#include "libbpf_legacy.h"

Functions
__u32	bpf_program__flags (const struct bpf_program *prog)
	Query the BPF program flags.

int	bpf_program__set_flags (struct bpf_program *prog, __u32 flags)
	Set the BPF program flags. The set of flags is defined by the program type. Neither libbpf nor the eBPF runtime check the flags and only the extension that handles this program type will interpret them. See the documentation for the program type for what flags are defined for that program type.

LIBBPF_API struct perf_buffer *	perf_buffer__new (int map_fd, size_t page_cnt, perf_buffer_sample_fn sample_cb, perf_buffer_lost_fn lost_cb, void ctx, const struct perf_buffer_opts opts)
	Create BPF perfbuf manager.

LIBBPF_API void	perf_buffer__free (struct perf_buffer *pb)
	Free a perf buffer manager.

Link-related functions
int	bpf_link__destroy (struct bpf_link *link)
	Clean up a link.

void	bpf_link__disconnect (struct bpf_link *link)
	Release ownership of a link so that it is not detached when destroyed.

int	bpf_link__fd (const struct bpf_link *link)
	Get a file descriptor that refers to a link.

int	bpf_link__pin (struct bpf_link link, const char path)
	Pin a link to a specified path.

int	bpf_link__unpin (struct bpf_link *link)
	Unpin a link.

const char *	libbpf_bpf_link_type_str (enum bpf_link_type t)
	libbpf_bpf_link_type_str() converts the provided link type value into a textual representation.

Map-related functions
int	bpf_map__fd (const struct bpf_map *map)
	Get a file descriptor that refers to a map.

bool	bpf_map__is_pinned (const struct bpf_map *map)
	Determine whether a map is pinned.

__u32	bpf_map__key_size (const struct bpf_map *map)
	Get the size of keys in a given map.

__u32	bpf_map__max_entries (const struct bpf_map *map)
	Get the maximum number of entries allowed in a given map.

const char *	bpf_map__name (const struct bpf_map *map)
	Get the name of an eBPF map.

int	bpf_map__pin (struct bpf_map map, const char path)
	Pin a map to a specified path.

enum bpf_map_type	bpf_map__type (const struct bpf_map *map)
	Get the type of a map.

int	bpf_map__unpin (struct bpf_map map, const char path)
	Unpin a map.

__u32	bpf_map__value_size (const struct bpf_map *map)
	Get the size of values in a given map.

const char *	libbpf_bpf_map_type_str (enum bpf_map_type t)
	libbpf_bpf_map_type_str() converts the provided map type value into a textual representation.

Object-related functions
void	bpf_object__close (struct bpf_object *object)
	Close an eBPF object.

struct bpf_map *	bpf_object__find_map_by_name (const struct bpf_object obj, const char name)
	bpf_object__find_map_by_name() returns BPF map of the given name, if it exists within the passed BPF object

int	bpf_object__find_map_fd_by_name (const struct bpf_object obj, const char name)
	Find a map with a given name among maps associated with an eBPF object.

struct bpf_program *	bpf_object__find_program_by_name (const struct bpf_object obj, const char name)
	Find a program with a given name among programs associated with an eBPF object.

int	bpf_object__load (struct bpf_object *obj)
	Load all the programs in a given object.

const char *	bpf_object__name (const struct bpf_object *obj)
	Get the name of an eBPF object.

struct bpf_map *	bpf_object__next_map (const struct bpf_object obj, const struct bpf_map map)
	Get the next map for a given eBPF object.

struct bpf_program *	bpf_object__next_program (const struct bpf_object obj, struct bpf_program prog)
	Get the next program for a given eBPF object.

struct bpf_object *	bpf_object__open (const char *path)
	Open a file without loading the programs.

struct bpf_object *	bpf_object__open_file (const char path, const struct bpf_object_open_opts opts)
	Open a file without loading the programs.

int	bpf_object__pin (struct bpf_object object, const char path)
	Pin an eBPF object to a specified path.

int	bpf_object__pin_maps (struct bpf_object obj, const char path)
	Pin all maps associated with an eBPF object to a specified path.

int	bpf_object__pin_programs (struct bpf_object obj, const char path)
	Pin all programs associated with an eBPF object to a specified path.

struct bpf_map *	bpf_object__prev_map (const struct bpf_object obj, const struct bpf_map map)
	Get the previous map for a given eBPF object.

struct bpf_program *	bpf_object__prev_program (const struct bpf_object obj, struct bpf_program prog)
	Get the previous eBPF program for a given eBPF object.

int	bpf_object__unpin_maps (struct bpf_object obj, const char path)
	Unpin all maps associated with an eBPF object from a specified path.

int	bpf_object__unpin_programs (struct bpf_object obj, const char path)
	Unpin all programs associated with an eBPF object from a specified path.

