Program Types and ELF Sections

The table below lists the program types, their attach types where relevant and the ELF section names supported by libbpf for them. The ELF section names follow these rules:

  • type is an exact match, e.g. SEC("socket")

  • type+ means it can be either exact SEC("type") or well-formed SEC("type/extras") with a ‘/’ separator between type and extras.

When extras are specified, they provide details of how to auto-attach the BPF program. The format of extras depends on the program type, e.g. SEC("tracepoint/<category>/<name>") for tracepoints or SEC("usdt/<path>:<provider>:<name>") for USDT probes. The extras are described in more detail in the footnotes.

Program Type

Attach Type

ELF Section Name

Sleepable

BPF_PROG_TYPE_CGROUP_DEVICE

BPF_CGROUP_DEVICE

cgroup/dev

BPF_PROG_TYPE_CGROUP_SKB

cgroup/skb

BPF_CGROUP_INET_EGRESS

cgroup_skb/egress

BPF_CGROUP_INET_INGRESS

cgroup_skb/ingress

BPF_PROG_TYPE_CGROUP_SOCKOPT

BPF_CGROUP_GETSOCKOPT

cgroup/getsockopt

BPF_CGROUP_SETSOCKOPT

cgroup/setsockopt

BPF_PROG_TYPE_CGROUP_SOCK_ADDR

BPF_CGROUP_INET4_BIND

cgroup/bind4

BPF_CGROUP_INET4_CONNECT

cgroup/connect4

BPF_CGROUP_INET4_GETPEERNAME

cgroup/getpeername4

BPF_CGROUP_INET4_GETSOCKNAME

cgroup/getsockname4

BPF_CGROUP_INET6_BIND

cgroup/bind6

BPF_CGROUP_INET6_CONNECT

cgroup/connect6

BPF_CGROUP_INET6_GETPEERNAME

cgroup/getpeername6

BPF_CGROUP_INET6_GETSOCKNAME

cgroup/getsockname6

BPF_CGROUP_UDP4_RECVMSG

cgroup/recvmsg4

BPF_CGROUP_UDP4_SENDMSG

cgroup/sendmsg4

BPF_CGROUP_UDP6_RECVMSG

cgroup/recvmsg6

BPF_CGROUP_UDP6_SENDMSG

cgroup/sendmsg6

BPF_CGROUP_UNIX_CONNECT

cgroup/connect_unix

BPF_CGROUP_UNIX_SENDMSG

cgroup/sendmsg_unix

BPF_CGROUP_UNIX_RECVMSG

cgroup/recvmsg_unix

BPF_CGROUP_UNIX_GETPEERNAME

cgroup/getpeername_unix

BPF_CGROUP_UNIX_GETSOCKNAME

cgroup/getsockname_unix

BPF_PROG_TYPE_CGROUP_SOCK

BPF_CGROUP_INET4_POST_BIND

cgroup/post_bind4

BPF_CGROUP_INET6_POST_BIND

cgroup/post_bind6

BPF_CGROUP_INET_SOCK_CREATE

cgroup/sock_create

cgroup/sock

BPF_CGROUP_INET_SOCK_RELEASE

cgroup/sock_release

BPF_PROG_TYPE_CGROUP_SYSCTL

BPF_CGROUP_SYSCTL

cgroup/sysctl

BPF_PROG_TYPE_EXT

freplace+ [1]

BPF_PROG_TYPE_FLOW_DISSECTOR

BPF_FLOW_DISSECTOR

flow_dissector

BPF_PROG_TYPE_KPROBE

kprobe+ [2]

kretprobe+ [2]

ksyscall+ [3]

kretsyscall+ [3]

uprobe+ [4]

uprobe.s+ [4]

Yes

uretprobe+ [4]

uretprobe.s+ [4]

Yes

usdt+ [5]

BPF_TRACE_KPROBE_MULTI

kprobe.multi+ [6]

kretprobe.multi+ [6]

BPF_PROG_TYPE_LIRC_MODE2

BPF_LIRC_MODE2

lirc_mode2

BPF_PROG_TYPE_LSM

BPF_LSM_CGROUP

lsm_cgroup+

BPF_LSM_MAC

lsm+ [7]

lsm.s+ [7]

Yes

BPF_PROG_TYPE_LWT_IN

lwt_in

BPF_PROG_TYPE_LWT_OUT

lwt_out

BPF_PROG_TYPE_LWT_SEG6LOCAL

lwt_seg6local

BPF_PROG_TYPE_LWT_XMIT

lwt_xmit

BPF_PROG_TYPE_PERF_EVENT

perf_event

BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE

raw_tp.w+ [8]

raw_tracepoint.w+

BPF_PROG_TYPE_RAW_TRACEPOINT

raw_tp+ [8]

raw_tracepoint+

BPF_PROG_TYPE_SCHED_ACT

action

BPF_PROG_TYPE_SCHED_CLS

classifier

tc

BPF_PROG_TYPE_SK_LOOKUP

BPF_SK_LOOKUP

sk_lookup

BPF_PROG_TYPE_SK_MSG

BPF_SK_MSG_VERDICT

sk_msg

BPF_PROG_TYPE_SK_REUSEPORT

BPF_SK_REUSEPORT_SELECT_OR_MIGRATE

sk_reuseport/migrate

BPF_SK_REUSEPORT_SELECT

sk_reuseport

BPF_PROG_TYPE_SK_SKB

sk_skb

BPF_SK_SKB_STREAM_PARSER

sk_skb/stream_parser

BPF_SK_SKB_STREAM_VERDICT

sk_skb/stream_verdict

BPF_PROG_TYPE_SOCKET_FILTER

socket

BPF_PROG_TYPE_SOCK_OPS

BPF_CGROUP_SOCK_OPS

sockops

BPF_PROG_TYPE_STRUCT_OPS

struct_ops+

BPF_PROG_TYPE_SYSCALL

syscall

Yes

BPF_PROG_TYPE_TRACEPOINT

tp+ [9]

tracepoint+ [9]

BPF_PROG_TYPE_TRACING

BPF_MODIFY_RETURN

fmod_ret+ [1]

fmod_ret.s+ [1]

Yes

BPF_TRACE_FENTRY

fentry+ [1]

fentry.s+ [1]

Yes

BPF_TRACE_FEXIT

fexit+ [1]

fexit.s+ [1]

Yes

BPF_TRACE_ITER

iter+ [10]

iter.s+ [10]

Yes

BPF_TRACE_RAW_TP

tp_btf+ [1]

BPF_PROG_TYPE_XDP

BPF_XDP_CPUMAP

xdp.frags/cpumap

xdp/cpumap

BPF_XDP_DEVMAP

xdp.frags/devmap

xdp/devmap

BPF_XDP

xdp.frags

xdp

Footnotes