Motivation

The extended Berkeley Packet Filter (eBPF) has rapidly evolved from a low-level packet filtering mechanism to a powerful framework for building high-performance, programmable applications within the Linux kernel. As its ecosystem has grown, so too has the complexity of its supporting libraries. One of the famous and most reliable library developers uses is libbpf.

For developers diving into eBPF, libbpf serves as the essential user-space library to interact with BPF objects, manage maps and programs, handle kernel integration, and access advanced features like BTF (BPF Type Format). However, despite its critical role, libbpf’s documentation remains fragmented, and many of its functions are poorly understood or underutilized.

I am writting this post to change that.

In this comprehensive reference guide, you’ll find categorized, structured documentation of libbpf functions, complete with parameters, return types, use cases, and practical explanations. Whether you’re building observability tools, network filters, or system profilers, this guide is designed to help you quickly locate and understand the exact function you need.

For reference I have taken the following libraries into consideration: libbpf (C/C++) and libbpf-rs (Rust - I Code a lot here) the two most widely used APIs for managing eBPF programs, maps, links, and metadata.

On top of that I’ll be attaching a Google Doc at the end, just incase you wish to download this guide and modify according to your preferences.

1. BTF (BPF Type Format) Functions

Function NamePurposeParametersReturn TypeWhen to UseDetailed Explanation
bpf_btf_get_fd_by_idGet BTF file descriptor by ID__u32 idintWhen you need to access BTF object with known IDReturns file descriptor for BTF object with given ID. Useful for introspection tools to examine type information of loaded programs
bpf_btf_get_fd_by_id_optsGet BTF file descriptor by ID with options__u32 id, const struct bpf_get_fd_by_id_opts *optsintWhen you need BTF access with specific optionsExtended version with options like token_fd for permission delegation
bpf_btf_get_info_by_fdGet BTF information by file descriptorint btf_fd, struct bpf_btf_info *info, __u32 *info_lenintWhen you need metadata about BTF objectPopulates BTF object information structure with metadata like name, BTF data size, etc.
bpf_btf_get_next_idGet next BTF ID__u32 start_id, __u32 *next_idintFor iterating through all BTF objectsUsed by introspection tools to enumerate all loaded BTF objects in the system
bpf_btf_loadLoad BTF data into kernelconst void *btf_data, size_t btf_size, struct bpf_btf_load_opts *optsintWhen loading BTF type informationLoads BTF blob into kernel, returns BTF file descriptor for use with maps and programs
btf__newCreate new BTF object from raw dataconst void *data, __u32 sizestruct btf *When parsing BTF from ELF or raw bytesCreates BTF object instance from raw BTF section data, used during program loading
btf__freeFree BTF objectstruct btf *btfvoidWhen cleaning up BTF resourcesFrees all memory associated with BTF object, should be called for every btf__new()
btf__load_into_kernelLoad BTF into kernelstruct btf *btfintWhen making BTF available to kernelUploads BTF object to kernel, making it available for program verification and map creation
btf__parseParse BTF from fileconst char *path, struct btf_ext **btf_extstruct btf *When loading BTF from ELF fileParses BTF section from ELF file, commonly used with compiled BPF programs
Function NamePurposeParametersReturn TypeWhen to UseDetailed Explanation
bpf_link__destroyDestroy BPF linkstruct bpf_link *linkintWhen detaching and cleaning up programDetaches program from kernel hook and frees all associated resources
bpf_link__detachDetach BPF linkstruct bpf_link *linkintWhen you want to detach but keep link objectDetaches program from hook point but preserves link object for potential reuse
bpf_link__disconnectDisconnect BPF linkstruct bpf_link *linkvoidWhen severing link connectionDisconnects link from underlying kernel attachment without destroying the object
bpf_link__fdGet link file descriptorconst struct bpf_link *linkintWhen you need raw FD for operationsReturns underlying file descriptor for direct syscall operations
bpf_link__openOpen existing link from filesystemconst char *pathstruct bpf_link *When loading pinned linkOpens previously pinned link from BPF filesystem
bpf_link__pinPin link to filesystemstruct bpf_link *link, const char *pathintWhen persisting link beyond process lifetimePins link to BPF filesystem, allowing it to persist after process exits
bpf_link__pin_pathGet pin path of linkconst struct bpf_link *linkconst char *When checking where link is pinnedReturns filesystem path where link is pinned, NULL if not pinned
bpf_link__unpinUnpin link from filesystemstruct bpf_link *linkintWhen removing persisted linkRemoves link from filesystem, decrementing reference count
bpf_link__update_mapUpdate map associated with linkstruct bpf_link *link, const struct bpf_map *mapintWhen changing map for struct_opsUpdates the map associated with struct_ops link to different map
bpf_link__update_programUpdate program in linkstruct bpf_link *link, struct bpf_program *progintWhen hot-swapping programsAtomically replaces program in existing link without recreating attachment
bpf_link_createCreate new BPF linkint prog_fd, int target_fd, enum bpf_attach_type attach_type, const struct bpf_link_create_opts *optsintWhen you need low-level link controlLow-level wrapper around BPF_LINK_CREATE syscall for precise control
bpf_link_detachDetach link by FDint link_fdintWhen detaching using raw file descriptorDetaches link using its file descriptor directly
bpf_link_get_fd_by_idGet link FD by ID__u32 idintWhen accessing link with known IDReturns file descriptor for link with specified ID
bpf_link_get_fd_by_id_optsGet link FD by ID with options__u32 id, const struct bpf_get_fd_by_id_opts *optsintWhen accessing link with optionsExtended version with additional options like token_fd
bpf_link_get_info_by_fdGet link informationint link_fd, struct bpf_link_info *info, __u32 *info_lenintWhen querying link metadataRetrieves link information including type, program ID, and attach information
bpf_link_get_next_idGet next link ID__u32 start_id, __u32 *next_idintFor enumerating all linksUsed by introspection tools to iterate through all links in system
bpf_link_updateUpdate existing linkint link_fd, int new_prog_fd, const struct bpf_link_update_opts *optsintWhen replacing program in linkUpdates link to use different program, useful for program hot-swapping

