Libbpf userspace
Definitions for the libbpf userspace library are split across a few different header files.
High level APIs
In the libbpf.h header file you will find the high level APIs which do a lot of work for you under the hood. These are the most commonly used APIs.
- BPF Object functions
bpf_object__openbpf_object__open_filebpf_object__open_membpf_object__loadbpf_object__closebpf_object__pin_mapsbpf_object__unpin_mapsbpf_object__pin_programsbpf_object__unpin_programsbpf_object__pinbpf_object__unpinbpf_object__namebpf_object__kversionbpf_object__set_kversionbpf_object__token_fdbpf_object__btfbpf_object__btf_fdbpf_object__find_program_by_name- BPF Skeleton functions
bpf_object__next_programbpf_object__prev_programbpf_object__find_map_by_namebpf_object__find_map_fd_by_namebpf_object__next_mapbpf_object__prev_map
- BPF Program functions
bpf_program__set_ifindexbpf_program__namebpf_program__section_namebpf_program__autoloadbpf_program__set_autoloadbpf_program__autoattachbpf_program__set_autoattachbpf_program__insnsbpf_program__set_insnsbpf_program__insn_cntbpf_program__fdbpf_program__pinbpf_program__unpinbpf_program__unload- Program attach functions
bpf_program__attachbpf_program__attach_perf_eventbpf_program__attach_perf_event_optsbpf_program__attach_kprobebpf_program__attach_kprobe_optsbpf_program__attach_kprobe_multi_optsbpf_program__attach_uprobe_multibpf_program__attach_ksyscallbpf_program__attach_uprobebpf_program__attach_uprobe_optsbpf_program__attach_usdtbpf_program__attach_tracepointbpf_program__attach_tracepoint_optsbpf_program__attach_raw_tracepointbpf_program__attach_raw_tracepoint_optsbpf_program__attach_tracebpf_program__attach_trace_optsbpf_program__attach_lsmbpf_program__attach_cgroupbpf_program__attach_netnsbpf_program__attach_sockmapbpf_program__attach_xdpbpf_program__attach_freplacebpf_program__attach_netfilterbpf_program__attach_tcxbpf_program__attach_netkitbpf_program__attach_iter
bpf_program__typebpf_program__set_typebpf_program__set_expected_attach_typebpf_program__flagsbpf_program__set_flagsbpf_program__log_levelbpf_program__set_log_levelbpf_program__log_bufbpf_program__set_log_bufbpf_program__set_attach_targetbpf_program__expected_attach_type
- Link functions
- Map functions
bpf_map__attach_struct_opsbpf_map__set_autocreatebpf_map__autocreatebpf_map__set_autoattachbpf_map__autoattachbpf_map__fdbpf_map__reuse_fdbpf_map__namebpf_map__typebpf_map__set_typebpf_map__max_entriesbpf_map__set_max_entriesbpf_map__map_flagsbpf_map__set_map_flagsbpf_map__numa_nodebpf_map__set_numa_nodebpf_map__key_sizebpf_map__set_key_sizebpf_map__value_sizebpf_map__set_value_sizebpf_map__btf_key_type_idbpf_map__btf_value_type_idbpf_map__ifindexbpf_map__set_ifindexbpf_map__map_extrabpf_map__set_map_extrabpf_map__set_initial_valuebpf_map__initial_valuebpf_map__is_internalbpf_map__set_pin_pathbpf_map__pin_pathbpf_map__is_pinnedbpf_map__pinbpf_map__unpinbpf_map__set_inner_map_fdbpf_map__inner_mapbpf_map__lookup_elembpf_map__update_elembpf_map__delete_elembpf_map__lookup_and_delete_elembpf_map__get_next_key
- XDP functions
- TC functions
- Ring buffer functions
- User ring buffer
- Perf buffer functions
- Program line info functions
- Linker functions
- Misc libbpf functions
libbpf_major_versionlibbpf_minor_versionlibbpf_version_stringlibbpf_strerrorlibbpf_bpf_attach_type_strlibbpf_bpf_link_type_strlibbpf_bpf_map_type_strlibbpf_bpf_prog_type_strlibbpf_set_printlibbpf_prog_type_by_namelibbpf_attach_type_by_namelibbpf_find_vmlinux_btf_idlibbpf_probe_bpf_prog_typelibbpf_probe_bpf_map_typelibbpf_probe_bpf_helperlibbpf_num_possible_cpuslibbpf_register_prog_handlerlibbpf_unregister_prog_handler
BTF APIs
In the btf.h header file you will find the BTF APIs, to do more advanced BTF operations other than just loading BTF
from an object file.
