LIBBPF API

Error Handling

When libbpf is used in “libbpf 1.0 mode”, API functions can return errors in one of two ways.

You can set “libbpf 1.0” mode with the following line:

libbpf_set_strict_mode(LIBBPF_STRICT_DIRECT_ERRS | LIBBPF_STRICT_CLEAN_PTRS);

If the function returns an error code directly, it uses 0 to indicate success and a negative error code to indicate what caused the error. In this case the error code should be checked directly from the return, you do not need to check errno.

For example:

err = some_libbpf_api_with_error_return(...);
if (err < 0) {
    /* Handle error accordingly */
}

If the function returns a pointer, it will return NULL to indicate there was an error. In this case errno should be checked for the error code.

For example:

ptr = some_libbpf_api_returning_ptr();
if (!ptr) {
    /* note no minus sign for EINVAL and E2BIG below */
    if (errno == EINVAL) {
       /* handle EINVAL error */
    } else if (errno == E2BIG) {
       /* handle E2BIG error */
    }
}

libbpf.h

Functions

LIBBPF_API __u32 libbpf_major_version (void)

LIBBPF_API __u32 libbpf_minor_version (void)

LIBBPF_API const char * libbpf_version_string (void)

LIBBPF_API int libbpf_strerror (int err, char *buf, size_t size)

LIBBPF_API const char * libbpf_bpf_attach_type_str (enum bpf_attach_type t)

libbpf_bpf_attach_type_str() converts the provided attach type value into a textual representation.

Parameters:

t – The attach type.

Returns:

Pointer to a static string identifying the attach type. NULL is returned for unknown bpf_attach_type values.

LIBBPF_API const char * libbpf_bpf_link_type_str (enum bpf_link_type t)

libbpf_bpf_link_type_str() converts the provided link type value into a textual representation.

Parameters:

t – The link type.

Returns:

Pointer to a static string identifying the link type. NULL is returned for unknown bpf_link_type values.

LIBBPF_API const char * libbpf_bpf_map_type_str (enum bpf_map_type t)

libbpf_bpf_map_type_str() converts the provided map type value into a textual representation.

Parameters:

t – The map type.

Returns:

Pointer to a static string identifying the map type. NULL is returned for unknown bpf_map_type values.

LIBBPF_API const char * libbpf_bpf_prog_type_str (enum bpf_prog_type t)

libbpf_bpf_prog_type_str() converts the provided program type value into a textual representation.

Parameters:

t – The program type.

Returns:

Pointer to a static string identifying the program type. NULL is returned for unknown bpf_prog_type values.

LIBBPF_API libbpf_print_fn_t libbpf_set_print (libbpf_print_fn_t fn)

LIBBPF_API struct bpf_object * bpf_object__open (const char *path)

LIBBPF_API struct bpf_object * bpf_object__open_file (const char *path, const struct bpf_object_open_opts *opts)

bpf_object__open_file() creates a bpf_object by opening the BPF ELF object file pointed to by the passed path and loading it into memory.

Parameters:

• path – BPF object file path

• opts – options for how to load the bpf object, this parameter is optional and can be set to NULL

Returns:

pointer to the new bpf_object; or NULL is returned on error, error code is stored in errno

LIBBPF_API struct bpf_object * bpf_object__open_mem (const void *obj_buf, size_t obj_buf_sz, const struct bpf_object_open_opts *opts)

bpf_object__open_mem() creates a bpf_object by reading the BPF objects raw bytes from a memory buffer containing a valid BPF ELF object file.

Parameters:

• obj_buf – pointer to the buffer containing ELF file bytes

• obj_buf_sz – number of bytes in the buffer

• opts – options for how to load the bpf object

Returns:

pointer to the new bpf_object; or NULL is returned on error, error code is stored in errno

LIBBPF_API int bpf_object__load (struct bpf_object *obj)

LIBBPF_API void bpf_object__close (struct bpf_object *object)

LIBBPF_API int bpf_object__pin_maps (struct bpf_object *obj, const char *path)

LIBBPF_API int bpf_object__unpin_maps (struct bpf_object *obj, const char *path)

LIBBPF_API int bpf_object__pin_programs (struct bpf_object *obj, const char *path)

LIBBPF_API int bpf_object__unpin_programs (struct bpf_object *obj, const char *path)

LIBBPF_API int bpf_object__pin (struct bpf_object *object, const char *path)

LIBBPF_API const char * bpf_object__name (const struct bpf_object *obj)

LIBBPF_API unsigned int bpf_object__kversion (const struct bpf_object *obj)

LIBBPF_API int bpf_object__set_kversion (struct bpf_object *obj, __u32 kern_version)

LIBBPF_API struct btf * bpf_object__btf (const struct bpf_object *obj)

LIBBPF_API int bpf_object__btf_fd (const struct bpf_object *obj)

LIBBPF_API struct bpf_program * bpf_object__find_program_by_name (const struct bpf_object *obj, const char *name)

LIBBPF_API int libbpf_prog_type_by_name (const char *name, enum bpf_prog_type *prog_type, enum bpf_attach_type *expected_attach_type)

LIBBPF_API int libbpf_attach_type_by_name (const char *name, enum bpf_attach_type *attach_type)

LIBBPF_API int libbpf_find_vmlinux_btf_id (const char *name, enum bpf_attach_type attach_type)

LIBBPF_API struct bpf_program * bpf_object__next_program (const struct bpf_object *obj, struct bpf_program *prog)

LIBBPF_API struct bpf_program * bpf_object__prev_program (const struct bpf_object *obj, struct bpf_program *prog)

LIBBPF_API void bpf_program__set_ifindex (struct bpf_program *prog, __u32 ifindex)

LIBBPF_API const char * bpf_program__name (const struct bpf_program *prog)

LIBBPF_API const char * bpf_program__section_name (const struct bpf_program *prog)

LIBBPF_API bool bpf_program__autoload (const struct bpf_program *prog)

LIBBPF_API int bpf_program__set_autoload (struct bpf_program *prog, bool autoload)

LIBBPF_API bool bpf_program__autoattach (const struct bpf_program *prog)

LIBBPF_API void bpf_program__set_autoattach (struct bpf_program *prog, bool autoattach)

LIBBPF_API const struct bpf_insn * bpf_program__insns (const struct bpf_program *prog)

bpf_program__insns() gives read-only access to BPF program’s underlying BPF instructions.

Returned pointer is always valid and not NULL. Number of struct bpf_insn pointed to can be fetched using bpf_program__insn_cnt() API.

Keep in mind, libbpf can modify and append/delete BPF program’s instructions as it processes BPF object file and prepares everything for uploading into the kernel. So depending on the point in BPF object lifetime, bpf_program__insns() can return different sets of instructions. As an example, during BPF object load phase BPF program instructions will be CO-RE-relocated, BPF subprograms instructions will be appended, ldimm64 instructions will have FDs embedded, etc. So instructions returned before bpf_object__load() and after it might be quite different.

Parameters:

prog – BPF program for which to return instructions

Returns:

a pointer to an array of BPF instructions that belong to the specified BPF program

LIBBPF_API int bpf_program__set_insns (struct bpf_program *prog, struct bpf_insn *new_insns, size_t new_insn_cnt)

bpf_program__set_insns() can set BPF program’s underlying BPF instructions.

WARNING: This is a very advanced libbpf API and users need to know what they are doing. This should be used from prog_prepare_load_fn callback only.

Parameters:

• prog – BPF program for which to return instructions

• new_insns – a pointer to an array of BPF instructions

• new_insn_cnt – number of struct bpf_insn’s that form specified BPF program

Returns:

0, on success; negative error code, otherwise

LIBBPF_API size_t bpf_program__insn_cnt (const struct bpf_program *prog)

bpf_program__insn_cnt() returns number of struct bpf_insn’s that form specified BPF program.

See bpf_program__insns() documentation for notes on how libbpf can change instructions and their count during different phases of bpf_object lifetime.

Parameters:

prog – BPF program for which to return number of BPF instructions

LIBBPF_API int bpf_program__fd (const struct bpf_program *prog)

LIBBPF_API int bpf_program__pin (struct bpf_program *prog, const char *path)

bpf_program__pin() pins the BPF program to a file in the BPF FS specified by a path. This increments the programs reference count, allowing it to stay loaded after the process which loaded it has exited.

Parameters:

• prog – BPF program to pin, must already be loaded

• path – file path in a BPF file system

Returns:

0, on success; negative error code, otherwise

LIBBPF_API int bpf_program__unpin (struct bpf_program *prog, const char *path)

bpf_program__unpin() unpins the BPF program from a file in the BPFFS specified by a path. This decrements the programs reference count.

The file pinning the BPF program can also be unlinked by a different process in which case this function will return an error.

Parameters:

• prog – BPF program to unpin

• path – file path to the pin in a BPF file system

Returns:

0, on success; negative error code, otherwise

LIBBPF_API void bpf_program__unload (struct bpf_program *prog)

LIBBPF_API struct bpf_link * bpf_link__open (const char *path)

LIBBPF_API int bpf_link__fd (const struct bpf_link *link)

LIBBPF_API const char * bpf_link__pin_path (const struct bpf_link *link)

LIBBPF_API int bpf_link__pin (struct bpf_link *link, const char *path)

bpf_link__pin() pins the BPF link to a file in the BPF FS specified by a path. This increments the links reference count, allowing it to stay loaded after the process which loaded it has exited.

Parameters:

• link – BPF link to pin, must already be loaded

• path – file path in a BPF file system

Returns:

0, on success; negative error code, otherwise

LIBBPF_API int bpf_link__unpin (struct bpf_link *link)

bpf_link__unpin() unpins the BPF link from a file in the BPFFS specified by a path. This decrements the links reference count.

The file pinning the BPF link can also be unlinked by a different process in which case this function will return an error.

