Program Types and ELF Sections
The table below lists the program types, their attach types where relevant and the ELF section
names supported by libbpf for them. The ELF section names follow these rules:
type
is an exact match, e.g. SEC("socket")
type+
means it can be either exact SEC("type")
or well-formed SEC("type/extras")
with a ‘/
’ separator between type
and extras
.
When extras
are specified, they provide details of how to auto-attach the BPF program. The
format of extras
depends on the program type, e.g. SEC("tracepoint/<category>/<name>")
for tracepoints or SEC("usdt/<path>:<provider>:<name>")
for USDT probes. The extras are
described in more detail in the footnotes.
Program Type |
Attach Type |
ELF Section Name |
Sleepable |
BPF_PROG_TYPE_CGROUP_DEVICE
|
BPF_CGROUP_DEVICE
|
cgroup/dev
|
|
BPF_PROG_TYPE_CGROUP_SKB
|
|
cgroup/skb
|
|
BPF_CGROUP_INET_EGRESS
|
cgroup_skb/egress
|
|
BPF_CGROUP_INET_INGRESS
|
cgroup_skb/ingress
|
|
BPF_PROG_TYPE_CGROUP_SOCKOPT
|
BPF_CGROUP_GETSOCKOPT
|
cgroup/getsockopt
|
|
BPF_CGROUP_SETSOCKOPT
|
cgroup/setsockopt
|
|
BPF_PROG_TYPE_CGROUP_SOCK_ADDR
|
BPF_CGROUP_INET4_BIND
|
cgroup/bind4
|
|
BPF_CGROUP_INET4_CONNECT
|
cgroup/connect4
|
|
BPF_CGROUP_INET4_GETPEERNAME
|
cgroup/getpeername4
|
|
BPF_CGROUP_INET4_GETSOCKNAME
|
cgroup/getsockname4
|
|
BPF_CGROUP_INET6_BIND
|
cgroup/bind6
|
|
BPF_CGROUP_INET6_CONNECT
|
cgroup/connect6
|
|
BPF_CGROUP_INET6_GETPEERNAME
|
cgroup/getpeername6
|
|
BPF_CGROUP_INET6_GETSOCKNAME
|
cgroup/getsockname6
|
|
BPF_CGROUP_UDP4_RECVMSG
|
cgroup/recvmsg4
|
|
BPF_CGROUP_UDP4_SENDMSG
|
cgroup/sendmsg4
|
|
BPF_CGROUP_UDP6_RECVMSG
|
cgroup/recvmsg6
|
|
BPF_CGROUP_UDP6_SENDMSG
|
cgroup/sendmsg6
|
|
BPF_CGROUP_UNIX_CONNECT
|
cgroup/connect_unix
|
|
BPF_CGROUP_UNIX_SENDMSG
|
cgroup/sendmsg_unix
|
|
BPF_CGROUP_UNIX_RECVMSG
|
cgroup/recvmsg_unix
|
|
BPF_CGROUP_UNIX_GETPEERNAME
|
cgroup/getpeername_unix
|
|
BPF_CGROUP_UNIX_GETSOCKNAME
|
cgroup/getsockname_unix
|
|
BPF_PROG_TYPE_CGROUP_SOCK
|
BPF_CGROUP_INET4_POST_BIND
|
cgroup/post_bind4
|
|
BPF_CGROUP_INET6_POST_BIND
|
cgroup/post_bind6
|
|
BPF_CGROUP_INET_SOCK_CREATE
|
cgroup/sock_create
|
|
cgroup/sock
|
|
BPF_CGROUP_INET_SOCK_RELEASE
|
cgroup/sock_release
|
|
BPF_PROG_TYPE_CGROUP_SYSCTL
|
BPF_CGROUP_SYSCTL
|
cgroup/sysctl
|
