LIBBPF API

Error Handling

When libbpf is used in “libbpf 1.0 mode”, API functions can return errors in one of two ways.

You can set “libbpf 1.0” mode with the following line:

libbpf_set_strict_mode(LIBBPF_STRICT_DIRECT_ERRS | LIBBPF_STRICT_CLEAN_PTRS);

If the function returns an error code directly, it uses 0 to indicate success and a negative error code to indicate what caused the error. In this case the error code should be checked directly from the return, you do not need to check errno.

For example:

err = some_libbpf_api_with_error_return(...);
if (err < 0) {
    /* Handle error accordingly */
}

If the function returns a pointer, it will return NULL to indicate there was an error. In this case errno should be checked for the error code.

For example:

ptr = some_libbpf_api_returning_ptr();
if (!ptr) {
    /* note no minus sign for EINVAL and E2BIG below */
    if (errno == EINVAL) {
       /* handle EINVAL error */
    } else if (errno == E2BIG) {
       /* handle E2BIG error */
    }
}

libbpf.h

Functions

LIBBPF_API __u32 libbpf_major_version (void)

LIBBPF_API __u32 libbpf_minor_version (void)

LIBBPF_API const char * libbpf_version_string (void)

LIBBPF_API int libbpf_strerror (int err, char *buf, size_t size)

LIBBPF_API libbpf_print_fn_t libbpf_set_print (libbpf_print_fn_t fn)

LIBBPF_API struct bpf_object * bpf_object__open (const char *path)

LIBBPF_API struct bpf_object * bpf_object__open_file (const char *path, const struct bpf_object_open_opts *opts)

bpf_object__open_file() creates a bpf_object by opening the BPF ELF object file pointed to by the passed path and loading it into memory.

Parameters

path – BPF object file path
opts – options for how to load the bpf object, this parameter is optional and can be set to NULL

Returns

pointer to the new bpf_object; or NULL is returned on error, error code is stored in errno

LIBBPF_API struct bpf_object * bpf_object__open_mem (const void *obj_buf, size_t obj_buf_sz, const struct bpf_object_open_opts *opts)

bpf_object__open_mem() creates a bpf_object by reading the BPF objects raw bytes from a memory buffer containing a valid BPF ELF object file.

Parameters

obj_buf – pointer to the buffer containing ELF file bytes
obj_buf_sz – number of bytes in the buffer
opts – options for how to load the bpf object

Returns

pointer to the new bpf_object; or NULL is returned on error, error code is stored in errno

LIBBPF_DEPRECATED_SINCE (0, 8, "use bpf_object__open_mem() instead") LIBBPF_API struct bpf_object *bpf_object__open_buffer(const void *obj_buf

LIBBPF_DEPRECATED_SINCE (0, 7, "use bpf_object__open_file() instead") LIBBPF_API struct bpf_object *bpf_object__open_xattr(struct bpf_object_open_attr *attr)

LIBBPF_API int bpf_object__pin_maps (struct bpf_object *obj, const char *path)

LIBBPF_API int bpf_object__unpin_maps (struct bpf_object *obj, const char *path)

LIBBPF_API int bpf_object__pin_programs (struct bpf_object *obj, const char *path)

LIBBPF_API int bpf_object__unpin_programs (struct bpf_object *obj, const char *path)

LIBBPF_API int bpf_object__pin (struct bpf_object *object, const char *path)

LIBBPF_API void bpf_object__close (struct bpf_object *object)

LIBBPF_API int bpf_object__load (struct bpf_object *obj)

LIBBPF_DEPRECATED_SINCE (0, 8, "use bpf_object__load() instead") LIBBPF_API int bpf_object__load_xattr(struct bpf_object_load_attr *attr)

LIBBPF_DEPRECATED_SINCE (0, 6, "bpf_object__unload() is deprecated, use bpf_object__close() instead") LIBBPF_API int bpf_object__unload(struct bpf_object *obj)

LIBBPF_API const char * bpf_object__name (const struct bpf_object *obj)

LIBBPF_API unsigned int bpf_object__kversion (const struct bpf_object *obj)

LIBBPF_API int bpf_object__set_kversion (struct bpf_object *obj, __u32 kern_version)

LIBBPF_API struct btf * bpf_object__btf (const struct bpf_object *obj)

LIBBPF_API int bpf_object__btf_fd (const struct bpf_object *obj)

LIBBPF_DEPRECATED_SINCE (0, 7, "use bpf_object__find_program_by_name() instead") LIBBPF_API struct bpf_program *bpf_object__find_program_by_title(const struct bpf_object *obj

LIBBPF_API struct bpf_program * bpf_object__find_program_by_name (const struct bpf_object *obj, const char *name)

LIBBPF_API LIBBPF_DEPRECATED_SINCE (0, 7, "track bpf_objects in application code instead") struct bpf_object *bpf_object__next(struct bpf_object *prev)

LIBBPF_DEPRECATED_SINCE (0, 7, "storage via set_priv/priv is deprecated") LIBBPF_API int bpf_object__set_priv(struct bpf_object *obj

LIBBPF_API int libbpf_prog_type_by_name (const char *name, enum bpf_prog_type *prog_type, enum bpf_attach_type *expected_attach_type)

LIBBPF_API int libbpf_attach_type_by_name (const char *name, enum bpf_attach_type *attach_type)

LIBBPF_API int libbpf_find_vmlinux_btf_id (const char *name, enum bpf_attach_type attach_type)

LIBBPF_API LIBBPF_DEPRECATED_SINCE (0, 7, "use bpf_object__next_program() instead") struct bpf_program *bpf_program__next(struct bpf_program *prog

LIBBPF_API struct bpf_program * bpf_object__next_program (const struct bpf_object *obj, struct bpf_program *prog)

LIBBPF_API LIBBPF_DEPRECATED_SINCE (0, 7, "use bpf_object__prev_program() instead") struct bpf_program *bpf_program__prev(struct bpf_program *prog

LIBBPF_API struct bpf_program * bpf_object__prev_program (const struct bpf_object *obj, struct bpf_program *prog)

LIBBPF_API void bpf_program__set_ifindex (struct bpf_program *prog, __u32 ifindex)

LIBBPF_API const char * bpf_program__name (const struct bpf_program *prog)

LIBBPF_API const char * bpf_program__section_name (const struct bpf_program *prog)

LIBBPF_API LIBBPF_DEPRECATED ("BPF program title is confusing term; please use bpf_program__section_name() instead") const char *bpf_program__title(const struct bpf_program *prog

LIBBPF_API bool bpf_program__autoload (const struct bpf_program *prog)

LIBBPF_API int bpf_program__set_autoload (struct bpf_program *prog, bool autoload)

LIBBPF_DEPRECATED_SINCE (0, 7, "use bpf_program__insn_cnt() instead") LIBBPF_API size_t bpf_program__size(const struct bpf_program *prog)

LIBBPF_API const struct bpf_insn * bpf_program__insns (const struct bpf_program *prog)

bpf_program__insns() gives read-only access to BPF program’s underlying BPF instructions.

Returned pointer is always valid and not NULL. Number of struct bpf_insn pointed to can be fetched using bpf_program__insn_cnt() API.

Keep in mind, libbpf can modify and append/delete BPF program’s instructions as it processes BPF object file and prepares everything for uploading into the kernel. So depending on the point in BPF object lifetime, bpf_program__insns() can return different sets of instructions. As an example, during BPF object load phase BPF program instructions will be CO-RE-relocated, BPF subprograms instructions will be appended, ldimm64 instructions will have FDs embedded, etc. So instructions returned before bpf_object__load() and after it might be quite different.

Parameters: prog – BPF program for which to return instructions
Returns: a pointer to an array of BPF instructions that belong to the specified BPF program

LIBBPF_API size_t bpf_program__insn_cnt (const struct bpf_program *prog)

bpf_program__insn_cnt() returns number of struct bpf_insn’s that form specified BPF program.

See bpf_program__insns() documentation for notes on how libbpf can change instructions and their count during different phases of bpf_object lifetime.

Parameters: prog – BPF program for which to return number of BPF instructions

LIBBPF_DEPRECATED_SINCE (0, 6, "use bpf_object__load() instead") LIBBPF_API int bpf_program__load(struct bpf_program *prog

LIBBPF_API int bpf_program__fd (const struct bpf_program *prog)

LIBBPF_DEPRECATED_SINCE (0, 7, "multi-instance bpf_program support is deprecated") LIBBPF_API int bpf_program__pin_instance(struct bpf_program *prog

LIBBPF_API int bpf_program__pin (struct bpf_program *prog, const char *path)

bpf_program__pin() pins the BPF program to a file in the BPF FS specified by a path. This increments the programs reference count, allowing it to stay loaded after the process which loaded it has exited.

Parameters

prog – BPF program to pin, must already be loaded
path – file path in a BPF file system

Returns

0, on success; negative error code, otherwise

LIBBPF_API int bpf_program__unpin (struct bpf_program *prog, const char *path)

bpf_program__unpin() unpins the BPF program from a file in the BPFFS specified by a path. This decrements the programs reference count.

The file pinning the BPF program can also be unlinked by a different process in which case this function will return an error.

Parameters

prog – BPF program to unpin
path – file path to the pin in a BPF file system

Returns

0, on success; negative error code, otherwise

LIBBPF_API void bpf_program__unload (struct bpf_program *prog)

LIBBPF_API struct bpf_link * bpf_link__open (const char *path)

LIBBPF_API int bpf_link__fd (const struct bpf_link *link)

LIBBPF_API const char * bpf_link__pin_path (const struct bpf_link *link)

LIBBPF_API int bpf_link__pin (struct bpf_link *link, const char *path)

LIBBPF_API int bpf_link__unpin (struct bpf_link *link)

LIBBPF_API int bpf_link__update_program (struct bpf_link *link, struct bpf_program *prog)

LIBBPF_API void bpf_link__disconnect (struct bpf_link *link)

LIBBPF_API int bpf_link__detach (struct bpf_link *link)

LIBBPF_API int bpf_link__destroy (struct bpf_link *link)

LIBBPF_API struct bpf_link * bpf_program__attach (const struct bpf_program *prog)

LIBBPF_API struct bpf_link * bpf_program__attach_perf_event (const struct bpf_program *prog, int pfd)

LIBBPF_API struct bpf_link * bpf_program__attach_perf_event_opts (const struct bpf_program *prog, int pfd, const struct bpf_perf_event_opts *opts)

LIBBPF_API struct bpf_link * bpf_program__attach_kprobe (const struct bpf_program *prog, bool retprobe, const char *func_name)

LIBBPF_API struct bpf_link * bpf_program__attach_kprobe_opts (const struct bpf_program *prog, const char *func_name, const struct bpf_kprobe_opts *opts)

LIBBPF_API struct bpf_link * bpf_program__attach_kprobe_multi_opts (const struct bpf_program *prog, const char *pattern, const struct bpf_kprobe_multi_opts *opts)

LIBBPF_API struct bpf_link * bpf_program__attach_uprobe (const struct bpf_program *prog, bool retprobe, pid_t pid, const char *binary_path, size_t func_offset)

bpf_program__attach_uprobe() attaches a BPF program to the userspace function which is found by binary path and offset. You can optionally specify a particular proccess to attach to. You can also optionally attach the program to the function exit instead of entry.