btf__freebtf__newbtf__new_splitbtf__new_emptybtf__new_empty_splitbtf__distill_basebtf__parsebtf__parse_splitbtf__parse_elfbtf__parse_elf_splitbtf__parse_rawbtf__parse_raw_splitbtf__load_vmlinux_btfbtf__load_module_btfbtf__load_from_kernel_by_idbtf__load_from_kernel_by_id_splitbtf__load_into_kernelbtf__find_by_namebtf__find_by_name_kindbtf__type_cntbtf__base_btfbtf__type_by_idbtf__pointer_sizebtf__set_pointer_sizebtf__endiannessbtf__set_endiannessbtf__resolve_sizebtf__resolve_typebtf__align_ofbtf__fdbtf__set_fdbtf__raw_databtf__name_by_offsetbtf__str_by_offsetbtf_ext__newbtf_ext__freebtf_ext__raw_databtf_ext__endiannessbtf_ext__set_endiannessbtf__find_strbtf__add_strbtf__add_typebtf__add_btfbtf__add_intbtf__add_floatbtf__add_ptrbtf__add_arraybtf__add_structbtf__add_unionbtf__add_fieldbtf__add_enumbtf__add_enum_valuebtf__add_enum64btf__add_enum64_valuebtf__add_fwdbtf__add_typedefbtf__add_volatilebtf__add_constbtf__add_restrictbtf__add_type_tagbtf__add_funcbtf__add_func_protobtf__add_func_parambtf__add_varbtf__add_datasecbtf__add_datasec_var_infobtf__add_decl_tagbtf__add_decl_attrbtf__dedupbtf__relocatebtf_dump__newbtf_dump__freebtf_dump__dump_typebtf_dump__emit_type_declbtf_dump__dump_type_data
Low level APIs
In the bpf.h header file you will find the low level APIs which are used to interact with the kernel. These are basically just wrappers around the bpf() syscall. You should only use these if you know what you are doing and can't do something with the high level APIs.
libbpf_set_memlock_rlimbpf_map_createbpf_prog_loadbpf_btf_loadbpf_map_update_elembpf_map_lookup_elembpf_map_lookup_elem_flagsbpf_map_lookup_and_delete_elembpf_map_lookup_and_delete_elem_flagsbpf_map_delete_elembpf_map_delete_elem_flagsbpf_map_get_next_keybpf_map_freezebpf_map_delete_batchbpf_map_lookup_batchbpf_map_lookup_and_delete_batchbpf_map_update_batchbpf_obj_pinbpf_obj_pin_optsbpf_obj_getbpf_obj_get_optsbpf_prog_attachbpf_prog_detachbpf_prog_detach2bpf_prog_attach_optsbpf_prog_detach_optsbpf_link_createbpf_link_detachbpf_link_updatebpf_iter_createbpf_prog_get_next_idbpf_map_get_next_idbpf_btf_get_next_idbpf_link_get_next_idbpf_prog_get_fd_by_idbpf_prog_get_fd_by_id_optsbpf_map_get_fd_by_idbpf_map_get_fd_by_id_optsbpf_btf_get_fd_by_idbpf_btf_get_fd_by_id_optsbpf_link_get_fd_by_idbpf_link_get_fd_by_id_optsbpf_obj_get_info_by_fdbpf_prog_get_info_by_fdbpf_map_get_info_by_fdbpf_btf_get_info_by_fdbpf_link_get_info_by_fdbpf_prog_query_optsbpf_prog_querybpf_raw_tracepoint_open_optsbpf_raw_tracepoint_openbpf_task_fd_querybpf_enable_statsbpf_prog_bind_mapbpf_prog_test_run_optsbpf_token_create
Deprecated APIs
In the libbpf_legacy.h header file you will find the deprecated APIs. These are APIs that are no longer recommended to use and might be removed in the future.