3. BPF Map Functions

Function NamePurposeParametersReturn TypeWhen to UseDetailed Explanation
bpf_map__attach_struct_opsAttach struct_ops mapconst struct bpf_map *mapstruct bpf_link *When using struct_ops mapsAttaches struct_ops map to kernel subsystem, enabling callback function registration
bpf_map__autoattachCheck if map auto-attachesconst struct bpf_map *mapboolWhen checking map attachment behaviorReturns whether map will automatically attach during skeleton attach phase
bpf_map__autocreateCheck if map auto-createsconst struct bpf_map *mapboolWhen checking map creation behaviorReturns whether map will be automatically created during object load
bpf_map__btf_key_type_idGet BTF key type IDconst struct bpf_map *map__u32When working with typed mapsReturns BTF type ID for map key, enabling type-aware operations
bpf_map__btf_value_type_idGet BTF value type IDconst struct bpf_map *map__u32When working with typed mapsReturns BTF type ID for map value, used for type verification
bpf_map__delete_elemDelete map elementconst struct bpf_map *map, const void *key, size_t key_sz, __u64 flagsintWhen removing key-value pairsHigh-level wrapper for deleting map elements with size validation
bpf_map__fdGet map file descriptorconst struct bpf_map *mapintWhen you need raw FD for operationsReturns underlying file descriptor for direct map operations
bpf_map__get_next_keyGet next key in mapconst struct bpf_map *map, const void *cur_key, void *next_key, size_t key_szintWhen iterating through map keysRetrieves next key for map iteration, returns -ENOENT when reaching end
bpf_map__get_pin_pathGet map pin pathconst struct bpf_map *mapconst char *When checking map persistenceReturns filesystem path where map is pinned, NULL if not pinned
bpf_map__ifindexGet map network interface indexconst struct bpf_map *map__u32When working with device mapsReturns network interface index for device-specific maps
bpf_map__initial_valueGet map initial valueconst struct bpf_map *map, size_t *psizevoid *When accessing global dataReturns pointer to initial data for global variable maps (bss, data, rodata)
bpf_map__inner_mapGet inner map templatestruct bpf_map *mapstruct bpf_map *When working with map-in-mapReturns template map for map-in-map types (array of maps, hash of maps)
bpf_map__is_internalCheck if map is internalconst struct bpf_map *mapboolWhen filtering map typesReturns true for internal maps created by libbpf (global vars, externs)
bpf_map__is_pinnedCheck if map is pinnedconst struct bpf_map *mapboolWhen checking map persistenceReturns whether map is currently pinned to filesystem
bpf_map__key_sizeGet map key sizeconst struct bpf_map *map__u32When validating key sizesReturns size in bytes of map keys
bpf_map__lookup_and_delete_elemLookup and delete atomicallyconst struct bpf_map *map, const void *key, size_t key_sz, void *value, size_t value_sz, __u64 flagsintWhen implementing queues/stacksAtomically retrieves and removes element, useful for FIFO/LIFO operations
bpf_map__lookup_elemLookup map elementconst struct bpf_map *map, const void *key, size_t key_sz, void *value, size_t value_sz, __u64 flagsintWhen reading map valuesHigh-level wrapper for map lookups with size validation
bpf_map__map_extraGet map extra parametersconst struct bpf_map *map__u64When accessing map-specific dataReturns map-specific extra data (bloom filter hash count, etc.)
bpf_map__map_flagsGet map flagsconst struct bpf_map *map__u32When checking map propertiesReturns map creation flags (NO_PREALLOC, NUMA_NODE, etc.)
bpf_map__max_entriesGet maximum entriesconst struct bpf_map *map__u32When checking map capacityReturns maximum number of entries the map can hold
bpf_map__nameGet map nameconst struct bpf_map *mapconst char *When identifying mapsReturns name of the map as defined in BPF program
bpf_map__numa_nodeGet NUMA nodeconst struct bpf_map *map__u32When checking NUMA placementReturns NUMA node where map memory is allocated
bpf_map__pinPin map to filesystemstruct bpf_map *map, const char *pathintWhen persisting mapsPins map to BPF filesystem for persistence beyond process lifetime
bpf_map__pin_pathGet pin pathconst struct bpf_map *mapconst char *When checking pin locationReturns filesystem path where map is pinned
bpf_map__reuse_fdReuse existing map FDstruct bpf_map *map, int fdintWhen sharing maps between processesMakes map object use existing file descriptor instead of creating new map
bpf_map__set_autoattachSet auto-attach behaviorstruct bpf_map *map, bool autoattachintWhen controlling attachmentSets whether map automatically attaches during skeleton attach phase
bpf_map__set_autocreateSet auto-create behaviorstruct bpf_map *map, bool autocreateintWhen controlling creationSets whether map is automatically created during object load
bpf_map__set_ifindexSet network interface indexstruct bpf_map *map, __u32 ifindexintWhen binding to specific deviceSets network interface for device-specific maps
bpf_map__set_initial_valueSet initial map valuestruct bpf_map *map, const void *data, size_t sizeintWhen initializing global dataSets initial data for global variable maps
bpf_map__set_inner_map_fdSet inner map FDstruct bpf_map *map, int fdintWhen configuring map-in-mapSets template map for map-in-map types
bpf_map__set_key_sizeSet key sizestruct bpf_map *map, __u32 sizeintWhen configuring map before loadSets size of map keys, must be called before object load
bpf_map__set_map_extraSet map extra parametersstruct bpf_map *map, __u64 map_extraintWhen setting map-specific optionsSets map-specific extra parameters
bpf_map__set_map_flagsSet map flagsstruct bpf_map *map, __u32 flagsintWhen configuring map behaviorSets map creation flags before load
bpf_map__set_max_entriesSet maximum entriesstruct bpf_map *map, __u32 max_entriesintWhen sizing mapsSets maximum number of entries, must be called before load
bpf_map__set_numa_nodeSet NUMA nodestruct bpf_map *map, __u32 numa_nodeintWhen optimizing memory placementSets NUMA node for map memory allocation
bpf_map__set_pin_pathSet pin pathstruct bpf_map *map, const char *pathintWhen configuring persistenceSets filesystem path for map pinning
bpf_map__set_typeSet map typestruct bpf_map *map, enum bpf_map_type typeintWhen changing map typeChanges map type, must be called before object load
bpf_map__set_value_sizeSet value sizestruct bpf_map *map, __u32 sizeintWhen configuring value sizeSets size of map values, can resize global data sections
bpf_map__typeGet map typeconst struct bpf_map *mapenum bpf_map_typeWhen checking map typeReturns the type of the map (HASH, ARRAY, etc.)
bpf_map__unpinUnpin map from filesystemstruct bpf_map *map, const char *pathintWhen removing persistenceRemoves map from filesystem, decrementing reference count
bpf_map__update_elemUpdate map elementconst struct bpf_map *map, const void *key, size_t key_sz, const void *value, size_t value_sz, __u64 flagsintWhen writing to mapsHigh-level wrapper for map updates with size validation
bpf_map__value_sizeGet value sizeconst struct bpf_map *map__u32When validating value sizesReturns size in bytes of map values
bpf_map_createCreate new mapenum bpf_map_type map_type, const char *map_name, __u32 key_size, __u32 value_size, __u32 max_entries, const struct bpf_map_create_opts *optsintWhen creating maps programmaticallyLow-level map creation with precise control over all parameters