Parameters

prog – BPF program to attach
retprobe – Attach to function exit
pid – Process ID to attach the uprobe to, 0 for self (own process), -1 for all processes
binary_path – Path to binary that contains the function symbol
func_offset – Offset within the binary of the function symbol

Returns

Reference to the newly created BPF link; or NULL is returned on error, error code is stored in errno

LIBBPF_API struct bpf_link * bpf_program__attach_uprobe_opts (const struct bpf_program *prog, pid_t pid, const char *binary_path, size_t func_offset, const struct bpf_uprobe_opts *opts)

bpf_program__attach_uprobe_opts() is just like bpf_program__attach_uprobe() except with a options struct for various configurations.

Parameters

prog – BPF program to attach
pid – Process ID to attach the uprobe to, 0 for self (own process), -1 for all processes
binary_path – Path to binary that contains the function symbol
func_offset – Offset within the binary of the function symbol
opts – Options for altering program attachment

Returns

Reference to the newly created BPF link; or NULL is returned on error, error code is stored in errno

LIBBPF_API struct bpf_link * bpf_program__attach_usdt (const struct bpf_program *prog, pid_t pid, const char *binary_path, const char *usdt_provider, const char *usdt_name, const struct bpf_usdt_opts *opts)

bpf_program__attach_usdt() is just like bpf_program__attach_uprobe_opts() except it covers USDT (User-space Statically Defined Tracepoint) attachment, instead of attaching to user-space function entry or exit.

Parameters

prog – BPF program to attach
pid – Process ID to attach the uprobe to, 0 for self (own process), -1 for all processes
binary_path – Path to binary that contains provided USDT probe
usdt_provider – USDT provider name
usdt_name – USDT probe name
opts – Options for altering program attachment

Returns

Reference to the newly created BPF link; or NULL is returned on error, error code is stored in errno

LIBBPF_API struct bpf_link * bpf_program__attach_tracepoint (const struct bpf_program *prog, const char *tp_category, const char *tp_name)

LIBBPF_API struct bpf_link * bpf_program__attach_tracepoint_opts (const struct bpf_program *prog, const char *tp_category, const char *tp_name, const struct bpf_tracepoint_opts *opts)

LIBBPF_API struct bpf_link * bpf_program__attach_raw_tracepoint (const struct bpf_program *prog, const char *tp_name)

LIBBPF_API struct bpf_link * bpf_program__attach_trace (const struct bpf_program *prog)

LIBBPF_API struct bpf_link * bpf_program__attach_lsm (const struct bpf_program *prog)

LIBBPF_API struct bpf_link * bpf_program__attach_cgroup (const struct bpf_program *prog, int cgroup_fd)

LIBBPF_API struct bpf_link * bpf_program__attach_netns (const struct bpf_program *prog, int netns_fd)

LIBBPF_API struct bpf_link * bpf_program__attach_xdp (const struct bpf_program *prog, int ifindex)

LIBBPF_API struct bpf_link * bpf_program__attach_freplace (const struct bpf_program *prog, int target_fd, const char *attach_func_name)

LIBBPF_API struct bpf_link * bpf_map__attach_struct_ops (const struct bpf_map *map)

LIBBPF_API struct bpf_link * bpf_program__attach_iter (const struct bpf_program *prog, const struct bpf_iter_attach_opts *opts)

LIBBPF_DEPRECATED_SINCE (0, 7, "use bpf_program__insns() for getting bpf_program instructions") LIBBPF_API int bpf_program__set_prep(struct bpf_program *prog

LIBBPF_DEPRECATED_SINCE (0, 8, "use bpf_program__set_type() instead") LIBBPF_API int bpf_program__set_socket_filter(struct bpf_program *prog)

LIBBPF_API enum bpf_prog_type bpf_program__type (const struct bpf_program *prog)

LIBBPF_API void bpf_program__set_type (struct bpf_program *prog, enum bpf_prog_type type)

LIBBPF_API enum bpf_attach_type bpf_program__expected_attach_type (const struct bpf_program *prog)

LIBBPF_API void bpf_program__set_expected_attach_type (struct bpf_program *prog, enum bpf_attach_type type)

LIBBPF_API __u32 bpf_program__flags (const struct bpf_program *prog)

LIBBPF_API int bpf_program__set_flags (struct bpf_program *prog, __u32 flags)

LIBBPF_API __u32 bpf_program__log_level (const struct bpf_program *prog)

LIBBPF_API int bpf_program__set_log_level (struct bpf_program *prog, __u32 log_level)

LIBBPF_API const char * bpf_program__log_buf (const struct bpf_program *prog, size_t *log_size)

LIBBPF_API int bpf_program__set_log_buf (struct bpf_program *prog, char *log_buf, size_t log_size)

LIBBPF_API int bpf_program__set_attach_target (struct bpf_program *prog, int attach_prog_fd, const char *attach_func_name)

LIBBPF_DEPRECATED_SINCE (0, 8, "use bpf_program__type() instead") LIBBPF_API bool bpf_program__is_socket_filter(const struct bpf_program *prog)

LIBBPF_API struct bpf_map * bpf_object__find_map_by_name (const struct bpf_object *obj, const char *name)

bpf_object__find_map_by_name() returns BPF map of the given name, if it exists within the passed BPF object

Parameters

obj – BPF object
name – name of the BPF map

Returns

BPF map instance, if such map exists within the BPF object; or NULL otherwise.

LIBBPF_API int bpf_object__find_map_fd_by_name (const struct bpf_object *obj, const char *name)

LIBBPF_API LIBBPF_DEPRECATED_SINCE (0, 8, "use bpf_object__find_map_by_name() instead") struct bpf_map *bpf_object__find_map_by_offset(struct bpf_object *obj

LIBBPF_API LIBBPF_DEPRECATED_SINCE (0, 7, "use bpf_object__next_map() instead") struct bpf_map *bpf_map__next(const struct bpf_map *map

LIBBPF_API struct bpf_map * bpf_object__next_map (const struct bpf_object *obj, const struct bpf_map *map)

LIBBPF_API LIBBPF_DEPRECATED_SINCE (0, 7, "use bpf_object__prev_map() instead") struct bpf_map *bpf_map__prev(const struct bpf_map *map

LIBBPF_API struct bpf_map * bpf_object__prev_map (const struct bpf_object *obj, const struct bpf_map *map)

LIBBPF_API int bpf_map__fd (const struct bpf_map *map)

bpf_map__fd() gets the file descriptor of the passed BPF map

Parameters: map – the BPF map instance
Returns: the file descriptor; or -EINVAL in case of an error

LIBBPF_API int bpf_map__reuse_fd (struct bpf_map *map, int fd)

LIBBPF_API LIBBPF_DEPRECATED_SINCE (0, 8, "use appropriate getters or setters instead") const struct bpf_map_def *bpf_map__def(const struct bpf_map *map)

LIBBPF_API const char * bpf_map__name (const struct bpf_map *map)

LIBBPF_API enum bpf_map_type bpf_map__type (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_type (struct bpf_map *map, enum bpf_map_type type)

LIBBPF_API __u32 bpf_map__max_entries (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_max_entries (struct bpf_map *map, __u32 max_entries)

LIBBPF_DEPRECATED_SINCE (0, 8, "use bpf_map__set_max_entries() instead") LIBBPF_API int bpf_map__resize(struct bpf_map *map

LIBBPF_API __u32 bpf_map__map_flags (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_map_flags (struct bpf_map *map, __u32 flags)

LIBBPF_API __u32 bpf_map__numa_node (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_numa_node (struct bpf_map *map, __u32 numa_node)

LIBBPF_API __u32 bpf_map__key_size (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_key_size (struct bpf_map *map, __u32 size)

LIBBPF_API __u32 bpf_map__value_size (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_value_size (struct bpf_map *map, __u32 size)

LIBBPF_API __u32 bpf_map__btf_key_type_id (const struct bpf_map *map)

LIBBPF_API __u32 bpf_map__btf_value_type_id (const struct bpf_map *map)

LIBBPF_API __u32 bpf_map__ifindex (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_ifindex (struct bpf_map *map, __u32 ifindex)

LIBBPF_API __u64 bpf_map__map_extra (const struct bpf_map *map)

LIBBPF_API int bpf_map__set_map_extra (struct bpf_map *map, __u64 map_extra)

LIBBPF_API int bpf_map__set_initial_value (struct bpf_map *map, const void *data, size_t size)

LIBBPF_API const void * bpf_map__initial_value (struct bpf_map *map, size_t *psize)

LIBBPF_DEPRECATED_SINCE (0, 8, "use bpf_map__type() instead") LIBBPF_API bool bpf_map__is_offload_neutral(const struct bpf_map *map)

LIBBPF_API bool bpf_map__is_internal (const struct bpf_map *map)

bpf_map__is_internal() tells the caller whether or not the passed map is a special map created by libbpf automatically for things like global variables, __ksym externs, Kconfig values, etc

Parameters: map – the bpf_map
Returns: true, if the map is an internal map; false, otherwise

LIBBPF_API int bpf_map__set_pin_path (struct bpf_map *map, const char *path)

LIBBPF_API const char * bpf_map__pin_path (const struct bpf_map *map)

LIBBPF_API bool bpf_map__is_pinned (const struct bpf_map *map)

LIBBPF_API int bpf_map__pin (struct bpf_map *map, const char *path)

LIBBPF_API int bpf_map__unpin (struct bpf_map *map, const char *path)

LIBBPF_API int bpf_map__set_inner_map_fd (struct bpf_map *map, int fd)

LIBBPF_API struct bpf_map * bpf_map__inner_map (struct bpf_map *map)

LIBBPF_API long libbpf_get_error (const void *ptr)

libbpf_get_error() extracts the error code from the passed pointer

Many libbpf API functions which return pointers have logic to encode error codes as pointers, and do not return NULL. Meaning libbpf_get_error() should be used on the return value from these functions immediately after calling the API function, with no intervening calls that could clobber the errno variable. Consult the individual functions documentation to verify if this logic applies should be used.

