1 .\" Man page generated from reStructuredText.
3 .TH BPF-HELPERS 7 "" "" ""
5 BPF-HELPERS \- list of eBPF helper functions
7 .nr rst2man-indent-level 0
11 level \\n[rst2man-indent-level]
12 level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
19 .\" .rstReportMargin pre:
21 . nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
22 . nr rst2man-indent-level +1
23 .\" .rstReportMargin post:
27 .\" indent \\n[an-margin]
28 .\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
29 .nr rst2man-indent-level -1
30 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
31 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
33 .\" Copyright (C) All BPF authors and contributors from 2014 to present.
34 .\" See git log include/uapi/linux/bpf.h in kernel tree for details.
36 .\" %%%LICENSE_START(VERBATIM)
37 .\" Permission is granted to make and distribute verbatim copies of this
38 .\" manual provided the copyright notice and this permission notice are
39 .\" preserved on all copies.
41 .\" Permission is granted to copy and distribute modified versions of this
42 .\" manual under the conditions for verbatim copying, provided that the
43 .\" entire resulting derived work is distributed under the terms of a
44 .\" permission notice identical to this one.
46 .\" Since the Linux kernel and libraries are constantly changing, this
47 .\" manual page may be incorrect or out-of-date. The author(s) assume no
48 .\" responsibility for errors or omissions, or for damages resulting from
49 .\" the use of the information contained herein. The author(s) may not
50 .\" have taken the same level of care in the production of this manual,
51 .\" which is licensed free of charge, as they might when working
54 .\" Formatted or processed versions of this manual, if unaccompanied by
55 .\" the source, must acknowledge the copyright and authors of this work.
58 .\" Please do not edit this file. It was generated from the documentation
59 .\" located in file include/uapi/linux/bpf.h of the Linux kernel sources
60 .\" (helpers description), and from scripts/bpf_helpers_doc.py in the same
61 .\" repository (header and footer).
65 The extended Berkeley Packet Filter (eBPF) subsystem consists in programs
66 written in a pseudo\-assembly language, then attached to one of the several
67 kernel hooks and run in reaction of specific events. This framework differs
68 from the older, "classic" BPF (or "cBPF") in several aspects, one of them being
69 the ability to call special functions (or "helpers") from within a program.
70 These functions are restricted to a white\-list of helpers defined in the
73 These helpers are used by eBPF programs to interact with the system, or with
74 the context in which they work. For instance, they can be used to print
75 debugging messages, to get the time since the system was booted, to interact
76 with eBPF maps, or to manipulate network packets. Since there are several eBPF
77 program types, and that they do not run in the same context, each program type
78 can only call a subset of those helpers.
80 Due to eBPF conventions, a helper can not have more than five arguments.
82 Internally, eBPF programs call directly into the compiled helper functions
83 without requiring any foreign\-function interface. As a result, calling helpers
84 introduces no overhead, thus offering excellent performance.
86 This document is an attempt to list and document the helpers available to eBPF
87 developers. They are sorted by chronological order (the oldest helpers in the
92 .B \fBvoid *bpf_map_lookup_elem(struct bpf_map *\fP\fImap\fP\fB, const void *\fP\fIkey\fP\fB)\fP
96 Perform a lookup in \fImap\fP for an entry associated to \fIkey\fP\&.
99 Map value associated to \fIkey\fP, or \fBNULL\fP if no entry was
103 .B \fBint bpf_map_update_elem(struct bpf_map *\fP\fImap\fP\fB, const void *\fP\fIkey\fP\fB, const void *\fP\fIvalue\fP\fB, u64\fP \fIflags\fP\fB)\fP
107 Add or update the value of the entry associated to \fIkey\fP in
108 \fImap\fP with \fIvalue\fP\&. \fIflags\fP is one of:
112 The entry for \fIkey\fP must not exist in the map.
115 The entry for \fIkey\fP must already exist in the map.
118 No condition on the existence of the entry for \fIkey\fP\&.
121 Flag value \fBBPF_NOEXIST\fP cannot be used for maps of types
122 \fBBPF_MAP_TYPE_ARRAY\fP or \fBBPF_MAP_TYPE_PERCPU_ARRAY\fP (all
123 elements always exist), the helper would return an error.
126 0 on success, or a negative error in case of failure.
129 .B \fBint bpf_map_delete_elem(struct bpf_map *\fP\fImap\fP\fB, const void *\fP\fIkey\fP\fB)\fP
133 Delete entry with \fIkey\fP from \fImap\fP\&.
136 0 on success, or a negative error in case of failure.
139 .B \fBint bpf_probe_read(void *\fP\fIdst\fP\fB, u32\fP \fIsize\fP\fB, const void *\fP\fIunsafe_ptr\fP\fB)\fP
143 For tracing programs, safely attempt to read \fIsize\fP bytes from
144 kernel space address \fIunsafe_ptr\fP and store the data in \fIdst\fP\&.
146 Generally, use bpf_probe_read_user() or bpf_probe_read_kernel()
150 0 on success, or a negative error in case of failure.
153 .B \fBu64 bpf_ktime_get_ns(void)\fP
157 Return the time elapsed since system boot, in nanoseconds.
160 Current \fIktime\fP\&.
163 .B \fBint bpf_trace_printk(const char *\fP\fIfmt\fP\fB, u32\fP \fIfmt_size\fP\fB, ...)\fP
167 This helper is a "printk()\-like" facility for debugging. It
168 prints a message defined by format \fIfmt\fP (of size \fIfmt_size\fP)
169 to file \fI/sys/kernel/debug/tracing/trace\fP from DebugFS, if
170 available. It can take up to three additional \fBu64\fP
171 arguments (as an eBPF helpers, the total number of arguments is
174 Each time the helper is called, it appends a line to the trace.
175 Lines are discarded while \fI/sys/kernel/debug/tracing/trace\fP is
176 open, use \fI/sys/kernel/debug/tracing/trace_pipe\fP to avoid this.
177 The format of the trace is customizable, and the exact output
178 one will get depends on the options set in
179 \fI/sys/kernel/debug/tracing/trace_options\fP (see also the
180 \fIREADME\fP file under the same directory). However, it usually
181 defaults to something like:
187 telnet\-470 [001] .N.. 419421.045894: 0x00000001: <formatted msg>
198 \fBtelnet\fP is the name of the current task.
200 \fB470\fP is the PID of the current task.
202 \fB001\fP is the CPU number on which the task is
205 In \fB\&.N..\fP, each character refers to a set of
206 options (whether irqs are enabled, scheduling
207 options, whether hard/softirqs are running, level of
208 preempt_disabled respectively). \fBN\fP means that
209 \fBTIF_NEED_RESCHED\fP and \fBPREEMPT_NEED_RESCHED\fP
212 \fB419421.045894\fP is a timestamp.
214 \fB0x00000001\fP is a fake value used by BPF for the
215 instruction pointer register.