Program-related functions
struct bpf_link *	bpf_program__attach (const struct bpf_program *prog)
	bpf_program__attach() is a generic function for attaching a BPF program based on the program's expected attach type.

struct bpf_link *	bpf_program__attach_xdp (struct bpf_program *prog, int ifindex)
	Attach an eBPF program to an XDP hook.

bool	bpf_program__autoload (const struct bpf_program *prog)
	Get whether an eBPF program will be loaded when the object is loaded.

int	bpf_program__set_autoload (struct bpf_program *prog, bool autoload)
	Set whether an eBPF program will be loaded when the object is loaded.

int	bpf_prog_attach (int prog_fd, int attachable_fd, enum bpf_attach_type type, unsigned int flags)
	Attach an eBPF program to an attach point.

int	bpf_prog_detach (int attachable_fd, enum bpf_attach_type type)
	Detach eBPF program(s) from an attach point.

int	bpf_prog_detach2 (int prog_fd, int attachable_fd, enum bpf_attach_type type)
	Detach an eBPF program from an attach point.

int	bpf_program__fd (const struct bpf_program *prog)
	Get a file descriptor that refers to a program.

enum bpf_attach_type	bpf_program__get_expected_attach_type (const struct bpf_program *prog)
	Get the expected attach type for an eBPF program.

enum bpf_prog_type	bpf_program__get_type (const struct bpf_program *prog)
	Get the program type for an eBPF program.

size_t	bpf_program__insn_cnt (const struct bpf_program *prog)
	bpf_program__insn_cnt() returns number of `struct bpf_insn`'s that form specified BPF program.

const char *	bpf_program__name (const struct bpf_program *prog)
	Get the function name of an eBPF program.

int	bpf_program__pin (struct bpf_program prog, const char path)
	Pin a program to a specified path. This increments the programs reference count, allowing it to stay loaded after the process which loaded it has exited.

const char *	bpf_program__section_name (const struct bpf_program *prog)
	Gets the ELF section name of an eBPF program, if any.

int	bpf_program__set_expected_attach_type (struct bpf_program *prog, enum bpf_attach_type type)
	bpf_program__set_expected_attach_type() sets the attach type of the passed BPF program. This is used for auto-detection of attachment when programs are loaded.

int	bpf_program__set_type (struct bpf_program *prog, enum bpf_prog_type type)
	bpf_program__set_type() sets the program type of the passed BPF program.

enum bpf_prog_type	bpf_program__type (const struct bpf_program *prog)
	Get the program type for an eBPF program.

void	bpf_program__unload (struct bpf_program *prog)
	Unload a program.

int	bpf_program__unpin (struct bpf_program prog, const char path)
	Unpin a program.

int	bpf_xdp_attach (int ifindex, int prog_fd, __u32 flags, const struct bpf_xdp_attach_opts *opts)
	Attach an XDP program to a given interface.

int	bpf_xdp_detach (int ifindex, __u32 flags, const struct bpf_xdp_attach_opts *opts)
	Detach an XDP program from a given interface.

int	bpf_xdp_query_id (int ifindex, int flags, __u32 *prog_id)
	Get the XDP program id attached to a given interface index.

int	libbpf_attach_type_by_name (const char name, enum bpf_attach_type attach_type)
	libbpf_attach_type_by_name() converts the provided textual representation into an attach type value.

const char *	libbpf_bpf_attach_type_str (enum bpf_attach_type t)
	libbpf_bpf_attach_type_str() converts the provided attach type value into a textual representation.

const char *	libbpf_bpf_prog_type_str (enum bpf_prog_type t)
	libbpf_bpf_prog_type_str() converts the provided program type value into a textual representation.

int	libbpf_prog_type_by_name (const char name, enum bpf_prog_type prog_type, enum bpf_attach_type *expected_attach_type)
	Get a program type and expected attach type by name.

System-related functions
long	libbpf_get_error (const void *ptr)
	Get a negative error code based on errno and a possibly null pointer.

int	libbpf_strerror (int err, char *buf, size_t size)
	Get an error message.

int	libbpf_num_possible_cpus (void)
	Get the number of processors on the current system.

struct ring_buffer *	ring_buffer__new (int map_fd, ring_buffer_sample_fn sample_cb, void ctx, const struct ring_buffer_opts opts)
	Creates a new ring buffer manager.

void	ring_buffer__free (struct ring_buffer *rb)
	Frees a new ring buffer manager.

