP6_SENDMSG`` | ``cgroup/sendmsg6`` | |
59
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
60
+
| ``BPF_PROG_TYPE_CGROUP_SOCK`` | ``BPF_CGROUP_INET4_POST_BIND`` | ``cgroup/post_bind4`` | |
61
+
+ +----------------------------------------+----------------------------------+-----------+
62
+
| | ``BPF_CGROUP_INET6_POST_BIND`` | ``cgroup/post_bind6`` | |
63
+
+ +----------------------------------------+----------------------------------+-----------+
64
+
| | ``BPF_CGROUP_INET_SOCK_CREATE`` | ``cgroup/sock_create`` | |
65
+
+ + +----------------------------------+-----------+
66
+
| | | ``cgroup/sock`` | |
67
+
+ +----------------------------------------+----------------------------------+-----------+
68
+
| | ``BPF_CGROUP_INET_SOCK_RELEASE`` | ``cgroup/sock_release`` | |
69
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
70
+
| ``BPF_PROG_TYPE_CGROUP_SYSCTL`` | ``BPF_CGROUP_SYSCTL`` | ``cgroup/sysctl`` | |
71
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
72
+
| ``BPF_PROG_TYPE_EXT`` | | ``freplace+`` [#fentry]_ | |
73
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
74
+
| ``BPF_PROG_TYPE_FLOW_DISSECTOR`` | ``BPF_FLOW_DISSECTOR`` | ``flow_dissector`` | |
75
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
76
+
| ``BPF_PROG_TYPE_KPROBE`` | | ``kprobe+`` [#kprobe]_ | |
77
+
+ + +----------------------------------+-----------+
78
+
| | | ``kretprobe+`` [#kprobe]_ | |
79
+
+ + +----------------------------------+-----------+
80
+
| | | ``ksyscall+`` [#ksyscall]_ | |
81
+
+ + +----------------------------------+-----------+
82
+
| | | ``kretsyscall+`` [#ksyscall]_ | |
83
+
+ + +----------------------------------+-----------+
84
+
| | | ``uprobe+`` [#uprobe]_ | |
85
+
+ + +----------------------------------+-----------+
86
+
| | | ``uprobe.s+`` [#uprobe]_ | Yes |
87
+
+ + +----------------------------------+-----------+
88
+
| | | ``uretprobe+`` [#uprobe]_ | |
89
+
+ + +----------------------------------+-----------+
90
+
| | | ``uretprobe.s+`` [#uprobe]_ | Yes |
91
+
+ + +----------------------------------+-----------+
92
+
| | | ``usdt+`` [#usdt]_ | |
93
+
+ +----------------------------------------+----------------------------------+-----------+
94
+
| | ``BPF_TRACE_KPROBE_MULTI`` | ``kprobe.multi+`` [#kpmulti]_ | |
95
+
+ + +----------------------------------+-----------+
96
+
| | | ``kretprobe.multi+`` [#kpmulti]_ | |
97
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
98
+
| ``BPF_PROG_TYPE_LIRC_MODE2`` | ``BPF_LIRC_MODE2`` | ``lirc_mode2`` | |
99
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
100
+
| ``BPF_PROG_TYPE_LSM`` | ``BPF_LSM_CGROUP`` | ``lsm_cgroup+`` | |
101
+
+ +----------------------------------------+----------------------------------+-----------+
102
+
| | ``BPF_LSM_MAC`` | ``lsm+`` [#lsm]_ | |
103
+
+ + +----------------------------------+-----------+
104
+
| | | ``lsm.s+`` [#lsm]_ | Yes |
105
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
106
+
| ``BPF_PROG_TYPE_LWT_IN`` | | ``lwt_in`` | |
107
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
108
+
| ``BPF_PROG_TYPE_LWT_OUT`` | | ``lwt_out`` | |
109
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
110
+
| ``BPF_PROG_TYPE_LWT_SEG6LOCAL`` | | ``lwt_seg6local`` | |
111
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
112
+
| ``BPF_PROG_TYPE_LWT_XMIT`` | | ``lwt_xmit`` | |
113
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
114
+
| ``BPF_PROG_TYPE_PERF_EVENT`` | | ``perf_event`` | |
115
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
116
+
| ``BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`` | | ``raw_tp.w+`` [#rawtp]_ | |
117
+
+ + +----------------------------------+-----------+
118
+
| | | ``raw_tracepoint.w+`` | |
119
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
120
+
| ``BPF_PROG_TYPE_RAW_TRACEPOINT`` | | ``raw_tp+`` [#rawtp]_ | |
121
+
+ + +----------------------------------+-----------+
122
+
| | | ``raw_tracepoint+`` | |
123
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
124
+
| ``BPF_PROG_TYPE_SCHED_ACT`` | | ``action`` | |
125
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
126
+
| ``BPF_PROG_TYPE_SCHED_CLS`` | | ``classifier`` | |
127
+
+ + +----------------------------------+-----------+
128
+
| | | ``tc`` | |
129
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
130
+
| ``BPF_PROG_TYPE_SK_LOOKUP`` | ``BPF_SK_LOOKUP`` | ``sk_lookup`` | |
131
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
132
+
| ``BPF_PROG_TYPE_SK_MSG`` | ``BPF_SK_MSG_VERDICT`` | ``sk_msg`` | |
133
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