Parameters:

• prog – BPF program to unpin

• path – file path to the pin in a BPF file system

Returns:

0, on success; negative error code, otherwise

LIBBPF_API int bpf_link__update_program (struct bpf_link *link, struct bpf_program *prog)

LIBBPF_API void bpf_link__disconnect (struct bpf_link *link)

LIBBPF_API int bpf_link__detach (struct bpf_link *link)

LIBBPF_API int bpf_link__destroy (struct bpf_link *link)

LIBBPF_API struct bpf_link * bpf_program__attach (const struct bpf_program *prog)

bpf_program__attach() is a generic function for attaching a BPF program based on auto-detection of program type, attach type, and extra paremeters, where applicable.

This is supported for:

• kprobe/kretprobe (depends on SEC() definition)

• uprobe/uretprobe (depends on SEC() definition)

• tracepoint

• raw tracepoint

• tracing programs (typed raw TP/fentry/fexit/fmod_ret)

Parameters:

prog – BPF program to attach

Returns:

Reference to the newly created BPF link; or NULL is returned on error, error code is stored in errno

LIBBPF_API struct bpf_link * bpf_program__attach_perf_event (const struct bpf_program *prog, int pfd)

LIBBPF_API struct bpf_link * bpf_program__attach_perf_event_opts (const struct bpf_program *prog, int pfd, const struct bpf_perf_event_opts *opts)

LIBBPF_API struct bpf_link * bpf_program__attach_kprobe (const struct bpf_program *prog, bool retprobe, const char *func_name)

LIBBPF_API struct bpf_link * bpf_program__attach_kprobe_opts (const struct bpf_program *prog, const char *func_name, const struct bpf_kprobe_opts *opts)

LIBBPF_API struct bpf_link * bpf_program__attach_kprobe_multi_opts (const struct bpf_program *prog, const char *pattern, const struct bpf_kprobe_multi_opts *opts)

LIBBPF_API struct bpf_link * bpf_program__attach_ksyscall (const struct bpf_program *prog, const char *syscall_name, const struct bpf_ksyscall_opts *opts)

bpf_program__attach_ksyscall() attaches a BPF program to kernel syscall handler of a specified syscall. Optionally it’s possible to request to install retprobe that will be triggered at syscall exit. It’s also possible to associate BPF cookie (though options).

Libbpf automatically will determine correct full kernel function name, which depending on system architecture and kernel version/configuration could be of the form __<arch>_sys_<syscall> or __se_sys_<syscall>, and will attach specified program using kprobe/kretprobe mechanism.

bpf_program__attach_ksyscall() is an API counterpart of declarative SEC(“ksyscall/<syscall>”) annotation of BPF programs.

At the moment SEC(“ksyscall”) and bpf_program__attach_ksyscall() do not handle all the calling convention quirks for mmap(), clone() and compat syscalls. It also only attaches to “native” syscall interfaces. If host system supports compat syscalls or defines 32-bit syscalls in 64-bit kernel, such syscall interfaces won’t be attached to by libbpf.

These limitations may or may not change in the future. Therefore it is recommended to use SEC(“kprobe”) for these syscalls or if working with compat and 32-bit interfaces is required.

Parameters:

• prog – BPF program to attach

• syscall_name – Symbolic name of the syscall (e.g., “bpf”)

• opts – Additional options (see struct bpf_ksyscall_opts)

Returns:

Reference to the newly created BPF link; or NULL is returned on error, error code is stored in errno

LIBBPF_API struct bpf_link * bpf_program__attach_uprobe (const struct bpf_program *prog, bool retprobe, pid_t pid, const char *binary_path, size_t func_offset)

bpf_program__attach_uprobe() attaches a BPF program to the userspace function which is found by binary path and offset. You can optionally specify a particular proccess to attach to. You can also optionally attach the program to the function exit instead of entry.

Parameters:

• prog – BPF program to attach

• retprobe – Attach to function exit

• pid – Process ID to attach the uprobe to, 0 for self (own process), -1 for all processes

• binary_path – Path to binary that contains the function symbol

• func_offset – Offset within the binary of the function symbol

Returns:

Reference to the newly created BPF link; or NULL is returned on error, error code is stored in errno

LIBBPF_API struct bpf_link * bpf_program__attach_uprobe_opts (const struct bpf_program *prog, pid_t pid, const char *binary_path, size_t func_offset, const struct bpf_uprobe_opts *opts)

bpf_program__attach_uprobe_opts() is just like bpf_program__attach_uprobe() except with a options struct for various configurations.

Parameters:

• prog – BPF program to attach

• pid – Process ID to attach the uprobe to, 0 for self (own process), -1 for all processes

• binary_path – Path to binary that contains the function symbol

• func_offset – Offset within the binary of the function symbol

• opts – Options for altering program attachment

Returns:

Reference to the newly created BPF link; or NULL is returned on error, error code is stored in errno

LIBBPF_API struct bpf_link * bpf_program__attach_usdt (const struct bpf_program *prog, pid_t pid, const char *binary_path, const char *usdt_provider, const char *usdt_name, const struct bpf_usdt_opts *opts)

bpf_program__attach_usdt() is just like bpf_program__attach_uprobe_opts() except it covers USDT (User-space Statically Defined Tracepoint) attachment, instead of attaching to user-space function entry or exit.

Parameters:

• prog – BPF program to attach

• pid – Process ID to attach the uprobe to, 0 for self (own process), -1 for all processes

• binary_path – Path to binary that contains provided USDT probe

• usdt_provider – USDT provider name

• usdt_name – USDT probe name

• opts – Options for altering program attachment

Returns:

Reference to the newly created BPF link; or NULL is returned on error, error code is stored in errno

LIBBPF_API struct bpf_link * bpf_program__attach_tracepoint (const struct bpf_program *prog, const char *tp_category, const char *tp_name)

LIBBPF_API struct bpf_link * bpf_program__attach_tracepoint_opts (const struct bpf_program *prog, const char *tp_category, const char *tp_name, const struct bpf_tracepoint_opts *opts)

LIBBPF_API struct bpf_link * bpf_program__attach_raw_tracepoint (const struct bpf_program *prog, const char *tp_name)

LIBBPF_API struct bpf_link * bpf_program__attach_trace (const struct bpf_program *prog)

LIBBPF_API struct bpf_link * bpf_program__attach_trace_opts (const struct bpf_program *prog, const struct bpf_trace_opts *opts)

LIBBPF_API struct bpf_link * bpf_program__attach_lsm (const struct bpf_program *prog)

LIBBPF_API struct bpf_link * bpf_program__attach_cgroup (const struct bpf_program *prog, int cgroup_fd)

LIBBPF_API struct bpf_link * bpf_program__attach_netns (const struct bpf_program *prog, int netns_fd)

LIBBPF_API struct bpf_link * bpf_program__attach_xdp (const struct bpf_program *prog, int ifindex)

LIBBPF_API struct bpf_link * bpf_program__attach_freplace (const struct bpf_program *prog, int target_fd, const char *attach_func_name)

LIBBPF_API struct bpf_link * bpf_map__attach_struct_ops (const struct bpf_map *map)

LIBBPF_API struct bpf_link * bpf_program__attach_iter (const struct bpf_program *prog, const struct bpf_iter_attach_opts *opts)

LIBBPF_API enum bpf_prog_type bpf_program__type (const struct bpf_program *prog)

LIBBPF_API int bpf_program__set_type (struct bpf_program *prog, enum bpf_prog_type type)

bpf_program__set_type() sets the program type of the passed BPF program.

This must be called before the BPF object is loaded, otherwise it has no effect and an error is returned.

Parameters:

• prog – BPF program to set the program type for

• type – program type to set the BPF map to have

Returns:

error code; or 0 if no error. An error occurs if the object is already loaded.

LIBBPF_API enum bpf_attach_type bpf_program__expected_attach_type (const struct bpf_program *prog)

LIBBPF_API int bpf_program__set_expected_attach_type (struct bpf_program *prog, enum bpf_attach_type type)

bpf_program__set_expected_attach_type() sets the attach type of the passed BPF program. This is used for auto-detection of attachment when programs are loaded.

This must be called before the BPF object is loaded, otherwise it has no effect and an error is returned.

Parameters:

• prog – BPF program to set the attach type for

• type – attach type to set the BPF map to have

Returns:

error code; or 0 if no error. An error occurs if the object is already loaded.

LIBBPF_API __u32 bpf_program__flags (const struct bpf_program *prog)

LIBBPF_API int bpf_program__set_flags (struct bpf_program *prog, __u32 flags)

LIBBPF_API __u32 bpf_program__log_level (const struct bpf_program *prog)

LIBBPF_API int bpf_program__set_log_level (struct bpf_program *prog, __u32 log_level)

LIBBPF_API const char * bpf_program__log_buf (const struct bpf_program *prog, size_t *log_size)

LIBBPF_API int bpf_program__set_log_buf (struct bpf_program *prog, char *log_buf, size_t log_size)

LIBBPF_API int bpf_program__set_attach_target (struct bpf_program *prog, int attach_prog_fd, const char *attach_func_name)

bpf_program__set_attach_target() sets BTF-based attach target for supported BPF program types:

• BTF-aware raw tracepoints (tp_btf);

• fentry/fexit/fmod_ret;

• lsm;

• freplace.

Parameters:

• prog – BPF program to set the attach type for

• type – attach type to set the BPF map to have

Returns:

error code; or 0 if no error occurred.

LIBBPF_API struct bpf_map * bpf_object__find_map_by_name (const struct bpf_object *obj, const char *name)

bpf_object__find_map_by_name() returns BPF map of the given name, if it exists within the passed BPF object

Parameters:

• obj – BPF object

• name – name of the BPF map

Returns:

BPF map instance, if such map exists within the BPF object; or NULL otherwise.