Function Documentation

◆ bpf_link__destroy()

int bpf_link__destroy ( struct bpf_link * link )

Clean up a link.

Unless bpf_link__disconnect was called first, this API detaches the link. Either way, it then closes the link fd and frees the memory for the link.

Parameters

[in] link Link to destroy.

See also: bpf_link_detach; ebpf_link_close

◆ bpf_link__disconnect()

void bpf_link__disconnect ( struct bpf_link * link )

Release ownership of a link so that it is not detached when destroyed.

Parameters

[in] link Link to disconnect.

See also: bpf_link__destroy

◆ bpf_link__fd()

int bpf_link__fd ( const struct bpf_link * link )

Get a file descriptor that refers to a link.

Parameters

[in] link Link to get a file descriptor for.

Returns: File descriptor that refers to the link. The caller should not call _close() on the fd.

◆ bpf_link__pin()

int bpf_link__pin	(	struct bpf_link *	link,
		const char *	path
	)

Pin a link to a specified path.

Parameters

[in]	link	Link to pin.
[in]	path	Path to pin the link to.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.
-EBUSY	A pin path was previously specified.
-EEXIST	Something is already pinned to the specified path.
-EINVAL	An invalid argument was provided.
-ENOMEM	Out of memory.

See also: bpf_link__unpin

◆ bpf_link__unpin()

int bpf_link__unpin ( struct bpf_link * link )

Unpin a link.

Parameters

[in] link Link to unpin.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.
-EINVAL	An invalid argument was provided.
-ENOENT	The link was not pinned.

See also: bpf_link__pin

◆ bpf_map__fd()

int bpf_map__fd ( const struct bpf_map * map )

Get a file descriptor that refers to a map.

Parameters

[in] map Map to get a file descriptor for.

Returns: the file descriptor; or -EINVAL in case of an error. The caller should not call _close() on the fd.

◆ bpf_map__is_pinned()

bool bpf_map__is_pinned ( const struct bpf_map * map )

Determine whether a map is pinned.

Parameters

[in] map Map to check.

Return values

true	The map is pinned.
false	The map is not pinned.

See also: bpf_map__pin; bpf_object__pin; bpf_object__pin_maps

◆ bpf_map__key_size()

__u32 bpf_map__key_size ( const struct bpf_map * map )

Get the size of keys in a given map.

Parameters

[in] map Map to check.

Returns: The size in bytes of keys in the map.

◆ bpf_map__max_entries()

__u32 bpf_map__max_entries ( const struct bpf_map * map )

Get the maximum number of entries allowed in a given map.

Parameters

[in] map Map to check.

Returns: The maximum number of entries allowed.

◆ bpf_map__name()

const char * bpf_map__name ( const struct bpf_map * map )

Get the name of an eBPF map.

Parameters

[in] map The map to check.

Returns: The name of the map, or NULL if none.

◆ bpf_map__pin()

int bpf_map__pin	(	struct bpf_map *	map,
		const char *	path
	)

Pin a map to a specified path.

Parameters

[in]	map	Map to pin.
[in]	path	Path to pin the map to.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.
-EBUSY	A pin path was previously specified.
-EEXIST	Something is already pinned to the specified path.
-EINVAL	An invalid argument was provided.
-ENOMEM	Out of memory.

See also: bpf_map_unpin; bpf_object__pin_maps

◆ bpf_map__type()

enum bpf_map_type bpf_map__type ( const struct bpf_map * map )

Get the type of a map.

Parameters

[in] map Map to check.

Returns: The map type.

◆ bpf_map__unpin()

int bpf_map__unpin	(	struct bpf_map *	map,
		const char *	path
	)

Unpin a map.

Parameters

[in]	map	Map to unpin.
[in]	path	Path from which to unpin the map.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.
-EINVAL	An invalid argument was provided.
-ENOENT	The map was not pinned.

See also: bpf_map_pin; bpf_object__unpin_maps

◆ bpf_map__value_size()

__u32 bpf_map__value_size ( const struct bpf_map * map )

Get the size of values in a given map.

Parameters

[in] map Map to check.

Returns: The size in bytes of values in the map.

◆ bpf_object__close()

void bpf_object__close ( struct bpf_object * object )

Close an eBPF object.

Parameters

[in] object The object to close.