For these API functions, if libbpf_set_strict_mode(LIBBPF_STRICT_CLEAN_PTRS) is enabled, NULL is returned on error instead.

If ptr is NULL, then errno should be already set by the failing API, because libbpf never returns NULL on success and it now always sets errno on error.

Example usage:

struct perf_buffer *pb;

pb = perf_buffer__new(bpf_map__fd(obj->maps.events), PERF_BUFFER_PAGES, &opts); err = libbpf_get_error(pb); if (err) { pb = NULL; fprintf(stderr, “failed to open perf buffer: %d\n”, err); goto cleanup; }

Parameters: ptr – pointer returned from libbpf API function
Returns: error code; or 0 if no error occured

LIBBPF_DEPRECATED_SINCE (0, 8, "use bpf_object__open() and bpf_object__load() instead") LIBBPF_API int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr

LIBBPF_DEPRECATED_SINCE (0, 7, "use bpf_object__open() and bpf_object__load() instead") LIBBPF_API int bpf_prog_load_deprecated(const char *file

LIBBPF_DEPRECATED_SINCE (0, 8, "use bpf_xdp_attach() instead") LIBBPF_API int bpf_set_link_xdp_fd(int ifindex

LIBBPF_DEPRECATED_SINCE (0, 8, "use bpf_xdp_query_id() instead") LIBBPF_API int bpf_get_link_xdp_id(int ifindex

LIBBPF_DEPRECATED_SINCE (0, 8, "use bpf_xdp_query() instead") LIBBPF_API int bpf_get_link_xdp_info(int ifindex

LIBBPF_API int bpf_xdp_attach (int ifindex, int prog_fd, __u32 flags, const struct bpf_xdp_attach_opts *opts)

LIBBPF_API int bpf_xdp_detach (int ifindex, __u32 flags, const struct bpf_xdp_attach_opts *opts)

LIBBPF_API int bpf_xdp_query (int ifindex, int flags, struct bpf_xdp_query_opts *opts)

LIBBPF_API int bpf_xdp_query_id (int ifindex, int flags, __u32 *prog_id)

LIBBPF_API int bpf_tc_hook_create (struct bpf_tc_hook *hook)

LIBBPF_API int bpf_tc_hook_destroy (struct bpf_tc_hook *hook)

LIBBPF_API int bpf_tc_attach (const struct bpf_tc_hook *hook, struct bpf_tc_opts *opts)

LIBBPF_API int bpf_tc_detach (const struct bpf_tc_hook *hook, const struct bpf_tc_opts *opts)

LIBBPF_API int bpf_tc_query (const struct bpf_tc_hook *hook, struct bpf_tc_opts *opts)

LIBBPF_API struct ring_buffer * ring_buffer__new (int map_fd, ring_buffer_sample_fn sample_cb, void *ctx, const struct ring_buffer_opts *opts)

LIBBPF_API void ring_buffer__free (struct ring_buffer *rb)

LIBBPF_API int ring_buffer__add (struct ring_buffer *rb, int map_fd, ring_buffer_sample_fn sample_cb, void *ctx)

LIBBPF_API int ring_buffer__poll (struct ring_buffer *rb, int timeout_ms)

LIBBPF_API int ring_buffer__consume (struct ring_buffer *rb)

LIBBPF_API int ring_buffer__epoll_fd (const struct ring_buffer *rb)

LIBBPF_API struct perf_buffer * perf_buffer__new (int map_fd, size_t page_cnt, perf_buffer_sample_fn sample_cb, perf_buffer_lost_fn lost_cb, void *ctx, const struct perf_buffer_opts *opts)

perf_buffer__new() creates BPF perfbuf manager for a specified BPF_PERF_EVENT_ARRAY map

Parameters

map_fd – FD of BPF_PERF_EVENT_ARRAY BPF map that will be used by BPF code to send data over to user-space
page_cnt – number of memory pages allocated for each per-CPU buffer
sample_cb – function called on each received data record
lost_cb – function called when record loss has occurred
ctx – user-provided extra context passed into sample_cb and lost_cb

Returns

a new instance of struct perf_buffer on success, NULL on error with errno containing an error code

LIBBPF_API struct perf_buffer * perf_buffer__new_v0_6_0 (int map_fd, size_t page_cnt, perf_buffer_sample_fn sample_cb, perf_buffer_lost_fn lost_cb, void *ctx, const struct perf_buffer_opts *opts)

LIBBPF_API LIBBPF_DEPRECATED_SINCE (0, 7, "use new variant of perf_buffer__new() instead") struct perf_buffer *perf_buffer__new_deprecated(int map_fd

LIBBPF_API struct perf_buffer * perf_buffer__new_raw (int map_fd, size_t page_cnt, struct perf_event_attr *attr, perf_buffer_event_fn event_cb, void *ctx, const struct perf_buffer_raw_opts *opts)

LIBBPF_API struct perf_buffer * perf_buffer__new_raw_v0_6_0 (int map_fd, size_t page_cnt, struct perf_event_attr *attr, perf_buffer_event_fn event_cb, void *ctx, const struct perf_buffer_raw_opts *opts)

LIBBPF_API LIBBPF_DEPRECATED_SINCE (0, 7, "use new variant of perf_buffer__new_raw() instead") struct perf_buffer *perf_buffer__new_raw_deprecated(int map_fd

LIBBPF_API void perf_buffer__free (struct perf_buffer *pb)

LIBBPF_API int perf_buffer__epoll_fd (const struct perf_buffer *pb)

LIBBPF_API int perf_buffer__poll (struct perf_buffer *pb, int timeout_ms)

LIBBPF_API int perf_buffer__consume (struct perf_buffer *pb)

LIBBPF_API int perf_buffer__consume_buffer (struct perf_buffer *pb, size_t buf_idx)

LIBBPF_API size_t perf_buffer__buffer_cnt (const struct perf_buffer *pb)

LIBBPF_API int perf_buffer__buffer_fd (const struct perf_buffer *pb, size_t buf_idx)

LIBBPF_DEPRECATED_SINCE (0, 8, "use perf_buffer__poll() or perf_buffer__consume() instead") LIBBPF_API enum bpf_perf_event_ret bpf_perf_event_read_simple(void *mmap_mem

LIBBPF_API void bpf_prog_linfo__free (struct bpf_prog_linfo *prog_linfo)

LIBBPF_API struct bpf_prog_linfo * bpf_prog_linfo__new (const struct bpf_prog_info *info)

LIBBPF_API const struct bpf_line_info * bpf_prog_linfo__lfind_addr_func (const struct bpf_prog_linfo *prog_linfo, __u64 addr, __u32 func_idx, __u32 nr_skip)

LIBBPF_API const struct bpf_line_info * bpf_prog_linfo__lfind (const struct bpf_prog_linfo *prog_linfo, __u32 insn_off, __u32 nr_skip)

LIBBPF_DEPRECATED_SINCE (0, 8, "use libbpf_probe_bpf_prog_type() instead") LIBBPF_API bool bpf_probe_prog_type(enum bpf_prog_type prog_type

LIBBPF_DEPRECATED_SINCE (0, 8, "use libbpf_probe_bpf_map_type() instead") LIBBPF_API bool bpf_probe_map_type(enum bpf_map_type map_type

LIBBPF_DEPRECATED_SINCE (0, 8, "use libbpf_probe_bpf_helper() instead") LIBBPF_API bool bpf_probe_helper(enum bpf_func_id id

LIBBPF_DEPRECATED_SINCE (0, 8, "implement your own or use bpftool for feature detection") LIBBPF_API bool bpf_probe_large_insn_limit(__u32 ifindex)

LIBBPF_API int libbpf_probe_bpf_prog_type (enum bpf_prog_type prog_type, const void *opts)

libbpf_probe_bpf_prog_type() detects if host kernel supports BPF programs of a given type.

Make sure the process has required set of CAP_* permissions (or runs as root) when performing feature checking.

Parameters

prog_type – BPF program type to detect kernel support for
opts – reserved for future extensibility, should be NULL

Returns

1, if given program type is supported; 0, if given program type is not supported; negative error code if feature detection failed or can’t be performed

LIBBPF_API int libbpf_probe_bpf_map_type (enum bpf_map_type map_type, const void *opts)

libbpf_probe_bpf_map_type() detects if host kernel supports BPF maps of a given type.

Make sure the process has required set of CAP_* permissions (or runs as root) when performing feature checking.

Parameters

map_type – BPF map type to detect kernel support for
opts – reserved for future extensibility, should be NULL

Returns

1, if given map type is supported; 0, if given map type is not supported; negative error code if feature detection failed or can’t be performed

LIBBPF_API int libbpf_probe_bpf_helper (enum bpf_prog_type prog_type, enum bpf_func_id helper_id, const void *opts)

libbpf_probe_bpf_helper() detects if host kernel supports the use of a given BPF helper from specified BPF program type.

Make sure the process has required set of CAP_* permissions (or runs as root) when performing feature checking.

Parameters

prog_type – BPF program type used to check the support of BPF helper
helper_id – BPF helper ID (enum bpf_func_id) to check support for
opts – reserved for future extensibility, should be NULL

Returns

1, if given combination of program type and helper is supported; 0, if the combination is not supported; negative error code if feature detection for provided input arguments failed or can’t be performed

LIBBPF_DEPRECATED_SINCE (0, 6, "use a custom linear prog_info wrapper") LIBBPF_API struct bpf_prog_info_linear *bpf_program__get_prog_info_linear(int fd

LIBBPF_API int libbpf_num_possible_cpus (void)

libbpf_num_possible_cpus() is a helper function to get the number of possible CPUs that the host kernel supports and expects.