217 \fB<formatted msg>\fP is the message formatted with
223 The conversion specifiers supported by \fIfmt\fP are similar, but
224 more limited than for printk(). They are \fB%d\fP, \fB%i\fP,
225 \fB%u\fP, \fB%x\fP, \fB%ld\fP, \fB%li\fP, \fB%lu\fP, \fB%lx\fP, \fB%lld\fP,
226 \fB%lli\fP, \fB%llu\fP, \fB%llx\fP, \fB%p\fP, \fB%s\fP\&. No modifier (size
227 of field, padding with zeroes, etc.) is available, and the
228 helper will return \fB\-EINVAL\fP (but print nothing) if it
229 encounters an unknown specifier.
231 Also, note that \fBbpf_trace_printk\fP() is slow, and should
232 only be used for debugging purposes. For this reason, a notice
233 bloc (spanning several lines) is printed to kernel logs and
234 states that the helper should not be used "for production use"
235 the first time this helper is used (or more precisely, when
236 \fBtrace_printk\fP() buffers are allocated). For passing values
237 to user space, perf events should be preferred.
240 The number of bytes written to the buffer, or a negative error
244 .B \fBu32 bpf_get_prandom_u32(void)\fP
248 Get a pseudo\-random number.
250 From a security point of view, this helper uses its own
251 pseudo\-random internal state, and cannot be used to infer the
252 seed of other random functions in the kernel. However, it is
253 essential to note that the generator used by the helper is not
254 cryptographically secure.
257 A random 32\-bit unsigned value.
260 .B \fBu32 bpf_get_smp_processor_id(void)\fP
264 Get the SMP (symmetric multiprocessing) processor id. Note that
265 all programs run with preemption disabled, which means that the
266 SMP processor id is stable during all the execution of the
270 The SMP id of the processor running the program.
273 .B \fBint bpf_skb_store_bytes(struct sk_buff *\fP\fIskb\fP\fB, u32\fP \fIoffset\fP\fB, const void *\fP\fIfrom\fP\fB, u32\fP \fIlen\fP\fB, u64\fP \fIflags\fP\fB)\fP
277 Store \fIlen\fP bytes from address \fIfrom\fP into the packet
278 associated to \fIskb\fP, at \fIoffset\fP\&. \fIflags\fP are a combination of
279 \fBBPF_F_RECOMPUTE_CSUM\fP (automatically recompute the
280 checksum for the packet after storing the bytes) and
281 \fBBPF_F_INVALIDATE_HASH\fP (set \fIskb\fP\fB\->hash\fP, \fIskb\fP\fB\->swhash\fP and \fIskb\fP\fB\->l4hash\fP to 0).
283 A call to this helper is susceptible to change the underlying
284 packet buffer. Therefore, at load time, all checks on pointers
285 previously done by the verifier are invalidated and must be
286 performed again, if the helper is used in combination with
287 direct packet access.
290 0 on success, or a negative error in case of failure.
293 .B \fBint bpf_l3_csum_replace(struct sk_buff *\fP\fIskb\fP\fB, u32\fP \fIoffset\fP\fB, u64\fP \fIfrom\fP\fB, u64\fP \fIto\fP\fB, u64\fP \fIsize\fP\fB)\fP
297 Recompute the layer 3 (e.g. IP) checksum for the packet
298 associated to \fIskb\fP\&. Computation is incremental, so the helper
299 must know the former value of the header field that was
300 modified (\fIfrom\fP), the new value of this field (\fIto\fP), and the
301 number of bytes (2 or 4) for this field, stored in \fIsize\fP\&.
302 Alternatively, it is possible to store the difference between
303 the previous and the new values of the header field in \fIto\fP, by
304 setting \fIfrom\fP and \fIsize\fP to 0. For both methods, \fIoffset\fP
305 indicates the location of the IP checksum within the packet.
307 This helper works in combination with \fBbpf_csum_diff\fP(),
308 which does not update the checksum in\-place, but offers more
309 flexibility and can handle sizes larger than 2 or 4 for the
312 A call to this helper is susceptible to change the underlying
313 packet buffer. Therefore, at load time, all checks on pointers
314 previously done by the verifier are invalidated and must be
315 performed again, if the helper is used in combination with
316 direct packet access.
319 0 on success, or a negative error in case of failure.
322 .B \fBint bpf_l4_csum_replace(struct sk_buff *\fP\fIskb\fP\fB, u32\fP \fIoffset\fP\fB, u64\fP \fIfrom\fP\fB, u64\fP \fIto\fP\fB, u64\fP \fIflags\fP\fB)\fP
326 Recompute the layer 4 (e.g. TCP, UDP or ICMP) checksum for the
327 packet associated to \fIskb\fP\&. Computation is incremental, so the
328 helper must know the former value of the header field that was
329 modified (\fIfrom\fP), the new value of this field (\fIto\fP), and the
330 number of bytes (2 or 4) for this field, stored on the lowest
331 four bits of \fIflags\fP\&. Alternatively, it is possible to store
332 the difference between the previous and the new values of the
333 header field in \fIto\fP, by setting \fIfrom\fP and the four lowest
334 bits of \fIflags\fP to 0. For both methods, \fIoffset\fP indicates the
335 location of the IP checksum within the packet. In addition to
336 the size of the field, \fIflags\fP can be added (bitwise OR) actual
337 flags. With \fBBPF_F_MARK_MANGLED_0\fP, a null checksum is left
338 untouched (unless \fBBPF_F_MARK_ENFORCE\fP is added as well), and
339 for updates resulting in a null checksum the value is set to
340 \fBCSUM_MANGLED_0\fP instead. Flag \fBBPF_F_PSEUDO_HDR\fP indicates
341 the checksum is to be computed against a pseudo\-header.
343 This helper works in combination with \fBbpf_csum_diff\fP(),
344 which does not update the checksum in\-place, but offers more
345 flexibility and can handle sizes larger than 2 or 4 for the
348 A call to this helper is susceptible to change the underlying
349 packet buffer. Therefore, at load time, all checks on pointers
350 previously done by the verifier are invalidated and must be
351 performed again, if the helper is used in combination with
352 direct packet access.
355 0 on success, or a negative error in case of failure.
358 .B \fBint bpf_tail_call(void *\fP\fIctx\fP\fB, struct bpf_map *\fP\fIprog_array_map\fP\fB, u32\fP \fIindex\fP\fB)\fP
362 This special helper is used to trigger a "tail call", or in
363 other words, to jump into another eBPF program. The same stack
364 frame is used (but values on stack and in registers for the
365 caller are not accessible to the callee). This mechanism allows
366 for program chaining, either for raising the maximum number of
367 available eBPF instructions, or to execute given programs in
368 conditional blocks. For security reasons, there is an upper
369 limit to the number of successive tail calls that can be
372 Upon call of this helper, the program attempts to jump into a
373 program referenced at index \fIindex\fP in \fIprog_array_map\fP, a
374 special map of type \fBBPF_MAP_TYPE_PROG_ARRAY\fP, and passes
375 \fIctx\fP, a pointer to the context.