See also: bpf_prog_load

◆ bpf_object__find_map_by_name()

struct bpf_map * bpf_object__find_map_by_name	(	const struct bpf_object *	obj,
		const char *	name
	)

bpf_object__find_map_by_name() returns BPF map of the given name, if it exists within the passed BPF object

Parameters

obj	BPF object
name	name of the BPF map

Returns: BPF map instance, if such map exists within the BPF object; or NULL otherwise.

◆ bpf_object__find_map_fd_by_name()

int bpf_object__find_map_fd_by_name	(	const struct bpf_object *	obj,
		const char *	name
	)

Find a map with a given name among maps associated with an eBPF object.

Parameters

[in]	obj	The object to check.
[in]	name	The name to look for.

Returns: A file descriptor referring to the map found, or a negative value if none. The caller should not call _close() on the fd.

See also: bpf_map__fd

◆ bpf_object__find_program_by_name()

struct bpf_program * bpf_object__find_program_by_name	(	const struct bpf_object *	obj,
		const char *	name
	)

Find a program with a given name among programs associated with an eBPF object.

Parameters

[in]	obj	The object to check.
[in]	name	The name to look for.

Returns: The program found, or NULL if none.

See also: bpf_program__name

◆ bpf_object__load()

int bpf_object__load ( struct bpf_object * obj )

Load all the programs in a given object.

Parameters

[in] obj Object from which to load programs.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.
-EINVAL	An invalid argument was provided.
-ENOMEM	Out of memory.

See also: bpf_object__load_xattr; bpf_object__open; bpf_object__unload; bpf_prog_load

◆ bpf_object__name()

const char * bpf_object__name ( const struct bpf_object * obj )

Get the name of an eBPF object.

Parameters

[in] obj The object to check.

Returns: The name of the object, or NULL if none.

◆ bpf_object__next_map()

struct bpf_map * bpf_object__next_map	(	const struct bpf_object *	obj,
		const struct bpf_map *	map
	)

Get the next map for a given eBPF object.

Parameters

[in]	obj	Object with maps.
[in]	map	Previous map.

Returns: Next map, or NULL if none.

See also: bpf_object__prev_map

◆ bpf_object__next_program()

struct bpf_program * bpf_object__next_program	(	const struct bpf_object *	obj,
		struct bpf_program *	prog
	)

Get the next program for a given eBPF object.

Parameters

[in]	obj	Object with programs.
[in]	prog	Previous program, or NULL to get the first program.

Returns: Next program, or NULL if none.

See also: bpf_object__prev_program

◆ bpf_object__open()

struct bpf_object * bpf_object__open ( const char * path )

Open a file without loading the programs.

Parameters

[in] path File name to open.

Returns: Pointer to an eBPF object, or NULL on failure.

◆ bpf_object__open_file()

struct bpf_object * bpf_object__open_file	(	const char *	path,
		const struct bpf_object_open_opts *	opts
	)

Open a file without loading the programs.

Parameters

[in]	path	File name to open.
	opts	options for how to load the bpf object, this parameter is optional and can be set to NULL

Returns: pointer to the new bpf_object; or NULL is returned on error, error code is stored in errno

◆ bpf_object__pin()

int bpf_object__pin	(	struct bpf_object *	object,
		const char *	path
	)

Pin an eBPF object to a specified path.

Parameters

[in]	object	Object to pin.
[in]	path	Path to pin the object to.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.
-EBUSY	Something is already pinned to the specified path.
-EINVAL	An invalid argument was provided.
-ENOMEM	Out of memory.

See also: bpf_object__pin_maps; bpf_object__pin_programs; bpf_object__unpin_maps; bpf_object__unpin_programs

◆ bpf_object__pin_maps()

int bpf_object__pin_maps	(	struct bpf_object *	obj,
		const char *	path
	)

Pin all maps associated with an eBPF object to a specified path.

Parameters

[in]	obj	Object to pin maps of.
[in]	path	Path to pin the maps to.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.
-EBUSY	Something is already pinned to the specified path.
-EINVAL	An invalid argument was provided.
-ENOMEM	Out of memory.

See also: bpf_map__pin; bpf_object__pin; bpf_object__unpin_maps

◆ bpf_object__pin_programs()

int bpf_object__pin_programs	(	struct bpf_object *	obj,
		const char *	path
	)

Pin all programs associated with an eBPF object to a specified path.

Parameters

[in]	obj	Object to pin programs of.
[in]	path	Path to pin the programs to.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.
-EBUSY	Something is already pinned to the specified path.
-EINVAL	An invalid argument was provided.
-ENOMEM	Out of memory.