Example usage:

int ncpus = libbpf_num_possible_cpus();
if (ncpus < 0) {
     // error handling
}
long values[ncpus];
bpf_map_lookup_elem(per_cpu_map_fd, key, values);

Returns: number of possible CPUs; or error code on failure

LIBBPF_API int bpf_object__open_skeleton (struct bpf_object_skeleton *s, const struct bpf_object_open_opts *opts)

LIBBPF_API int bpf_object__load_skeleton (struct bpf_object_skeleton *s)

LIBBPF_API int bpf_object__attach_skeleton (struct bpf_object_skeleton *s)

LIBBPF_API void bpf_object__detach_skeleton (struct bpf_object_skeleton *s)

LIBBPF_API void bpf_object__destroy_skeleton (struct bpf_object_skeleton *s)

LIBBPF_API int bpf_object__open_subskeleton (struct bpf_object_subskeleton *s)

LIBBPF_API void bpf_object__destroy_subskeleton (struct bpf_object_subskeleton *s)

LIBBPF_API int bpf_object__gen_loader (struct bpf_object *obj, struct gen_loader_opts *opts)

LIBBPF_API struct bpf_linker * bpf_linker__new (const char *filename, struct bpf_linker_opts *opts)

LIBBPF_API int bpf_linker__add_file (struct bpf_linker *linker, const char *filename, const struct bpf_linker_file_opts *opts)

LIBBPF_API int bpf_linker__finalize (struct bpf_linker *linker)

LIBBPF_API void bpf_linker__free (struct bpf_linker *linker)

LIBBPF_API int libbpf_register_prog_handler (const char *sec, enum bpf_prog_type prog_type, enum bpf_attach_type exp_attach_type, const struct libbpf_prog_handler_opts *opts)

libbpf_register_prog_handler() registers a custom BPF program SEC() handler.

sec defines which SEC() definitions are handled by this custom handler registration. sec can have few different forms:

if sec is just a plain string (e.g., “abc”), it will match only SEC(“abc”). If BPF program specifies SEC(“abc/whatever”) it will result in an error;
if sec is of the form “abc/”, proper SEC() form is SEC(“abc/something”), where acceptable “something” should be checked by prog_init_fn callback, if there are additional restrictions;
if sec is of the form “abc+”, it will successfully match both SEC(“abc”) and SEC(“abc/whatever”) forms;
if sec is NULL, custom handler is registered for any BPF program that doesn’t match any of the registered (custom or libbpf’s own) SEC() handlers. There could be only one such generic custom handler registered at any given time.

All custom handlers (except the one with sec == NULL) are processed before libbpf’s own SEC() handlers. It is allowed to “override” libbpf’s SEC() handlers by registering custom ones for the same section prefix (i.e., it’s possible to have custom SEC(“perf_event/LLC-load-misses”) handler).

Note, like much of global libbpf APIs (e.g., libbpf_set_print(), libbpf_set_strict_mode(), etc)) these APIs are not thread-safe. User needs to ensure synchronization if there is a risk of running this API from multiple threads simultaneously.

Parameters

sec – section prefix for which custom handler is registered
prog_type – BPF program type associated with specified section
exp_attach_type – Expected BPF attach type associated with specified section
opts – optional cookie, callbacks, and other extra options

Returns

Non-negative handler ID is returned on success. This handler ID has to be passed to libbpf_unregister_prog_handler() to unregister such custom handler. Negative error code is returned on error.

LIBBPF_API int libbpf_unregister_prog_handler (int handler_id)

libbpf_unregister_prog_handler() unregisters previously registered custom BPF program SEC() handler.

Note, like much of global libbpf APIs (e.g., libbpf_set_print(), libbpf_set_strict_mode(), etc)) these APIs are not thread-safe. User needs to ensure synchronization if there is a risk of running this API from multiple threads simultaneously.

Parameters: handler_id – handler ID returned by libbpf_register_prog_handler() after successful registration
Returns: 0 on success, negative error code if handler isn’t found

Defines

bpf_object_open_opts__last_field kernel_log_level

bpf_object__for_each_safe(pos, tmp) for ((pos) = bpf_object__next(NULL), \ (tmp) = bpf_object__next(pos); \ (pos) != NULL; \ (pos) = (tmp), (tmp) = bpf_object__next(tmp)) 

bpf_object__for_each_program(pos, obj) for ((pos) = bpf_object__next_program((obj), NULL); \ (pos) != NULL; \ (pos) = bpf_object__next_program((obj), (pos))) 

bpf_perf_event_opts__last_field bpf_cookie

bpf_kprobe_opts__last_field retprobe

bpf_kprobe_multi_opts__last_field retprobe

bpf_uprobe_opts__last_field func_name

bpf_usdt_opts__last_field usdt_cookie

bpf_tracepoint_opts__last_field bpf_cookie

bpf_iter_attach_opts__last_field link_info_len

bpf_object__for_each_map(pos, obj) for ((pos) = bpf_object__next_map((obj), NULL); \ (pos) != NULL; \ (pos) = bpf_object__next_map((obj), (pos))) 

bpf_map__for_each bpf_object__for_each_map

bpf_xdp_set_link_opts__last_field old_fd

bpf_xdp_attach_opts__last_field old_prog_fd

bpf_xdp_query_opts__last_field attach_mode

BPF_TC_PARENT(a, b) ((((a) << 16) & 0xFFFF0000U) | ((b) & 0x0000FFFFU))

bpf_tc_hook__last_field parent

bpf_tc_opts__last_field priority

ring_buffer_opts__last_field sz

perf_buffer_opts__last_field sz

perf_buffer__new(...) ___libbpf_overload(___perf_buffer_new, __VA_ARGS__)

perf_buffer_raw_opts__last_field map_keys

perf_buffer__new_raw(...) ___libbpf_overload(___perf_buffer_new_raw, __VA_ARGS__)

gen_loader_opts__last_field insns_sz

bpf_linker_opts__last_field sz

bpf_linker_file_opts__last_field sz

libbpf_prog_handler_opts__last_field prog_attach_fn

Enums

enum libbpf_errno

Values:

enumerator __LIBBPF_ERRNO__START = 4000

enumerator LIBBPF_ERRNO__LIBELF = __LIBBPF_ERRNO__START 

enumerator LIBBPF_ERRNO__FORMAT

enumerator LIBBPF_ERRNO__KVERSION

enumerator LIBBPF_ERRNO__ENDIAN

enumerator LIBBPF_ERRNO__INTERNAL

enumerator LIBBPF_ERRNO__RELOC

enumerator LIBBPF_ERRNO__LOAD

enumerator LIBBPF_ERRNO__VERIFY

enumerator LIBBPF_ERRNO__PROG2BIG

enumerator LIBBPF_ERRNO__KVER

enumerator LIBBPF_ERRNO__PROGTYPE

enumerator LIBBPF_ERRNO__WRNGPID

enumerator LIBBPF_ERRNO__INVSEQ

enumerator LIBBPF_ERRNO__NLPARSE

enumerator __LIBBPF_ERRNO__END

enum libbpf_print_level

Values:

enumerator LIBBPF_WARN

enumerator LIBBPF_INFO

enumerator LIBBPF_DEBUG

enum libbpf_pin_type

Values:

enumerator LIBBPF_PIN_NONE

enumerator LIBBPF_PIN_BY_NAME

enumerator LIBBPF_PIN_NONE

enumerator LIBBPF_PIN_BY_NAME

enum bpf_tc_attach_point

Values:

enumerator BPF_TC_INGRESS = 1 << 0

enumerator BPF_TC_EGRESS = 1 << 1

enumerator BPF_TC_CUSTOM = 1 << 2

enum bpf_tc_flags

Values:

enumerator BPF_TC_F_REPLACE = 1 << 0

enum bpf_perf_event_ret

Values:

enumerator LIBBPF_PERF_EVENT_DONE = 0

enumerator LIBBPF_PERF_EVENT_ERROR = -1

enumerator LIBBPF_PERF_EVENT_CONT = -2

enum bpf_prog_info_array

Values:

enumerator BPF_PROG_INFO_FIRST_ARRAY = 0

enumerator BPF_PROG_INFO_JITED_INSNS = 0

enumerator BPF_PROG_INFO_XLATED_INSNS

enumerator BPF_PROG_INFO_MAP_IDS

enumerator BPF_PROG_INFO_JITED_KSYMS

enumerator BPF_PROG_INFO_JITED_FUNC_LENS

enumerator BPF_PROG_INFO_FUNC_INFO

enumerator BPF_PROG_INFO_LINE_INFO

enumerator BPF_PROG_INFO_JITED_LINE_INFO

enumerator BPF_PROG_INFO_PROG_TAGS

enumerator BPF_PROG_INFO_LAST_ARRAY

enum libbpf_tristate

Values:

enumerator TRI_NO = 0

enumerator TRI_YES = 1

enumerator TRI_MODULE = 2

enumerator TRI_NO = 0

enumerator TRI_YES = 1

enumerator TRI_MODULE = 2

bpf.h

Functions

int libbpf_set_memlock_rlim(size_t memlock_bytes)

LIBBPF_API int bpf_map_create (enum bpf_map_type map_type, const char *map_name, __u32 key_size, __u32 value_size, __u32 max_entries, const struct bpf_map_create_opts *opts)

LIBBPF_DEPRECATED_SINCE (0, 7, "use bpf_map_create() instead") LIBBPF_API int bpf_create_map_xattr(const struct bpf_create_map_attr *create_attr)

LIBBPF_API int bpf_prog_load (enum bpf_prog_type prog_type, const char *prog_name, const char *license, const struct bpf_insn *insns, size_t insn_cnt, const struct bpf_prog_load_opts *opts)

LIBBPF_API int bpf_prog_load_v0_6_0 (enum bpf_prog_type prog_type, const char *prog_name, const char *license, const struct bpf_insn *insns, size_t insn_cnt, const struct bpf_prog_load_opts *opts)

LIBBPF_DEPRECATED_SINCE (0, 7, "use bpf_prog_load() instead") LIBBPF_API int bpf_load_program_xattr(const struct bpf_load_program_attr *load_attr

LIBBPF_API int bpf_btf_load (const void *btf_data, size_t btf_size, const struct bpf_btf_load_opts *opts)

LIBBPF_DEPRECATED_SINCE (0, 8, "use bpf_btf_load() instead") LIBBPF_API int bpf_load_btf(const void *btf

LIBBPF_API int bpf_map_update_elem (int fd, const void *key, const void *value, __u64 flags)

LIBBPF_API int bpf_map_lookup_elem (int fd, const void *key, void *value)

LIBBPF_API int bpf_map_lookup_elem_flags (int fd, const void *key, void *value, __u64 flags)

LIBBPF_API int bpf_map_lookup_and_delete_elem (int fd, const void *key, void *value)

LIBBPF_API int bpf_map_lookup_and_delete_elem_flags (int fd, const void *key, void *value, __u64 flags)

LIBBPF_API int bpf_map_delete_elem (int fd, const void *key)

LIBBPF_API int bpf_map_get_next_key (int fd, const void *key, void *next_key)

LIBBPF_API int bpf_map_freeze (int fd)

LIBBPF_API int bpf_map_delete_batch (int fd, const void *keys, __u32 *count, const struct bpf_map_batch_opts *opts)

bpf_map_delete_batch() allows for batch deletion of multiple elements in a BPF map.