LIBBPF_API int bpf_object__find_map_fd_by_name (const struct bpf_object *obj, const char *name)

LIBBPF_API struct bpf_map * bpf_object__next_map (const struct bpf_object *obj, const struct bpf_map *map)

LIBBPF_API struct bpf_map * bpf_object__prev_map (const struct bpf_object *obj, const struct bpf_map *map)

LIBBPF_API int bpf_map__set_autocreate (struct bpf_map *map, bool autocreate)

bpf_map__set_autocreate() sets whether libbpf has to auto-create BPF map during BPF object load phase.

bpf_map__set_autocreate() allows to opt-out from libbpf auto-creating BPF map. By default, libbpf will attempt to create every single BPF map defined in BPF object file using BPF_MAP_CREATE command of bpf() syscall and fill in map FD in BPF instructions.

This API allows to opt-out of this process for specific map instance. This can be useful if host kernel doesn’t support such BPF map type or used combination of flags and user application wants to avoid creating such a map in the first place. User is still responsible to make sure that their BPF-side code that expects to use such missing BPF map is recognized by BPF verifier as dead code, otherwise BPF verifier will reject such BPF program.

Parameters:

• map – the BPF map instance

• autocreate – whether to create BPF map during BPF object load

Returns:

0 on success; -EBUSY if BPF object was already loaded

LIBBPF_API bool bpf_map__autocreate (const struct bpf_map *map)

LIBBPF_API int bpf_map__fd (const struct bpf_map *map)

bpf_map__fd() gets the file descriptor of the passed BPF map

Parameters:

map – the BPF map instance

Returns:

the file descriptor; or -EINVAL in case of an error

LIBBPF_API int bpf_map__reuse_fd (struct bpf_map *map, int fd)

LIBBPF_API const char * bpf_map__name (const struct bpf_map *map)

LIBBPF_API enum bpf_map_type bpf_map__type (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_type (struct bpf_map *map, enum bpf_map_type type)

LIBBPF_API __u32 bpf_map__max_entries (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_max_entries (struct bpf_map *map, __u32 max_entries)

LIBBPF_API __u32 bpf_map__map_flags (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_map_flags (struct bpf_map *map, __u32 flags)

LIBBPF_API __u32 bpf_map__numa_node (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_numa_node (struct bpf_map *map, __u32 numa_node)

LIBBPF_API __u32 bpf_map__key_size (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_key_size (struct bpf_map *map, __u32 size)

LIBBPF_API __u32 bpf_map__value_size (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_value_size (struct bpf_map *map, __u32 size)

LIBBPF_API __u32 bpf_map__btf_key_type_id (const struct bpf_map *map)

LIBBPF_API __u32 bpf_map__btf_value_type_id (const struct bpf_map *map)

LIBBPF_API __u32 bpf_map__ifindex (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_ifindex (struct bpf_map *map, __u32 ifindex)

LIBBPF_API __u64 bpf_map__map_extra (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_map_extra (struct bpf_map *map, __u64 map_extra)

LIBBPF_API int bpf_map__set_initial_value (struct bpf_map *map, const void *data, size_t size)

LIBBPF_API const void * bpf_map__initial_value (struct bpf_map *map, size_t *psize)

LIBBPF_API bool bpf_map__is_internal (const struct bpf_map *map)

bpf_map__is_internal() tells the caller whether or not the passed map is a special map created by libbpf automatically for things like global variables, __ksym externs, Kconfig values, etc

Parameters:

map – the bpf_map

Returns:

true, if the map is an internal map; false, otherwise

LIBBPF_API int bpf_map__set_pin_path (struct bpf_map *map, const char *path)

LIBBPF_API const char * bpf_map__pin_path (const struct bpf_map *map)

LIBBPF_API bool bpf_map__is_pinned (const struct bpf_map *map)

LIBBPF_API int bpf_map__pin (struct bpf_map *map, const char *path)

LIBBPF_API int bpf_map__unpin (struct bpf_map *map, const char *path)

LIBBPF_API int bpf_map__set_inner_map_fd (struct bpf_map *map, int fd)

LIBBPF_API struct bpf_map * bpf_map__inner_map (struct bpf_map *map)

LIBBPF_API int bpf_map__lookup_elem (const struct bpf_map *map, const void *key, size_t key_sz, void *value, size_t value_sz, __u64 flags)

bpf_map__lookup_elem() allows to lookup BPF map value corresponding to provided key.

bpf_map__lookup_elem() is high-level equivalent of bpf_map_lookup_elem() API with added check for key and value size.

Parameters:

• map – BPF map to lookup element in

• key – pointer to memory containing bytes of the key used for lookup

• key_sz – size in bytes of key data, needs to match BPF map definition’s key_size

• value – pointer to memory in which looked up value will be stored

• value_sz – size in byte of value data memory; it has to match BPF map definition’s value_size. For per-CPU BPF maps value size has to be a product of BPF map value size and number of possible CPUs in the system (could be fetched with libbpf_num_possible_cpus()). Note also that for per-CPU values value size has to be aligned up to closest 8 bytes for alignment reasons, so expected size is: round_up(value_size, 8)

Returns:

0, on success; negative error, otherwise

LIBBPF_API int bpf_map__update_elem (const struct bpf_map *map, const void *key, size_t key_sz, const void *value, size_t value_sz, __u64 flags)

bpf_map__update_elem() allows to insert or update value in BPF map that corresponds to provided key.

bpf_map__update_elem() is high-level equivalent of bpf_map_update_elem() API with added check for key and value size.

Parameters:

• map – BPF map to insert to or update element in

• key – pointer to memory containing bytes of the key

• key_sz – size in bytes of key data, needs to match BPF map definition’s key_size

• value – pointer to memory containing bytes of the value

• value_sz – size in byte of value data memory; it has to match BPF map definition’s value_size. For per-CPU BPF maps value size has to be a product of BPF map value size and number of possible CPUs in the system (could be fetched with libbpf_num_possible_cpus()). Note also that for per-CPU values value size has to be aligned up to closest 8 bytes for alignment reasons, so expected size is: round_up(value_size, 8)

Returns:

0, on success; negative error, otherwise

LIBBPF_API int bpf_map__delete_elem (const struct bpf_map *map, const void *key, size_t key_sz, __u64 flags)

bpf_map__delete_elem() allows to delete element in BPF map that corresponds to provided key.

bpf_map__delete_elem() is high-level equivalent of bpf_map_delete_elem() API with added check for key size.

Parameters:

• map – BPF map to delete element from

• key – pointer to memory containing bytes of the key

• key_sz – size in bytes of key data, needs to match BPF map definition’s key_size extra flags passed to kernel for this operation

Returns:

0, on success; negative error, otherwise

LIBBPF_API int bpf_map__lookup_and_delete_elem (const struct bpf_map *map, const void *key, size_t key_sz, void *value, size_t value_sz, __u64 flags)

bpf_map__lookup_and_delete_elem() allows to lookup BPF map value corresponding to provided key and atomically delete it afterwards.

bpf_map__lookup_and_delete_elem() is high-level equivalent of bpf_map_lookup_and_delete_elem() API with added check for key and value size.

Parameters:

• map – BPF map to lookup element in

• key – pointer to memory containing bytes of the key used for lookup

• key_sz – size in bytes of key data, needs to match BPF map definition’s key_size

• value – pointer to memory in which looked up value will be stored

• value_sz – size in byte of value data memory; it has to match BPF map definition’s value_size. For per-CPU BPF maps value size has to be a product of BPF map value size and number of possible CPUs in the system (could be fetched with libbpf_num_possible_cpus()). Note also that for per-CPU values value size has to be aligned up to closest 8 bytes for alignment reasons, so expected size is: round_up(value_size, 8)

Returns:

0, on success; negative error, otherwise

LIBBPF_API int bpf_map__get_next_key (const struct bpf_map *map, const void *cur_key, void *next_key, size_t key_sz)

bpf_map__get_next_key() allows to iterate BPF map keys by fetching next key that follows current key.

bpf_map__get_next_key() is high-level equivalent of bpf_map_get_next_key() API with added check for key size.

Parameters:

• map – BPF map to fetch next key from

• cur_key – pointer to memory containing bytes of current key or NULL to fetch the first key

• next_key – pointer to memory to write next key into

• key_sz – size in bytes of key data, needs to match BPF map definition’s key_size

Returns:

0, on success; -ENOENT if cur_key is the last key in BPF map; negative error, otherwise

LIBBPF_API int bpf_xdp_attach (int ifindex, int prog_fd, __u32 flags, const struct bpf_xdp_attach_opts *opts)

LIBBPF_API int bpf_xdp_detach (int ifindex, __u32 flags, const struct bpf_xdp_attach_opts *opts)

LIBBPF_API int bpf_xdp_query (int ifindex, int flags, struct bpf_xdp_query_opts *opts)

LIBBPF_API int bpf_xdp_query_id (int ifindex, int flags, __u32 *prog_id)

LIBBPF_API int bpf_tc_hook_create (struct bpf_tc_hook *hook)

LIBBPF_API int bpf_tc_hook_destroy (struct bpf_tc_hook *hook)

LIBBPF_API int bpf_tc_attach (const struct bpf_tc_hook *hook, struct bpf_tc_opts *opts)

LIBBPF_API int bpf_tc_detach (const struct bpf_tc_hook *hook, const struct bpf_tc_opts *opts)

LIBBPF_API int bpf_tc_query (const struct bpf_tc_hook *hook, struct bpf_tc_opts *opts)

LIBBPF_API struct ring_buffer * ring_buffer__new (int map_fd, ring_buffer_sample_fn sample_cb, void *ctx, const struct ring_buffer_opts *opts)

LIBBPF_API void ring_buffer__free (struct ring_buffer *rb)

LIBBPF_API int ring_buffer__add (struct ring_buffer *rb, int map_fd, ring_buffer_sample_fn sample_cb, void *ctx)

LIBBPF_API int ring_buffer__poll (struct ring_buffer *rb, int timeout_ms)

LIBBPF_API int ring_buffer__consume (struct ring_buffer *rb)