377 If the call succeeds, the kernel immediately runs the first
378 instruction of the new program. This is not a function call,
379 and it never returns to the previous program. If the call
380 fails, then the helper has no effect, and the caller continues
381 to run its subsequent instructions. A call can fail if the
382 destination program for the jump does not exist (i.e. \fIindex\fP
383 is superior to the number of entries in \fIprog_array_map\fP), or
384 if the maximum number of tail calls has been reached for this
385 chain of programs. This limit is defined in the kernel by the
386 macro \fBMAX_TAIL_CALL_CNT\fP (not accessible to user space),
387 which is currently set to 32.
390 0 on success, or a negative error in case of failure.
393 .B \fBint bpf_clone_redirect(struct sk_buff *\fP\fIskb\fP\fB, u32\fP \fIifindex\fP\fB, u64\fP \fIflags\fP\fB)\fP
397 Clone and redirect the packet associated to \fIskb\fP to another
398 net device of index \fIifindex\fP\&. Both ingress and egress
399 interfaces can be used for redirection. The \fBBPF_F_INGRESS\fP
400 value in \fIflags\fP is used to make the distinction (ingress path
401 is selected if the flag is present, egress path otherwise).
402 This is the only flag supported for now.
404 In comparison with \fBbpf_redirect\fP() helper,
405 \fBbpf_clone_redirect\fP() has the associated cost of
406 duplicating the packet buffer, but this can be executed out of
407 the eBPF program. Conversely, \fBbpf_redirect\fP() is more
408 efficient, but it is handled through an action code where the
409 redirection happens only after the eBPF program has returned.
411 A call to this helper is susceptible to change the underlying
412 packet buffer. Therefore, at load time, all checks on pointers
413 previously done by the verifier are invalidated and must be
414 performed again, if the helper is used in combination with
415 direct packet access.
418 0 on success, or a negative error in case of failure.
421 .B \fBu64 bpf_get_current_pid_tgid(void)\fP
425 A 64\-bit integer containing the current tgid and pid, and
427 \fIcurrent_task\fP\fB\->tgid << 32 |\fP
428 \fIcurrent_task\fP\fB\->pid\fP\&.
431 .B \fBu64 bpf_get_current_uid_gid(void)\fP
435 A 64\-bit integer containing the current GID and UID, and
436 created as such: \fIcurrent_gid\fP \fB<< 32 |\fP \fIcurrent_uid\fP\&.
439 .B \fBint bpf_get_current_comm(void *\fP\fIbuf\fP\fB, u32\fP \fIsize_of_buf\fP\fB)\fP
443 Copy the \fBcomm\fP attribute of the current task into \fIbuf\fP of
444 \fIsize_of_buf\fP\&. The \fBcomm\fP attribute contains the name of
445 the executable (excluding the path) for the current task. The
446 \fIsize_of_buf\fP must be strictly positive. On success, the
447 helper makes sure that the \fIbuf\fP is NUL\-terminated. On failure,
448 it is filled with zeroes.
451 0 on success, or a negative error in case of failure.
454 .B \fBu32 bpf_get_cgroup_classid(struct sk_buff *\fP\fIskb\fP\fB)\fP
458 Retrieve the classid for the current task, i.e. for the net_cls
459 cgroup to which \fIskb\fP belongs.
461 This helper can be used on TC egress path, but not on ingress.
463 The net_cls cgroup provides an interface to tag network packets
464 based on a user\-provided identifier for all traffic coming from
465 the tasks belonging to the related cgroup. See also the related
466 kernel documentation, available from the Linux sources in file
467 \fIDocumentation/admin\-guide/cgroup\-v1/net_cls.rst\fP\&.
469 The Linux kernel has two versions for cgroups: there are
470 cgroups v1 and cgroups v2. Both are available to users, who can
471 use a mixture of them, but note that the net_cls cgroup is for
472 cgroup v1 only. This makes it incompatible with BPF programs
473 run on cgroups, which is a cgroup\-v2\-only feature (a socket can
474 only hold data for one version of cgroups at a time).
476 This helper is only available is the kernel was compiled with
477 the \fBCONFIG_CGROUP_NET_CLASSID\fP configuration option set to
478 "\fBy\fP" or to "\fBm\fP".
481 The classid, or 0 for the default unconfigured classid.
484 .B \fBint bpf_skb_vlan_push(struct sk_buff *\fP\fIskb\fP\fB, __be16\fP \fIvlan_proto\fP\fB, u16\fP \fIvlan_tci\fP\fB)\fP
488 Push a \fIvlan_tci\fP (VLAN tag control information) of protocol
489 \fIvlan_proto\fP to the packet associated to \fIskb\fP, then update
490 the checksum. Note that if \fIvlan_proto\fP is different from
491 \fBETH_P_8021Q\fP and \fBETH_P_8021AD\fP, it is considered to
492 be \fBETH_P_8021Q\fP\&.
494 A call to this helper is susceptible to change the underlying
495 packet buffer. Therefore, at load time, all checks on pointers
496 previously done by the verifier are invalidated and must be
497 performed again, if the helper is used in combination with
498 direct packet access.
501 0 on success, or a negative error in case of failure.
504 .B \fBint bpf_skb_vlan_pop(struct sk_buff *\fP\fIskb\fP\fB)\fP
508 Pop a VLAN header from the packet associated to \fIskb\fP\&.
510 A call to this helper is susceptible to change the underlying
511 packet buffer. Therefore, at load time, all checks on pointers
512 previously done by the verifier are invalidated and must be
513 performed again, if the helper is used in combination with
514 direct packet access.
517 0 on success, or a negative error in case of failure.
520 .B \fBint bpf_skb_get_tunnel_key(struct sk_buff *\fP\fIskb\fP\fB, struct bpf_tunnel_key *\fP\fIkey\fP\fB, u32\fP \fIsize\fP\fB, u64\fP \fIflags\fP\fB)\fP
524 Get tunnel metadata. This helper takes a pointer \fIkey\fP to an
525 empty \fBstruct bpf_tunnel_key\fP of \fBsize\fP, that will be
526 filled with tunnel metadata for the packet associated to \fIskb\fP\&.
527 The \fIflags\fP can be set to \fBBPF_F_TUNINFO_IPV6\fP, which
528 indicates that the tunnel is based on IPv6 protocol instead of
531 The \fBstruct bpf_tunnel_key\fP is an object that generalizes the
532 principal parameters used by various tunneling protocols into a
533 single struct. This way, it can be used to easily make a
534 decision based on the contents of the encapsulation header,
535 "summarized" in this struct. In particular, it holds the IP
536 address of the remote end (IPv4 or IPv6, depending on the case)
537 in \fIkey\fP\fB\->remote_ipv4\fP or \fIkey\fP\fB\->remote_ipv6\fP\&. Also,
538 this struct exposes the \fIkey\fP\fB\->tunnel_id\fP, which is
539 generally mapped to a VNI (Virtual Network Identifier), making
540 it programmable together with the \fBbpf_skb_set_tunnel_key\fP() helper.