Parameters

fd – BPF map file descriptor
keys – pointer to an array of count keys
count – input and output parameter; on input count represents the number of elements in the map to delete in batch; on output if a non-EFAULT error is returned, count represents the number of deleted elements if the output count value is not equal to the input count value If EFAULT is returned, count should not be trusted to be correct.
opts – options for configuring the way the batch deletion works

Returns

0, on success; negative error code, otherwise (errno is also set to the error code)

LIBBPF_API int bpf_map_lookup_batch (int fd, void *in_batch, void *out_batch, void *keys, void *values, __u32 *count, const struct bpf_map_batch_opts *opts)

bpf_map_lookup_batch() allows for batch lookup of BPF map elements.

The parameter in_batch is the address of the first element in the batch to read. out_batch is an output parameter that should be passed as in_batch to subsequent calls to bpf_map_lookup_batch(). NULL can be passed for in_batch to indicate that the batched lookup starts from the beginning of the map.

The keys and values are output parameters which must point to memory large enough to hold count items based on the key and value size of the map map_fd. The keys buffer must be of key_size * count. The values buffer must be of value_size * count.

Parameters

fd – BPF map file descriptor
in_batch – address of the first element in batch to read, can pass NULL to indicate that the batched lookup starts from the beginning of the map.
out_batch – output parameter that should be passed to next call as in_batch
keys – pointer to an array large enough for count keys
values – pointer to an array large enough for count values
count – input and output parameter; on input it’s the number of elements in the map to read in batch; on output it’s the number of elements that were successfully read. If a non-EFAULT error is returned, count will be set as the number of elements that were read before the error occurred. If EFAULT is returned, count should not be trusted to be correct.
opts – options for configuring the way the batch lookup works

Returns

0, on success; negative error code, otherwise (errno is also set to the error code)

LIBBPF_API int bpf_map_lookup_and_delete_batch (int fd, void *in_batch, void *out_batch, void *keys, void *values, __u32 *count, const struct bpf_map_batch_opts *opts)

bpf_map_lookup_and_delete_batch() allows for batch lookup and deletion of BPF map elements where each element is deleted after being retrieved.

Parameters

fd – BPF map file descriptor
in_batch – address of the first element in batch to read, can pass NULL to get address of the first element in out_batch
out_batch – output parameter that should be passed to next call as in_batch
keys – pointer to an array of count keys
values – pointer to an array large enough for count values
count – input and output parameter; on input it’s the number of elements in the map to read and delete in batch; on output it represents the number of elements that were successfully read and deleted If a non-**EFAULT** error code is returned and if the output count value is not equal to the input count value, up to count elements may have been deleted. if EFAULT is returned up to count elements may have been deleted without being returned via the keys and values output parameters.
opts – options for configuring the way the batch lookup and delete works

Returns

0, on success; negative error code, otherwise (errno is also set to the error code)

LIBBPF_API int bpf_map_update_batch (int fd, const void *keys, const void *values, __u32 *count, const struct bpf_map_batch_opts *opts)

bpf_map_update_batch() updates multiple elements in a map by specifying keys and their corresponding values.

The keys and values parameters must point to memory large enough to hold count items based on the key and value size of the map.

The opts parameter can be used to control how bpf_map_update_batch() should handle keys that either do or do not already exist in the map. In particular the flags parameter of bpf_map_batch_opts can be one of the following:

Note that count is an input and output parameter, where on output it represents how many elements were successfully updated. Also note that if EFAULT then count should not be trusted to be correct.

BPF_ANY Create new elements or update existing.

BPF_NOEXIST Create new elements only if they do not exist.

BPF_EXIST Update existing elements.

BPF_F_LOCK Update spin_lock-ed map elements. This must be specified if the map value contains a spinlock.

Parameters

fd – BPF map file descriptor
keys – pointer to an array of count keys
values – pointer to an array of count values
count – input and output parameter; on input it’s the number of elements in the map to update in batch; on output if a non-EFAULT error is returned, count represents the number of updated elements if the output count value is not equal to the input count value. If EFAULT is returned, count should not be trusted to be correct.
opts – options for configuring the way the batch update works

Returns

0, on success; negative error code, otherwise (errno is also set to the error code)

LIBBPF_API int bpf_obj_pin (int fd, const char *pathname)

LIBBPF_API int bpf_obj_get (const char *pathname)

LIBBPF_API int bpf_prog_attach (int prog_fd, int attachable_fd, enum bpf_attach_type type, unsigned int flags)

LIBBPF_API int bpf_prog_attach_opts (int prog_fd, int attachable_fd, enum bpf_attach_type type, const struct bpf_prog_attach_opts *opts)

LIBBPF_DEPRECATED_SINCE (0, 8, "use bpf_prog_attach_opts() instead") LIBBPF_API int bpf_prog_attach_xattr(int prog_fd

LIBBPF_API int bpf_prog_detach (int attachable_fd, enum bpf_attach_type type)

LIBBPF_API int bpf_prog_detach2 (int prog_fd, int attachable_fd, enum bpf_attach_type type)

LIBBPF_API int bpf_link_create (int prog_fd, int target_fd, enum bpf_attach_type attach_type, const struct bpf_link_create_opts *opts)

LIBBPF_API int bpf_link_detach (int link_fd)

LIBBPF_API int bpf_link_update (int link_fd, int new_prog_fd, const struct bpf_link_update_opts *opts)

LIBBPF_API int bpf_iter_create (int link_fd)

LIBBPF_DEPRECATED_SINCE (0, 7, "use bpf_prog_test_run_opts() instead") LIBBPF_API int bpf_prog_test_run_xattr(struct bpf_prog_test_run_attr *test_attr)

LIBBPF_API int bpf_prog_get_next_id (__u32 start_id, __u32 *next_id)

LIBBPF_API int bpf_map_get_next_id (__u32 start_id, __u32 *next_id)

LIBBPF_API int bpf_btf_get_next_id (__u32 start_id, __u32 *next_id)

LIBBPF_API int bpf_link_get_next_id (__u32 start_id, __u32 *next_id)

LIBBPF_API int bpf_prog_get_fd_by_id (__u32 id)

LIBBPF_API int bpf_map_get_fd_by_id (__u32 id)

LIBBPF_API int bpf_btf_get_fd_by_id (__u32 id)

LIBBPF_API int bpf_link_get_fd_by_id (__u32 id)

LIBBPF_API int bpf_obj_get_info_by_fd (int bpf_fd, void *info, __u32 *info_len)

LIBBPF_API int bpf_prog_query (int target_fd, enum bpf_attach_type type, __u32 query_flags, __u32 *attach_flags, __u32 *prog_ids, __u32 *prog_cnt)

LIBBPF_API int bpf_raw_tracepoint_open (const char *name, int prog_fd)

LIBBPF_API int bpf_task_fd_query (int pid, int fd, __u32 flags, char *buf, __u32 *buf_len, __u32 *prog_id, __u32 *fd_type, __u64 *probe_offset, __u64 *probe_addr)

LIBBPF_API int bpf_enable_stats (enum bpf_stats_type type)

LIBBPF_API int bpf_prog_bind_map (int prog_fd, int map_fd, const struct bpf_prog_bind_opts *opts)

LIBBPF_API int bpf_prog_test_run_opts (int prog_fd, struct bpf_test_run_opts *opts)

Defines

bpf_map_create_opts__last_field map_ifindex

bpf_prog_load_opts__last_field log_buf

bpf_prog_load(...) ___libbpf_overload(___bpf_prog_load, __VA_ARGS__)

MAPS_RELAX_COMPAT 0x01

BPF_LOG_BUF_SIZE (UINT32_MAX >> 8) /* verifier maximum in kernels <= 5.1 */

bpf_btf_load_opts__last_field log_size

bpf_map_batch_opts__last_field flags

bpf_prog_attach_opts__last_field replace_prog_fd

bpf_link_create_opts__last_field kprobe_multi.cookies

bpf_link_update_opts__last_field old_prog_fd

bpf_prog_bind_opts__last_field flags

bpf_test_run_opts__last_field batch_size

btf.h

Functions

LIBBPF_API void btf__free (struct btf *btf)

btf__free() frees all data of a BTF object

Parameters: btf – BTF object to free

LIBBPF_API struct btf * btf__new (const void *data, __u32 size)

btf__new() creates a new instance of a BTF object from the raw bytes of an ELF’s BTF section

On error, error-code-encoded-as-pointer is returned, not a NULL. To extract error code from such a pointer libbpf_get_error() should be used. If libbpf_set_strict_mode(LIBBPF_STRICT_CLEAN_PTRS) is enabled, NULL is returned on error instead. In both cases thread-local errno variable is always set to error code as well.

Parameters

data – raw bytes
size – number of bytes passed in data

Returns

new BTF object instance which has to be eventually freed with btf__free()

LIBBPF_API struct btf * btf__new_split (const void *data, __u32 size, struct btf *base_btf)

btf__new_split() create a new instance of a BTF object from the provided raw data bytes. It takes another BTF instance, base_btf, which serves as a base BTF, which is extended by types in a newly created BTF instance

If base_btf is NULL, btf__new_split() is equivalent to btf__new() and creates non-split BTF.

On error, error-code-encoded-as-pointer is returned, not a NULL. To extract error code from such a pointer libbpf_get_error() should be used. If libbpf_set_strict_mode(LIBBPF_STRICT_CLEAN_PTRS) is enabled, NULL is returned on error instead. In both cases thread-local errno variable is always set to error code as well.