LIBBPF_API int ring_buffer__epoll_fd (const struct ring_buffer *rb)

LIBBPF_API struct perf_buffer * perf_buffer__new (int map_fd, size_t page_cnt, perf_buffer_sample_fn sample_cb, perf_buffer_lost_fn lost_cb, void *ctx, const struct perf_buffer_opts *opts)

perf_buffer__new() creates BPF perfbuf manager for a specified BPF_PERF_EVENT_ARRAY map

Parameters:

• map_fd – FD of BPF_PERF_EVENT_ARRAY BPF map that will be used by BPF code to send data over to user-space

• page_cnt – number of memory pages allocated for each per-CPU buffer

• sample_cb – function called on each received data record

• lost_cb – function called when record loss has occurred

• ctx – user-provided extra context passed into sample_cb and lost_cb

Returns:

a new instance of struct perf_buffer on success, NULL on error with errno containing an error code

LIBBPF_API struct perf_buffer * perf_buffer__new_raw (int map_fd, size_t page_cnt, struct perf_event_attr *attr, perf_buffer_event_fn event_cb, void *ctx, const struct perf_buffer_raw_opts *opts)

LIBBPF_API void perf_buffer__free (struct perf_buffer *pb)

LIBBPF_API int perf_buffer__epoll_fd (const struct perf_buffer *pb)

LIBBPF_API int perf_buffer__poll (struct perf_buffer *pb, int timeout_ms)

LIBBPF_API int perf_buffer__consume (struct perf_buffer *pb)

LIBBPF_API int perf_buffer__consume_buffer (struct perf_buffer *pb, size_t buf_idx)

LIBBPF_API size_t perf_buffer__buffer_cnt (const struct perf_buffer *pb)

LIBBPF_API int perf_buffer__buffer_fd (const struct perf_buffer *pb, size_t buf_idx)

LIBBPF_API int perf_buffer__buffer (struct perf_buffer *pb, int buf_idx, void **buf, size_t *buf_size)

perf_buffer__buffer() returns the per-cpu raw mmap()’ed underlying memory region of the ring buffer. This ring buffer can be used to implement a custom events consumer. The ring buffer starts with the struct perf_event_mmap_page, which holds the ring buffer managment fields, when accessing the header structure it’s important to be SMP aware. You can refer to perf_event_read_simple for a simple example.

Parameters:

• pb – the perf buffer structure

• buf_idx – the buffer index to retreive

• buf – (out) gets the base pointer of the mmap()’ed memory

• buf_size – (out) gets the size of the mmap()’ed region

Returns:

0 on success, negative error code for failure

LIBBPF_API void bpf_prog_linfo__free (struct bpf_prog_linfo *prog_linfo)

LIBBPF_API struct bpf_prog_linfo * bpf_prog_linfo__new (const struct bpf_prog_info *info)

LIBBPF_API const struct bpf_line_info * bpf_prog_linfo__lfind_addr_func (const struct bpf_prog_linfo *prog_linfo, __u64 addr, __u32 func_idx, __u32 nr_skip)

LIBBPF_API const struct bpf_line_info * bpf_prog_linfo__lfind (const struct bpf_prog_linfo *prog_linfo, __u32 insn_off, __u32 nr_skip)

LIBBPF_API int libbpf_probe_bpf_prog_type (enum bpf_prog_type prog_type, const void *opts)

libbpf_probe_bpf_prog_type() detects if host kernel supports BPF programs of a given type.

Make sure the process has required set of CAP_* permissions (or runs as root) when performing feature checking.

Parameters:

• prog_type – BPF program type to detect kernel support for

• opts – reserved for future extensibility, should be NULL

Returns:

1, if given program type is supported; 0, if given program type is not supported; negative error code if feature detection failed or can’t be performed

LIBBPF_API int libbpf_probe_bpf_map_type (enum bpf_map_type map_type, const void *opts)

libbpf_probe_bpf_map_type() detects if host kernel supports BPF maps of a given type.

Make sure the process has required set of CAP_* permissions (or runs as root) when performing feature checking.

Parameters:

• map_type – BPF map type to detect kernel support for

• opts – reserved for future extensibility, should be NULL

Returns:

1, if given map type is supported; 0, if given map type is not supported; negative error code if feature detection failed or can’t be performed

LIBBPF_API int libbpf_probe_bpf_helper (enum bpf_prog_type prog_type, enum bpf_func_id helper_id, const void *opts)

libbpf_probe_bpf_helper() detects if host kernel supports the use of a given BPF helper from specified BPF program type.

Make sure the process has required set of CAP_* permissions (or runs as root) when performing feature checking.

Parameters:

• prog_type – BPF program type used to check the support of BPF helper

• helper_id – BPF helper ID (enum bpf_func_id) to check support for

• opts – reserved for future extensibility, should be NULL

Returns:

1, if given combination of program type and helper is supported; 0, if the combination is not supported; negative error code if feature detection for provided input arguments failed or can’t be performed

LIBBPF_API int libbpf_num_possible_cpus (void)

libbpf_num_possible_cpus() is a helper function to get the number of possible CPUs that the host kernel supports and expects.

Example usage:

int ncpus = libbpf_num_possible_cpus();
if (ncpus < 0) {
     // error handling
}
long values[ncpus];
bpf_map_lookup_elem(per_cpu_map_fd, key, values);

Returns:

number of possible CPUs; or error code on failure

LIBBPF_API int bpf_object__open_skeleton (struct bpf_object_skeleton *s, const struct bpf_object_open_opts *opts)

LIBBPF_API int bpf_object__load_skeleton (struct bpf_object_skeleton *s)

LIBBPF_API int bpf_object__attach_skeleton (struct bpf_object_skeleton *s)

LIBBPF_API void bpf_object__detach_skeleton (struct bpf_object_skeleton *s)

LIBBPF_API void bpf_object__destroy_skeleton (struct bpf_object_skeleton *s)

LIBBPF_API int bpf_object__open_subskeleton (struct bpf_object_subskeleton *s)

LIBBPF_API void bpf_object__destroy_subskeleton (struct bpf_object_subskeleton *s)

LIBBPF_API int bpf_object__gen_loader (struct bpf_object *obj, struct gen_loader_opts *opts)

LIBBPF_API struct bpf_linker * bpf_linker__new (const char *filename, struct bpf_linker_opts *opts)

LIBBPF_API int bpf_linker__add_file (struct bpf_linker *linker, const char *filename, const struct bpf_linker_file_opts *opts)

LIBBPF_API int bpf_linker__finalize (struct bpf_linker *linker)

LIBBPF_API void bpf_linker__free (struct bpf_linker *linker)

LIBBPF_API int libbpf_register_prog_handler (const char *sec, enum bpf_prog_type prog_type, enum bpf_attach_type exp_attach_type, const struct libbpf_prog_handler_opts *opts)

libbpf_register_prog_handler() registers a custom BPF program SEC() handler.

sec defines which SEC() definitions are handled by this custom handler registration. sec can have few different forms:

• if sec is just a plain string (e.g., “abc”), it will match only SEC(“abc”). If BPF program specifies SEC(“abc/whatever”) it will result in an error;

• if sec is of the form “abc/”, proper SEC() form is SEC(“abc/something”), where acceptable “something” should be checked by prog_init_fn callback, if there are additional restrictions;

• if sec is of the form “abc+”, it will successfully match both SEC(“abc”) and SEC(“abc/whatever”) forms;

• if sec is NULL, custom handler is registered for any BPF program that doesn’t match any of the registered (custom or libbpf’s own) SEC() handlers. There could be only one such generic custom handler registered at any given time.

All custom handlers (except the one with sec == NULL) are processed before libbpf’s own SEC() handlers. It is allowed to “override” libbpf’s SEC() handlers by registering custom ones for the same section prefix (i.e., it’s possible to have custom SEC(“perf_event/LLC-load-misses”) handler).

Note, like much of global libbpf APIs (e.g., libbpf_set_print(), libbpf_set_strict_mode(), etc)) these APIs are not thread-safe. User needs to ensure synchronization if there is a risk of running this API from multiple threads simultaneously.

Parameters:

• sec – section prefix for which custom handler is registered

• prog_type – BPF program type associated with specified section

• exp_attach_type – Expected BPF attach type associated with specified section

• opts – optional cookie, callbacks, and other extra options

Returns:

Non-negative handler ID is returned on success. This handler ID has to be passed to libbpf_unregister_prog_handler() to unregister such custom handler. Negative error code is returned on error.

LIBBPF_API int libbpf_unregister_prog_handler (int handler_id)

libbpf_unregister_prog_handler() unregisters previously registered custom BPF program SEC() handler.

Note, like much of global libbpf APIs (e.g., libbpf_set_print(), libbpf_set_strict_mode(), etc)) these APIs are not thread-safe. User needs to ensure synchronization if there is a risk of running this API from multiple threads simultaneously.