See also: bpf_program__pin; bpf_object__pin; bpf_object__unpin_programs

◆ bpf_object__prev_map()

struct bpf_map * bpf_object__prev_map	(	const struct bpf_object *	obj,
		const struct bpf_map *	map
	)

Get the previous map for a given eBPF object.

Parameters

[in]	obj	Object with maps.
[in]	map	Next map.

Returns: Previous map, or NULL if none.

See also: bpf_object__next_map

◆ bpf_object__prev_program()

struct bpf_program * bpf_object__prev_program	(	const struct bpf_object *	obj,
		struct bpf_program *	prog
	)

Get the previous eBPF program for a given eBPF object.

Parameters

[in]	obj	Object with programs.
[in]	prog	Next program.

Returns: Previous eBPF program, or NULL if none.

See also: bpf_object__next_program

◆ bpf_object__unpin_maps()

int bpf_object__unpin_maps	(	struct bpf_object *	obj,
		const char *	path
	)

Unpin all maps associated with an eBPF object from a specified path.

Parameters

[in]	obj	Object to unpin maps of.
[in]	path	Path from which to unpin the maps.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.
-EINVAL	An invalid argument was provided.

See also: bpf_map__unpin; bpf_object__pin_maps; bpf_object__unpin

◆ bpf_object__unpin_programs()

int bpf_object__unpin_programs	(	struct bpf_object *	obj,
		const char *	path
	)

Unpin all programs associated with an eBPF object from a specified path.

Parameters

[in]	obj	Object to unpin programs of.
[in]	path	Path from which to unpin the programs.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.
-EINVAL	An invalid argument was provided.

See also: bpf_program__unpin; bpf_object__pin_programs; bpf_object__unpin

◆ bpf_prog_attach()

int bpf_prog_attach	(	int	prog_fd,
		int	attachable_fd,
		enum bpf_attach_type	type,
		unsigned int	flags
	)

Attach an eBPF program to an attach point.

Parameters

[in]	prog_fd	File descriptor of the program to attach.
[in]	attachable_fd	File descriptor corresponding to the attach point.
[in]	type	Attach type.
[in]	flags	Flags (currently 0).

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.

◆ bpf_prog_detach()

int bpf_prog_detach	(	int	attachable_fd,
		enum bpf_attach_type	type
	)

Detach eBPF program(s) from an attach point.

Parameters

[in]	attachable_fd	File descriptor corresponding to the attach point.
[in]	type	Attach type.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.

◆ bpf_prog_detach2()

int bpf_prog_detach2	(	int	prog_fd,
		int	attachable_fd,
		enum bpf_attach_type	type
	)

Detach an eBPF program from an attach point.

Parameters

[in]	prog_fd	File descriptor of the program to detach.
[in]	attachable_fd	File descriptor corresponding to the attach point.
[in]	type	Attach type.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.

◆ bpf_program__attach()

struct bpf_link * bpf_program__attach ( const struct bpf_program * prog )

bpf_program__attach() is a generic function for attaching a BPF program based on the program's expected attach type.

Parameters

prog	BPF program to attach.

Returns: Reference to the newly created BPF link; or NULL is returned on error, error code is stored in errno.

See also: bpf_link__destroy; bpf_program__get_expected_attach_type; bpf_program__set_expected_attach_type; ebpf_link_close

◆ bpf_program__attach_xdp()

struct bpf_link * bpf_program__attach_xdp	(	struct bpf_program *	prog,
		int	ifindex
	)

Attach an eBPF program to an XDP hook.

Parameters

[in]	prog	The program to attach.
[in]	ifindex	The interface index to attach to.

Returns: The link created. On error, returns NULL and sets errno.

See also: bpf_link__destroy; bpf_program__attach; ebpf_link_close

◆ bpf_program__autoload()

bool bpf_program__autoload ( const struct bpf_program * prog )

Get whether an eBPF program will be loaded when the object is loaded.

Parameters

[in] prog The program to check.

Returns: True if the program will be loaded, false if not.

See also: bpf_object__load; bpf_object__load_xattr; bpf_program__set_autoload

◆ bpf_program__fd()

int bpf_program__fd ( const struct bpf_program * prog )

Get a file descriptor that refers to a program.

Parameters

[in] prog Program to get a file descriptor for.

Returns: File descriptor that refers to the program. The caller should not call _close() on the fd.

◆ bpf_program__flags()

__u32 bpf_program__flags ( const struct bpf_program * prog )

Query the BPF program flags.

Parameters

[in] prog A pointer to the BPF program.