4. BPF Object Functions

Function NamePurposeParametersReturn TypeWhen to UseDetailed Explanation
bpf_object__attach_skeletonAttach skeleton programsstruct bpf_object_skeleton *sintWhen using skeleton-based loadingAttaches all programs in skeleton to their respective hook points
bpf_object__btfGet object’s BTFconst struct bpf_object *objstruct btf *When accessing type informationReturns BTF object associated with BPF object for type introspection
bpf_object__btf_fdGet BTF file descriptorconst struct bpf_object *objintWhen you need BTF FDReturns file descriptor of BTF object associated with BPF object
bpf_object__closeClose BPF objectstruct bpf_object *objvoidWhen cleaning upFrees all resources associated with BPF object
bpf_object__destroy_skeletonDestroy skeletonstruct bpf_object_skeleton *svoidWhen cleaning up skeletonFrees all skeleton resources including maps, programs, and links
bpf_object__destroy_subskeletonDestroy subskeletonstruct bpf_object_subskeleton *svoidWhen cleaning up subskeletonFrees subskeleton resources for partial object access
bpf_object__detach_skeletonDetach skeleton programsstruct bpf_object_skeleton *svoidWhen detaching all programsDetaches all programs in skeleton from their hook points
bpf_object__find_map_by_nameFind map by nameconst struct bpf_object *obj, const char *namestruct bpf_map *When accessing specific mapsLocates map within object by name, returns NULL if not found
bpf_object__find_map_fd_by_nameFind map FD by nameconst struct bpf_object *obj, const char *nameintWhen you need map FD directlyReturns file descriptor of named map, -1 if not found
bpf_object__find_program_by_nameFind program by nameconst struct bpf_object *obj, const char *namestruct bpf_program *When accessing specific programsLocates program within object by name
bpf_object__gen_loaderGenerate loader programstruct bpf_object *obj, struct gen_loader_opts *optsintWhen creating loader programsGenerates BPF program that can load the object at runtime
bpf_object__kversionGet kernel versionconst struct bpf_object *objunsigned intWhen checking version requirementsReturns kernel version the object was compiled for
bpf_object__loadLoad object into kernelstruct bpf_object *objintWhen loading all programs and mapsLoads all programs and maps in object into kernel
bpf_object__load_skeletonLoad skeletonstruct bpf_object_skeleton *sintWhen using skeleton loadingLoads all skeleton components into kernel
bpf_object__nameGet object nameconst struct bpf_object *objconst char *When identifying objectsReturns name of the BPF object
bpf_object__next_mapGet next mapconst struct bpf_object *obj, const struct bpf_map *mapstruct bpf_map *When iterating through mapsIterates through all maps in object, NULL to start
bpf_object__next_programGet next programconst struct bpf_object *obj, struct bpf_program *progstruct bpf_program *When iterating through programsIterates through all programs in object, NULL to start
bpf_object__openOpen BPF object fileconst char *pathstruct bpf_object *When loading from ELF fileOpens and parses BPF ELF object file
bpf_object__open_fileOpen with optionsconst char *path, const struct bpf_object_open_opts *optsstruct bpf_object *When you need open optionsExtended open with options like BTF custom path
bpf_object__open_memOpen from memoryconst void *obj_buf, size_t obj_buf_sz, const struct bpf_object_open_opts *optsstruct bpf_object *When loading from memory bufferOpens BPF object from memory buffer instead of file
bpf_object__open_skeletonOpen skeletonstruct bpf_object_skeleton *s, const struct bpf_object_open_opts *optsintWhen using skeleton loadingOpens skeleton object with specified options
bpf_object__open_subskeletonOpen subskeletonstruct bpf_object_subskeleton *sintWhen accessing partial objectOpens subskeleton for accessing subset of object components
bpf_object__pinPin entire objectstruct bpf_object *object, const char *pathintWhen persisting entire objectPins all maps and programs in object to filesystem directory
bpf_object__pin_mapsPin all mapsstruct bpf_object *obj, const char *pathintWhen persisting maps onlyPins all maps in object to specified directory
bpf_object__pin_programsPin all programsstruct bpf_object *obj, const char *pathintWhen persisting programsPins all programs in object to filesystem directory
bpf_object__prev_mapGet previous mapconst struct bpf_object *obj, const struct bpf_map *mapstruct bpf_map *When reverse-iterating mapsReverse iteration through maps in object
bpf_object__prev_programGet previous programconst struct bpf_object *obj, struct bpf_program *progstruct bpf_program *When reverse-iterating programsReverse iteration through programs in object
bpf_object__set_kversionSet kernel versionstruct bpf_object *obj, __u32 kern_versionintWhen targeting specific kernelSets target kernel version for compatibility
bpf_object__token_fdGet token file descriptorconst struct bpf_object *objintWhen using delegation tokensReturns BPF token FD for permission delegation
bpf_object__unpinUnpin entire objectstruct bpf_object *object, const char *pathintWhen removing object persistenceUnpins all object components from filesystem
bpf_object__unpin_mapsUnpin all mapsstruct bpf_object *obj, const char *pathintWhen removing map persistenceUnpins all maps from filesystem directory
bpf_object__unpin_programsUnpin all programsstruct bpf_object *obj, const char *pathintWhen removing program persistenceUnpins all programs from filesystem directory