542 Let\(aqs imagine that the following code is part of a program
543 attached to the TC ingress interface, on one end of a GRE
544 tunnel, and is supposed to filter out all messages coming from
545 remote ends with IPv4 address other than 10.0.0.1:
552 struct bpf_tunnel_key key = {};
554 ret = bpf_skb_get_tunnel_key(skb, &key, sizeof(key), 0);
556 return TC_ACT_SHOT; // drop packet
558 if (key.remote_ipv4 != 0x0a000001)
559 return TC_ACT_SHOT; // drop packet
561 return TC_ACT_OK; // accept packet
567 This interface can also be used with all encapsulation devices
568 that can operate in "collect metadata" mode: instead of having
569 one network device per specific configuration, the "collect
570 metadata" mode only requires a single device where the
571 configuration can be extracted from this helper.
573 This can be used together with various tunnels such as VXLan,
574 Geneve, GRE or IP in IP (IPIP).
577 0 on success, or a negative error in case of failure.
580 .B \fBint bpf_skb_set_tunnel_key(struct sk_buff *\fP\fIskb\fP\fB, struct bpf_tunnel_key *\fP\fIkey\fP\fB, u32\fP \fIsize\fP\fB, u64\fP \fIflags\fP\fB)\fP
584 Populate tunnel metadata for packet associated to \fIskb.\fP The
585 tunnel metadata is set to the contents of \fIkey\fP, of \fIsize\fP\&. The
586 \fIflags\fP can be set to a combination of the following values:
589 .B \fBBPF_F_TUNINFO_IPV6\fP
590 Indicate that the tunnel is based on IPv6 protocol
593 .B \fBBPF_F_ZERO_CSUM_TX\fP
594 For IPv4 packets, add a flag to tunnel metadata
595 indicating that checksum computation should be skipped
596 and checksum set to zeroes.
598 .B \fBBPF_F_DONT_FRAGMENT\fP
599 Add a flag to tunnel metadata indicating that the
600 packet should not be fragmented.
602 .B \fBBPF_F_SEQ_NUMBER\fP
603 Add a flag to tunnel metadata indicating that a
604 sequence number should be added to tunnel header before
605 sending the packet. This flag was added for GRE
606 encapsulation, but might be used with other protocols
607 as well in the future.
610 Here is a typical usage on the transmit path:
616 struct bpf_tunnel_key key;
618 bpf_skb_set_tunnel_key(skb, &key, sizeof(key), 0);
619 bpf_clone_redirect(skb, vxlan_dev_ifindex, 0);
625 See also the description of the \fBbpf_skb_get_tunnel_key\fP()
626 helper for additional information.
629 0 on success, or a negative error in case of failure.
632 .B \fBu64 bpf_perf_event_read(struct bpf_map *\fP\fImap\fP\fB, u64\fP \fIflags\fP\fB)\fP
636 Read the value of a perf event counter. This helper relies on a
637 \fImap\fP of type \fBBPF_MAP_TYPE_PERF_EVENT_ARRAY\fP\&. The nature of
638 the perf event counter is selected when \fImap\fP is updated with
639 perf event file descriptors. The \fImap\fP is an array whose size
640 is the number of available CPUs, and each cell contains a value
641 relative to one CPU. The value to retrieve is indicated by
642 \fIflags\fP, that contains the index of the CPU to look up, masked
643 with \fBBPF_F_INDEX_MASK\fP\&. Alternatively, \fIflags\fP can be set to
644 \fBBPF_F_CURRENT_CPU\fP to indicate that the value for the
645 current CPU should be retrieved.
647 Note that before Linux 4.13, only hardware perf event can be
650 Also, be aware that the newer helper
651 \fBbpf_perf_event_read_value\fP() is recommended over
652 \fBbpf_perf_event_read\fP() in general. The latter has some ABI
653 quirks where error and counter value are used as a return code
654 (which is wrong to do since ranges may overlap). This issue is
655 fixed with \fBbpf_perf_event_read_value\fP(), which at the same
656 time provides more features over the \fBbpf_perf_event_read\fP() interface. Please refer to the description of
657 \fBbpf_perf_event_read_value\fP() for details.
660 The value of the perf event counter read from the map, or a
661 negative error code in case of failure.
664 .B \fBint bpf_redirect(u32\fP \fIifindex\fP\fB, u64\fP \fIflags\fP\fB)\fP
668 Redirect the packet to another net device of index \fIifindex\fP\&.
669 This helper is somewhat similar to \fBbpf_clone_redirect\fP(), except that the packet is not cloned, which provides
670 increased performance.
672 Except for XDP, both ingress and egress interfaces can be used
673 for redirection. The \fBBPF_F_INGRESS\fP value in \fIflags\fP is used
674 to make the distinction (ingress path is selected if the flag
675 is present, egress path otherwise). Currently, XDP only
676 supports redirection to the egress interface, and accepts no
679 The same effect can also be attained with the more generic
680 \fBbpf_redirect_map\fP(), which uses a BPF map to store the
681 redirect target instead of providing it directly to the helper.
684 For XDP, the helper returns \fBXDP_REDIRECT\fP on success or
685 \fBXDP_ABORTED\fP on error. For other program types, the values
686 are \fBTC_ACT_REDIRECT\fP on success or \fBTC_ACT_SHOT\fP on
690 .B \fBu32 bpf_get_route_realm(struct sk_buff *\fP\fIskb\fP\fB)\fP
694 Retrieve the realm or the route, that is to say the
695 \fBtclassid\fP field of the destination for the \fIskb\fP\&. The
696 indentifier retrieved is a user\-provided tag, similar to the
697 one used with the net_cls cgroup (see description for
698 \fBbpf_get_cgroup_classid\fP() helper), but here this tag is
699 held by a route (a destination entry), not by a task.
701 Retrieving this identifier works with the clsact TC egress hook
702 (see also \fBtc\-bpf(8)\fP), or alternatively on conventional
703 classful egress qdiscs, but not on TC ingress path. In case of
704 clsact TC egress hook, this has the advantage that, internally,
705 the destination entry has not been dropped yet in the transmit
706 path. Therefore, the destination entry does not need to be
707 artificially held via \fBnetif_keep_dst\fP() for a classful
708 qdisc until the \fIskb\fP is freed.
710 This helper is available only if the kernel was compiled with
711 \fBCONFIG_IP_ROUTE_CLASSID\fP configuration option.
714 The realm of the route for the packet associated to \fIskb\fP, or 0
718 .B \fBint bpf_perf_event_output(void *\fP\fIctx\fP\fB, struct bpf_map *\fP\fImap\fP\fB, u64\fP \fIflags\fP\fB, void *\fP\fIdata\fP\fB, u64\fP \fIsize\fP\fB)\fP
722 Write raw \fIdata\fP blob into a special BPF perf event held by
723 \fImap\fP of type \fBBPF_MAP_TYPE_PERF_EVENT_ARRAY\fP\&. This perf
724 event must have the following attributes: \fBPERF_SAMPLE_RAW\fP
725 as \fBsample_type\fP, \fBPERF_TYPE_SOFTWARE\fP as \fBtype\fP, and
726 \fBPERF_COUNT_SW_BPF_OUTPUT\fP as \fBconfig\fP\&.