Parameters

data – raw bytes
size – length of raw bytes
base_btf – the base BTF object

Returns

new BTF object instance which has to be eventually freed with btf__free()

LIBBPF_API struct btf * btf__new_empty (void)

btf__new_empty() creates an empty BTF object. Use btf__add_*() to populate such BTF object.

On error, error-code-encoded-as-pointer is returned, not a NULL. To extract error code from such a pointer libbpf_get_error() should be used. If libbpf_set_strict_mode(LIBBPF_STRICT_CLEAN_PTRS) is enabled, NULL is returned on error instead. In both cases thread-local errno variable is always set to error code as well.

Returns: new BTF object instance which has to be eventually freed with btf__free()

LIBBPF_API struct btf * btf__new_empty_split (struct btf *base_btf)

btf__new_empty_split() creates an unpopulated BTF object from an ELF BTF section except with a base BTF on top of which split BTF should be based

If base_btf is NULL, btf__new_empty_split() is equivalent to btf__new_empty() and creates non-split BTF.

On error, error-code-encoded-as-pointer is returned, not a NULL. To extract error code from such a pointer libbpf_get_error() should be used. If libbpf_set_strict_mode(LIBBPF_STRICT_CLEAN_PTRS) is enabled, NULL is returned on error instead. In both cases thread-local errno variable is always set to error code as well.

Returns: new BTF object instance which has to be eventually freed with btf__free()

LIBBPF_API struct btf * btf__parse (const char *path, struct btf_ext **btf_ext)

LIBBPF_API struct btf * btf__parse_split (const char *path, struct btf *base_btf)

LIBBPF_API struct btf * btf__parse_elf (const char *path, struct btf_ext **btf_ext)

LIBBPF_API struct btf * btf__parse_elf_split (const char *path, struct btf *base_btf)

LIBBPF_API struct btf * btf__parse_raw (const char *path)

LIBBPF_API struct btf * btf__parse_raw_split (const char *path, struct btf *base_btf)

LIBBPF_API struct btf * btf__load_vmlinux_btf (void)

LIBBPF_API struct btf * btf__load_module_btf (const char *module_name, struct btf *vmlinux_btf)

LIBBPF_API struct btf * libbpf_find_kernel_btf (void)

LIBBPF_API struct btf * btf__load_from_kernel_by_id (__u32 id)

LIBBPF_API struct btf * btf__load_from_kernel_by_id_split (__u32 id, struct btf *base_btf)

LIBBPF_DEPRECATED_SINCE (0, 6, "use btf__load_from_kernel_by_id instead") LIBBPF_API int btf__get_from_id(__u32 id

LIBBPF_DEPRECATED_SINCE (0, 6, "intended for internal libbpf use only") LIBBPF_API int btf__finalize_data(struct bpf_object *obj

LIBBPF_DEPRECATED_SINCE (0, 6, "use btf__load_into_kernel instead") LIBBPF_API int btf__load(struct btf *btf)

LIBBPF_API int btf__load_into_kernel (struct btf *btf)

LIBBPF_API __s32 btf__find_by_name (const struct btf *btf, const char *type_name)

LIBBPF_API __s32 btf__find_by_name_kind (const struct btf *btf, const char *type_name, __u32 kind)

LIBBPF_DEPRECATED_SINCE (0, 7, "use btf__type_cnt() instead; note that btf__get_nr_types() == btf__type_cnt() - 1") LIBBPF_API __u32 btf__get_nr_types(const struct btf *btf)

LIBBPF_API __u32 btf__type_cnt (const struct btf *btf)

LIBBPF_API const struct btf * btf__base_btf (const struct btf *btf)

LIBBPF_API const struct btf_type * btf__type_by_id (const struct btf *btf, __u32 id)

LIBBPF_API size_t btf__pointer_size (const struct btf *btf)

LIBBPF_API int btf__set_pointer_size (struct btf *btf, size_t ptr_sz)

LIBBPF_API enum btf_endianness btf__endianness (const struct btf *btf)

LIBBPF_API int btf__set_endianness (struct btf *btf, enum btf_endianness endian)

LIBBPF_API __s64 btf__resolve_size (const struct btf *btf, __u32 type_id)

LIBBPF_API int btf__resolve_type (const struct btf *btf, __u32 type_id)

LIBBPF_API int btf__align_of (const struct btf *btf, __u32 id)

LIBBPF_API int btf__fd (const struct btf *btf)

LIBBPF_API void btf__set_fd (struct btf *btf, int fd)

LIBBPF_API const void * btf__raw_data (const struct btf *btf, __u32 *size)

LIBBPF_API const char * btf__name_by_offset (const struct btf *btf, __u32 offset)

LIBBPF_API const char * btf__str_by_offset (const struct btf *btf, __u32 offset)

LIBBPF_DEPRECATED_SINCE (0, 7, "this API is not necessary when BTF-defined maps are used") LIBBPF_API int btf__get_map_kv_tids(const struct btf *btf

LIBBPF_API struct btf_ext * btf_ext__new (const __u8 *data, __u32 size)

LIBBPF_API void btf_ext__free (struct btf_ext *btf_ext)

LIBBPF_API const void * btf_ext__raw_data (const struct btf_ext *btf_ext, __u32 *size)

LIBBPF_API LIBBPF_DEPRECATED ("btf_ext__reloc_func_info was never meant as a public API and has wrong assumptions embedded in it; it will be removed in the future libbpf versions") int btf_ext__reloc_func_info(const struct btf *btf

LIBBPF_API LIBBPF_DEPRECATED ("btf_ext__reloc_line_info was never meant as a public API and has wrong assumptions embedded in it; it will be removed in the future libbpf versions") int btf_ext__reloc_line_info(const struct btf *btf

LIBBPF_API LIBBPF_DEPRECATED ("btf_ext__reloc_func_info is deprecated; write custom func_info parsing to fetch rec_size") __u32 btf_ext__func_info_rec_size(const struct btf_ext *btf_ext)

LIBBPF_API LIBBPF_DEPRECATED ("btf_ext__reloc_line_info is deprecated; write custom line_info parsing to fetch rec_size") __u32 btf_ext__line_info_rec_size(const struct btf_ext *btf_ext)

LIBBPF_API int btf__find_str (struct btf *btf, const char *s)

LIBBPF_API int btf__add_str (struct btf *btf, const char *s)

LIBBPF_API int btf__add_type (struct btf *btf, const struct btf *src_btf, const struct btf_type *src_type)

LIBBPF_API int btf__add_btf (struct btf *btf, const struct btf *src_btf)

btf__add_btf() appends all the BTF types from src_btf into btf

btf__add_btf() can be used to simply and efficiently append the entire contents of one BTF object to another one. All the BTF type data is copied over, all referenced type IDs are adjusted by adding a necessary ID offset. Only strings referenced from BTF types are copied over and deduplicated, so if there were some unused strings in src_btf, those won’t be copied over, which is consistent with the general string deduplication semantics of BTF writing APIs.

If any error is encountered during this process, the contents of btf is left intact, which means that btf__add_btf() follows the transactional semantics and the operation as a whole is all-or-nothing.

src_btf has to be non-split BTF, as of now copying types from split BTF is not supported and will result in -ENOTSUP error code returned.

Parameters

btf – BTF object which all the BTF types and strings are added to
src_btf – BTF object which all BTF types and referenced strings are copied from

Returns

BTF type ID of the first appended BTF type, or negative error code

LIBBPF_API int btf__add_int (struct btf *btf, const char *name, size_t byte_sz, int encoding)

LIBBPF_API int btf__add_float (struct btf *btf, const char *name, size_t byte_sz)

LIBBPF_API int btf__add_ptr (struct btf *btf, int ref_type_id)

LIBBPF_API int btf__add_array (struct btf *btf, int index_type_id, int elem_type_id, __u32 nr_elems)

LIBBPF_API int btf__add_struct (struct btf *btf, const char *name, __u32 sz)

LIBBPF_API int btf__add_union (struct btf *btf, const char *name, __u32 sz)

LIBBPF_API int btf__add_field (struct btf *btf, const char *name, int field_type_id, __u32 bit_offset, __u32 bit_size)

LIBBPF_API int btf__add_enum (struct btf *btf, const char *name, __u32 bytes_sz)

LIBBPF_API int btf__add_enum_value (struct btf *btf, const char *name, __s64 value)

LIBBPF_API int btf__add_fwd (struct btf *btf, const char *name, enum btf_fwd_kind fwd_kind)

LIBBPF_API int btf__add_typedef (struct btf *btf, const char *name, int ref_type_id)

LIBBPF_API int btf__add_volatile (struct btf *btf, int ref_type_id)

LIBBPF_API int btf__add_const (struct btf *btf, int ref_type_id)

LIBBPF_API int btf__add_restrict (struct btf *btf, int ref_type_id)

LIBBPF_API int btf__add_type_tag (struct btf *btf, const char *value, int ref_type_id)

LIBBPF_API int btf__add_func (struct btf *btf, const char *name, enum btf_func_linkage linkage, int proto_type_id)

LIBBPF_API int btf__add_func_proto (struct btf *btf, int ret_type_id)

LIBBPF_API int btf__add_func_param (struct btf *btf, const char *name, int type_id)

LIBBPF_API int btf__add_var (struct btf *btf, const char *name, int linkage, int type_id)

LIBBPF_API int btf__add_datasec (struct btf *btf, const char *name, __u32 byte_sz)

LIBBPF_API int btf__add_datasec_var_info (struct btf *btf, int var_type_id, __u32 offset, __u32 byte_sz)

LIBBPF_API int btf__add_decl_tag (struct btf *btf, const char *value, int ref_type_id, int component_idx)

LIBBPF_API int btf__dedup (struct btf *btf, const struct btf_dedup_opts *opts)

LIBBPF_API int btf__dedup_v0_6_0 (struct btf *btf, const struct btf_dedup_opts *opts)

LIBBPF_DEPRECATED_SINCE (0, 7, "use btf__dedup() instead") LIBBPF_API int btf__dedup_deprecated(struct btf *btf

LIBBPF_API struct btf_dump * btf_dump__new (const struct btf *btf, btf_dump_printf_fn_t printf_fn, void *ctx, const struct btf_dump_opts *opts)

LIBBPF_API struct btf_dump * btf_dump__new_v0_6_0 (const struct btf *btf, btf_dump_printf_fn_t printf_fn, void *ctx, const struct btf_dump_opts *opts)