5. BPF Program Functions

Function NamePurposeParametersReturn TypeWhen to UseDetailed Explanation
bpf_program__attachGeneric program attachmentconst struct bpf_program *progstruct bpf_link *When using auto-detectionAutomatically detects program type and attaches appropriately
bpf_program__attach_cgroupAttach to cgroupconst struct bpf_program *prog, int cgroup_fdstruct bpf_link *When filtering cgroup operationsAttaches program to cgroup for network or process filtering
bpf_program__attach_freplaceAttach as function replacementconst struct bpf_program *prog, int target_fd, const char *attach_func_namestruct bpf_link *When replacing kernel functionsReplaces existing BPF program function with new implementation
bpf_program__attach_iterAttach to iteratorconst struct bpf_program *prog, const struct bpf_iter_attach_opts *optsstruct bpf_link *When creating BPF iteratorsAttaches program to BPF iterator for custom data traversal
bpf_program__attach_kprobeAttach to kernel probeconst struct bpf_program *prog, bool retprobe, const char *func_namestruct bpf_link *When tracing kernel functionsAttaches to kernel function entry or exit for tracing
bpf_program__attach_kprobe_multi_optsAttach to multiple kprobesconst struct bpf_program *prog, const char *pattern, const struct bpf_kprobe_multi_opts *optsstruct bpf_link *When tracing multiple functionsAttaches to multiple kernel functions matching pattern
bpf_program__attach_kprobe_optsAttach kprobe with optionsconst struct bpf_program *prog, const char *func_name, const struct bpf_kprobe_opts *optsstruct bpf_link *When you need kprobe optionsExtended kprobe attachment with custom options like offset, cookie
bpf_program__attach_ksyscallAttach to system callconst struct bpf_program *prog, const char *syscall_name, const struct bpf_ksyscall_opts *optsstruct bpf_link *When tracing system callsAttaches to kernel system call handlers with arch-independence
bpf_program__attach_lsmAttach to LSM hookconst struct bpf_program *progstruct bpf_link *When implementing security policiesAttaches to Linux Security Module hooks for security enforcement
bpf_program__attach_netfilterAttach to netfilterconst struct bpf_program *prog, const struct bpf_netfilter_opts *optsstruct bpf_link *When filtering network packetsAttaches to netfilter hooks for packet filtering
bpf_program__attach_netkitAttach to netkit deviceconst struct bpf_program *prog, int ifindex, const struct bpf_netkit_opts *optsstruct bpf_link *When working with netkit devicesAttaches program to netkit virtual network device
bpf_program__attach_netnsAttach to network namespaceconst struct bpf_program *prog, int netns_fdstruct bpf_link *When filtering per-netnsAttaches program to specific network namespace
bpf_program__attach_perf_eventAttach to perf eventconst struct bpf_program *prog, int pfdstruct bpf_link *When monitoring performanceAttaches to perf event for performance monitoring
bpf_program__attach_perf_event_optsAttach to perf event with optionsconst struct bpf_program *prog, int pfd, const struct bpf_perf_event_opts *optsstruct bpf_link *When you need perf optionsExtended perf event attachment with custom options
bpf_program__attach_raw_tracepointAttach to raw tracepointconst struct bpf_program *prog, const char *tp_namestruct bpf_link *When you need low-latency tracingAttaches to raw kernel tracepoints for minimal overhead
bpf_program__attach_raw_tracepoint_optsAttach raw tracepoint with optionsconst struct bpf_program *prog, const char *tp_name, struct bpf_raw_tracepoint_opts *optsstruct bpf_link *When you need raw tracepoint optionsExtended raw tracepoint with additional options
bpf_program__attach_sockmapAttach to socket mapconst struct bpf_program *prog, int map_fdstruct bpf_link *When redirecting socketsAttaches program to socket map for socket redirection
bpf_program__attach_tcxAttach to TC expressconst struct bpf_program *prog, int ifindex, const struct bpf_tcx_opts *optsstruct bpf_link *When using TC express datapathAttaches to traffic control express path for high-performance packet processing
bpf_program__attach_traceAttach tracing programconst struct bpf_program *progstruct bpf_link *When tracing with fentry/fexitAttaches tracing programs like fentry, fexit, fmod_ret
bpf_program__attach_trace_optsAttach trace with optionsconst struct bpf_program *prog, const struct bpf_trace_opts *optsstruct bpf_link *When you need trace optionsExtended tracing attachment with additional options
bpf_program__attach_tracepointAttach to tracepointconst struct bpf_program *prog, const char *tp_category, const char *tp_namestruct bpf_link *When tracing specific eventsAttaches to kernel tracepoints for event monitoring
bpf_program__attach_tracepoint_optsAttach tracepoint with optionsconst struct bpf_program *prog, const char *tp_category, const char *tp_name, const struct bpf_tracepoint_opts *optsstruct bpf_link *When you need tracepoint optionsExtended tracepoint attachment with custom options
bpf_program__attach_uprobeAttach to user probeconst struct bpf_program *prog, bool retprobe, pid_t pid, const char *binary_path, size_t func_offsetstruct bpf_link *When tracing userspace functionsAttaches to userspace function for application tracing