Returns: The flags of the BPF program that were last set by this process.

◆ bpf_program__get_expected_attach_type()

enum bpf_attach_type bpf_program__get_expected_attach_type ( const struct bpf_program * prog )

Get the expected attach type for an eBPF program.

Parameters

[in] prog Program to check.

Returns: Expected attach type.

See also: bpf_program__attach; bpf_program__set_expected_attach_type

◆ bpf_program__get_type()

enum bpf_prog_type bpf_program__get_type ( const struct bpf_program * prog )

Get the program type for an eBPF program.

Parameters

[in] prog Program to check.

Returns: Program type.

Deprecated:: Use bpf_program__type() instead.

See also: bpf_program__get_expected_attach_type; bpf_program__type

◆ bpf_program__insn_cnt()

size_t bpf_program__insn_cnt ( const struct bpf_program * prog )

bpf_program__insn_cnt() returns number of struct bpf_insn's that form specified BPF program.

Parameters

[in] prog BPF program for which to return number of BPF instructions

Returns: Number of instructions.

◆ bpf_program__name()

const char * bpf_program__name ( const struct bpf_program * prog )

Get the function name of an eBPF program.

Parameters

[in] prog Program to check.

Returns: The name of the program, which is the name of the main function called when invoked.

See also: bpf_object__find_program_by_name

◆ bpf_program__pin()

int bpf_program__pin	(	struct bpf_program *	prog,
		const char *	path
	)

Pin a program to a specified path. This increments the programs reference count, allowing it to stay loaded after the process which loaded it has exited.

Parameters

[in]	prog	Program to pin.
[in]	path	Path to pin the program to.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.
-EBUSY	A pin path was previously specified.
-EEXIST	Something is already pinned to the specified path.
-EINVAL	An invalid argument was provided.
-ENOMEM	Out of memory.

See also: bpf_object__pin; bpf_object__pin_programs; bpf_program__unpin

◆ bpf_program__section_name()

const char * bpf_program__section_name ( const struct bpf_program * prog )

Gets the ELF section name of an eBPF program, if any.

Parameters

[in] prog An eBPF program.

Returns: The ELF section name of an eBPF program, or NULL if none.

◆ bpf_program__set_autoload()

int bpf_program__set_autoload	(	struct bpf_program *	prog,
		bool	autoload
	)

Set whether an eBPF program will be loaded when the object is loaded.

Parameters

[in] prog The program to update.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.

See also: bpf_object__load; bpf_object__load_xattr; bpf_program__autoload

◆ bpf_program__set_expected_attach_type()

int bpf_program__set_expected_attach_type	(	struct bpf_program *	prog,
		enum bpf_attach_type	type
	)

bpf_program__set_expected_attach_type() sets the attach type of the passed BPF program. This is used for auto-detection of attachment when programs are loaded.

Parameters

prog	BPF program to set the attach type for
type	attach type to set the BPF map to have

Returns: error code; or 0 if no error. An error occurs if the object is already loaded.

This must be called before the BPF object is loaded, otherwise it has no effect and an error is returned.

◆ bpf_program__set_flags()

int bpf_program__set_flags	(	struct bpf_program *	prog,
		__u32	flags
	)

Set the BPF program flags. The set of flags is defined by the program type. Neither libbpf nor the eBPF runtime check the flags and only the extension that handles this program type will interpret them. See the documentation for the program type for what flags are defined for that program type.

Parameters

[in]	prog	A pointer to the BPF program.
[in]	flags	The flags to set.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.

◆ bpf_program__set_type()

int bpf_program__set_type	(	struct bpf_program *	prog,
		enum bpf_prog_type	type
	)

bpf_program__set_type() sets the program type of the passed BPF program.

Parameters

prog	BPF program to set the program type for
type	program type to set the BPF map to have

Returns: error code; or 0 if no error. An error occurs if the object is already loaded.

This must be called before the BPF object is loaded, otherwise it has no effect and an error is returned.

◆ bpf_program__type()

enum bpf_prog_type bpf_program__type ( const struct bpf_program * prog )

Get the program type for an eBPF program.

Parameters

[in] prog Program to check.

Returns: Program type.

See also: bpf_program__get_expected_attach_type

◆ bpf_program__unload()

void bpf_program__unload ( struct bpf_program * prog )

Unload a program.

Parameters

[in] prog Program to unload.

See also: bpf_object__unload; bpf_prog_load

◆ bpf_program__unpin()

int bpf_program__unpin	(	struct bpf_program *	prog,
		const char *	path
	)

Unpin a program.