Parameters:

handler_id – handler ID returned by libbpf_register_prog_handler() after successful registration

Returns:

0 on success, negative error code if handler isn’t found

Defines

bpf_object_open_opts__last_field kernel_log_level

bpf_object__for_each_program(pos, obj)

for ((pos) = bpf_object__next_program((obj), NULL); \

(pos) != NULL; \

(pos) = bpf_object__next_program((obj), (pos)))

bpf_perf_event_opts__last_field bpf_cookie

bpf_kprobe_opts__last_field retprobe

bpf_kprobe_multi_opts__last_field retprobe

bpf_ksyscall_opts__last_field retprobe

bpf_uprobe_opts__last_field func_name

bpf_usdt_opts__last_field usdt_cookie

bpf_tracepoint_opts__last_field bpf_cookie

bpf_trace_opts__last_field cookie

bpf_iter_attach_opts__last_field link_info_len

bpf_object__for_each_map(pos, obj)

for ((pos) = bpf_object__next_map((obj), NULL); \

(pos) != NULL; \

(pos) = bpf_object__next_map((obj), (pos)))

bpf_map__for_each bpf_object__for_each_map

bpf_xdp_set_link_opts__last_field old_fd

bpf_xdp_attach_opts__last_field old_prog_fd

bpf_xdp_query_opts__last_field attach_mode

BPF_TC_PARENT(a, b) ((((a) << 16) & 0xFFFF0000U) | ((b) & 0x0000FFFFU))

bpf_tc_hook__last_field parent

bpf_tc_opts__last_field priority

ring_buffer_opts__last_field sz

perf_buffer_opts__last_field sz

perf_buffer_raw_opts__last_field map_keys

gen_loader_opts__last_field insns_sz

bpf_linker_opts__last_field sz

bpf_linker_file_opts__last_field sz

libbpf_prog_handler_opts__last_field prog_attach_fn

Enums

enum libbpf_errno

Values:

enumerator __LIBBPF_ERRNO__START = 4000

enumerator LIBBPF_ERRNO__LIBELF = __LIBBPF_ERRNO__START

enumerator LIBBPF_ERRNO__FORMAT

enumerator LIBBPF_ERRNO__KVERSION

enumerator LIBBPF_ERRNO__ENDIAN

enumerator LIBBPF_ERRNO__INTERNAL

enumerator LIBBPF_ERRNO__RELOC

enumerator LIBBPF_ERRNO__LOAD

enumerator LIBBPF_ERRNO__VERIFY

enumerator LIBBPF_ERRNO__PROG2BIG

enumerator LIBBPF_ERRNO__KVER

enumerator LIBBPF_ERRNO__PROGTYPE

enumerator LIBBPF_ERRNO__WRNGPID

enumerator LIBBPF_ERRNO__INVSEQ

enumerator LIBBPF_ERRNO__NLPARSE

enumerator __LIBBPF_ERRNO__END

enum libbpf_print_level

Values:

enumerator LIBBPF_WARN

enumerator LIBBPF_INFO

enumerator LIBBPF_DEBUG

enum bpf_tc_attach_point

Values:

enumerator BPF_TC_INGRESS = 1 << 0

enumerator BPF_TC_EGRESS = 1 << 1

enumerator BPF_TC_CUSTOM = 1 << 2

enum bpf_tc_flags

Values:

enumerator BPF_TC_F_REPLACE = 1 << 0

enum bpf_perf_event_ret

Values:

enumerator LIBBPF_PERF_EVENT_DONE = 0

enumerator LIBBPF_PERF_EVENT_ERROR = -1

enumerator LIBBPF_PERF_EVENT_CONT = -2

enum libbpf_tristate

Values:

enumerator TRI_NO = 0

enumerator TRI_YES = 1

enumerator TRI_MODULE = 2

enumerator TRI_NO = 0

enumerator TRI_YES = 1

enumerator TRI_MODULE = 2

bpf.h

Functions

int libbpf_set_memlock_rlim(size_t memlock_bytes)

LIBBPF_API int bpf_map_create (enum bpf_map_type map_type, const char *map_name, __u32 key_size, __u32 value_size, __u32 max_entries, const struct bpf_map_create_opts *opts)

LIBBPF_API int bpf_prog_load (enum bpf_prog_type prog_type, const char *prog_name, const char *license, const struct bpf_insn *insns, size_t insn_cnt, const struct bpf_prog_load_opts *opts)

LIBBPF_API int bpf_btf_load (const void *btf_data, size_t btf_size, const struct bpf_btf_load_opts *opts)

LIBBPF_API int bpf_map_update_elem (int fd, const void *key, const void *value, __u64 flags)

LIBBPF_API int bpf_map_lookup_elem (int fd, const void *key, void *value)

LIBBPF_API int bpf_map_lookup_elem_flags (int fd, const void *key, void *value, __u64 flags)

LIBBPF_API int bpf_map_lookup_and_delete_elem (int fd, const void *key, void *value)

LIBBPF_API int bpf_map_lookup_and_delete_elem_flags (int fd, const void *key, void *value, __u64 flags)

LIBBPF_API int bpf_map_delete_elem (int fd, const void *key)

LIBBPF_API int bpf_map_delete_elem_flags (int fd, const void *key, __u64 flags)

LIBBPF_API int bpf_map_get_next_key (int fd, const void *key, void *next_key)

LIBBPF_API int bpf_map_freeze (int fd)

LIBBPF_API int bpf_map_delete_batch (int fd, const void *keys, __u32 *count, const struct bpf_map_batch_opts *opts)

bpf_map_delete_batch() allows for batch deletion of multiple elements in a BPF map.

Parameters:

• fd – BPF map file descriptor

• keys – pointer to an array of count keys

• count – input and output parameter; on input count represents the number of elements in the map to delete in batch; on output if a non-EFAULT error is returned, count represents the number of deleted elements if the output count value is not equal to the input count value If EFAULT is returned, count should not be trusted to be correct.

• opts – options for configuring the way the batch deletion works

Returns:

0, on success; negative error code, otherwise (errno is also set to the error code)

LIBBPF_API int bpf_map_lookup_batch (int fd, void *in_batch, void *out_batch, void *keys, void *values, __u32 *count, const struct bpf_map_batch_opts *opts)

bpf_map_lookup_batch() allows for batch lookup of BPF map elements.

The parameter in_batch is the address of the first element in the batch to read. out_batch is an output parameter that should be passed as in_batch to subsequent calls to bpf_map_lookup_batch(). NULL can be passed for in_batch to indicate that the batched lookup starts from the beginning of the map.

The keys and values are output parameters which must point to memory large enough to hold count items based on the key and value size of the map map_fd. The keys buffer must be of key_size * count. The values buffer must be of value_size * count.

Parameters:

• fd – BPF map file descriptor

• in_batch – address of the first element in batch to read, can pass NULL to indicate that the batched lookup starts from the beginning of the map.

• out_batch – output parameter that should be passed to next call as in_batch

• keys – pointer to an array large enough for count keys

• values – pointer to an array large enough for count values

• count – input and output parameter; on input it’s the number of elements in the map to read in batch; on output it’s the number of elements that were successfully read. If a non-EFAULT error is returned, count will be set as the number of elements that were read before the error occurred. If EFAULT is returned, count should not be trusted to be correct.

• opts – options for configuring the way the batch lookup works

Returns:

0, on success; negative error code, otherwise (errno is also set to the error code)

LIBBPF_API int bpf_map_lookup_and_delete_batch (int fd, void *in_batch, void *out_batch, void *keys, void *values, __u32 *count, const struct bpf_map_batch_opts *opts)

bpf_map_lookup_and_delete_batch() allows for batch lookup and deletion of BPF map elements where each element is deleted after being retrieved.

Parameters:

• fd – BPF map file descriptor

• in_batch – address of the first element in batch to read, can pass NULL to get address of the first element in out_batch

• out_batch – output parameter that should be passed to next call as in_batch

• keys – pointer to an array of count keys

• values – pointer to an array large enough for count values

• count – input and output parameter; on input it’s the number of elements in the map to read and delete in batch; on output it represents the number of elements that were successfully read and deleted If a non-**EFAULT** error code is returned and if the output count value is not equal to the input count value, up to count elements may have been deleted. if EFAULT is returned up to count elements may have been deleted without being returned via the keys and values output parameters.

• opts – options for configuring the way the batch lookup and delete works

Returns:

0, on success; negative error code, otherwise (errno is also set to the error code)

LIBBPF_API int bpf_map_update_batch (int fd, const void *keys, const void *values, __u32 *count, const struct bpf_map_batch_opts *opts)

bpf_map_update_batch() updates multiple elements in a map by specifying keys and their corresponding values.

The keys and values parameters must point to memory large enough to hold count items based on the key and value size of the map.

The opts parameter can be used to control how bpf_map_update_batch() should handle keys that either do or do not already exist in the map. In particular the flags parameter of bpf_map_batch_opts can be one of the following:

Note that count is an input and output parameter, where on output it represents how many elements were successfully updated. Also note that if EFAULT then count should not be trusted to be correct.

BPF_ANY Create new elements or update existing.

BPF_NOEXIST Create new elements only if they do not exist.

BPF_EXIST Update existing elements.

BPF_F_LOCK Update spin_lock-ed map elements. This must be specified if the map value contains a spinlock.

Parameters:

• fd – BPF map file descriptor

• keys – pointer to an array of count keys

• values – pointer to an array of count values

• count – input and output parameter; on input it’s the number of elements in the map to update in batch; on output if a non-EFAULT error is returned, count represents the number of updated elements if the output count value is not equal to the input count value. If EFAULT is returned, count should not be trusted to be correct.