bpf_program__attach_uprobe_multiAttach to multiple uprobesconst struct bpf_program *prog, pid_t pid, const char *binary_path, const char *func_pattern, const struct bpf_uprobe_multi_opts *optsstruct bpf_link *When tracing multiple user functionsAttaches to multiple userspace functions matching pattern
bpf_program__attach_uprobe_optsAttach uprobe with optionsconst struct bpf_program *prog, pid_t pid, const char *binary_path, size_t func_offset, const struct bpf_uprobe_opts *optsstruct bpf_link *When you need uprobe optionsExtended uprobe attachment with custom options
bpf_program__attach_usdtAttach to USDT probeconst struct bpf_program *prog, pid_t pid, const char *binary_path, const char *usdt_provider, const char *usdt_name, const struct bpf_usdt_opts *optsstruct bpf_link *When tracing USDT probesAttaches to User Statically Defined Tracepoints
bpf_program__attach_xdpAttach to XDPconst struct bpf_program *prog, int ifindexstruct bpf_link *When processing packets at driver levelAttaches XDP program to network interface for early packet processing
bpf_program__autoattachCheck auto-attach statusconst struct bpf_program *progboolWhen checking attachment behaviorReturns whether program will auto-attach during skeleton attach
bpf_program__autoloadCheck auto-load statusconst struct bpf_program *progboolWhen checking load behaviorReturns whether program will be loaded automatically
bpf_program__expected_attach_typeGet expected attach typeconst struct bpf_program *progenum bpf_attach_typeWhen querying attach requirementsReturns the expected attachment type for the program
bpf_program__fdGet program file descriptorconst struct bpf_program *progintWhen you need raw FDReturns underlying file descriptor for direct operations
bpf_program__flagsGet program flagsconst struct bpf_program *prog__u32When checking program propertiesReturns program load flags
bpf_program__get_expected_attach_typeGet expected attach typeconst struct bpf_program *progenum bpf_attach_typeWhen querying attachment requirementsAlias for bpf_program__expected_attach_type
bpf_program__get_typeGet program typeconst struct bpf_program *progenum bpf_prog_typeWhen checking program typeReturns the BPF program type
bpf_program__insn_cntGet instruction countconst struct bpf_program *progsize_tWhen analyzing program sizeReturns number of BPF instructions in program
bpf_program__insnsGet program instructionsconst struct bpf_program *progconst struct bpf_insn *When analyzing program codeReturns pointer to BPF instruction array
bpf_program__log_bufGet program log bufferconst struct bpf_program *prog, size_t *log_sizeconst char *When debugging program loadingReturns verifier log buffer for debugging
bpf_program__log_levelGet log levelconst struct bpf_program *prog__u32When checking debug settingsReturns current verifier log level
bpf_program__nameGet program nameconst struct bpf_program *progconst char *When identifying programsReturns name of the BPF program
bpf_program__pinPin program to filesystemstruct bpf_program *prog, const char *pathintWhen persisting programsPins program to BPF filesystem for persistence
bpf_program__section_nameGet section nameconst struct bpf_program *progconst char *When checking program sourceReturns ELF section name where program was defined
bpf_program__set_attach_targetSet attach targetstruct bpf_program *prog, int attach_prog_fd, const char *attach_func_nameintWhen setting BTF attach targetsSets target for BTF-aware programs (fentry, fexit, etc.)
bpf_program__set_autoattachSet auto-attach behaviorstruct bpf_program *prog, bool autoattachvoidWhen controlling attachmentSets whether program auto-attaches during skeleton attach
bpf_program__set_autoloadSet auto-load behaviorstruct bpf_program *prog, bool autoloadintWhen controlling loadingSets whether program loads automatically
bpf_program__set_expected_attach_typeSet expected attach typestruct bpf_program *prog, enum bpf_attach_type typeintWhen configuring attachmentSets expected attachment type for program
bpf_program__set_flagsSet program flagsstruct bpf_program *prog, __u32 flagsintWhen configuring load behaviorSets program loading flags
bpf_program__set_ifindexSet interface indexstruct bpf_program *prog, __u32 ifindexvoidWhen targeting specific interfacesSets network interface index for device-specific programs
bpf_program__set_insnsSet program instructionsstruct bpf_program *prog, struct bpf_insn *new_insns, size_t new_insn_cntintWhen modifying program codeReplaces program instructions (advanced use only)
bpf_program__set_log_bufSet log bufferstruct bpf_program *prog, char *log_buf, size_t log_sizeintWhen capturing verifier outputSets buffer for verifier log messages
bpf_program__set_log_levelSet log levelstruct bpf_program *prog, __u32 log_levelintWhen configuring debug outputSets verifier log verbosity level
bpf_program__set_typeSet program typestruct bpf_program *prog, enum bpf_prog_type typeintWhen changing program typeSets BPF program type, must be called before load
bpf_program__typeGet program typeconst struct bpf_program *progenum bpf_prog_typeWhen checking program typeReturns the BPF program type
bpf_program__unloadUnload programstruct bpf_program *progvoidWhen removing from kernelRemoves program from kernel, making it loadable again
bpf_program__unpinUnpin programstruct bpf_program *prog, const char *pathintWhen removing persistenceRemoves program from filesystem

