1. BTF (BPF Type Format) Functions

Function Name Purpose Parameters Return Type When to Use Detailed Explanation
bpf_btf_get_fd_by_id Get BTF file descriptor by ID __u32 id int When you need to access BTF object with known ID Returns file descriptor for BTF object with given ID. Useful for introspection tools to examine type information of loaded programs
bpf_btf_get_fd_by_id_opts Get BTF file descriptor by ID with options __u32 id, const struct bpf_get_fd_by_id_opts *opts int When you need BTF access with specific options Extended version with options like token_fd for permission delegation
bpf_btf_get_info_by_fd Get BTF information by file descriptor int btf_fd, struct bpf_btf_info *info, __u32 *info_len int When you need metadata about BTF object Populates BTF object information structure with metadata like name, BTF data size, etc.
bpf_btf_get_next_id Get next BTF ID __u32 start_id, __u32 *next_id int For iterating through all BTF objects Used by introspection tools to enumerate all loaded BTF objects in the system
bpf_btf_load Load BTF data into kernel const void *btf_data, size_t btf_size, struct bpf_btf_load_opts *opts int When loading BTF type information Loads BTF blob into kernel, returns BTF file descriptor for use with maps and programs
btf__new Create new BTF object from raw data const void *data, __u32 size struct btf * When parsing BTF from ELF or raw bytes Creates BTF object instance from raw BTF section data, used during program loading
btf__free Free BTF object struct btf *btf void When cleaning up BTF resources Frees all memory associated with BTF object, should be called for every btf__new()
btf__load_into_kernel Load BTF into kernel struct btf *btf int When making BTF available to kernel Uploads BTF object to kernel, making it available for program verification and map creation
btf__parse Parse BTF from file const char *path, struct btf_ext **btf_ext struct btf * When loading BTF from ELF file Parses BTF section from ELF file, commonly used with compiled BPF programs

2. BPF Link Management Functions

Function Name Purpose Parameters Return Type When to Use Detailed Explanation
bpf_link__destroy Destroy BPF link struct bpf_link *link int When detaching and cleaning up program Detaches program from kernel hook and frees all associated resources
bpf_link__detach Detach BPF link struct bpf_link *link int When you want to detach but keep link object Detaches program from hook point but preserves link object for potential reuse
bpf_link__disconnect Disconnect BPF link struct bpf_link *link void When severing link connection Disconnects link from underlying kernel attachment without destroying the object
bpf_link__fd Get link file descriptor const struct bpf_link *link int When you need raw FD for operations Returns underlying file descriptor for direct syscall operations
bpf_link__open Open existing link from filesystem const char *path struct bpf_link * When loading pinned link Opens previously pinned link from BPF filesystem
bpf_link__pin Pin link to filesystem struct bpf_link *link, const char *path int When persisting link beyond process lifetime Pins link to BPF filesystem, allowing it to persist after process exits
bpf_link__pin_path Get pin path of link const struct bpf_link *link const char * When checking where link is pinned Returns filesystem path where link is pinned, NULL if not pinned
bpf_link__unpin Unpin link from filesystem struct bpf_link *link int When removing persisted link Removes link from filesystem, decrementing reference count
bpf_link__update_map Update map associated with link struct bpf_link *link, const struct bpf_map *map int When changing map for struct_ops Updates the map associated with struct_ops link to different map
bpf_link__update_program Update program in link struct bpf_link *link, struct bpf_program *prog int When hot-swapping programs Atomically replaces program in existing link without recreating attachment
bpf_link_create Create new BPF link int prog_fd, int target_fd, enum bpf_attach_type attach_type, const struct bpf_link_create_opts *opts int When you need low-level link control Low-level wrapper around BPF_LINK_CREATE syscall for precise control
bpf_link_detach Detach link by FD int link_fd int When detaching using raw file descriptor Detaches link using its file descriptor directly
bpf_link_get_fd_by_id Get link FD by ID __u32 id int When accessing link with known ID Returns file descriptor for link with specified ID
bpf_link_get_fd_by_id_opts Get link FD by ID with options __u32 id, const struct bpf_get_fd_by_id_opts *opts int When accessing link with options Extended version with additional options like token_fd
bpf_link_get_info_by_fd Get link information int link_fd, struct bpf_link_info *info, __u32 *info_len int When querying link metadata Retrieves link information including type, program ID, and attach information
bpf_link_get_next_id Get next link ID __u32 start_id, __u32 *next_id int For enumerating all links Used by introspection tools to iterate through all links in system
bpf_link_update Update existing link int link_fd, int new_prog_fd, const struct bpf_link_update_opts *opts int When replacing program in link Updates link to use different program, useful for program hot-swapping