• opts – options for configuring the way the batch update works

Returns:

0, on success; negative error code, otherwise (errno is also set to the error code)

LIBBPF_API int bpf_obj_pin (int fd, const char *pathname)

LIBBPF_API int bpf_obj_get (const char *pathname)

LIBBPF_API int bpf_obj_get_opts (const char *pathname, const struct bpf_obj_get_opts *opts)

LIBBPF_API int bpf_prog_attach (int prog_fd, int attachable_fd, enum bpf_attach_type type, unsigned int flags)

LIBBPF_API int bpf_prog_attach_opts (int prog_fd, int attachable_fd, enum bpf_attach_type type, const struct bpf_prog_attach_opts *opts)

LIBBPF_API int bpf_prog_detach (int attachable_fd, enum bpf_attach_type type)

LIBBPF_API int bpf_prog_detach2 (int prog_fd, int attachable_fd, enum bpf_attach_type type)

LIBBPF_API int bpf_link_create (int prog_fd, int target_fd, enum bpf_attach_type attach_type, const struct bpf_link_create_opts *opts)

LIBBPF_API int bpf_link_detach (int link_fd)

LIBBPF_API int bpf_link_update (int link_fd, int new_prog_fd, const struct bpf_link_update_opts *opts)

LIBBPF_API int bpf_iter_create (int link_fd)

LIBBPF_API int bpf_prog_get_next_id (__u32 start_id, __u32 *next_id)

LIBBPF_API int bpf_map_get_next_id (__u32 start_id, __u32 *next_id)

LIBBPF_API int bpf_btf_get_next_id (__u32 start_id, __u32 *next_id)

LIBBPF_API int bpf_link_get_next_id (__u32 start_id, __u32 *next_id)

LIBBPF_API int bpf_prog_get_fd_by_id (__u32 id)

LIBBPF_API int bpf_map_get_fd_by_id (__u32 id)

LIBBPF_API int bpf_btf_get_fd_by_id (__u32 id)

LIBBPF_API int bpf_link_get_fd_by_id (__u32 id)

LIBBPF_API int bpf_obj_get_info_by_fd (int bpf_fd, void *info, __u32 *info_len)

LIBBPF_API int bpf_prog_query_opts (int target_fd, enum bpf_attach_type type, struct bpf_prog_query_opts *opts)

LIBBPF_API int bpf_prog_query (int target_fd, enum bpf_attach_type type, __u32 query_flags, __u32 *attach_flags, __u32 *prog_ids, __u32 *prog_cnt)

LIBBPF_API int bpf_raw_tracepoint_open (const char *name, int prog_fd)

LIBBPF_API int bpf_task_fd_query (int pid, int fd, __u32 flags, char *buf, __u32 *buf_len, __u32 *prog_id, __u32 *fd_type, __u64 *probe_offset, __u64 *probe_addr)

LIBBPF_API int bpf_enable_stats (enum bpf_stats_type type)

LIBBPF_API int bpf_prog_bind_map (int prog_fd, int map_fd, const struct bpf_prog_bind_opts *opts)

LIBBPF_API int bpf_prog_test_run_opts (int prog_fd, struct bpf_test_run_opts *opts)

Defines

bpf_map_create_opts__last_field map_ifindex

bpf_prog_load_opts__last_field log_buf

MAPS_RELAX_COMPAT 0x01

BPF_LOG_BUF_SIZE (UINT32_MAX >> 8) /* verifier maximum in kernels <= 5.1 */

bpf_btf_load_opts__last_field log_size

bpf_map_batch_opts__last_field flags

bpf_obj_get_opts__last_field file_flags

bpf_prog_attach_opts__last_field replace_prog_fd

bpf_link_create_opts__last_field kprobe_multi.cookies

bpf_link_update_opts__last_field old_prog_fd

bpf_prog_query_opts__last_field prog_attach_flags

bpf_prog_bind_opts__last_field flags

bpf_test_run_opts__last_field batch_size

btf.h

Functions

LIBBPF_API void btf__free (struct btf *btf)

btf__free() frees all data of a BTF object

Parameters:

btf – BTF object to free

LIBBPF_API struct btf * btf__new (const void *data, __u32 size)

btf__new() creates a new instance of a BTF object from the raw bytes of an ELF’s BTF section

On error, error-code-encoded-as-pointer is returned, not a NULL. To extract error code from such a pointer libbpf_get_error() should be used. If libbpf_set_strict_mode(LIBBPF_STRICT_CLEAN_PTRS) is enabled, NULL is returned on error instead. In both cases thread-local errno variable is always set to error code as well.

Parameters:

• data – raw bytes

• size – number of bytes passed in data

Returns:

new BTF object instance which has to be eventually freed with btf__free()

LIBBPF_API struct btf * btf__new_split (const void *data, __u32 size, struct btf *base_btf)

btf__new_split() create a new instance of a BTF object from the provided raw data bytes. It takes another BTF instance, base_btf, which serves as a base BTF, which is extended by types in a newly created BTF instance

If base_btf is NULL, btf__new_split() is equivalent to btf__new() and creates non-split BTF.

On error, error-code-encoded-as-pointer is returned, not a NULL. To extract error code from such a pointer libbpf_get_error() should be used. If libbpf_set_strict_mode(LIBBPF_STRICT_CLEAN_PTRS) is enabled, NULL is returned on error instead. In both cases thread-local errno variable is always set to error code as well.

Parameters:

• data – raw bytes

• size – length of raw bytes

• base_btf – the base BTF object

Returns:

new BTF object instance which has to be eventually freed with btf__free()

LIBBPF_API struct btf * btf__new_empty (void)

btf__new_empty() creates an empty BTF object. Use btf__add_*() to populate such BTF object.

On error, error-code-encoded-as-pointer is returned, not a NULL. To extract error code from such a pointer libbpf_get_error() should be used. If libbpf_set_strict_mode(LIBBPF_STRICT_CLEAN_PTRS) is enabled, NULL is returned on error instead. In both cases thread-local errno variable is always set to error code as well.

Returns:

new BTF object instance which has to be eventually freed with btf__free()

LIBBPF_API struct btf * btf__new_empty_split (struct btf *base_btf)

btf__new_empty_split() creates an unpopulated BTF object from an ELF BTF section except with a base BTF on top of which split BTF should be based

If base_btf is NULL, btf__new_empty_split() is equivalent to btf__new_empty() and creates non-split BTF.

On error, error-code-encoded-as-pointer is returned, not a NULL. To extract error code from such a pointer libbpf_get_error() should be used. If libbpf_set_strict_mode(LIBBPF_STRICT_CLEAN_PTRS) is enabled, NULL is returned on error instead. In both cases thread-local errno variable is always set to error code as well.

Returns:

new BTF object instance which has to be eventually freed with btf__free()

LIBBPF_API struct btf * btf__parse (const char *path, struct btf_ext **btf_ext)

LIBBPF_API struct btf * btf__parse_split (const char *path, struct btf *base_btf)

LIBBPF_API struct btf * btf__parse_elf (const char *path, struct btf_ext **btf_ext)

LIBBPF_API struct btf * btf__parse_elf_split (const char *path, struct btf *base_btf)

LIBBPF_API struct btf * btf__parse_raw (const char *path)

LIBBPF_API struct btf * btf__parse_raw_split (const char *path, struct btf *base_btf)

LIBBPF_API struct btf * btf__load_vmlinux_btf (void)

LIBBPF_API struct btf * btf__load_module_btf (const char *module_name, struct btf *vmlinux_btf)

LIBBPF_API struct btf * btf__load_from_kernel_by_id (__u32 id)

LIBBPF_API struct btf * btf__load_from_kernel_by_id_split (__u32 id, struct btf *base_btf)

LIBBPF_API int btf__load_into_kernel (struct btf *btf)

LIBBPF_API __s32 btf__find_by_name (const struct btf *btf, const char *type_name)

LIBBPF_API __s32 btf__find_by_name_kind (const struct btf *btf, const char *type_name, __u32 kind)

LIBBPF_API __u32 btf__type_cnt (const struct btf *btf)

LIBBPF_API const struct btf * btf__base_btf (const struct btf *btf)

LIBBPF_API const struct btf_type * btf__type_by_id (const struct btf *btf, __u32 id)

LIBBPF_API size_t btf__pointer_size (const struct btf *btf)

LIBBPF_API int btf__set_pointer_size (struct btf *btf, size_t ptr_sz)

LIBBPF_API enum btf_endianness btf__endianness (const struct btf *btf)

LIBBPF_API int btf__set_endianness (struct btf *btf, enum btf_endianness endian)

LIBBPF_API __s64 btf__resolve_size (const struct btf *btf, __u32 type_id)

LIBBPF_API int btf__resolve_type (const struct btf *btf, __u32 type_id)

LIBBPF_API int btf__align_of (const struct btf *btf, __u32 id)

LIBBPF_API int btf__fd (const struct btf *btf)

LIBBPF_API void btf__set_fd (struct btf *btf, int fd)

LIBBPF_API const void * btf__raw_data (const struct btf *btf, __u32 *size)

LIBBPF_API const char * btf__name_by_offset (const struct btf *btf, __u32 offset)

LIBBPF_API const char * btf__str_by_offset (const struct btf *btf, __u32 offset)

LIBBPF_API struct btf_ext * btf_ext__new (const __u8 *data, __u32 size)

LIBBPF_API void btf_ext__free (struct btf_ext *btf_ext)

LIBBPF_API const void * btf_ext__raw_data (const struct btf_ext *btf_ext, __u32 *size)

LIBBPF_API int btf__find_str (struct btf *btf, const char *s)

LIBBPF_API int btf__add_str (struct btf *btf, const char *s)

LIBBPF_API int btf__add_type (struct btf *btf, const struct btf *src_btf, const struct btf_type *src_type)

LIBBPF_API int btf__add_btf (struct btf *btf, const struct btf *src_btf)

btf__add_btf() appends all the BTF types from src_btf into btf

btf__add_btf() can be used to simply and efficiently append the entire contents of one BTF object to another one. All the BTF type data is copied over, all referenced type IDs are adjusted by adding a necessary ID offset. Only strings referenced from BTF types are copied over and deduplicated, so if there were some unused strings in src_btf, those won’t be copied over, which is consistent with the general string deduplication semantics of BTF writing APIs.

If any error is encountered during this process, the contents of btf is left intact, which means that btf__add_btf() follows the transactional semantics and the operation as a whole is all-or-nothing.

src_btf has to be non-split BTF, as of now copying types from split BTF is not supported and will result in -ENOTSUP error code returned.