6. Ring Buffer Functions

Function NamePurposeParametersReturn TypeWhen to UseDetailed Explanation
ring_buffer__newCreate ring buffer managerint map_fd, ring_buffer_sample_fn sample_cb, void *ctx, const struct ring_buffer_opts *optsstruct ring_buffer *When setting up efficient data transferCreates ring buffer manager for high-performance data streaming from kernel to userspace
ring_buffer__freeFree ring bufferstruct ring_buffer *rbvoidWhen cleaning upFrees all resources associated with ring buffer manager
ring_buffer__addAdd ring bufferstruct ring_buffer *rb, int map_fd, ring_buffer_sample_fn sample_cb, void *ctxintWhen managing multiple ring buffersAdds additional ring buffer to existing manager
ring_buffer__pollPoll for datastruct ring_buffer *rb, int timeout_msintWhen waiting for dataPolls ring buffer for new data with timeout
ring_buffer__consumeConsume available datastruct ring_buffer *rbintWhen processing all available dataConsumes all available data without blocking
ring_buffer__consume_nConsume N recordsstruct ring_buffer *rb, size_t nintWhen limiting processingConsumes up to N records from ring buffer
ring_buffer__epoll_fdGet epoll file descriptorconst struct ring_buffer *rbintWhen integrating with event loopsReturns FD for epoll integration in event-driven applications
ring_buffer__ringGet individual ringstruct ring_buffer *rb, unsigned int idxstruct ring *When accessing specific ringsReturns specific ring buffer instance from manager
user_ring_buffer__newCreate user ring bufferint map_fd, const struct user_ring_buffer_opts *optsstruct user_ring_buffer *When userspace needs to send data to kernelCreates ring buffer for userspace-to-kernel communication
user_ring_buffer__reserveReserve buffer spacestruct user_ring_buffer *rb, __u32 sizevoid *When writing to ring bufferReserves space in ring buffer for writing data
user_ring_buffer__reserve_blockingReserve with blockingstruct user_ring_buffer *rb, __u32 size, int timeout_msvoid *When blocking until space availableBlocks until space becomes available in ring buffer
user_ring_buffer__submitSubmit reserved datastruct user_ring_buffer *rb, void *samplevoidWhen finalizing data writeSubmits previously reserved data to ring buffer
user_ring_buffer__discardDiscard reserved datastruct user_ring_buffer *rb, void *samplevoidWhen canceling write operationDiscards previously reserved space without writing
user_ring_buffer__freeFree user ring bufferstruct user_ring_buffer *rbvoidWhen cleaning upFrees user ring buffer resources

7. Performance Buffer Functions

Function NamePurposeParametersReturn TypeWhen to UseDetailed Explanation
perf_buffer__newCreate performance bufferint map_fd, size_t page_cnt, perf_buffer_sample_fn sample_cb, perf_buffer_lost_fn lost_cb, void *ctx, const struct perf_buffer_opts *optsstruct perf_buffer *When using perf events for data transferCreates performance event buffer for kernel-to-userspace communication
perf_buffer__new_rawCreate raw performance bufferint map_fd, size_t page_cnt, struct perf_event_attr *attr, perf_buffer_event_fn event_cb, void *ctx, const struct perf_buffer_raw_opts *optsstruct perf_buffer *When you need custom perf event attributesCreates perf buffer with custom performance event configuration
perf_buffer__freeFree performance bufferstruct perf_buffer *pbvoidWhen cleaning upFrees all performance buffer resources
perf_buffer__epoll_fdGet epoll file descriptorconst struct perf_buffer *pbintWhen integrating with event loopsReturns FD for epoll integration
perf_buffer__pollPoll for eventsstruct perf_buffer *pb, int timeout_msintWhen waiting for perf eventsPolls performance buffer for new events
perf_buffer__consumeConsume all eventsstruct perf_buffer *pbintWhen processing all available eventsConsumes all available events without blocking
perf_buffer__consume_bufferConsume specific bufferstruct perf_buffer *pb, size_t buf_idxintWhen processing specific CPU bufferConsumes events from specific per-CPU buffer
perf_buffer__buffer_cntGet buffer countconst struct perf_buffer *pbsize_tWhen checking buffer configurationReturns number of per-CPU buffers
perf_buffer__buffer_fdGet buffer file descriptorconst struct perf_buffer *pb, size_t buf_idxintWhen accessing specific buffer FDReturns FD for specific per-CPU buffer
perf_buffer__bufferGet raw buffer datastruct perf_buffer *pb, int buf_idx, void **buf, size_t *buf_sizeintWhen implementing custom event processingReturns raw mmap’d buffer for custom processing