3. BPF Map Functions

Function Name Purpose Parameters Return Type When to Use Detailed Explanation
bpf_map__attach_struct_ops Attach struct_ops map const struct bpf_map *map struct bpf_link * When using struct_ops maps Attaches struct_ops map to kernel subsystem, enabling callback function registration
bpf_map__autoattach Check if map auto-attaches const struct bpf_map *map bool When checking map attachment behavior Returns whether map will automatically attach during skeleton attach phase
bpf_map__autocreate Check if map auto-creates const struct bpf_map *map bool When checking map creation behavior Returns whether map will be automatically created during object load
bpf_map__btf_key_type_id Get BTF key type ID const struct bpf_map *map __u32 When working with typed maps Returns BTF type ID for map key, enabling type-aware operations
bpf_map__btf_value_type_id Get BTF value type ID const struct bpf_map *map __u32 When working with typed maps Returns BTF type ID for map value, used for type verification
bpf_map__delete_elem Delete map element const struct bpf_map *map, const void *key, size_t key_sz, __u64 flags int When removing key-value pairs High-level wrapper for deleting map elements with size validation
bpf_map__fd Get map file descriptor const struct bpf_map *map int When you need raw FD for operations Returns underlying file descriptor for direct map operations
bpf_map__get_next_key Get next key in map const struct bpf_map *map, const void *cur_key, void *next_key, size_t key_sz int When iterating through map keys Retrieves next key for map iteration, returns -ENOENT when reaching end
bpf_map__get_pin_path Get map pin path const struct bpf_map *map const char * When checking map persistence Returns filesystem path where map is pinned, NULL if not pinned
bpf_map__ifindex Get map network interface index const struct bpf_map *map __u32 When working with device maps Returns network interface index for device-specific maps
bpf_map__initial_value Get map initial value const struct bpf_map *map, size_t *psize void * When accessing global data Returns pointer to initial data for global variable maps (bss, data, rodata)
bpf_map__inner_map Get inner map template struct bpf_map *map struct bpf_map * When working with map-in-map Returns template map for map-in-map types (array of maps, hash of maps)
bpf_map__is_internal Check if map is internal const struct bpf_map *map bool When filtering map types Returns true for internal maps created by libbpf (global vars, externs)
bpf_map__is_pinned Check if map is pinned const struct bpf_map *map bool When checking map persistence Returns whether map is currently pinned to filesystem
bpf_map__key_size Get map key size const struct bpf_map *map __u32 When validating key sizes Returns size in bytes of map keys
bpf_map__lookup_and_delete_elem Lookup and delete atomically const struct bpf_map *map, const void *key, size_t key_sz, void *value, size_t value_sz, __u64 flags int When implementing queues/stacks Atomically retrieves and removes element, useful for FIFO/LIFO operations
bpf_map__lookup_elem Lookup map element const struct bpf_map *map, const void *key, size_t key_sz, void *value, size_t value_sz, __u64 flags int When reading map values High-level wrapper for map lookups with size validation
bpf_map__map_extra Get map extra parameters const struct bpf_map *map __u64 When accessing map-specific data Returns map-specific extra data (bloom filter hash count, etc.)
bpf_map__map_flags Get map flags const struct bpf_map *map __u32 When checking map properties Returns map creation flags (NO_PREALLOC, NUMA_NODE, etc.)
bpf_map__max_entries Get maximum entries const struct bpf_map *map __u32 When checking map capacity Returns maximum number of entries the map can hold
