Libbpf userspace
Definitions for the libbpf userspace library are split across a few different header files.
High level APIs
In the libbpf.h header file you will find the high level APIs which do a lot of work for you under the hood. These are the most commonly used APIs.
- BPF Object functions
bpf_object__openbpf_object__open_filebpf_object__open_membpf_object__loadbpf_object__closebpf_object__pin_mapsbpf_object__unpin_mapsbpf_object__pin_programsbpf_object__unpin_programsbpf_object__pinbpf_object__unpinbpf_object__namebpf_object__kversionbpf_object__set_kversionbpf_object__token_fdbpf_object__btfbpf_object__btf_fdbpf_object__find_program_by_name- BPF Skeleton functions
bpf_object__open_skeletonbpf_object__load_skeletonbpf_object__attach_skeletonbpf_object__detach_skeletonbpf_object__destroy_skeletonbpf_object__open_subskeletonbpf_object__destroy_subskeletonbpf_object__gen_loader
bpf_object__next_programbpf_object__prev_programbpf_object__find_map_by_namebpf_object__find_map_fd_by_namebpf_object__next_mapbpf_object__prev_map
- BPF Program functions
bpf_program__set_ifindexbpf_program__namebpf_program__section_namebpf_program__autoloadbpf_program__set_autoloadbpf_program__autoattachbpf_program__set_autoattachbpf_program__insnsbpf_program__set_insnsbpf_program__insn_cntbpf_program__fdbpf_program__pinbpf_program__unpinbpf_program__unload- Program attach functions
bpf_program__attachbpf_program__attach_perf_eventbpf_program__attach_perf_event_optsbpf_program__attach_kprobebpf_program__attach_kprobe_optsbpf_program__attach_kprobe_multi_optsbpf_program__attach_uprobe_multibpf_program__attach_ksyscallbpf_program__attach_uprobebpf_program__attach_uprobe_optsbpf_program__attach_usdtbpf_program__attach_tracepointbpf_program__attach_tracepoint_optsbpf_program__attach_raw_tracepointbpf_program__attach_raw_tracepoint_optsbpf_program__attach_tracebpf_program__attach_trace_optsbpf_program__attach_lsmbpf_program__attach_cgroupbpf_program__attach_netnsbpf_program__attach_sockmapbpf_program__attach_xdpbpf_program__attach_freplacebpf_program__attach_netfilterbpf_program__attach_tcxbpf_program__attach_netkit
bpf_program__attach_iterbpf_program__typebpf_program__set_typebpf_program__set_expected_attach_typebpf_program__flagsbpf_program__set_flagsbpf_program__log_levelbpf_program__set_log_levelbpf_program__log_bufbpf_program__set_log_bufbpf_program__set_attach_targetbpf_program__expected_attach_type
- Link functions
bpf_link__openbpf_link__fdbpf_link__pin_pathbpf_link__pinbpf_link__unpinbpf_link__update_programbpf_link__disconnectbpf_link__detachbpf_link__destroybpf_link__update_map
- Map functions
bpf_map__attach_struct_opsbpf_map__set_autocreatebpf_map__autocreatebpf_map__set_autoattachbpf_map__autoattachbpf_map__fdbpf_map__reuse_fdbpf_map__namebpf_map__typebpf_map__set_typebpf_map__max_entriesbpf_map__set_max_entriesbpf_map__map_flagsbpf_map__set_map_flagsbpf_map__numa_nodebpf_map__set_numa_nodebpf_map__key_sizebpf_map__set_key_sizebpf_map__value_sizebpf_map__set_value_sizebpf_map__btf_key_type_idbpf_map__btf_value_type_idbpf_map__ifindexbpf_map__set_ifindexbpf_map__map_extrabpf_map__set_map_extrabpf_map__set_initial_valuebpf_map__initial_valuebpf_map__is_internalbpf_map__set_pin_pathbpf_map__pin_pathbpf_map__is_pinnedbpf_map__pinbpf_map__unpinbpf_map__set_inner_map_fdbpf_map__inner_mapbpf_map__lookup_elembpf_map__update_elembpf_map__delete_elembpf_map__lookup_and_delete_elembpf_map__get_next_key
- XDP functions
bpf_xdp_attachbpf_xdp_detachbpf_xdp_querybpf_xdp_query_id
- TC functions
bpf_tc_hook_createbpf_tc_hook_destroybpf_tc_attachbpf_tc_detachbpf_tc_query
- Ring buffer functions
ring_buffer__newring_buffer__freering_buffer__addring_buffer__pollring_buffer__consumering_buffer__consume_nring_buffer__epoll_fdring_buffer__ring- Ring functions
ring__consumer_posring__producer_posring__avail_data_sizering__sizering__map_fdring__consumering__consume_n
- User ring buffer
user_ring_buffer__newuser_ring_buffer__reserveuser_ring_buffer__reserve_blockinguser_ring_buffer__submituser_ring_buffer__discarduser_ring_buffer__free
- Perf buffer functions
perf_buffer__newperf_buffer__new_rawperf_buffer__freeperf_buffer__epoll_fdperf_buffer__pollperf_buffer__consumeperf_buffer__consume_bufferperf_buffer__buffer_cntperf_buffer__buffer_fdperf_buffer__buffer
- Program line info functions
bpf_prog_linfo__freebpf_prog_linfo__newbpf_prog_linfo__lfind_addr_funcbpf_prog_linfo__lfind
- Linker functions
bpf_linker__newbpf_linker__add_filebpf_linker__finalizebpf_linker__free
- Misc libbpf functions
libbpf_major_versionlibbpf_minor_versionlibbpf_version_stringlibbpf_strerrorlibbpf_bpf_attach_type_strlibbpf_bpf_link_type_strlibbpf_bpf_map_type_strlibbpf_bpf_prog_type_strlibbpf_set_printlibbpf_prog_type_by_namelibbpf_attach_type_by_namelibbpf_find_vmlinux_btf_idlibbpf_probe_bpf_prog_typelibbpf_probe_bpf_map_typelibbpf_probe_bpf_helperlibbpf_num_possible_cpuslibbpf_register_prog_handlerlibbpf_unregister_prog_handler
BTF APIs
In the btf.h header file you will find the BTF APIs, to do more advanced BTF operations other than just loading BTF
from an object file.
