package libbpf

  1. Overview
  2. Docs

Module C_function_description.FunctionsSource

Parameters

module F : Ctypes.FOREIGN

Signature

Sourceval libbpf_major_version : (unit -> Unsigned.uint32 F.return) F.result
Sourceval libbpf_minor_version : (unit -> Unsigned.uint32 F.return) F.result
Sourceval libbpf_version_string : (unit -> string F.return) F.result
Sourceval libbpf_strerror : (int -> char Ctypes_static.ptr -> Unsigned.size_t -> int F.return) F.result
Sourceval libbpf_bpf_attach_type_str : (Types.Bpf_attach_type.t -> string F.return) F.result
Sourceval libbpf_bpf_map_type_str : (Types.Bpf_map_type.t -> string F.return) F.result
Sourceval libbpf_bpf_prog_type_str : (Types.Bpf_prog_type.t -> string F.return) F.result
Sourceval libbpf_set_print : (([ `DEBUG | `INFO | `UNEXPECTED | `WARN ] -> string -> int) Ctypes_static.static_funptr -> ([ `DEBUG | `INFO | `UNEXPECTED | `WARN ] -> string -> int) Ctypes_static.static_funptr F.return) F.result

bpf_object__open path creates a bpf_object by opening the BPF ELF object file pointed to by the passed path and loading it into memory.

Returns pointer to the new bpf_object; or NULL is returned on error, error code is stored in errno.

bpf_object__load obj_ptr loads the BPF object into the kernel. obj_ptr must be a valid BPF object instance returned by a successful call to bpf_object__open.

Returns 0, on success; negative error code, otherwise, error code is stored in errno

bpf_object__find_program_by_name name returns the BPF program of the given name, if it exists within the passed BPF object

Returns the pointer to the BPF program instance, if such program exists within the BPF object; or NULL otherwise.

bpf_object__next_program obj_ptr prog_ptr returns the next program after prog_ptr found in the passed BPF object

bpf_program__pin prog path pins the BPF program to a file in the BPF FS specified by a path. This increments the programs reference count, allowing it to stay loaded after the process which loaded it has exited.

  • parameter prog

    BPF program to pin, must already be loaded

  • parameter path

    file path in a BPF file system

  • returns

    0, on success; negative error code, otherwise

bpf_program__unpin prog path unpins the BPF program from a file in the BPFFS specified by a path. This decrements the programs reference count. The file pinning the BPF program can also be unlinked by a different process in which case this function will return an error.

  • parameter prog

    BPF program to unpin

  • parameter path

    file path to the pin in a BPF file system

  • returns

    0, on success; negative error code, otherwise

bpf_program__attach prog is a generic function for attaching a BPF program based on auto-detection of program type, attach type, and extra paremeters, where applicable.

This is supported for:

  • kprobe/kretprobe (depends on SEC() definition)
  • uprobe/uretprobe (depends on SEC() definition)
  • tracepoint
  • raw tracepoint
  • tracing programs (typed raw TP/fentry/fexit/fmod_ret)

Returns pointer to the newly created BPF link; or NULL is returned on error, error code is stored in errno

bpf_link__pin link path pins the BPF link to a file in the BPF FS specified by a path. This increments the links reference count, allowing it to stay loaded after the process which loaded it has exited.

  • parameter link

    BPF link to pin, must already be loaded

  • parameter path

    file path in a BPF file system

  • returns

    0, on success; negative error code, otherwise

bpf_link__unpin link path unpins the BPF link from a file in the BPFFS specified by a path. This decrements the links reference count. The file pinning the BPF link can also be unlinked by a different process in which case this function will return an error.

  • parameter prog

    BPF program to unpin

  • parameter path

    file path to the pin in a BPF file system

  • returns

    0, on success; negative error code, otherwise

bpf_link__destroy link_ptr Removes the link to the BPF program. Returns 0 on success or -errno

bpf_object__close obj_ptr closes a BPF object and releases all resources.

bpf_object__find_map_by_name obj_ptr name returns BPF map of the given name, if it exists within the passed BPF object.