134
+
| ``BPF_PROG_TYPE_SK_REUSEPORT`` | ``BPF_SK_REUSEPORT_SELECT_OR_MIGRATE`` | ``sk_reuseport/migrate`` | |
135
+
+ +----------------------------------------+----------------------------------+-----------+
136
+
| | ``BPF_SK_REUSEPORT_SELECT`` | ``sk_reuseport`` | |
137
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
138
+
| ``BPF_PROG_TYPE_SK_SKB`` | | ``sk_skb`` | |
139
+
+ +----------------------------------------+----------------------------------+-----------+
140
+
| | ``BPF_SK_SKB_STREAM_PARSER`` | ``sk_skb/stream_parser`` | |
141
+
+ +----------------------------------------+----------------------------------+-----------+
142
+
| | ``BPF_SK_SKB_STREAM_VERDICT`` | ``sk_skb/stream_verdict`` | |
143
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
144
+
| ``BPF_PROG_TYPE_SOCKET_FILTER`` | | ``socket`` | |
145
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
146
+
| ``BPF_PROG_TYPE_SOCK_OPS`` | ``BPF_CGROUP_SOCK_OPS`` | ``sockops`` | |
147
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
148
+
| ``BPF_PROG_TYPE_STRUCT_OPS`` | | ``struct_ops+`` | |
149
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
150
+
| ``BPF_PROG_TYPE_SYSCALL`` | | ``syscall`` | Yes |
151
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
152
+
| ``BPF_PROG_TYPE_TRACEPOINT`` | | ``tp+`` [#tp]_ | |
153
+
+ + +----------------------------------+-----------+
154
+
| | | ``tracepoint+`` [#tp]_ | |
155
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
156
+
| ``BPF_PROG_TYPE_TRACING`` | ``BPF_MODIFY_RETURN`` | ``fmod_ret+`` [#fentry]_ | |
157
+
+ + +----------------------------------+-----------+
158
+
| | | ``fmod_ret.s+`` [#fentry]_ | Yes |
159
+
+ +----------------------------------------+----------------------------------+-----------+
160
+
| | ``BPF_TRACE_FENTRY`` | ``fentry+`` [#fentry]_ | |
161
+
+ + +----------------------------------+-----------+
162
+
| | | ``fentry.s+`` [#fentry]_ | Yes |
163
+
+ +----------------------------------------+----------------------------------+-----------+
164
+
| | ``BPF_TRACE_FEXIT`` | ``fexit+`` [#fentry]_ | |
165
+
+ + +----------------------------------+-----------+
166
+
| | | ``fexit.s+`` [#fentry]_ | Yes |
167
+
+ +----------------------------------------+----------------------------------+-----------+
168
+
| | ``BPF_TRACE_ITER`` | ``iter+`` [#iter]_ | |
169
+
+ + +----------------------------------+-----------+
170
+
| | | ``iter.s+`` [#iter]_ | Yes |
171
+
+ +----------------------------------------+----------------------------------+-----------+
172
+
| | ``BPF_TRACE_RAW_TP`` | ``tp_btf+`` [#fentry]_ | |
173
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
174
+
| ``BPF_PROG_TYPE_XDP`` | ``BPF_XDP_CPUMAP`` | ``xdp.frags/cpumap`` | |
175
+
+ + +----------------------------------+-----------+
176
+
| | | ``xdp/cpumap`` | |
177
+
+ +----------------------------------------+----------------------------------+-----------+
178
+
| | ``BPF_XDP_DEVMAP`` | ``xdp.frags/devmap`` | |
179
+
+ + +----------------------------------+-----------+
180
+
| | | ``xdp/devmap`` | |
181
+
+ +----------------------------------------+----------------------------------+-----------+
182
+
| | ``BPF_XDP`` | ``xdp.frags`` | |
183
+
+ + +----------------------------------+-----------+
184
+
| | | ``xdp`` | |
185
+
+-------------------------------------------+----------------------------------------+----------------------------------+-----------+
186
+
187
+
188
+
.. rubric:: Footnotes
189
+
190
+
.. [#fentry] The ``fentry`` attach format is ``fentry[.s]/<function>``.
191
+
.. [#kprobe] The ``kprobe`` attach format is ``kprobe/<function>[+<offset>]``. Valid
192
+
characters for ``function`` are ``a-zA-Z0-9_.`` and ``offset`` must be a valid
193
+
non-negative integer.
194
+
.. [#ksyscall] The ``ksyscall`` attach format is ``ksyscall/<syscall>``.
195
+
.. [#uprobe] The ``uprobe`` attach format is ``uprobe[.s]/<path>:<function>[+<offset>]``.
196
+
.. [#usdt] The ``usdt`` attach format is ``usdt/<path>:<provider>:<name>``.
197
+
.. [#kpmulti] The ``kprobe.multi`` attach format is ``kprobe.multi/<pattern>`` where ``pattern``
198
+
supports ``*`` and ``?`` wildcards. Valid characters for pattern are
199
+
``a-zA-Z0-9_.*?``.
200
+
.. [#lsm] The ``lsm`` attachment format is ``lsm[.s]/<hook>``.
201
+
.. [#rawtp] The ``raw_tp`` attach format is ``raw_tracepoint[.w]/<tracepoint>``.
202
+
.. [#tp] The ``tracepoint`` attach format is ``tracepoint/<category>/<name>``.
203
+
.. [#iter] The ``iter`` attach format is ``iter[.s]/<struct-name>``.