Program Types and ELF Sections¶

The table below lists the program types, their attach types where relevant and the ELF section names supported by libbpf for them. The ELF section names follow these rules:

type is an exact match, e.g. SEC("socket")
type+ means it can be either exact SEC("type") or well-formed SEC("type/extras") with a '/' separator between type and extras.

When extras are specified, they provide details of how to auto-attach the BPF program. The format of extras depends on the program type, e.g. SEC("tracepoint/<category>/<name>") for tracepoints or SEC("usdt/<path>:<provider>:<name>") for USDT probes. The extras are described in more detail in the footnotes.

Program Type	Attach Type	ELF Section Name	Sleepable
`BPF_PROG_TYPE_CGROUP_DEVICE`	`BPF_CGROUP_DEVICE`	`cgroup/dev`
`BPF_PROG_TYPE_CGROUP_SKB`		`cgroup/skb`
	`BPF_CGROUP_INET_EGRESS`	`cgroup_skb/egress`
	`BPF_CGROUP_INET_INGRESS`	`cgroup_skb/ingress`
`BPF_PROG_TYPE_CGROUP_SOCKOPT`	`BPF_CGROUP_GETSOCKOPT`	`cgroup/getsockopt`
`BPF_PROG_TYPE_CGROUP_SOCKOPT`	`BPF_CGROUP_SETSOCKOPT`	`cgroup/setsockopt`
`BPF_PROG_TYPE_CGROUP_SOCK_ADDR`	`BPF_CGROUP_INET4_BIND`	`cgroup/bind4`
	`BPF_CGROUP_INET4_CONNECT`	`cgroup/connect4`
	`BPF_CGROUP_INET4_GETPEERNAME`	`cgroup/getpeername4`
	`BPF_CGROUP_INET4_GETSOCKNAME`	`cgroup/getsockname4`
	`BPF_CGROUP_INET6_BIND`	`cgroup/bind6`
	`BPF_CGROUP_INET6_CONNECT`	`cgroup/connect6`
	`BPF_CGROUP_INET6_GETPEERNAME`	`cgroup/getpeername6`
	`BPF_CGROUP_INET6_GETSOCKNAME`	`cgroup/getsockname6`
	`BPF_CGROUP_UDP4_RECVMSG`	`cgroup/recvmsg4`
	`BPF_CGROUP_UDP4_SENDMSG`	`cgroup/sendmsg4`
	`BPF_CGROUP_UDP6_RECVMSG`	`cgroup/recvmsg6`
	`BPF_CGROUP_UDP6_SENDMSG`	`cgroup/sendmsg6`
	`BPF_CGROUP_UNIX_CONNECT`	`cgroup/connect_unix`
	`BPF_CGROUP_UNIX_SENDMSG`	`cgroup/sendmsg_unix`
	`BPF_CGROUP_UNIX_RECVMSG`	`cgroup/recvmsg_unix`
	`BPF_CGROUP_UNIX_GETPEERNAME`	`cgroup/getpeername_unix`
	`BPF_CGROUP_UNIX_GETSOCKNAME`	`cgroup/getsockname_unix`
`BPF_PROG_TYPE_CGROUP_SOCK`	`BPF_CGROUP_INET4_POST_BIND`	`cgroup/post_bind4`
	`BPF_CGROUP_INET6_POST_BIND`	`cgroup/post_bind6`
	`BPF_CGROUP_INET_SOCK_CREATE`	`cgroup/sock_create`
	`BPF_CGROUP_INET_SOCK_CREATE`	`cgroup/sock`
	`BPF_CGROUP_INET_SOCK_RELEASE`	`cgroup/sock_release`
`BPF_PROG_TYPE_CGROUP_SYSCTL`	`BPF_CGROUP_SYSCTL`	`cgroup/sysctl`
`BPF_PROG_TYPE_EXT`		`freplace+` [1]
`BPF_PROG_TYPE_FLOW_DISSECTOR`	`BPF_FLOW_DISSECTOR`	`flow_dissector`
`BPF_PROG_TYPE_KPROBE`		`kprobe+` [2]
		`kretprobe+` [2]
		`ksyscall+` [3]
		`kretsyscall+` [3]
		`uprobe+` [4]
		`uprobe.s+` [4]	Yes
		`uretprobe+` [4]
		`uretprobe.s+` [4]	Yes
		`usdt+` [5]
	`BPF_TRACE_KPROBE_MULTI`	`kprobe.multi+` [6]
	`BPF_TRACE_KPROBE_MULTI`	`kretprobe.multi+` [6]
`BPF_PROG_TYPE_LIRC_MODE2`	`BPF_LIRC_MODE2`	`lirc_mode2`
`BPF_PROG_TYPE_LSM`	`BPF_LSM_CGROUP`	`lsm_cgroup+`
	`BPF_LSM_MAC`	`lsm+` [7]
	`BPF_LSM_MAC`	`lsm.s+` [7]	Yes
`BPF_PROG_TYPE_LWT_IN`		`lwt_in`
`BPF_PROG_TYPE_LWT_OUT`		`lwt_out`
`BPF_PROG_TYPE_LWT_SEG6LOCAL`		`lwt_seg6local`
`BPF_PROG_TYPE_LWT_XMIT`		`lwt_xmit`
`BPF_PROG_TYPE_PERF_EVENT`		`perf_event`
`BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`		`raw_tp.w+` [8]
`BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`		`raw_tracepoint.w+`
`BPF_PROG_TYPE_RAW_TRACEPOINT`		`raw_tp+` [8]
`BPF_PROG_TYPE_RAW_TRACEPOINT`		`raw_tracepoint+`
`BPF_PROG_TYPE_SCHED_ACT`		`action`
`BPF_PROG_TYPE_SCHED_CLS`		`classifier`
`BPF_PROG_TYPE_SCHED_CLS`		`tc`
`BPF_PROG_TYPE_SK_LOOKUP`	`BPF_SK_LOOKUP`	`sk_lookup`
`BPF_PROG_TYPE_SK_MSG`	`BPF_SK_MSG_VERDICT`	`sk_msg`
`BPF_PROG_TYPE_SK_REUSEPORT`	`BPF_SK_REUSEPORT_SELECT_OR_MIGRATE`	`sk_reuseport/migrate`
`BPF_PROG_TYPE_SK_REUSEPORT`	`BPF_SK_REUSEPORT_SELECT`	`sk_reuseport`
`BPF_PROG_TYPE_SK_SKB`		`sk_skb`
	`BPF_SK_SKB_STREAM_PARSER`	`sk_skb/stream_parser`
	`BPF_SK_SKB_STREAM_VERDICT`	`sk_skb/stream_verdict`
`BPF_PROG_TYPE_SOCKET_FILTER`		`socket`
`BPF_PROG_TYPE_SOCK_OPS`	`BPF_CGROUP_SOCK_OPS`	`sockops`
`BPF_PROG_TYPE_STRUCT_OPS`		`struct_ops+`
`BPF_PROG_TYPE_SYSCALL`		`syscall`	Yes
`BPF_PROG_TYPE_TRACEPOINT`		`tp+` [9]
`BPF_PROG_TYPE_TRACEPOINT`		`tracepoint+` [9]
`BPF_PROG_TYPE_TRACING`	`BPF_MODIFY_RETURN`	`fmod_ret+` [1]
	`BPF_MODIFY_RETURN`	`fmod_ret.s+` [1]	Yes
	`BPF_TRACE_FENTRY`	`fentry+` [1]
	`BPF_TRACE_FENTRY`	`fentry.s+` [1]	Yes
	`BPF_TRACE_FEXIT`	`fexit+` [1]
	`BPF_TRACE_FEXIT`	`fexit.s+` [1]	Yes
	`BPF_TRACE_ITER`	`iter+` [10]
	`BPF_TRACE_ITER`	`iter.s+` [10]	Yes
	`BPF_TRACE_RAW_TP`	`tp_btf+` [1]
`BPF_PROG_TYPE_XDP`	`BPF_XDP_CPUMAP`	`xdp.frags/cpumap`
	`BPF_XDP_CPUMAP`	`xdp/cpumap`
	`BPF_XDP_DEVMAP`	`xdp.frags/devmap`
	`BPF_XDP_DEVMAP`	`xdp/devmap`
	`BPF_XDP`	`xdp.frags`
	`BPF_XDP`	`xdp`