728 The \fIflags\fP are used to indicate the index in \fImap\fP for which
729 the value must be put, masked with \fBBPF_F_INDEX_MASK\fP\&.
730 Alternatively, \fIflags\fP can be set to \fBBPF_F_CURRENT_CPU\fP
731 to indicate that the index of the current CPU core should be
734 The value to write, of \fIsize\fP, is passed through eBPF stack and
735 pointed by \fIdata\fP\&.
737 The context of the program \fIctx\fP needs also be passed to the
740 On user space, a program willing to read the values needs to
741 call \fBperf_event_open\fP() on the perf event (either for
742 one or for all CPUs) and to store the file descriptor into the
743 \fImap\fP\&. This must be done before the eBPF program can send data
744 into it. An example is available in file
745 \fIsamples/bpf/trace_output_user.c\fP in the Linux kernel source
746 tree (the eBPF program counterpart is in
747 \fIsamples/bpf/trace_output_kern.c\fP).
749 \fBbpf_perf_event_output\fP() achieves better performance
750 than \fBbpf_trace_printk\fP() for sharing data with user
751 space, and is much better suitable for streaming data from eBPF
754 Note that this helper is not restricted to tracing use cases
755 and can be used with programs attached to TC or XDP as well,
756 where it allows for passing data to user space listeners. Data
762 Only the packet payload, or
764 A combination of both.
768 0 on success, or a negative error in case of failure.
771 .B \fBint bpf_skb_load_bytes(const void *\fP\fIskb\fP\fB, u32\fP \fIoffset\fP\fB, void *\fP\fIto\fP\fB, u32\fP \fIlen\fP\fB)\fP
775 This helper was provided as an easy way to load data from a
776 packet. It can be used to load \fIlen\fP bytes from \fIoffset\fP from
777 the packet associated to \fIskb\fP, into the buffer pointed by
780 Since Linux 4.7, usage of this helper has mostly been replaced
781 by "direct packet access", enabling packet data to be
782 manipulated with \fIskb\fP\fB\->data\fP and \fIskb\fP\fB\->data_end\fP
783 pointing respectively to the first byte of packet data and to
784 the byte after the last byte of packet data. However, it
785 remains useful if one wishes to read large quantities of data
786 at once from a packet into the eBPF stack.
789 0 on success, or a negative error in case of failure.
792 .B \fBint bpf_get_stackid(void *\fP\fIctx\fP\fB, struct bpf_map *\fP\fImap\fP\fB, u64\fP \fIflags\fP\fB)\fP
796 Walk a user or a kernel stack and return its id. To achieve
797 this, the helper needs \fIctx\fP, which is a pointer to the context
798 on which the tracing program is executed, and a pointer to a
799 \fImap\fP of type \fBBPF_MAP_TYPE_STACK_TRACE\fP\&.
801 The last argument, \fIflags\fP, holds the number of stack frames to
802 skip (from 0 to 255), masked with
803 \fBBPF_F_SKIP_FIELD_MASK\fP\&. The next bits can be used to set
804 a combination of the following flags:
807 .B \fBBPF_F_USER_STACK\fP
808 Collect a user space stack instead of a kernel stack.
810 .B \fBBPF_F_FAST_STACK_CMP\fP
811 Compare stacks by hash only.
813 .B \fBBPF_F_REUSE_STACKID\fP
814 If two different stacks hash into the same \fIstackid\fP,
818 The stack id retrieved is a 32 bit long integer handle which
819 can be further combined with other data (including other stack
820 ids) and used as a key into maps. This can be useful for
821 generating a variety of graphs (such as flame graphs or off\-cpu
824 For walking a stack, this helper is an improvement over
825 \fBbpf_probe_read\fP(), which can be used with unrolled loops
826 but is not efficient and consumes a lot of eBPF instructions.
827 Instead, \fBbpf_get_stackid\fP() can collect up to
828 \fBPERF_MAX_STACK_DEPTH\fP both kernel and user frames. Note that
829 this limit can be controlled with the \fBsysctl\fP program, and
830 that it should be manually increased in order to profile long
831 user stacks (such as stacks for Java programs). To do so, use:
837 # sysctl kernel.perf_event_max_stack=<new value>
844 The positive or null stack id on success, or a negative error
848 .B \fBs64 bpf_csum_diff(__be32 *\fP\fIfrom\fP\fB, u32\fP \fIfrom_size\fP\fB, __be32 *\fP\fIto\fP\fB, u32\fP \fIto_size\fP\fB, __wsum\fP \fIseed\fP\fB)\fP
852 Compute a checksum difference, from the raw buffer pointed by
853 \fIfrom\fP, of length \fIfrom_size\fP (that must be a multiple of 4),
854 towards the raw buffer pointed by \fIto\fP, of size \fIto_size\fP
855 (same remark). An optional \fIseed\fP can be added to the value
856 (this can be cascaded, the seed may come from a previous call
859 This is flexible enough to be used in several ways:
862 With \fIfrom_size\fP == 0, \fIto_size\fP > 0 and \fIseed\fP set to
863 checksum, it can be used when pushing new data.
865 With \fIfrom_size\fP > 0, \fIto_size\fP == 0 and \fIseed\fP set to
866 checksum, it can be used when removing data from a packet.
868 With \fIfrom_size\fP > 0, \fIto_size\fP > 0 and \fIseed\fP set to 0, it
869 can be used to compute a diff. Note that \fIfrom_size\fP and
870 \fIto_size\fP do not need to be equal.
873 This helper can be used in combination with
874 \fBbpf_l3_csum_replace\fP() and \fBbpf_l4_csum_replace\fP(), to
875 which one can feed in the difference computed with
876 \fBbpf_csum_diff\fP().
879 The checksum result, or a negative error code in case of
883 .B \fBint bpf_skb_get_tunnel_opt(struct sk_buff *\fP\fIskb\fP\fB, void *\fP\fIopt\fP\fB, u32\fP \fIsize\fP\fB)\fP
887 Retrieve tunnel options metadata for the packet associated to
888 \fIskb\fP, and store the raw tunnel option data to the buffer \fIopt\fP
891 This helper can be used with encapsulation devices that can
892 operate in "collect metadata" mode (please refer to the related
893 note in the description of \fBbpf_skb_get_tunnel_key\fP() for
894 more details). A particular example where this can be used is
895 in combination with the Geneve encapsulation protocol, where it
896 allows for pushing (with \fBbpf_skb_get_tunnel_opt\fP() helper)
897 and retrieving arbitrary TLVs (Type\-Length\-Value headers) from
898 the eBPF program. This allows for full customization of these
902 The size of the option data retrieved.
905 .B \fBint bpf_skb_set_tunnel_opt(struct sk_buff *\fP\fIskb\fP\fB, void *\fP\fIopt\fP\fB, u32\fP \fIsize\fP\fB)\fP
909 Set tunnel options metadata for the packet associated to \fIskb\fP
910 to the option data contained in the raw buffer \fIopt\fP of \fIsize\fP\&.