btf__freebtf__newbtf__new_splitbtf__new_emptybtf__new_empty_splitbtf__distill_basebtf__parsebtf__parse_splitbtf__parse_elfbtf__parse_elf_splitbtf__parse_rawbtf__parse_raw_splitbtf__load_vmlinux_btfbtf__load_module_btfbtf__load_from_kernel_by_idbtf__load_from_kernel_by_id_splitbtf__load_into_kernelbtf__find_by_namebtf__find_by_name_kindbtf__type_cntbtf__base_btfbtf__type_by_idbtf__pointer_sizebtf__set_pointer_sizebtf__endiannessbtf__set_endiannessbtf__resolve_sizebtf__resolve_typebtf__align_ofbtf__fdbtf__set_fdbtf__raw_databtf__name_by_offsetbtf__str_by_offsetbtf_ext__newbtf_ext__freebtf_ext__raw_databtf_ext__endiannessbtf_ext__set_endiannessbtf__find_strbtf__add_strbtf__add_typebtf__add_btfbtf__add_intbtf__add_floatbtf__add_ptrbtf__add_arraybtf__add_structbtf__add_unionbtf__add_fieldbtf__add_enumbtf__add_enum_valuebtf__add_enum64btf__add_enum64_valuebtf__add_fwdbtf__add_typedefbtf__add_volatilebtf__add_constbtf__add_restrictbtf__add_type_tagbtf__add_funcbtf__add_func_protobtf__add_func_parambtf__add_varbtf__add_datasecbtf__add_datasec_var_infobtf__add_decl_tagbtf__dedupbtf__relocatebtf_dump__newbtf_dump__freebtf_dump__dump_typebtf_dump__emit_type_declbtf_dump__dump_type_data
Low level APIs
In the bpf.h header file you will find the low level APIs which are used to interact with the kernel. These are basically just wrappers around the bpf() syscall. You should only use these if you know what you are doing and can't do something with the high level APIs.
libbpf_set_memlock_rlimbpf_map_createbpf_prog_loadbpf_btf_loadbpf_map_update_elembpf_map_lookup_elembpf_map_lookup_elem_flagsbpf_map_lookup_and_delete_elembpf_map_lookup_and_delete_elem_flagsbpf_map_delete_elembpf_map_delete_elem_flagsbpf_map_get_next_keybpf_map_freezebpf_map_delete_batchbpf_map_lookup_batchbpf_map_lookup_and_delete_batchbpf_map_update_batchbpf_obj_pinbpf_obj_pin_optsbpf_obj_getbpf_obj_get_optsbpf_prog_attachbpf_prog_detachbpf_prog_detach2bpf_prog_attach_optsbpf_prog_detach_optsbpf_link_createbpf_link_detachbpf_link_updatebpf_iter_createbpf_prog_get_next_idbpf_map_get_next_idbpf_btf_get_next_idbpf_link_get_next_idbpf_prog_get_fd_by_idbpf_prog_get_fd_by_id_optsbpf_map_get_fd_by_idbpf_map_get_fd_by_id_optsbpf_btf_get_fd_by_idbpf_btf_get_fd_by_id_optsbpf_link_get_fd_by_idbpf_link_get_fd_by_id_optsbpf_obj_get_info_by_fdbpf_prog_get_info_by_fdbpf_map_get_info_by_fdbpf_btf_get_info_by_fdbpf_link_get_info_by_fdbpf_prog_query_optsbpf_prog_querybpf_raw_tracepoint_open_optsbpf_raw_tracepoint_openbpf_task_fd_querybpf_enable_statsbpf_prog_bind_mapbpf_prog_test_run_optsbpf_token_create
Deprecated APIs
In the libbpf_deprecated.h header file you will find the deprecated APIs. These are APIs that are no longer recommended to use and might be removed in the future.
libbpf_set_strict_modelibbpf_get_errorlibbpf_find_kernel_btfbpf_program__get_typebpf_program__get_expected_attach_typebpf_map__get_pin_pathbtf__get_raw_databtf_ext__get_raw_data