Parameters

[in]	prog	Program to unpin.
[in]	path	Path from which to unpin the program.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.
-EINVAL	An invalid argument was provided.
-ENOENT	The program was not pinned.

See also: bpf_object__unpin_programs; bpf_program__pin

◆ bpf_xdp_attach()

int bpf_xdp_attach	(	int	ifindex,
		int	prog_fd,
		__u32	flags,
		const struct bpf_xdp_attach_opts *	opts
	)

Attach an XDP program to a given interface.

Parameters

[in]	ifindex	The interface index to attach to, or -1 to detach.
[in]	prog_fd	File descriptor of program to attach.
[in]	flags	Flags. Use XDP_FLAGS_REPLACE to replace any program previously attached to the specified interface index.
[in]	opts	Options (currently unused).

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.

See also: bpf_program__attach_xdp; bpf_xdp_detach

◆ bpf_xdp_detach()

int bpf_xdp_detach	(	int	ifindex,
		__u32	flags,
		const struct bpf_xdp_attach_opts *	opts
	)

Detach an XDP program from a given interface.

Parameters

[in]	ifindex	The interface index to detach from.
[in]	prog_fd	File descriptor of program to detach.
[in]	flags	Flags. Use XDP_FLAGS_REPLACE to detach any program previously attached to the specified interface index.
[in]	opts	Options (currently unused).

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.

See also: bpf_link_detach; bpf_program__attach_xdp; bpf_xdp_attach

◆ bpf_xdp_query_id()

int bpf_xdp_query_id	(	int	ifindex,
		int	flags,
		__u32 *	prog_id
	)

Get the XDP program id attached to a given interface index.

Parameters

[in]	ifindex	The interface index to query.
[in]	flags	Flags (currently 0).
[out]	prog_id	The ID of the program attached.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.

See also: bpf_xdp_attach

◆ libbpf_attach_type_by_name()

int libbpf_attach_type_by_name	(	const char *	name,
		enum bpf_attach_type *	attach_type
	)

libbpf_attach_type_by_name() converts the provided textual representation into an attach type value.

Parameters

[in]	name	The textual representation of an attach type.
[out]	attach_type	Returns the attach type.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.

◆ libbpf_bpf_attach_type_str()

const char * libbpf_bpf_attach_type_str ( enum bpf_attach_type t )

libbpf_bpf_attach_type_str() converts the provided attach type value into a textual representation.

Parameters

[in] t The attach type.

Returns: Pointer to a static string identifying the attach type. NULL is returned for unknown bpf_attach_type values.

◆ libbpf_bpf_link_type_str()

const char * libbpf_bpf_link_type_str ( enum bpf_link_type t )

libbpf_bpf_link_type_str() converts the provided link type value into a textual representation.

Parameters

[in] t The link type.

Returns: Pointer to a static string identifying the link type. NULL is returned for unknown bpf_link_type values.

◆ libbpf_bpf_map_type_str()

const char * libbpf_bpf_map_type_str ( enum bpf_map_type t )

libbpf_bpf_map_type_str() converts the provided map type value into a textual representation.

Parameters

[in] t The map type.

Returns: Pointer to a static string identifying the map type. NULL is returned for unknown bpf_map_type values.

◆ libbpf_bpf_prog_type_str()

const char * libbpf_bpf_prog_type_str ( enum bpf_prog_type t )

libbpf_bpf_prog_type_str() converts the provided program type value into a textual representation.

Parameters

[in] t The program type.

Returns: Pointer to a static string identifying the program type. NULL is returned for unknown bpf_prog_type values.

◆ libbpf_get_error()

long libbpf_get_error ( const void * ptr )

Get a negative error code based on errno and a possibly null pointer.

Parameters

[in] ptr Pointer that may be NULL.

Returns: Negative error code.

◆ libbpf_num_possible_cpus()

int libbpf_num_possible_cpus ( void )

Get the number of processors on the current system.

Returns: Number of processors.

◆ libbpf_prog_type_by_name()

int libbpf_prog_type_by_name	(	const char *	name,
		enum bpf_prog_type *	prog_type,
		enum bpf_attach_type *	expected_attach_type
	)

Get a program type and expected attach type by name.

Parameters

[in]	name	Name, as if it were a section name in an ELF file.
[out]	prog_type	Program type.
[out]	expected_attach_type	Expected attach type.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.

◆ libbpf_strerror()

int libbpf_strerror	(	int	err,
		char *	buf,
		size_t	size
	)

Get an error message.

