程序类型和 ELF 节¶

下表列出了程序类型、相关的附加类型以及 libbpf 支持的 ELF 节名称。 ELF 节名称遵循以下规则

type 是精确匹配，例如 SEC("socket")
type+ 表示它可以是精确的 SEC("type") 或格式良好的 SEC("type/extras")，其中 type 和 extras 之间用 ‘/’ 分隔符分隔。

当指定 extras 时，它们提供了如何自动附加 BPF 程序的详细信息。extras 的格式取决于程序类型，例如，对于跟踪点，SEC("tracepoint/<category>/<name>")，或者对于 USDT 探针，SEC("usdt/<path>:<provider>:<name>")。脚注中将更详细地描述 extras。

程序类型	附加类型	ELF 节名称	可休眠
`BPF_PROG_TYPE_CGROUP_DEVICE`	`BPF_CGROUP_DEVICE`	`cgroup/dev`
`BPF_PROG_TYPE_CGROUP_SKB`		`cgroup/skb`
	`BPF_CGROUP_INET_EGRESS`	`cgroup_skb/egress`
	`BPF_CGROUP_INET_INGRESS`	`cgroup_skb/ingress`
`BPF_PROG_TYPE_CGROUP_SOCKOPT`	`BPF_CGROUP_GETSOCKOPT`	`cgroup/getsockopt`
`BPF_PROG_TYPE_CGROUP_SOCKOPT`	`BPF_CGROUP_SETSOCKOPT`	`cgroup/setsockopt`
`BPF_PROG_TYPE_CGROUP_SOCK_ADDR`	`BPF_CGROUP_INET4_BIND`	`cgroup/bind4`
	`BPF_CGROUP_INET4_CONNECT`	`cgroup/connect4`
	`BPF_CGROUP_INET4_GETPEERNAME`	`cgroup/getpeername4`
	`BPF_CGROUP_INET4_GETSOCKNAME`	`cgroup/getsockname4`
	`BPF_CGROUP_INET6_BIND`	`cgroup/bind6`
	`BPF_CGROUP_INET6_CONNECT`	`cgroup/connect6`
	`BPF_CGROUP_INET6_GETPEERNAME`	`cgroup/getpeername6`
	`BPF_CGROUP_INET6_GETSOCKNAME`	`cgroup/getsockname6`
	`BPF_CGROUP_UDP4_RECVMSG`	`cgroup/recvmsg4`
	`BPF_CGROUP_UDP4_SENDMSG`	`cgroup/sendmsg4`
	`BPF_CGROUP_UDP6_RECVMSG`	`cgroup/recvmsg6`
	`BPF_CGROUP_UDP6_SENDMSG`	`cgroup/sendmsg6`
	`BPF_CGROUP_UNIX_CONNECT`	`cgroup/connect_unix`
	`BPF_CGROUP_UNIX_SENDMSG`	`cgroup/sendmsg_unix`
	`BPF_CGROUP_UNIX_RECVMSG`	`cgroup/recvmsg_unix`
	`BPF_CGROUP_UNIX_GETPEERNAME`	`cgroup/getpeername_unix`
	`BPF_CGROUP_UNIX_GETSOCKNAME`	`cgroup/getsockname_unix`
`BPF_PROG_TYPE_CGROUP_SOCK`	`BPF_CGROUP_INET4_POST_BIND`	`cgroup/post_bind4`
	`BPF_CGROUP_INET6_POST_BIND`	`cgroup/post_bind6`
	`BPF_CGROUP_INET_SOCK_CREATE`	`cgroup/sock_create`
	`BPF_CGROUP_INET_SOCK_CREATE`	`cgroup/sock`
	`BPF_CGROUP_INET_SOCK_RELEASE`	`cgroup/sock_release`
`BPF_PROG_TYPE_CGROUP_SYSCTL`	`BPF_CGROUP_SYSCTL`	`cgroup/sysctl`
`BPF_PROG_TYPE_EXT`		`freplace+` [1]
`BPF_PROG_TYPE_FLOW_DISSECTOR`	`BPF_FLOW_DISSECTOR`	`flow_dissector`
`BPF_PROG_TYPE_KPROBE`		`kprobe+` [2]
		`kretprobe+` [2]
		`ksyscall+` [3]
		`kretsyscall+` [3]
		`uprobe+` [4]
		`uprobe.s+` [4]	是
		`uretprobe+` [4]
		`uretprobe.s+` [4]	是
		`usdt+` [5]
	`BPF_TRACE_KPROBE_MULTI`	`kprobe.multi+` [6]