912 See also the description of the \fBbpf_skb_get_tunnel_opt\fP()
913 helper for additional information.
916 0 on success, or a negative error in case of failure.
919 .B \fBint bpf_skb_change_proto(struct sk_buff *\fP\fIskb\fP\fB, __be16\fP \fIproto\fP\fB, u64\fP \fIflags\fP\fB)\fP
923 Change the protocol of the \fIskb\fP to \fIproto\fP\&. Currently
924 supported are transition from IPv4 to IPv6, and from IPv6 to
925 IPv4. The helper takes care of the groundwork for the
926 transition, including resizing the socket buffer. The eBPF
927 program is expected to fill the new headers, if any, via
928 \fBskb_store_bytes\fP() and to recompute the checksums with
929 \fBbpf_l3_csum_replace\fP() and \fBbpf_l4_csum_replace\fP(). The main case for this helper is to perform NAT64
930 operations out of an eBPF program.
932 Internally, the GSO type is marked as dodgy so that headers are
933 checked and segments are recalculated by the GSO/GRO engine.
934 The size for GSO target is adapted as well.
936 All values for \fIflags\fP are reserved for future usage, and must
939 A call to this helper is susceptible to change the underlying
940 packet buffer. Therefore, at load time, all checks on pointers
941 previously done by the verifier are invalidated and must be
942 performed again, if the helper is used in combination with
943 direct packet access.
946 0 on success, or a negative error in case of failure.
949 .B \fBint bpf_skb_change_type(struct sk_buff *\fP\fIskb\fP\fB, u32\fP \fItype\fP\fB)\fP
953 Change the packet type for the packet associated to \fIskb\fP\&. This
954 comes down to setting \fIskb\fP\fB\->pkt_type\fP to \fItype\fP, except
955 the eBPF program does not have a write access to \fIskb\fP\fB\->pkt_type\fP beside this helper. Using a helper here allows
956 for graceful handling of errors.
958 The major use case is to change incoming \fIskb*s to
959 **PACKET_HOST*\fP in a programmatic way instead of having to
960 recirculate via \fBredirect\fP(..., \fBBPF_F_INGRESS\fP), for
963 Note that \fItype\fP only allows certain values. At this time, they
970 .B \fBPACKET_BROADCAST\fP
973 .B \fBPACKET_MULTICAST\fP
974 Send packet to group.
976 .B \fBPACKET_OTHERHOST\fP
977 Send packet to someone else.
981 0 on success, or a negative error in case of failure.
984 .B \fBint bpf_skb_under_cgroup(struct sk_buff *\fP\fIskb\fP\fB, struct bpf_map *\fP\fImap\fP\fB, u32\fP \fIindex\fP\fB)\fP
988 Check whether \fIskb\fP is a descendant of the cgroup2 held by
989 \fImap\fP of type \fBBPF_MAP_TYPE_CGROUP_ARRAY\fP, at \fIindex\fP\&.
992 The return value depends on the result of the test, and can be:
995 0, if the \fIskb\fP failed the cgroup2 descendant test.
997 1, if the \fIskb\fP succeeded the cgroup2 descendant test.
999 A negative error code, if an error occurred.
1003 .B \fBu32 bpf_get_hash_recalc(struct sk_buff *\fP\fIskb\fP\fB)\fP
1007 Retrieve the hash of the packet, \fIskb\fP\fB\->hash\fP\&. If it is
1008 not set, in particular if the hash was cleared due to mangling,
1009 recompute this hash. Later accesses to the hash can be done
1010 directly with \fIskb\fP\fB\->hash\fP\&.
1012 Calling \fBbpf_set_hash_invalid\fP(), changing a packet
1013 prototype with \fBbpf_skb_change_proto\fP(), or calling
1014 \fBbpf_skb_store_bytes\fP() with the
1015 \fBBPF_F_INVALIDATE_HASH\fP are actions susceptible to clear
1016 the hash and to trigger a new computation for the next call to
1017 \fBbpf_get_hash_recalc\fP().
1023 .B \fBu64 bpf_get_current_task(void)\fP
1027 A pointer to the current task struct.
1030 .B \fBint bpf_probe_write_user(void *\fP\fIdst\fP\fB, const void *\fP\fIsrc\fP\fB, u32\fP \fIlen\fP\fB)\fP
1034 Attempt in a safe way to write \fIlen\fP bytes from the buffer
1035 \fIsrc\fP to \fIdst\fP in memory. It only works for threads that are in
1036 user context, and \fIdst\fP must be a valid user space address.
1038 This helper should not be used to implement any kind of
1039 security mechanism because of TOC\-TOU attacks, but rather to
1040 debug, divert, and manipulate execution of semi\-cooperative
1043 Keep in mind that this feature is meant for experiments, and it
1044 has a risk of crashing the system and running programs.
1045 Therefore, when an eBPF program using this helper is attached,
1046 a warning including PID and process name is printed to kernel
1050 0 on success, or a negative error in case of failure.
1053 .B \fBint bpf_current_task_under_cgroup(struct bpf_map *\fP\fImap\fP\fB, u32\fP \fIindex\fP\fB)\fP
1057 Check whether the probe is being run is the context of a given
1058 subset of the cgroup2 hierarchy. The cgroup2 to test is held by
1059 \fImap\fP of type \fBBPF_MAP_TYPE_CGROUP_ARRAY\fP, at \fIindex\fP\&.
1062 The return value depends on the result of the test, and can be:
1065 0, if the \fIskb\fP task belongs to the cgroup2.
1067 1, if the \fIskb\fP task does not belong to the cgroup2.
1069 A negative error code, if an error occurred.
1073 .B \fBint bpf_skb_change_tail(struct sk_buff *\fP\fIskb\fP\fB, u32\fP \fIlen\fP\fB, u64\fP \fIflags\fP\fB)\fP
1077 Resize (trim or grow) the packet associated to \fIskb\fP to the
1078 new \fIlen\fP\&. The \fIflags\fP are reserved for future usage, and must
1081 The basic idea is that the helper performs the needed work to
1082 change the size of the packet, then the eBPF program rewrites
1083 the rest via helpers like \fBbpf_skb_store_bytes\fP(),
1084 \fBbpf_l3_csum_replace\fP(), \fBbpf_l3_csum_replace\fP()
1085 and others. This helper is a slow path utility intended for
1086 replies with control messages. And because it is targeted for
1087 slow path, the helper itself can afford to be slow: it
1088 implicitly linearizes, unclones and drops offloads from the
1091 A call to this helper is susceptible to change the underlying
1092 packet buffer. Therefore, at load time, all checks on pointers
1093 previously done by the verifier are invalidated and must be
1094 performed again, if the helper is used in combination with
1095 direct packet access.
1098 0 on success, or a negative error in case of failure.