Parameters:

• btf – BTF object which all the BTF types and strings are added to

• src_btf – BTF object which all BTF types and referenced strings are copied from

Returns:

BTF type ID of the first appended BTF type, or negative error code

LIBBPF_API int btf__add_int (struct btf *btf, const char *name, size_t byte_sz, int encoding)

LIBBPF_API int btf__add_float (struct btf *btf, const char *name, size_t byte_sz)

LIBBPF_API int btf__add_ptr (struct btf *btf, int ref_type_id)

LIBBPF_API int btf__add_array (struct btf *btf, int index_type_id, int elem_type_id, __u32 nr_elems)

LIBBPF_API int btf__add_struct (struct btf *btf, const char *name, __u32 sz)

LIBBPF_API int btf__add_union (struct btf *btf, const char *name, __u32 sz)

LIBBPF_API int btf__add_field (struct btf *btf, const char *name, int field_type_id, __u32 bit_offset, __u32 bit_size)

LIBBPF_API int btf__add_enum (struct btf *btf, const char *name, __u32 bytes_sz)

LIBBPF_API int btf__add_enum_value (struct btf *btf, const char *name, __s64 value)

LIBBPF_API int btf__add_enum64 (struct btf *btf, const char *name, __u32 bytes_sz, bool is_signed)

LIBBPF_API int btf__add_enum64_value (struct btf *btf, const char *name, __u64 value)

LIBBPF_API int btf__add_fwd (struct btf *btf, const char *name, enum btf_fwd_kind fwd_kind)

LIBBPF_API int btf__add_typedef (struct btf *btf, const char *name, int ref_type_id)

LIBBPF_API int btf__add_volatile (struct btf *btf, int ref_type_id)

LIBBPF_API int btf__add_const (struct btf *btf, int ref_type_id)

LIBBPF_API int btf__add_restrict (struct btf *btf, int ref_type_id)

LIBBPF_API int btf__add_type_tag (struct btf *btf, const char *value, int ref_type_id)

LIBBPF_API int btf__add_func (struct btf *btf, const char *name, enum btf_func_linkage linkage, int proto_type_id)

LIBBPF_API int btf__add_func_proto (struct btf *btf, int ret_type_id)

LIBBPF_API int btf__add_func_param (struct btf *btf, const char *name, int type_id)

LIBBPF_API int btf__add_var (struct btf *btf, const char *name, int linkage, int type_id)

LIBBPF_API int btf__add_datasec (struct btf *btf, const char *name, __u32 byte_sz)

LIBBPF_API int btf__add_datasec_var_info (struct btf *btf, int var_type_id, __u32 offset, __u32 byte_sz)

LIBBPF_API int btf__add_decl_tag (struct btf *btf, const char *value, int ref_type_id, int component_idx)

LIBBPF_API int btf__dedup (struct btf *btf, const struct btf_dedup_opts *opts)

LIBBPF_API struct btf_dump * btf_dump__new (const struct btf *btf, btf_dump_printf_fn_t printf_fn, void *ctx, const struct btf_dump_opts *opts)

LIBBPF_API void btf_dump__free (struct btf_dump *d)

LIBBPF_API int btf_dump__dump_type (struct btf_dump *d, __u32 id)

LIBBPF_API int btf_dump__emit_type_decl (struct btf_dump *d, __u32 id, const struct btf_dump_emit_type_decl_opts *opts)

LIBBPF_API int btf_dump__dump_type_data (struct btf_dump *d, __u32 id, const void *data, size_t data_sz, const struct btf_dump_type_data_opts *opts)

static inline __u16 btf_kind(const struct btf_type *t)

static inline __u16 btf_vlen(const struct btf_type *t)

static inline bool btf_kflag(const struct btf_type *t)

static inline bool btf_is_void(const struct btf_type *t)

static inline bool btf_is_int(const struct btf_type *t)

static inline bool btf_is_ptr(const struct btf_type *t)

static inline bool btf_is_array(const struct btf_type *t)

static inline bool btf_is_struct(const struct btf_type *t)

static inline bool btf_is_union(const struct btf_type *t)

static inline bool btf_is_composite(const struct btf_type *t)

static inline bool btf_is_enum(const struct btf_type *t)

static inline bool btf_is_enum64(const struct btf_type *t)

static inline bool btf_is_fwd(const struct btf_type *t)

static inline bool btf_is_typedef(const struct btf_type *t)

static inline bool btf_is_volatile(const struct btf_type *t)

static inline bool btf_is_const(const struct btf_type *t)

static inline bool btf_is_restrict(const struct btf_type *t)

static inline bool btf_is_mod(const struct btf_type *t)

static inline bool btf_is_func(const struct btf_type *t)

static inline bool btf_is_func_proto(const struct btf_type *t)

static inline bool btf_is_var(const struct btf_type *t)

static inline bool btf_is_datasec(const struct btf_type *t)

static inline bool btf_is_float(const struct btf_type *t)

static inline bool btf_is_decl_tag(const struct btf_type *t)

static inline bool btf_is_type_tag(const struct btf_type *t)

static inline bool btf_is_any_enum(const struct btf_type *t)

static inline bool btf_kind_core_compat(const struct btf_type *t1, const struct btf_type *t2)

static inline __u8 btf_int_encoding(const struct btf_type *t)

static inline __u8 btf_int_offset(const struct btf_type *t)

static inline __u8 btf_int_bits(const struct btf_type *t)

static struct btf_array *btf_array(const struct btf_type *t)

static struct btf_enum *btf_enum(const struct btf_type *t)

static struct btf_enum64 *btf_enum64(const struct btf_type *t)

static inline __u64 btf_enum64_value(const struct btf_enum64 *e)

static struct btf_member *btf_members(const struct btf_type *t)

static inline __u32 btf_member_bit_offset(const struct btf_type *t, __u32 member_idx)

static inline __u32 btf_member_bitfield_size(const struct btf_type *t, __u32 member_idx)

static struct btf_param *btf_params(const struct btf_type *t)

static struct btf_var *btf_var(const struct btf_type *t)

static struct btf_var_secinfo *btf_var_secinfos(const struct btf_type *t)

static struct btf_decl_tag *btf_decl_tag(const struct btf_type *t)

Defines

BTF_ELF_SEC ".BTF"

BTF_EXT_ELF_SEC ".BTF.ext"

MAPS_ELF_SEC ".maps"

btf_dedup_opts__last_field force_collisions

btf_dump_opts__last_field sz

btf_dump_emit_type_decl_opts__last_field strip_mods

btf_dump_type_data_opts__last_field emit_zeroes

BTF_KIND_FUNC 12 /* Function */

BTF_KIND_FUNC_PROTO 13 /* Function Proto */

BTF_KIND_VAR 14 /* Variable */

BTF_KIND_DATASEC 15 /* Section */

BTF_KIND_FLOAT 16 /* Floating point */

BTF_KIND_DECL_TAG 17 /* Decl Tag */

BTF_KIND_TYPE_TAG 18 /* Type Tag */

BTF_KIND_ENUM64 19 /* Enum for up-to 64bit values */

Enums

enum btf_endianness

Values:

enumerator BTF_LITTLE_ENDIAN = 0

enumerator BTF_BIG_ENDIAN = 1

enum btf_fwd_kind

Values:

enumerator BTF_FWD_STRUCT = 0

enumerator BTF_FWD_UNION = 1

enumerator BTF_FWD_ENUM = 2

xsk.h

Warning

doxygenfile: Cannot find file “xsk.h

bpf_tracing.h

Defines

__BPF_TARGET_MISSING "GCC error \"Must specify a BPF target arch via __TARGET_ARCH_xxx\""

PT_REGS_PARM1(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM2(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM3(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM4(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM5(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_RET(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_FP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_RC(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_SP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_IP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM1_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM2_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM3_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM4_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM5_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_RET_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_FP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_RC_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_SP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_IP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

BPF_KPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

BPF_KRETPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM1_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM2_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM3_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM4_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM5_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM1_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM2_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM3_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM4_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM5_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_SYSCALL_REGS(ctx) ((struct pt_regs *)PT_REGS_PARM1(ctx))

BPF_PROG(name, args...)

name(unsigned long long *ctx);     \

static __always_inline typeof(name(0))     \

____##name(unsigned long long *ctx, ##args);     \

typeof(name(0)) name(unsigned long long *ctx)     \

{     \

_Pragma("GCC diagnostic push")     \

_Pragma("GCC diagnostic ignored \"-Wint-conversion\"")     \

return ____##name(___bpf_ctx_cast(args));     \

_Pragma("GCC diagnostic pop")     \

}     \

static __always_inline typeof(name(0))     \

____##name(unsigned long long *ctx, ##args)

BPF_KPROBE(name, args...)

name(struct pt_regs *ctx);     \

static __always_inline typeof(name(0))     \

____##name(struct pt_regs *ctx, ##args);     \

typeof(name(0)) name(struct pt_regs *ctx)     \

{     \

_Pragma("GCC diagnostic push")     \

_Pragma("GCC diagnostic ignored \"-Wint-conversion\"")     \

return ____##name(___bpf_kprobe_args(args));     \

_Pragma("GCC diagnostic pop")     \

}     \

static __always_inline typeof(name(0))     \

____##name(struct pt_regs *ctx, ##args)

BPF_KRETPROBE(name, args...)

name(struct pt_regs *ctx);     \

static __always_inline typeof(name(0))     \

____##name(struct pt_regs *ctx, ##args);     \

typeof(name(0)) name(struct pt_regs *ctx)     \

{     \

_Pragma("GCC diagnostic push")     \

_Pragma("GCC diagnostic ignored \"-Wint-conversion\"")     \

return ____##name(___bpf_kretprobe_args(args));     \

_Pragma("GCC diagnostic pop")     \

}     \

static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args)

BPF_KSYSCALL(name, args...)