Returns the pointer to the BPF map instance, if such map exists within the BPF object; or NULL otherwise.

bpf_map__fd map_ptr gets the file descriptor of the passed BPF map

Returns the file descriptor; or -EINVAL in case of an error

Sourceval bpf_map__lookup_elem : (Types.bpf_map Ctypes.structure Ctypes_static.ptr -> unit Ctypes_static.ptr -> Unsigned.size_t -> unit Ctypes_static.ptr -> Unsigned.size_t -> Unsigned.uint64 -> int F.return) F.result

bpf_map__lookup_elem map_ptr key_ptr key_sz val_ptr val_sz flags allows to lookup BPF map value corresponding to provided key.

bpf_map__lookup_elem is high-level equivalent of bpf_map_lookup_elem API with added check for key and value size.

sizes are in bytes of key and value data. For per-CPU BPF maps value size has to be a product of BPF map value size and number of possible CPUs in the system (could be fetched with libbpf_num_possible_cpus()). Note also that for per-CPU values value size has to be aligned up to closest 8 bytes for alignment reasons, so expected size is: round_up(value_size, 8)

Returns 0, on success; negative error, otherwise

Sourceval bpf_map__update_elem : (Types.bpf_map Ctypes.structure Ctypes_static.ptr -> unit Ctypes_static.ptr -> Unsigned.size_t -> unit Ctypes_static.ptr -> Unsigned.size_t -> Unsigned.uint64 -> int F.return) F.result

bpf_map__update_elem map_ptr key_ptr key_sz val_ptr val_sz flags allows to insert or update value in BPF map that corresponds to provided key.

bpf_map__update_elem is high-level equivalent of bpf_map_update_elem API with added check for key and value size.

Check bpf_map__lookup_elem for details on sizes. Returns 0, on success; negative error, otherwise

Sourceval bpf_map__delete_elem : (Types.bpf_map Ctypes.structure Ctypes_static.ptr -> unit Ctypes_static.ptr -> Unsigned.size_t -> Unsigned.uint64 -> int F.return) F.result

bpf_map__delete_elem map_ptr key_ptr key_sz flags allows to delete element in BPF map that corresponds to provided key.

bpf_map__delete_elem is high-level equivalent of bpf_map_delete_elem API with added check for key size.

Returns 0, on success; negative error, otherwise

Sourceval bpf_tc_hook_create : ([ `Hook ] Ctypes.structure Ctypes_static.ptr -> int F.return) F.result
Sourceval bpf_tc_hook_destroy : ([ `Hook ] Ctypes.structure Ctypes_static.ptr -> int F.return) F.result
Sourceval ring_buffer__new : (int -> (unit Ctypes.ptr -> unit Ctypes.ptr -> Unsigned.size_t -> int) Ctypes_static.static_funptr -> unit Ctypes_static.ptr -> [ `Ring_buffer_opts ] Ctypes.structure Ctypes_static.ptr -> [ `Ring_buffer ] Ctypes.structure Ctypes_static.ptr option F.return) F.result

ring_buffer__new map_fd fn ctx_ptr opts loads the callback function fn into the ring buffer map provided by the file descriptor map_fd. ctx_ptr allows the callback function to access user provided context.

Returns pointer to the ring_buffer manager instance or NULL otherwise

Sourceval ring_buffer__poll : ([ `Ring_buffer ] Ctypes.structure Ctypes_static.ptr -> int -> int F.return) F.result

ring_buffer__poll ring_buf_ptr timeout poll for available data and consume records, if any are available.

Returns number of records consumed (or INT_MAX, whichever is less), or negative number, if any of the registered callbacks returned error.

Sourceval ring_buffer__free : ([ `Ring_buffer ] Ctypes.structure Ctypes_static.ptr -> unit F.return) F.result

ring_buffer__free ring_buf_ptr Frees resources of the ring buffer manager

Sourceval ring_buffer__consume : ([ `Ring_buffer ] Ctypes.structure Ctypes_static.ptr -> int F.return) F.result

ring_buffer__consume ring_buf_ptr Consume available ring buffer(s) data without event polling.

Returns number of records consumed across all registered ring buffers (or INT_MAX, whichever is less), or negative number if any of the callbacks return error.

Sourceval ring_buffer__epoll_fd : ([ `Ring_buffer ] Ctypes.structure Ctypes_static.ptr -> int F.return) F.result

ring_buffer__epoll_fd ring_buf_ptr Gets an fd that can be used to sleep until data is available in the ring(s)