LIBBPF_API struct btf_dump * btf_dump__new_deprecated (const struct btf *btf, const struct btf_ext *btf_ext, const struct btf_dump_opts *opts, btf_dump_printf_fn_t printf_fn)

LIBBPF_API void btf_dump__free (struct btf_dump *d)

LIBBPF_API int btf_dump__dump_type (struct btf_dump *d, __u32 id)

LIBBPF_API int btf_dump__emit_type_decl (struct btf_dump *d, __u32 id, const struct btf_dump_emit_type_decl_opts *opts)

LIBBPF_API int btf_dump__dump_type_data (struct btf_dump *d, __u32 id, const void *data, size_t data_sz, const struct btf_dump_type_data_opts *opts)

static inline __u16 btf_kind(const struct btf_type *t)

static inline __u16 btf_vlen(const struct btf_type *t)

static inline bool btf_kflag(const struct btf_type *t)

static inline bool btf_is_void(const struct btf_type *t)

static inline bool btf_is_int(const struct btf_type *t)

static inline bool btf_is_ptr(const struct btf_type *t)

static inline bool btf_is_array(const struct btf_type *t)

static inline bool btf_is_struct(const struct btf_type *t)

static inline bool btf_is_union(const struct btf_type *t)

static inline bool btf_is_composite(const struct btf_type *t)

static inline bool btf_is_enum(const struct btf_type *t)

static inline bool btf_is_fwd(const struct btf_type *t)

static inline bool btf_is_typedef(const struct btf_type *t)

static inline bool btf_is_volatile(const struct btf_type *t)

static inline bool btf_is_const(const struct btf_type *t)

static inline bool btf_is_restrict(const struct btf_type *t)

static inline bool btf_is_mod(const struct btf_type *t)

static inline bool btf_is_func(const struct btf_type *t)

static inline bool btf_is_func_proto(const struct btf_type *t)

static inline bool btf_is_var(const struct btf_type *t)

static inline bool btf_is_datasec(const struct btf_type *t)

static inline bool btf_is_float(const struct btf_type *t)

static inline bool btf_is_decl_tag(const struct btf_type *t)

static inline bool btf_is_type_tag(const struct btf_type *t)

static inline __u8 btf_int_encoding(const struct btf_type *t)

static inline __u8 btf_int_offset(const struct btf_type *t)

static inline __u8 btf_int_bits(const struct btf_type *t)

static struct btf_array *btf_array(const struct btf_type *t)

static struct btf_enum *btf_enum(const struct btf_type *t)

static struct btf_member *btf_members(const struct btf_type *t)

static inline __u32 btf_member_bit_offset(const struct btf_type *t, __u32 member_idx)

static inline __u32 btf_member_bitfield_size(const struct btf_type *t, __u32 member_idx)

static struct btf_param *btf_params(const struct btf_type *t)

static struct btf_var *btf_var(const struct btf_type *t)

static struct btf_var_secinfo *btf_var_secinfos(const struct btf_type *t)

static struct btf_decl_tag *btf_decl_tag(const struct btf_type *t)

Defines

BTF_ELF_SEC ".BTF"

BTF_EXT_ELF_SEC ".BTF.ext"

MAPS_ELF_SEC ".maps"

btf_dedup_opts__last_field force_collisions

btf__dedup(...) ___libbpf_overload(___btf_dedup, __VA_ARGS__)

btf_dump__new(a1, a2, a3, a4) __builtin_choose_expr( \ __builtin_types_compatible_p(typeof(a4), btf_dump_printf_fn_t) || \ __builtin_types_compatible_p(typeof(a4), void(void *, const char *, va_list)), \ btf_dump__new_deprecated((void *)a1, (void *)a2, (void *)a3, (void *)a4), \ btf_dump__new((void *)a1, (void *)a2, (void *)a3, (void *)a4)) 

btf_dump_emit_type_decl_opts__last_field strip_mods

btf_dump_type_data_opts__last_field emit_zeroes

BTF_KIND_FUNC 12 /* Function */

BTF_KIND_FUNC_PROTO 13 /* Function Proto */

BTF_KIND_VAR 14 /* Variable */

BTF_KIND_DATASEC 15 /* Section */

BTF_KIND_FLOAT 16 /* Floating point */

BTF_KIND_DECL_TAG 17 /* Decl Tag */

BTF_KIND_TYPE_TAG 18 /* Type Tag */

Enums

enum btf_endianness

Values:

enumerator BTF_LITTLE_ENDIAN = 0

enumerator BTF_BIG_ENDIAN = 1

enum btf_fwd_kind

Values:

enumerator BTF_FWD_STRUCT = 0

enumerator BTF_FWD_UNION = 1

enumerator BTF_FWD_ENUM = 2

xsk.h

Functions

DEFINE_XSK_RING(xsk_ring_prod)

DEFINE_XSK_RING(xsk_ring_cons)

static inline __u64 *xsk_ring_prod__fill_addr(struct xsk_ring_prod *fill, __u32 idx)

static inline const __u64 *xsk_ring_cons__comp_addr(const struct xsk_ring_cons *comp, __u32 idx)

static struct xdp_desc *xsk_ring_prod__tx_desc(struct xsk_ring_prod *tx, __u32 idx)

static const struct xdp_desc *xsk_ring_cons__rx_desc(const struct xsk_ring_cons *rx, __u32 idx)

static inline int xsk_ring_prod__needs_wakeup(const struct xsk_ring_prod *r)

static inline __u32 xsk_prod_nb_free(struct xsk_ring_prod *r, __u32 nb)

static inline __u32 xsk_cons_nb_avail(struct xsk_ring_cons *r, __u32 nb)

static inline __u32 xsk_ring_prod__reserve(struct xsk_ring_prod *prod, __u32 nb, __u32 *idx)

static inline void xsk_ring_prod__submit(struct xsk_ring_prod *prod, __u32 nb)

static inline __u32 xsk_ring_cons__peek(struct xsk_ring_cons *cons, __u32 nb, __u32 *idx)

static inline void xsk_ring_cons__cancel(struct xsk_ring_cons *cons, __u32 nb)

static inline void xsk_ring_cons__release(struct xsk_ring_cons *cons, __u32 nb)

static inline void *xsk_umem__get_data(void *umem_area, __u64 addr)

static inline __u64 xsk_umem__extract_addr(__u64 addr)

static inline __u64 xsk_umem__extract_offset(__u64 addr)

static inline __u64 xsk_umem__add_offset_to_addr(__u64 addr)

LIBBPF_API LIBBPF_DEPRECATED_SINCE (0, 7, "AF_XDP support deprecated and moved to libxdp") int xsk_umem__fd(const struct xsk_umem *umem)

Defines

__XSK_READ_ONCE(x) (*(volatile typeof(x) *)&x)

__XSK_WRITE_ONCE(x, v) (*(volatile typeof(x) *)&x) = (v)

libbpf_smp_store_release(p, v) do { \ __sync_synchronize(); \ __XSK_WRITE_ONCE(*p, v); \ } while (0) 

libbpf_smp_load_acquire(p) ({ \ typeof(*p) ___p1 = __XSK_READ_ONCE(*p); \ __sync_synchronize(); \ ___p1; \ }) 

DEFINE_XSK_RING(name) struct name { \ __u32 cached_prod; \ __u32 cached_cons; \ __u32 mask; \ __u32 size; \ __u32 *producer; \ __u32 *consumer; \ void * ring ; \ __u32 *flags; \ } 

XSK_RING_CONS__DEFAULT_NUM_DESCS 2048

XSK_RING_PROD__DEFAULT_NUM_DESCS 2048

XSK_UMEM__DEFAULT_FRAME_SHIFT 12 /* 4096 bytes */

XSK_UMEM__DEFAULT_FRAME_SIZE (1 << XSK_UMEM__DEFAULT_FRAME_SHIFT)

XSK_UMEM__DEFAULT_FRAME_HEADROOM 0

XSK_UMEM__DEFAULT_FLAGS 0

XSK_LIBBPF_FLAGS__INHIBIT_PROG_LOAD (1 << 0)

bpf_tracing.h

Defines

__BPF_TARGET_MISSING "GCC error \"Must specify a BPF target arch via __TARGET_ARCH_xxx\""

PT_REGS_PARM1(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM2(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM3(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM4(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM5(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_RET(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_FP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_RC(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_SP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_IP(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM1_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM2_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM3_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM4_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM5_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_RET_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_FP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_RC_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_SP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_IP_CORE(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

BPF_KPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

BPF_KRETPROBE_READ_RET_IP(ip, ctx) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM1_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM2_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM3_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM4_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM5_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM1_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM2_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM3_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM4_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_PARM5_CORE_SYSCALL(x) ({ _Pragma(__BPF_TARGET_MISSING); 0l; })

PT_REGS_SYSCALL_REGS(ctx) ((struct pt_regs *)PT_REGS_PARM1(ctx))

BPF_PROG(name, args...) name(unsigned long long *ctx);     \ static __attribute__((always_inline)) typeof(name(0))     \ ____##name(unsigned long long *ctx, ##args);     \ typeof(name(0)) name(unsigned long long *ctx)     \ {     \ _Pragma("GCC diagnostic push")     \ _Pragma("GCC diagnostic ignored \"-Wint-conversion\"")     \ return ____##name(___bpf_ctx_cast(args));     \ _Pragma("GCC diagnostic pop")     \ }     \ static __attribute__((always_inline)) typeof(name(0))     \ ____##name(unsigned long long *ctx, ##args) 

BPF_KPROBE(name, args...) name(struct pt_regs *ctx);     \ static __attribute__((always_inline)) typeof(name(0))     \ ____##name(struct pt_regs *ctx, ##args);     \ typeof(name(0)) name(struct pt_regs *ctx)     \ {     \ _Pragma("GCC diagnostic push")     \ _Pragma("GCC diagnostic ignored \"-Wint-conversion\"")     \ return ____##name(___bpf_kprobe_args(args));     \ _Pragma("GCC diagnostic pop")     \ }     \ static __attribute__((always_inline)) typeof(name(0))     \ ____##name(struct pt_regs *ctx, ##args) 