1101 .B \fBint bpf_skb_pull_data(struct sk_buff *\fP\fIskb\fP\fB, u32\fP \fIlen\fP\fB)\fP
1105 Pull in non\-linear data in case the \fIskb\fP is non\-linear and not
1106 all of \fIlen\fP are part of the linear section. Make \fIlen\fP bytes
1107 from \fIskb\fP readable and writable. If a zero value is passed for
1108 \fIlen\fP, then the whole length of the \fIskb\fP is pulled.
1110 This helper is only needed for reading and writing with direct
1113 For direct packet access, testing that offsets to access
1114 are within packet boundaries (test on \fIskb\fP\fB\->data_end\fP) is
1115 susceptible to fail if offsets are invalid, or if the requested
1116 data is in non\-linear parts of the \fIskb\fP\&. On failure the
1117 program can just bail out, or in the case of a non\-linear
1118 buffer, use a helper to make the data available. The
1119 \fBbpf_skb_load_bytes\fP() helper is a first solution to access
1120 the data. Another one consists in using \fBbpf_skb_pull_data\fP
1121 to pull in once the non\-linear parts, then retesting and
1122 eventually access the data.
1124 At the same time, this also makes sure the \fIskb\fP is uncloned,
1125 which is a necessary condition for direct write. As this needs
1126 to be an invariant for the write part only, the verifier
1127 detects writes and adds a prologue that is calling
1128 \fBbpf_skb_pull_data()\fP to effectively unclone the \fIskb\fP from
1129 the very beginning in case it is indeed cloned.
1131 A call to this helper is susceptible to change the underlying
1132 packet buffer. Therefore, at load time, all checks on pointers
1133 previously done by the verifier are invalidated and must be
1134 performed again, if the helper is used in combination with
1135 direct packet access.
1138 0 on success, or a negative error in case of failure.
1141 .B \fBs64 bpf_csum_update(struct sk_buff *\fP\fIskb\fP\fB, __wsum\fP \fIcsum\fP\fB)\fP
1145 Add the checksum \fIcsum\fP into \fIskb\fP\fB\->csum\fP in case the
1146 driver has supplied a checksum for the entire packet into that
1147 field. Return an error otherwise. This helper is intended to be
1148 used in combination with \fBbpf_csum_diff\fP(), in particular
1149 when the checksum needs to be updated after data has been
1150 written into the packet through direct packet access.
1153 The checksum on success, or a negative error code in case of
1157 .B \fBvoid bpf_set_hash_invalid(struct sk_buff *\fP\fIskb\fP\fB)\fP
1161 Invalidate the current \fIskb\fP\fB\->hash\fP\&. It can be used after
1162 mangling on headers through direct packet access, in order to
1163 indicate that the hash is outdated and to trigger a
1164 recalculation the next time the kernel tries to access this
1165 hash or when the \fBbpf_get_hash_recalc\fP() helper is called.
1168 .B \fBint bpf_get_numa_node_id(void)\fP
1172 Return the id of the current NUMA node. The primary use case
1173 for this helper is the selection of sockets for the local NUMA
1174 node, when the program is attached to sockets using the
1175 \fBSO_ATTACH_REUSEPORT_EBPF\fP option (see also \fBsocket(7)\fP),
1176 but the helper is also available to other eBPF program types,
1177 similarly to \fBbpf_get_smp_processor_id\fP().
1180 The id of current NUMA node.
1183 .B \fBint bpf_skb_change_head(struct sk_buff *\fP\fIskb\fP\fB, u32\fP \fIlen\fP\fB, u64\fP \fIflags\fP\fB)\fP
1187 Grows headroom of packet associated to \fIskb\fP and adjusts the
1188 offset of the MAC header accordingly, adding \fIlen\fP bytes of
1189 space. It automatically extends and reallocates memory as
1192 This helper can be used on a layer 3 \fIskb\fP to push a MAC header
1193 for redirection into a layer 2 device.
1195 All values for \fIflags\fP are reserved for future usage, and must
1198 A call to this helper is susceptible to change the underlying
1199 packet buffer. Therefore, at load time, all checks on pointers
1200 previously done by the verifier are invalidated and must be
1201 performed again, if the helper is used in combination with
1202 direct packet access.
1205 0 on success, or a negative error in case of failure.
1208 .B \fBint bpf_xdp_adjust_head(struct xdp_buff *\fP\fIxdp_md\fP\fB, int\fP \fIdelta\fP\fB)\fP
1212 Adjust (move) \fIxdp_md\fP\fB\->data\fP by \fIdelta\fP bytes. Note that
1213 it is possible to use a negative value for \fIdelta\fP\&. This helper
1214 can be used to prepare the packet for pushing or popping
1217 A call to this helper is susceptible to change the underlying
1218 packet buffer. Therefore, at load time, all checks on pointers
1219 previously done by the verifier are invalidated and must be
1220 performed again, if the helper is used in combination with
1221 direct packet access.
1224 0 on success, or a negative error in case of failure.
1227 .B \fBint bpf_probe_read_str(void *\fP\fIdst\fP\fB, u32\fP \fIsize\fP\fB, const void *\fP\fIunsafe_ptr\fP\fB)\fP
1231 Copy a NUL terminated string from an unsafe kernel address
1232 \fIunsafe_ptr\fP to \fIdst\fP\&. See bpf_probe_read_kernel_str() for
1235 Generally, use bpf_probe_read_user_str() or bpf_probe_read_kernel_str()
1239 On success, the strictly positive length of the string,
1240 including the trailing NUL character. On error, a negative
1244 .B \fBu64 bpf_get_socket_cookie(struct sk_buff *\fP\fIskb\fP\fB)\fP
1248 If the \fBstruct sk_buff\fP pointed by \fIskb\fP has a known socket,
1249 retrieve the cookie (generated by the kernel) of this socket.
1250 If no cookie has been set yet, generate a new cookie. Once
1251 generated, the socket cookie remains stable for the life of the
1252 socket. This helper can be useful for monitoring per socket
1253 networking traffic statistics as it provides a global socket
1254 identifier that can be assumed unique.
1257 A 8\-byte long non\-decreasing number on success, or 0 if the
1258 socket field is missing inside \fIskb\fP\&.
1261 .B \fBu64 bpf_get_socket_cookie(struct bpf_sock_addr *\fP\fIctx\fP\fB)\fP
1265 Equivalent to bpf_get_socket_cookie() helper that accepts
1266 \fIskb\fP, but gets socket from \fBstruct bpf_sock_addr\fP context.
1269 A 8\-byte long non\-decreasing number.
1272 .B \fBu64 bpf_get_socket_cookie(struct bpf_sock_ops *\fP\fIctx\fP\fB)\fP
1276 Equivalent to bpf_get_socket_cookie() helper that accepts
1277 \fIskb\fP, but gets socket from \fBstruct bpf_sock_ops\fP context.