bpf_map__name Get map name const struct bpf_map *map const char * When identifying maps Returns name of the map as defined in BPF program
bpf_map__numa_node Get NUMA node const struct bpf_map *map __u32 When checking NUMA placement Returns NUMA node where map memory is allocated
bpf_map__pin Pin map to filesystem struct bpf_map *map, const char *path int When persisting maps Pins map to BPF filesystem for persistence beyond process lifetime
bpf_map__pin_path Get pin path const struct bpf_map *map const char * When checking pin location Returns filesystem path where map is pinned
bpf_map__reuse_fd Reuse existing map FD struct bpf_map *map, int fd int When sharing maps between processes Makes map object use existing file descriptor instead of creating new map
bpf_map__set_autoattach Set auto-attach behavior struct bpf_map *map, bool autoattach int When controlling attachment Sets whether map automatically attaches during skeleton attach phase
bpf_map__set_autocreate Set auto-create behavior struct bpf_map *map, bool autocreate int When controlling creation Sets whether map is automatically created during object load
bpf_map__set_ifindex Set network interface index struct bpf_map *map, __u32 ifindex int When binding to specific device Sets network interface for device-specific maps
bpf_map__set_initial_value Set initial map value struct bpf_map *map, const void *data, size_t size int When initializing global data Sets initial data for global variable maps
bpf_map__set_inner_map_fd Set inner map FD struct bpf_map *map, int fd int When configuring map-in-map Sets template map for map-in-map types
bpf_map__set_key_size Set key size struct bpf_map *map, __u32 size int When configuring map before load Sets size of map keys, must be called before object load
bpf_map__set_map_extra Set map extra parameters struct bpf_map *map, __u64 map_extra int When setting map-specific options Sets map-specific extra parameters
bpf_map__set_map_flags Set map flags struct bpf_map *map, __u32 flags int When configuring map behavior Sets map creation flags before load
bpf_map__set_max_entries Set maximum entries struct bpf_map *map, __u32 max_entries int When sizing maps Sets maximum number of entries, must be called before load
bpf_map__set_numa_node Set NUMA node struct bpf_map *map, __u32 numa_node int When optimizing memory placement Sets NUMA node for map memory allocation
bpf_map__set_pin_path Set pin path struct bpf_map *map, const char *path int When configuring persistence Sets filesystem path for map pinning
bpf_map__set_type Set map type struct bpf_map *map, enum bpf_map_type type int When changing map type Changes map type, must be called before object load
bpf_map__set_value_size Set value size struct bpf_map *map, __u32 size int When configuring value size Sets size of map values, can resize global data sections
bpf_map__type Get map type const struct bpf_map *map enum bpf_map_type When checking map type Returns the type of the map (HASH, ARRAY, etc.)
bpf_map__unpin Unpin map from filesystem struct bpf_map *map, const char *path int When removing persistence Removes map from filesystem, decrementing reference count
bpf_map__update_elem Update map element const struct bpf_map *map, const void *key, size_t key_sz, const void *value, size_t value_sz, __u64 flags int When writing to maps High-level wrapper for map updates with size validation
bpf_map__value_size Get value size const struct bpf_map *map __u32 When validating value sizes Returns size in bytes of map values
bpf_map_create Create new map enum bpf_map_type map_type, const char *map_name, __u32 key_size, __u32 value_size, __u32 max_entries, const struct bpf_map_create_opts *opts int When creating maps programmatically Low-level map creation with precise control over all parameters