BPF_KRETPROBE(name, args...) name(struct pt_regs *ctx);     \ static __attribute__((always_inline)) typeof(name(0))     \ ____##name(struct pt_regs *ctx, ##args);     \ typeof(name(0)) name(struct pt_regs *ctx)     \ {     \ _Pragma("GCC diagnostic push")     \ _Pragma("GCC diagnostic ignored \"-Wint-conversion\"")     \ return ____##name(___bpf_kretprobe_args(args));     \ _Pragma("GCC diagnostic pop")     \ }     \ static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args) 

BPF_KPROBE_SYSCALL(name, args...) name(struct pt_regs *ctx);     \ static __attribute__((always_inline)) typeof(name(0))     \ ____##name(struct pt_regs *ctx, ##args);     \ typeof(name(0)) name(struct pt_regs *ctx)     \ {     \ struct pt_regs *regs = PT_REGS_SYSCALL_REGS(ctx);     \ _Pragma("GCC diagnostic push")     \ _Pragma("GCC diagnostic ignored \"-Wint-conversion\"")     \ return ____##name(___bpf_syscall_args(args));     \ _Pragma("GCC diagnostic pop")     \ }     \ static __attribute__((always_inline)) typeof(name(0))     \ ____##name(struct pt_regs *ctx, ##args) 

bpf_core_read.h

Defines

__CORE_RELO(src, field, info) __builtin_preserve_field_info((src)->field, BPF_FIELD_##info)

__CORE_BITFIELD_PROBE_READ(dst, src, fld) bpf_probe_read_kernel(       \ (void *)dst,       \ __CORE_RELO(src, fld, BYTE_SIZE),       \ (const void *)src + __CORE_RELO(src, fld, BYTE_OFFSET)) 

BPF_CORE_READ_BITFIELD_PROBED(s, field) ({       \ unsigned long long val = 0;       \ \ __CORE_BITFIELD_PROBE_READ(&val, s, field);       \ val <<= __CORE_RELO(s, field, LSHIFT_U64);       \ if (__CORE_RELO(s, field, SIGNED))       \ val = ((long long)val) >> __CORE_RELO(s, field, RSHIFT_U64); \ else       \ val = val >> __CORE_RELO(s, field, RSHIFT_U64);       \ val;       \ }) 

BPF_CORE_READ_BITFIELD(s, field) ({       \ const void *p = (const void *)s + __CORE_RELO(s, field, BYTE_OFFSET); \ unsigned long long val;       \ \ /* This is a so-called barrier_var() operation that makes specified   \ * variable "a black box" for optimizing compiler.       \ * It forces compiler to perform BYTE_OFFSET relocation on p and use \ * its calculated value in the switch below, instead of applying      \ * the same relocation 4 times for each individual memory load.       \ */       \ asm volatile("" : "=r"(p) : "0"(p));       \ \ switch (__CORE_RELO(s, field, BYTE_SIZE)) {       \ case 1: val = *(const unsigned char *)p; break;       \ case 2: val = *(const unsigned short *)p; break;       \ case 4: val = *(const unsigned int *)p; break;       \ case 8: val = *(const unsigned long long *)p; break;       \ }       \ val <<= __CORE_RELO(s, field, LSHIFT_U64);       \ if (__CORE_RELO(s, field, SIGNED))       \ val = ((long long)val) >> __CORE_RELO(s, field, RSHIFT_U64); \ else       \ val = val >> __CORE_RELO(s, field, RSHIFT_U64);       \ val;       \ }) 

bpf_core_field_exists(field) __builtin_preserve_field_info(field, BPF_FIELD_EXISTS)

bpf_core_field_size(field) __builtin_preserve_field_info(field, BPF_FIELD_BYTE_SIZE)

bpf_core_type_id_local(type) __builtin_btf_type_id(*(typeof(type) *)0, BPF_TYPE_ID_LOCAL)

bpf_core_type_id_kernel(type) __builtin_btf_type_id(*(typeof(type) *)0, BPF_TYPE_ID_TARGET)

bpf_core_type_exists(type) __builtin_preserve_type_info(*(typeof(type) *)0, BPF_TYPE_EXISTS)

bpf_core_type_size(type) __builtin_preserve_type_info(*(typeof(type) *)0, BPF_TYPE_SIZE)

bpf_core_enum_value_exists(enum_type, enum_value) __builtin_preserve_enum_value(*(typeof(enum_type) *)enum_value, BPF_ENUMVAL_EXISTS)

bpf_core_enum_value(enum_type, enum_value) __builtin_preserve_enum_value(*(typeof(enum_type) *)enum_value, BPF_ENUMVAL_VALUE)

bpf_core_read(dst, sz, src) bpf_probe_read_kernel(dst, sz, (const void *)__builtin_preserve_access_index(src))

bpf_core_read_user(dst, sz, src) bpf_probe_read_user(dst, sz, (const void *)__builtin_preserve_access_index(src))

bpf_core_read_str(dst, sz, src) bpf_probe_read_kernel_str(dst, sz, (const void *)__builtin_preserve_access_index(src))

bpf_core_read_user_str(dst, sz, src) bpf_probe_read_user_str(dst, sz, (const void *)__builtin_preserve_access_index(src))

BPF_CORE_READ_INTO(dst, src, a, ...) ({     \ ___core_read(bpf_core_read, bpf_core_read,     \ dst, (src), a, ##__VA_ARGS__)     \ }) 

BPF_CORE_READ_USER_INTO(dst, src, a, ...) ({     \ ___core_read(bpf_core_read_user, bpf_core_read_user,     \ dst, (src), a, ##__VA_ARGS__)     \ }) 

BPF_PROBE_READ_INTO(dst, src, a, ...) ({     \ ___core_read(bpf_probe_read, bpf_probe_read,     \ dst, (src), a, ##__VA_ARGS__)     \ }) 

BPF_PROBE_READ_USER_INTO(dst, src, a, ...) ({     \ ___core_read(bpf_probe_read_user, bpf_probe_read_user,     \ dst, (src), a, ##__VA_ARGS__)     \ }) 

BPF_CORE_READ_STR_INTO(dst, src, a, ...) ({     \ ___core_read(bpf_core_read_str, bpf_core_read,     \ dst, (src), a, ##__VA_ARGS__)     \ }) 

BPF_CORE_READ_USER_STR_INTO(dst, src, a, ...) ({     \ ___core_read(bpf_core_read_user_str, bpf_core_read_user,     \ dst, (src), a, ##__VA_ARGS__)     \ }) 

BPF_PROBE_READ_STR_INTO(dst, src, a, ...) ({     \ ___core_read(bpf_probe_read_str, bpf_probe_read,     \ dst, (src), a, ##__VA_ARGS__)     \ }) 

BPF_PROBE_READ_USER_STR_INTO(dst, src, a, ...) ({     \ ___core_read(bpf_probe_read_user_str, bpf_probe_read_user,     \ dst, (src), a, ##__VA_ARGS__)     \ }) 

BPF_CORE_READ(src, a, ...) ({     \ ___type((src), a, ##__VA_ARGS__) __r;     \ BPF_CORE_READ_INTO(&__r, (src), a, ##__VA_ARGS__);     \ __r;     \ }) 

BPF_CORE_READ_USER(src, a, ...) ({     \ ___type((src), a, ##__VA_ARGS__) __r;     \ BPF_CORE_READ_USER_INTO(&__r, (src), a, ##__VA_ARGS__);     \ __r;     \ }) 

BPF_PROBE_READ(src, a, ...) ({     \ ___type((src), a, ##__VA_ARGS__) __r;     \ BPF_PROBE_READ_INTO(&__r, (src), a, ##__VA_ARGS__);     \ __r;     \ }) 

BPF_PROBE_READ_USER(src, a, ...) ({     \ ___type((src), a, ##__VA_ARGS__) __r;     \ BPF_PROBE_READ_USER_INTO(&__r, (src), a, ##__VA_ARGS__);     \ __r;     \ }) 

Enums

enum bpf_field_info_kind

Values:

enumerator BPF_FIELD_BYTE_OFFSET = 0

enumerator BPF_FIELD_BYTE_SIZE = 1

enumerator BPF_FIELD_EXISTS = 2

enumerator BPF_FIELD_SIGNED = 3

enumerator BPF_FIELD_LSHIFT_U64 = 4

enumerator BPF_FIELD_RSHIFT_U64 = 5

enum bpf_type_id_kind

Values:

enumerator BPF_TYPE_ID_LOCAL = 0

enumerator BPF_TYPE_ID_TARGET = 1

enum bpf_type_info_kind

Values:

enumerator BPF_TYPE_EXISTS = 0

enumerator BPF_TYPE_SIZE = 1

enum bpf_enum_value_kind

Values:

enumerator BPF_ENUMVAL_EXISTS = 0

enumerator BPF_ENUMVAL_VALUE = 1

bpf_endian.h

Defines

__bpf_ntohs(x) __builtin_bswap16(x)

__bpf_htons(x) __builtin_bswap16(x)

__bpf_constant_ntohs(x) ___bpf_swab16(x)

__bpf_constant_htons(x) ___bpf_swab16(x)

__bpf_ntohl(x) __builtin_bswap32(x)

__bpf_htonl(x) __builtin_bswap32(x)

__bpf_constant_ntohl(x) ___bpf_swab32(x)

__bpf_constant_htonl(x) ___bpf_swab32(x)

__bpf_be64_to_cpu(x) __builtin_bswap64(x)

__bpf_cpu_to_be64(x) __builtin_bswap64(x)

__bpf_constant_be64_to_cpu(x) ___bpf_swab64(x)

__bpf_constant_cpu_to_be64(x) ___bpf_swab64(x)

bpf_htons(x) (__builtin_constant_p(x) ? \ __bpf_constant_htons(x) : __bpf_htons(x)) 

bpf_ntohs(x) (__builtin_constant_p(x) ? \ __bpf_constant_ntohs(x) : __bpf_ntohs(x)) 

bpf_htonl(x) (__builtin_constant_p(x) ? \ __bpf_constant_htonl(x) : __bpf_htonl(x)) 

bpf_ntohl(x) (__builtin_constant_p(x) ? \ __bpf_constant_ntohl(x) : __bpf_ntohl(x)) 

bpf_cpu_to_be64(x) (__builtin_constant_p(x) ? \ __bpf_constant_cpu_to_be64(x) : __bpf_cpu_to_be64(x)) 

bpf_be64_to_cpu(x) (__builtin_constant_p(x) ? \ __bpf_constant_be64_to_cpu(x) : __bpf_be64_to_cpu(x)) 