|
BPF_PROG_TYPE_EXT
|
|
freplace+
|
|
BPF_PROG_TYPE_FLOW_DISSECTOR
|
BPF_FLOW_DISSECTOR
|
flow_dissector
|
|
BPF_PROG_TYPE_KPROBE
|
|
kprobe+
|
|
kretprobe+
|
|
ksyscall+
|
|
kretsyscall+
|
|
uprobe+
|
|
uprobe.s+
|
Yes |
uretprobe+
|
|
uretprobe.s+
|
Yes |
usdt+
|
|
BPF_TRACE_KPROBE_MULTI
|
kprobe.multi+
|
|
kretprobe.multi+
|
|
BPF_PROG_TYPE_LIRC_MODE2
|
BPF_LIRC_MODE2
|
lirc_mode2
|
|
BPF_PROG_TYPE_LSM
|
BPF_LSM_CGROUP
|
lsm_cgroup+
|
|
BPF_LSM_MAC
|
lsm+
|
|
lsm.s+
|
Yes |
BPF_PROG_TYPE_LWT_IN
|
|
lwt_in
|
|
BPF_PROG_TYPE_LWT_OUT
|
|
lwt_out
|
|
BPF_PROG_TYPE_LWT_SEG6LOCAL
|
|
lwt_seg6local
|
|
BPF_PROG_TYPE_LWT_XMIT
|
|
lwt_xmit
|
|
BPF_PROG_TYPE_NETFILTER
|
|
netfilter
|
|
BPF_PROG_TYPE_PERF_EVENT
|
|
perf_event
|
|
BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE
|
|
raw_tp.w+
|
|
raw_tracepoint.w+
|
|
BPF_PROG_TYPE_RAW_TRACEPOINT
|
|
raw_tp+
|
|
raw_tracepoint+
|
|
BPF_PROG_TYPE_SCHED_ACT
|
|
action
|
|
BPF_PROG_TYPE_SCHED_CLS
|
|
classifier
|
|
tc
|
|
BPF_NETKIT_PRIMARY
|
netkit/primary
|
|
BPF_NETKIT_PEER
|
netkit/peer
|
|
BPF_TCX_INGRESS
|
tc/ingress
|
|
BPF_TCX_EGRESS
|
tc/egress
|
|
BPF_TCX_INGRESS
|
tcx/ingress
|
|
BPF_TCX_EGRESS
|
tcx/egress
|
|
BPF_PROG_TYPE_SK_LOOKUP
|
BPF_SK_LOOKUP
|
sk_lookup
|
|
BPF_PROG_TYPE_SK_MSG
|
BPF_SK_MSG_VERDICT
|
sk_msg
|
|
BPF_PROG_TYPE_SK_REUSEPORT
|
BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
|
sk_reuseport/migrate
|
|
BPF_SK_REUSEPORT_SELECT
|
sk_reuseport
|
|
BPF_PROG_TYPE_SK_SKB
|
|
sk_skb
|
|
BPF_SK_SKB_STREAM_PARSER
|
sk_skb/stream_parser
|
|
BPF_SK_SKB_STREAM_VERDICT
|
sk_skb/stream_verdict
|
|
BPF_PROG_TYPE_SOCKET_FILTER
|
|
socket
|
|
BPF_PROG_TYPE_SOCK_OPS
|
BPF_CGROUP_SOCK_OPS
|
sockops
|
|
BPF_PROG_TYPE_STRUCT_OPS
|
|
struct_ops+
|
|
struct_ops.s+
|
Yes |
BPF_PROG_TYPE_SYSCALL
|
|
syscall
|
Yes |
BPF_PROG_TYPE_TRACEPOINT
|
|
tp+
|
|
tracepoint+
|
|
BPF_PROG_TYPE_TRACING
|
BPF_MODIFY_RETURN
|
fmod_ret+
|
|
fmod_ret.s+
|
Yes |
BPF_TRACE_FENTRY
|
fentry+
|
|
fentry.s+
|
Yes |
BPF_TRACE_FEXIT
|
fexit+
|
|
fexit.s+
|
Yes |
BPF_TRACE_ITER
|
iter+
|
|
iter.s+
|
Yes |
BPF_TRACE_RAW_TP
|
tp_btf+
|
|
BPF_PROG_TYPE_XDP
|
BPF_XDP_CPUMAP
|
xdp.frags/cpumap
|
|
xdp/cpumap
|
|
BPF_XDP_DEVMAP
|
xdp.frags/devmap
|
|
xdp/devmap
|
|
BPF_XDP
|
xdp.frags
|
|
xdp
|
|
Footnotes