4. BPF Object Functions

Function Name Purpose Parameters Return Type When to Use Detailed Explanation
bpf_object__attach_skeleton Attach skeleton programs struct bpf_object_skeleton *s int When using skeleton-based loading Attaches all programs in skeleton to their respective hook points
bpf_object__btf Get object’s BTF const struct bpf_object *obj struct btf * When accessing type information Returns BTF object associated with BPF object for type introspection
bpf_object__btf_fd Get BTF file descriptor const struct bpf_object *obj int When you need BTF FD Returns file descriptor of BTF object associated with BPF object
bpf_object__close Close BPF object struct bpf_object *obj void When cleaning up Frees all resources associated with BPF object
bpf_object__destroy_skeleton Destroy skeleton struct bpf_object_skeleton *s void When cleaning up skeleton Frees all skeleton resources including maps, programs, and links
bpf_object__destroy_subskeleton Destroy subskeleton struct bpf_object_subskeleton *s void When cleaning up subskeleton Frees subskeleton resources for partial object access
bpf_object__detach_skeleton Detach skeleton programs struct bpf_object_skeleton *s void When detaching all programs Detaches all programs in skeleton from their hook points
bpf_object__find_map_by_name Find map by name const struct bpf_object *obj, const char *name struct bpf_map * When accessing specific maps Locates map within object by name, returns NULL if not found
bpf_object__find_map_fd_by_name Find map FD by name const struct bpf_object *obj, const char *name int When you need map FD directly Returns file descriptor of named map, -1 if not found
bpf_object__find_program_by_name Find program by name const struct bpf_object *obj, const char *name struct bpf_program * When accessing specific programs Locates program within object by name
bpf_object__gen_loader Generate loader program struct bpf_object *obj, struct gen_loader_opts *opts int When creating loader programs Generates BPF program that can load the object at runtime
bpf_object__kversion Get kernel version const struct bpf_object *obj unsigned int When checking version requirements Returns kernel version the object was compiled for
bpf_object__load Load object into kernel struct bpf_object *obj int When loading all programs and maps Loads all programs and maps in object into kernel
bpf_object__load_skeleton Load skeleton struct bpf_object_skeleton *s int When using skeleton loading Loads all skeleton components into kernel
bpf_object__name Get object name const struct bpf_object *obj const char * When identifying objects Returns name of the BPF object
bpf_object__next_map Get next map const struct bpf_object *obj, const struct bpf_map *map struct bpf_map * When iterating through maps Iterates through all maps in object, NULL to start
bpf_object__next_program Get next program const struct bpf_object *obj, struct bpf_program *prog struct bpf_program * When iterating through programs Iterates through all programs in object, NULL to start
bpf_object__open Open BPF object file const char *path struct bpf_object * When loading from ELF file Opens and parses BPF ELF object file
bpf_object__open_file Open with options const char *path, const struct bpf_object_open_opts *opts struct bpf_object * When you need open options Extended open with options like BTF custom path
bpf_object__open_mem Open from memory const void *obj_buf, size_t obj_buf_sz, const struct bpf_object_open_opts *opts struct bpf_object * When loading from memory buffer Opens BPF object from memory buffer instead of file
bpf_object__open_skeleton Open skeleton struct bpf_object_skeleton *s, const struct bpf_object_open_opts *opts int When using skeleton loading Opens skeleton object with specified options
bpf_object__open_subskeleton Open subskeleton struct bpf_object_subskeleton *s int When accessing partial object Opens subskeleton for accessing subset of object components
bpf_object__pin Pin entire object struct bpf_object *object, const char *path int When persisting entire object Pins all maps and programs in object to filesystem directory
bpf_object__pin_maps Pin all maps struct bpf_object *obj, const char *path int When persisting maps only Pins all maps in object to specified directory

5. BPF Program Functions

| --- | --- | --- | --- | --- | --- |

6. Ring Buffer Functions

| --- | --- | --- | --- | --- | --- |

7. Performance Buffer Functions

| --- | --- | --- | --- | --- | --- |

8. Utility Functions

| --- | --- | --- | --- | --- | --- |

9. BPF Linker Functions

| --- | --- | --- | --- | --- | --- |

10. Low-Level BPF System Call Wrappers

| --- | --- | --- | --- | --- | --- |