	`BPF_TRACE_KPROBE_MULTI`	`kretprobe.multi+` [6]
`BPF_PROG_TYPE_LIRC_MODE2`	`BPF_LIRC_MODE2`	`lirc_mode2`
`BPF_PROG_TYPE_LSM`	`BPF_LSM_CGROUP`	`lsm_cgroup+`
	`BPF_LSM_MAC`	`lsm+` [7]
	`BPF_LSM_MAC`	`lsm.s+` [7]	是
`BPF_PROG_TYPE_LWT_IN`		`lwt_in`
`BPF_PROG_TYPE_LWT_OUT`		`lwt_out`
`BPF_PROG_TYPE_LWT_SEG6LOCAL`		`lwt_seg6local`
`BPF_PROG_TYPE_LWT_XMIT`		`lwt_xmit`
`BPF_PROG_TYPE_NETFILTER`		`netfilter`
`BPF_PROG_TYPE_PERF_EVENT`		`perf_event`
`BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`		`raw_tp.w+` [8]
`BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`		`raw_tracepoint.w+`
`BPF_PROG_TYPE_RAW_TRACEPOINT`		`raw_tp+` [8]
`BPF_PROG_TYPE_RAW_TRACEPOINT`		`raw_tracepoint+`
`BPF_PROG_TYPE_SCHED_ACT`		`action` [9]
`BPF_PROG_TYPE_SCHED_CLS`		`classifier` [9]
		`tc` [9]
	`BPF_NETKIT_PRIMARY`	`netkit/primary`
	`BPF_NETKIT_PEER`	`netkit/peer`
	`BPF_TCX_INGRESS`	`tc/ingress`
	`BPF_TCX_EGRESS`	`tc/egress`
	`BPF_TCX_INGRESS`	`tcx/ingress`
	`BPF_TCX_EGRESS`	`tcx/egress`
`BPF_PROG_TYPE_SK_LOOKUP`	`BPF_SK_LOOKUP`	`sk_lookup`
`BPF_PROG_TYPE_SK_MSG`	`BPF_SK_MSG_VERDICT`	`sk_msg`
`BPF_PROG_TYPE_SK_REUSEPORT`	`BPF_SK_REUSEPORT_SELECT_OR_MIGRATE`	`sk_reuseport/migrate`
`BPF_PROG_TYPE_SK_REUSEPORT`	`BPF_SK_REUSEPORT_SELECT`	`sk_reuseport`
`BPF_PROG_TYPE_SK_SKB`		`sk_skb`
	`BPF_SK_SKB_STREAM_PARSER`	`sk_skb/stream_parser`
	`BPF_SK_SKB_STREAM_VERDICT`	`sk_skb/stream_verdict`
`BPF_PROG_TYPE_SOCKET_FILTER`		`socket`
`BPF_PROG_TYPE_SOCK_OPS`	`BPF_CGROUP_SOCK_OPS`	`sockops`
`BPF_PROG_TYPE_STRUCT_OPS`		`struct_ops+` [10]
`BPF_PROG_TYPE_STRUCT_OPS`		`struct_ops.s+` [10]	是
`BPF_PROG_TYPE_SYSCALL`		`syscall`	是
`BPF_PROG_TYPE_TRACEPOINT`		`tp+` [11]
`BPF_PROG_TYPE_TRACEPOINT`		`tracepoint+` [11]
`BPF_PROG_TYPE_TRACING`	`BPF_MODIFY_RETURN`	`fmod_ret+` [1]
	`BPF_MODIFY_RETURN`	`fmod_ret.s+` [1]	是
	`BPF_TRACE_FENTRY`	`fentry+` [1]
	`BPF_TRACE_FENTRY`	`fentry.s+` [1]	是
	`BPF_TRACE_FEXIT`	`fexit+` [1]
	`BPF_TRACE_FEXIT`	`fexit.s+` [1]	是
	`BPF_TRACE_ITER`	`iter+` [12]
	`BPF_TRACE_ITER`	`iter.s+` [12]	是
	`BPF_TRACE_RAW_TP`	`tp_btf+` [1]
`BPF_PROG_TYPE_XDP`	`BPF_XDP_CPUMAP`	`xdp.frags/cpumap`
	`BPF_XDP_CPUMAP`	`xdp/cpumap`
	`BPF_XDP_DEVMAP`	`xdp.frags/devmap`
	`BPF_XDP_DEVMAP`	`xdp/devmap`
	`BPF_XDP`	`xdp.frags`
	`BPF_XDP`	`xdp`

脚注

Linux 内核

目录

本页

程序类型和 ELF 节¶