8. Utility Functions

Function NamePurposeParametersReturn TypeWhen to UseDetailed Explanation
libbpf_get_errorExtract error from pointerconst void *ptrlongWhen checking libbpf API errorsExtracts error code from libbpf function pointers (deprecated in 1.0)
libbpf_major_versionGet major versionvoid__u32When checking libbpf versionReturns major version number of libbpf library
libbpf_minor_versionGet minor versionvoid__u32When checking libbpf versionReturns minor version number of libbpf library
libbpf_version_stringGet version stringvoidconst char *When displaying version infoReturns human-readable version string
libbpf_strerrorGet error stringint err, char *buf, size_t sizeintWhen formatting error messagesConverts error code to human-readable string
libbpf_set_printSet print callbacklibbpf_print_fn_t fnlibbpf_print_fn_tWhen customizing debug outputSets custom function for libbpf debug/error messages
libbpf_num_possible_cpusGet CPU countvoidintWhen sizing per-CPU data structuresReturns number of possible CPUs for per-CPU map sizing
libbpf_find_kernel_btfFind kernel BTFvoidstruct btf *When accessing kernel type infoLocates and loads kernel BTF for type information
libbpf_find_vmlinux_btf_idFind kernel function BTF IDconst char *name, enum bpf_attach_type attach_typeintWhen working with kernel functionsFinds BTF ID for kernel function by name
libbpf_attach_type_by_nameGet attach type by nameconst char *name, enum bpf_attach_type *attach_typeintWhen parsing attach type stringsConverts attach type name to enum value
libbpf_prog_type_by_nameGet program type by nameconst char *name, enum bpf_prog_type *prog_type, enum bpf_attach_type *expected_attach_typeintWhen parsing program type stringsConverts program type name to enum values
libbpf_bpf_attach_type_strGet attach type stringenum bpf_attach_type tconst char *When displaying attach typesConverts attach type enum to string representation
libbpf_bpf_link_type_strGet link type stringenum bpf_link_type tconst char *When displaying link typesConverts link type enum to string representation
libbpf_bpf_map_type_strGet map type stringenum bpf_map_type tconst char *When displaying map typesConverts map type enum to string representation
libbpf_bpf_prog_type_strGet program type stringenum bpf_prog_type tconst char *When displaying program typesConverts program type enum to string representation
libbpf_probe_bpf_helperProbe helper availabilityenum bpf_prog_type prog_type, enum bpf_func_id helper_id, const void *optsintWhen checking feature supportTests if specific helper is available for program type
libbpf_probe_bpf_map_typeProbe map type supportenum bpf_map_type map_type, const void *optsintWhen checking map supportTests if specific map type is supported by kernel
libbpf_probe_bpf_prog_typeProbe program type supportenum bpf_prog_type prog_type, const void *optsintWhen checking program supportTests if specific program type is supported
libbpf_set_memlock_rlimSet memory lock limitsize_t memlock_bytesintWhen configuring memory limitsSets RLIMIT_MEMLOCK for BPF memory allocation
libbpf_set_strict_modeSet strict modeenum libbpf_strict_mode modeintWhen enabling strict error handlingEnables strict mode for cleaner error handling
libbpf_register_prog_handlerRegister program handlerconst char *sec, enum bpf_prog_type prog_type, enum bpf_attach_type exp_attach_type, const struct libbpf_prog_handler_opts *optsintWhen extending libbpfRegisters custom program section handler
libbpf_unregister_prog_handlerUnregister program handlerint handler_idintWhen cleaning up handlersRemoves previously registered program handler

9. BPF Linker Functions

Function NamePurposeParametersReturn TypeWhen to UseDetailed Explanation
bpf_linker__newCreate new linkerconst char *filename, struct bpf_linker_opts *optsstruct bpf_linker *When linking multiple BPF objectsCreates linker for combining multiple BPF object files
bpf_linker__add_fileAdd file to linkerstruct bpf_linker *linker, const char *filename, const struct bpf_linker_file_opts *optsintWhen adding object filesAdds BPF object file to linker for combination
bpf_linker__finalizeFinalize linkingstruct bpf_linker *linkerintWhen completing link processFinalizes linking process and generates output
bpf_linker__freeFree linkerstruct bpf_linker *linkervoidWhen cleaning up linkerFrees all linker resources