Parameters

[in]	err	Error number.
[out]	buf	Pointer to buffer to write message into.
[in]	size	Size of output buffer.

Return values

0	The operation was successful.
<0	An error occurred, and errno was set.

◆ perf_buffer__free()

LIBBPF_API void perf_buffer__free ( struct perf_buffer * pb )

Free a perf buffer manager.

Parameters

[in] rb Pointer to perf buffer manager to be freed.

◆ perf_buffer__new()

LIBBPF_API struct perf_buffer * perf_buffer__new	(	int	map_fd,
		size_t	page_cnt,
		perf_buffer_sample_fn	sample_cb,
		perf_buffer_lost_fn	lost_cb,
		void *	ctx,
		const struct perf_buffer_opts *	opts
	)

Create BPF perfbuf manager.

Parameters

[in]	map_fd	File descriptor to perf event array map.
[in]	page_cnt	Number of memory pages allocated for each per-CPU buffer. This should be set to 0.
[in]	sample_cb	Pointer to perf buffer notification callback function.
[in]	lost_cb	Function pointer for callback when record loss has occurred.
[in]	ctx	User provided extra context passed into sample_cb and lost_cb.
[in]	opts	The perf buffer manager options. This should be set to NULL.

Returns: Pointer to perf buffer manager.

◆ ring_buffer__free()

void ring_buffer__free ( struct ring_buffer * rb )

Frees a new ring buffer manager.

Parameters

[in] rb Pointer to ring buffer to be freed.

◆ ring_buffer__new()

struct ring_buffer * ring_buffer__new	(	int	map_fd,
		ring_buffer_sample_fn	sample_cb,
		void *	ctx,
		const struct ring_buffer_opts *	opts
	)

Creates a new ring buffer manager.

Parameters

[in]	map_fd	File descriptor to ring buffer map.
[in]	sample_cb	Pointer to ring buffer notification callback function.
[in]	ctx	Pointer to sample_cb callback function.
[in]	opts	Ring buffer options.

Returns: Pointer to ring buffer manager.

Functions

Function Documentation

◆ bpf_link__destroy()

◆ bpf_link__disconnect()

◆ bpf_link__fd()

◆ bpf_link__pin()

◆ bpf_link__unpin()

◆ bpf_map__fd()

◆ bpf_map__is_pinned()

◆ bpf_map__key_size()

◆ bpf_map__max_entries()

◆ bpf_map__name()

◆ bpf_map__pin()

◆ bpf_map__type()

◆ bpf_map__unpin()

◆ bpf_map__value_size()

◆ bpf_object__close()

◆ bpf_object__find_map_by_name()

◆ bpf_object__find_map_fd_by_name()

◆ bpf_object__find_program_by_name()

◆ bpf_object__load()

◆ bpf_object__name()

◆ bpf_object__next_map()

◆ bpf_object__next_program()

◆ bpf_object__open()

◆ bpf_object__open_file()

◆ bpf_object__pin()

◆ bpf_object__pin_maps()

◆ bpf_object__pin_programs()

◆ bpf_object__prev_map()

◆ bpf_object__prev_program()

◆ bpf_object__unpin_maps()

◆ bpf_object__unpin_programs()

◆ bpf_prog_attach()

◆ bpf_prog_detach()

◆ bpf_prog_detach2()

◆ bpf_program__attach()

◆ bpf_program__attach_xdp()

◆ bpf_program__autoload()

◆ bpf_program__fd()

◆ bpf_program__flags()

◆ bpf_program__get_expected_attach_type()

◆ bpf_program__get_type()

◆ bpf_program__insn_cnt()

◆ bpf_program__name()

◆ bpf_program__pin()

◆ bpf_program__section_name()

◆ bpf_program__set_autoload()

◆ bpf_program__set_expected_attach_type()

◆ bpf_program__set_flags()

◆ bpf_program__set_type()

◆ bpf_program__type()

◆ bpf_program__unload()

◆ bpf_program__unpin()

◆ bpf_xdp_attach()

◆ bpf_xdp_detach()

◆ bpf_xdp_query_id()

◆ libbpf_attach_type_by_name()

◆ libbpf_bpf_attach_type_str()

◆ libbpf_bpf_link_type_str()

◆ libbpf_bpf_map_type_str()

◆ libbpf_bpf_prog_type_str()

◆ libbpf_get_error()

◆ libbpf_num_possible_cpus()

◆ libbpf_prog_type_by_name()

◆ libbpf_strerror()

◆ perf_buffer__free()

◆ perf_buffer__new()

◆ ring_buffer__free()

◆ ring_buffer__new()