Footnotes

[1]	(1, 2, 3, 4, 5, 6, 7, 8) The `fentry` attach format is `fentry[.s]/<function>`.

[2]	(1, 2) The `kprobe` attach format is `kprobe/<function>[+<offset>]`. Valid characters for `function` are `a-zA-Z0-9_.` and `offset` must be a valid non-negative integer.

[3]	(1, 2) The `ksyscall` attach format is `ksyscall/<syscall>`.

[4]	(1, 2, 3, 4) The `uprobe` attach format is `uprobe[.s]/<path>:<function>[+<offset>]`.

[5]	The `usdt` attach format is `usdt/<path>:<provider>:<name>`.

[6]	(1, 2) The `kprobe.multi` attach format is `kprobe.multi/<pattern>` where `pattern` supports `` and `?` wildcards. Valid characters for pattern are `a-zA-Z0-9_.?`.

[7]	(1, 2) The `lsm` attachment format is `lsm[.s]/<hook>`.

[8]	(1, 2) The `raw_tp` attach format is `raw_tracepoint[.w]/<tracepoint>`.

[9]	(1, 2) The `tracepoint` attach format is `tracepoint/<category>/<name>`.

[10]	(1, 2) The `iter` attach format is `iter[.s]/<struct-name>`.

The Linux Kernel

Contents

This Page

Program Types and ELF Sections¶