name(struct pt_regs *ctx);     \

extern _Bool LINUX_HAS_SYSCALL_WRAPPER __kconfig;     \

static __always_inline typeof(name(0))     \

____##name(struct pt_regs *ctx, ##args);     \

typeof(name(0)) name(struct pt_regs *ctx)     \

{     \

struct pt_regs *regs = LINUX_HAS_SYSCALL_WRAPPER     \

? (struct pt_regs *)PT_REGS_PARM1(ctx)     \

: ctx;     \

_Pragma("GCC diagnostic push")     \

_Pragma("GCC diagnostic ignored \"-Wint-conversion\"")     \

if (LINUX_HAS_SYSCALL_WRAPPER)     \

return ____##name(___bpf_syswrap_args(args));     \

else     \

return ____##name(___bpf_syscall_args(args));     \

_Pragma("GCC diagnostic pop")     \

}     \

static __always_inline typeof(name(0))     \

____##name(struct pt_regs *ctx, ##args)

BPF_KPROBE_SYSCALL BPF_KSYSCALL

bpf_core_read.h

Defines

__CORE_RELO(src, field, info) __builtin_preserve_field_info((src)->field, BPF_FIELD_##info)

__CORE_BITFIELD_PROBE_READ(dst, src, fld)

bpf_probe_read_kernel(       \

(void *)dst,       \

__CORE_RELO(src, fld, BYTE_SIZE),       \

(const void *)src + __CORE_RELO(src, fld, BYTE_OFFSET))

BPF_CORE_READ_BITFIELD_PROBED(s, field)

({       \

unsigned long long val = 0;       \

\

__CORE_BITFIELD_PROBE_READ(&val, s, field);       \

val <<= __CORE_RELO(s, field, LSHIFT_U64);       \

if (__CORE_RELO(s, field, SIGNED))       \

val = ((long long)val) >> __CORE_RELO(s, field, RSHIFT_U64);  \

else       \

val = val >> __CORE_RELO(s, field, RSHIFT_U64);       \

val;       \

})

BPF_CORE_READ_BITFIELD(s, field)

({       \

const void *p = (const void *)s + __CORE_RELO(s, field, BYTE_OFFSET); \

unsigned long long val;       \

\

/* This is a so-called barrier_var() operation that makes specified   \

* variable "a black box" for optimizing compiler.       \

* It forces compiler to perform BYTE_OFFSET relocation on p and use  \

* its calculated value in the switch below, instead of applying      \

* the same relocation 4 times for each individual memory load.       \

*/       \

asm volatile("" : "=r"(p) : "0"(p));       \

\

switch (__CORE_RELO(s, field, BYTE_SIZE)) {       \

case 1: val = *(const unsigned char *)p; break;       \

case 2: val = *(const unsigned short *)p; break;       \

case 4: val = *(const unsigned int *)p; break;       \

case 8: val = *(const unsigned long long *)p; break;       \

}       \

val <<= __CORE_RELO(s, field, LSHIFT_U64);       \

if (__CORE_RELO(s, field, SIGNED))       \

val = ((long long)val) >> __CORE_RELO(s, field, RSHIFT_U64);  \

else       \

val = val >> __CORE_RELO(s, field, RSHIFT_U64);       \

val;       \

})

bpf_core_field_exists(field...) __builtin_preserve_field_info(___bpf_field_ref(field), BPF_FIELD_EXISTS)

bpf_core_field_size(field...) __builtin_preserve_field_info(___bpf_field_ref(field), BPF_FIELD_BYTE_SIZE)

bpf_core_field_offset(field...) __builtin_preserve_field_info(___bpf_field_ref(field), BPF_FIELD_BYTE_OFFSET)

bpf_core_type_id_local(type) __builtin_btf_type_id(*(typeof(type) *)0, BPF_TYPE_ID_LOCAL)

bpf_core_type_id_kernel(type) __builtin_btf_type_id(*(typeof(type) *)0, BPF_TYPE_ID_TARGET)

bpf_core_type_exists(type) __builtin_preserve_type_info(*(typeof(type) *)0, BPF_TYPE_EXISTS)

bpf_core_type_matches(type) __builtin_preserve_type_info(*(typeof(type) *)0, BPF_TYPE_MATCHES)

bpf_core_type_size(type) __builtin_preserve_type_info(*(typeof(type) *)0, BPF_TYPE_SIZE)

bpf_core_enum_value_exists(enum_type, enum_value) __builtin_preserve_enum_value(*(typeof(enum_type) *)enum_value, BPF_ENUMVAL_EXISTS)

bpf_core_enum_value(enum_type, enum_value) __builtin_preserve_enum_value(*(typeof(enum_type) *)enum_value, BPF_ENUMVAL_VALUE)

bpf_core_read(dst, sz, src) bpf_probe_read_kernel(dst, sz, (const void *)__builtin_preserve_access_index(src))

bpf_core_read_user(dst, sz, src) bpf_probe_read_user(dst, sz, (const void *)__builtin_preserve_access_index(src))

bpf_core_read_str(dst, sz, src) bpf_probe_read_kernel_str(dst, sz, (const void *)__builtin_preserve_access_index(src))

bpf_core_read_user_str(dst, sz, src) bpf_probe_read_user_str(dst, sz, (const void *)__builtin_preserve_access_index(src))

BPF_CORE_READ_INTO(dst, src, a, ...)

({     \

___core_read(bpf_core_read, bpf_core_read,     \

dst, (src), a, ##__VA_ARGS__)     \

})

BPF_CORE_READ_USER_INTO(dst, src, a, ...)

({     \

___core_read(bpf_core_read_user, bpf_core_read_user,     \

dst, (src), a, ##__VA_ARGS__)     \

})

BPF_PROBE_READ_INTO(dst, src, a, ...)

({     \

___core_read(bpf_probe_read, bpf_probe_read,     \

dst, (src), a, ##__VA_ARGS__)     \

})

BPF_PROBE_READ_USER_INTO(dst, src, a, ...)

({     \

___core_read(bpf_probe_read_user, bpf_probe_read_user,     \

dst, (src), a, ##__VA_ARGS__)     \

})

BPF_CORE_READ_STR_INTO(dst, src, a, ...)

({     \

___core_read(bpf_core_read_str, bpf_core_read,     \

dst, (src), a, ##__VA_ARGS__)     \

})

BPF_CORE_READ_USER_STR_INTO(dst, src, a, ...)

({     \

___core_read(bpf_core_read_user_str, bpf_core_read_user,     \

dst, (src), a, ##__VA_ARGS__)     \

})

BPF_PROBE_READ_STR_INTO(dst, src, a, ...)

({     \

___core_read(bpf_probe_read_str, bpf_probe_read,     \

dst, (src), a, ##__VA_ARGS__)     \

})

BPF_PROBE_READ_USER_STR_INTO(dst, src, a, ...)

({     \

___core_read(bpf_probe_read_user_str, bpf_probe_read_user,     \

dst, (src), a, ##__VA_ARGS__)     \

})

BPF_CORE_READ(src, a, ...)

({     \

___type((src), a, ##__VA_ARGS__) __r;     \

BPF_CORE_READ_INTO(&__r, (src), a, ##__VA_ARGS__);     \

__r;     \

})

BPF_CORE_READ_USER(src, a, ...)

({     \

___type((src), a, ##__VA_ARGS__) __r;     \

BPF_CORE_READ_USER_INTO(&__r, (src), a, ##__VA_ARGS__);     \

__r;     \

})

BPF_PROBE_READ(src, a, ...)

({     \

___type((src), a, ##__VA_ARGS__) __r;     \

BPF_PROBE_READ_INTO(&__r, (src), a, ##__VA_ARGS__);     \

__r;     \

})

BPF_PROBE_READ_USER(src, a, ...)

({     \

___type((src), a, ##__VA_ARGS__) __r;     \

BPF_PROBE_READ_USER_INTO(&__r, (src), a, ##__VA_ARGS__);     \

__r;     \

})

Enums

enum bpf_field_info_kind

Values:

enumerator BPF_FIELD_BYTE_OFFSET = 0

enumerator BPF_FIELD_BYTE_SIZE = 1

enumerator BPF_FIELD_EXISTS = 2

enumerator BPF_FIELD_SIGNED = 3

enumerator BPF_FIELD_LSHIFT_U64 = 4

enumerator BPF_FIELD_RSHIFT_U64 = 5

enum bpf_type_id_kind

Values:

enumerator BPF_TYPE_ID_LOCAL = 0

enumerator BPF_TYPE_ID_TARGET = 1

enum bpf_type_info_kind

Values:

enumerator BPF_TYPE_EXISTS = 0

enumerator BPF_TYPE_SIZE = 1

enumerator BPF_TYPE_MATCHES = 2

enum bpf_enum_value_kind

Values:

enumerator BPF_ENUMVAL_EXISTS = 0

enumerator BPF_ENUMVAL_VALUE = 1

bpf_endian.h

Defines

__bpf_ntohs(x) __builtin_bswap16(x)

__bpf_htons(x) __builtin_bswap16(x)

__bpf_constant_ntohs(x) ___bpf_swab16(x)

__bpf_constant_htons(x) ___bpf_swab16(x)

__bpf_ntohl(x) __builtin_bswap32(x)

__bpf_htonl(x) __builtin_bswap32(x)

__bpf_constant_ntohl(x) ___bpf_swab32(x)

__bpf_constant_htonl(x) ___bpf_swab32(x)

__bpf_be64_to_cpu(x) __builtin_bswap64(x)

__bpf_cpu_to_be64(x) __builtin_bswap64(x)

__bpf_constant_be64_to_cpu(x) ___bpf_swab64(x)

__bpf_constant_cpu_to_be64(x) ___bpf_swab64(x)

bpf_htons(x)

(__builtin_constant_p(x) ? \

__bpf_constant_htons(x) : __bpf_htons(x))

bpf_ntohs(x)

(__builtin_constant_p(x) ? \

__bpf_constant_ntohs(x) : __bpf_ntohs(x))

bpf_htonl(x)

(__builtin_constant_p(x) ? \

__bpf_constant_htonl(x) : __bpf_htonl(x))

bpf_ntohl(x)

(__builtin_constant_p(x) ? \

__bpf_constant_ntohl(x) : __bpf_ntohl(x))

bpf_cpu_to_be64(x)

(__builtin_constant_p(x) ? \

__bpf_constant_cpu_to_be64(x) : __bpf_cpu_to_be64(x))

bpf_be64_to_cpu(x)

(__builtin_constant_p(x) ? \

__bpf_constant_be64_to_cpu(x) : __bpf_be64_to_cpu(x))