10. Low-Level BPF System Call Wrappers

Function NamePurposeParametersReturn TypeWhen to UseDetailed Explanation
bpf_enable_statsEnable BPF statisticsenum bpf_stats_type typeintWhen enabling runtime statisticsEnables BPF runtime statistics collection
bpf_iter_createCreate BPF iteratorint link_fdintWhen creating custom iteratorsCreates iterator from BPF link for data traversal
bpf_obj_getGet object from filesystemconst char *pathnameintWhen loading pinned objectsLoads pinned BPF object from filesystem
bpf_obj_get_info_by_fdGet object info by FDint bpf_fd, void *info, __u32 *info_lenintWhen querying object metadataGeneric object information retrieval
bpf_obj_get_optsGet object with optionsconst char *pathname, const struct bpf_obj_get_opts *optsintWhen loading with specific optionsExtended object loading with options
bpf_obj_pinPin object to filesystemint fd, const char *pathnameintWhen persisting objectsPins BPF object to filesystem for persistence
bpf_obj_pin_optsPin object with optionsint fd, const char *pathname, const struct bpf_obj_pin_opts *optsintWhen pinning with optionsExtended pinning with additional options
bpf_prog_attachAttach programint prog_fd, int attachable_fd, enum bpf_attach_type type, unsigned int flagsintWhen attaching with raw FDsLow-level program attachment using file descriptors
bpf_prog_attach_optsAttach program with optionsint prog_fd, int target, enum bpf_attach_type type, const struct bpf_prog_attach_opts *optsintWhen you need attach optionsExtended program attachment with additional options
bpf_prog_bind_mapBind program to mapint prog_fd, int map_fd, const struct bpf_prog_bind_opts *optsintWhen pre-binding programs to mapsAssociates program with map for optimization
bpf_prog_detachDetach programint attachable_fd, enum bpf_attach_type typeintWhen detaching by typeDetaches program from attachment point by type
bpf_prog_detach2Detach specific programint prog_fd, int attachable_fd, enum bpf_attach_type typeintWhen detaching specific programDetaches specific program by file descriptor
bpf_prog_detach_optsDetach with optionsint prog_fd, int target, enum bpf_attach_type type, const struct bpf_prog_detach_opts *optsintWhen you need detach optionsExtended program detachment with options
bpf_prog_get_fd_by_idGet program FD by ID__u32 idintWhen accessing program by IDReturns file descriptor for program with specified ID
bpf_prog_get_fd_by_id_optsGet program FD with options__u32 id, const struct bpf_get_fd_by_id_opts *optsintWhen you need access optionsExtended FD retrieval with options
bpf_prog_get_info_by_fdGet program infoint prog_fd, struct bpf_prog_info *info, __u32 *info_lenintWhen querying program metadataRetrieves detailed program information
bpf_prog_get_next_idGet next program ID__u32 start_id, __u32 *next_idintWhen enumerating programsIterates through all loaded programs
bpf_prog_loadLoad program into kernelenum bpf_prog_type prog_type, const char *prog_name, const char *license, const struct bpf_insn *insns, size_t insn_cnt, struct bpf_prog_load_opts *optsintWhen loading with precise controlLow-level program loading with full control over parameters
bpf_prog_queryQuery attached programsint target_fd, enum bpf_attach_type type, __u32 query_flags, __u32 *attach_flags, __u32 *prog_ids, __u32 *prog_cntintWhen listing attached programsQueries programs attached to specific target
bpf_prog_query_optsQuery with optionsint target, enum bpf_attach_type type, struct bpf_prog_query_opts *optsintWhen you need query optionsExtended program querying with options
bpf_prog_test_run_optsTest program executionint prog_fd, struct bpf_test_run_opts *optsintWhen testing programsRuns program in test mode with provided input
bpf_raw_tracepoint_openOpen raw tracepointconst char *name, int prog_fdintWhen using raw tracepointsOpens raw tracepoint for minimal-overhead tracing
bpf_raw_tracepoint_open_optsOpen raw tracepoint with optionsint prog_fd, struct bpf_raw_tp_opts *optsintWhen you need raw tracepoint optionsExtended raw tracepoint opening
bpf_task_fd_queryQuery task file descriptorint pid, int fd, __u32 flags, char *buf, __u32 *buf_len, __u32 *prog_id, __u32 *fd_type, __u64 *probe_offset, __u64 *probe_addrintWhen debugging attachmentsQueries information about BPF programs attached to task
bpf_token_createCreate BPF tokenint bpffs_fd, struct bpf_token_create_opts *optsintWhen delegating permissionsCreates token for permission delegation to non-privileged processes

11. Traffic Control Functions

Function NamePurposeParametersReturn TypeWhen to UseDetailed Explanation
bpf_tc_attachAttach TC programconst struct bpf_tc_hook *hook, struct bpf_tc_opts *optsintWhen attaching to traffic controlAttaches BPF program to traffic control hook for packet processing
bpf_tc_detachDetach TC programconst struct bpf_tc_hook *hook, const struct bpf_tc_opts *optsintWhen removing TC attachmentDetaches BPF program from traffic control hook
bpf_tc_hook_createCreate TC hookstruct bpf_tc_hook *hookintWhen setting up TC infrastructureCreates traffic control hook for program attachment
bpf_tc_hook_destroyDestroy TC hookstruct bpf_tc_hook *hookintWhen cleaning up TC hooksDestroys traffic control hook
bpf_tc_queryQuery TC programsconst struct bpf_tc_hook *hook, struct bpf_tc_opts *optsintWhen listing TC programsQueries programs attached to traffic control hook

12. XDP Functions

Function NamePurposeParametersReturn TypeWhen to UseDetailed Explanation
bpf_xdp_attachAttach XDP programint ifindex, int prog_fd, __u32 flags, const struct bpf_xdp_attach_opts *optsintWhen attaching to network interfaceAttaches XDP program to network interface for early packet processing
bpf_xdp_detachDetach XDP programint ifindex, __u32 flags, const struct bpf_xdp_attach_opts *optsintWhen removing XDP attachmentDetaches XDP program from network interface
bpf_xdp_queryQuery XDP programsint ifindex, int flags, struct bpf_xdp_query_opts *optsintWhen checking XDP statusQueries XDP programs attached to interface
bpf_xdp_query_idQuery XDP program IDint ifindex, int flags, __u32 *prog_idintWhen getting attached program IDReturns ID of XDP program attached to interface