1280 A 8\-byte long non\-decreasing number.
1283 .B \fBu32 bpf_get_socket_uid(struct sk_buff *\fP\fIskb\fP\fB)\fP
1287 The owner UID of the socket associated to \fIskb\fP\&. If the socket
1288 is \fBNULL\fP, or if it is not a full socket (i.e. if it is a
1289 time\-wait or a request socket instead), \fBoverflowuid\fP value
1290 is returned (note that \fBoverflowuid\fP might also be the actual
1291 UID value for the socket).
1294 .B \fBu32 bpf_set_hash(struct sk_buff *\fP\fIskb\fP\fB, u32\fP \fIhash\fP\fB)\fP
1298 Set the full hash for \fIskb\fP (set the field \fIskb\fP\fB\->hash\fP)
1299 to value \fIhash\fP\&.
1305 .B \fBint bpf_setsockopt(struct bpf_sock_ops *\fP\fIbpf_socket\fP\fB, int\fP \fIlevel\fP\fB, int\fP \fIoptname\fP\fB, void *\fP\fIoptval\fP\fB, int\fP \fIoptlen\fP\fB)\fP
1309 Emulate a call to \fBsetsockopt()\fP on the socket associated to
1310 \fIbpf_socket\fP, which must be a full socket. The \fIlevel\fP at
1311 which the option resides and the name \fIoptname\fP of the option
1312 must be specified, see \fBsetsockopt(2)\fP for more information.
1313 The option value of length \fIoptlen\fP is pointed by \fIoptval\fP\&.
1315 This helper actually implements a subset of \fBsetsockopt()\fP\&.
1316 It supports the following \fIlevel\fPs:
1319 \fBSOL_SOCKET\fP, which supports the following \fIoptname\fPs:
1320 \fBSO_RCVBUF\fP, \fBSO_SNDBUF\fP, \fBSO_MAX_PACING_RATE\fP,
1321 \fBSO_PRIORITY\fP, \fBSO_RCVLOWAT\fP, \fBSO_MARK\fP\&.
1323 \fBIPPROTO_TCP\fP, which supports the following \fIoptname\fPs:
1324 \fBTCP_CONGESTION\fP, \fBTCP_BPF_IW\fP,
1325 \fBTCP_BPF_SNDCWND_CLAMP\fP\&.
1327 \fBIPPROTO_IP\fP, which supports \fIoptname\fP \fBIP_TOS\fP\&.
1329 \fBIPPROTO_IPV6\fP, which supports \fIoptname\fP \fBIPV6_TCLASS\fP\&.
1333 0 on success, or a negative error in case of failure.
1336 .B \fBint bpf_skb_adjust_room(struct sk_buff *\fP\fIskb\fP\fB, s32\fP \fIlen_diff\fP\fB, u32\fP \fImode\fP\fB, u64\fP \fIflags\fP\fB)\fP
1340 Grow or shrink the room for data in the packet associated to
1341 \fIskb\fP by \fIlen_diff\fP, and according to the selected \fImode\fP\&.
1343 There are two supported modes at this time:
1346 \fBBPF_ADJ_ROOM_MAC\fP: Adjust room at the mac layer
1347 (room space is added or removed below the layer 2 header).
1349 \fBBPF_ADJ_ROOM_NET\fP: Adjust room at the network layer
1350 (room space is added or removed below the layer 3 header).
1353 The following flags are supported at this time:
1356 \fBBPF_F_ADJ_ROOM_FIXED_GSO\fP: Do not adjust gso_size.
1357 Adjusting mss in this way is not allowed for datagrams.
1359 \fBBPF_F_ADJ_ROOM_ENCAP_L3_IPV4\fP,
1360 \fBBPF_F_ADJ_ROOM_ENCAP_L3_IPV6\fP:
1361 Any new space is reserved to hold a tunnel header.
1362 Configure skb offsets and other fields accordingly.
1364 \fBBPF_F_ADJ_ROOM_ENCAP_L4_GRE\fP,
1365 \fBBPF_F_ADJ_ROOM_ENCAP_L4_UDP\fP:
1366 Use with ENCAP_L3 flags to further specify the tunnel type.
1368 \fBBPF_F_ADJ_ROOM_ENCAP_L2\fP(\fIlen\fP):
1369 Use with ENCAP_L3/L4 flags to further specify the tunnel
1370 type; \fIlen\fP is the length of the inner MAC header.
1373 A call to this helper is susceptible to change the underlying
1374 packet buffer. Therefore, at load time, all checks on pointers
1375 previously done by the verifier are invalidated and must be
1376 performed again, if the helper is used in combination with
1377 direct packet access.
1380 0 on success, or a negative error in case of failure.
1383 .B \fBint bpf_redirect_map(struct bpf_map *\fP\fImap\fP\fB, u32\fP \fIkey\fP\fB, u64\fP \fIflags\fP\fB)\fP
1387 Redirect the packet to the endpoint referenced by \fImap\fP at
1388 index \fIkey\fP\&. Depending on its type, this \fImap\fP can contain
1389 references to net devices (for forwarding packets through other
1390 ports), or to CPUs (for redirecting XDP frames to another CPU;
1391 but this is only implemented for native XDP (with driver
1392 support) as of this writing).
1394 The lower two bits of \fIflags\fP are used as the return code if
1395 the map lookup fails. This is so that the return value can be
1396 one of the XDP program return codes up to XDP_TX, as chosen by
1397 the caller. Any higher bits in the \fIflags\fP argument must be
1400 See also bpf_redirect(), which only supports redirecting to an
1401 ifindex, but doesn\(aqt require a map to do so.
1404 \fBXDP_REDIRECT\fP on success, or the value of the two lower bits
1409 flags* argument on error.
1410 .IP "System Message: WARNING/2 (/tmp/bpf-helpers.rst:, line 1105)"
1411 Inline strong start\-string without end\-string.
1414 .B \fBint bpf_sk_redirect_map(struct sk_buff *\fP\fIskb\fP\fB, struct bpf_map *\fP\fImap\fP\fB, u32\fP \fIkey\fP\fB, u64\fP \fIflags\fP\fB)\fP
1418 Redirect the packet to the socket referenced by \fImap\fP (of type
1419 \fBBPF_MAP_TYPE_SOCKMAP\fP) at index \fIkey\fP\&. Both ingress and
1420 egress interfaces can be used for redirection. The
1421 \fBBPF_F_INGRESS\fP value in \fIflags\fP is used to make the
1422 distinction (ingress path is selected if the flag is present,
1423 egress path otherwise). This is the only flag supported for now.
1426 \fBSK_PASS\fP on success, or \fBSK_DROP\fP on error.
1429 .B \fBint bpf_sock_map_update(struct bpf_sock_ops *\fP\fIskops\fP\fB, struct bpf_map *\fP\fImap\fP\fB, void *\fP\fIkey\fP\fB, u64\fP \fIflags\fP\fB)\fP
1433 Add an entry to, or update a \fImap\fP referencing sockets. The
1434 \fIskops\fP is used as a new value for the entry associated to
1435 \fIkey\fP\&. \fIflags\fP is one of:
1438 .B \fBBPF_NOEXIST\fP
1439 The entry for \fIkey\fP must not exist in the map.
1442 The entry for \fIkey\fP must already exist in the map.
1445 No condition on the existence of the entry for \fIkey\fP\&.
1448 If the \fImap\fP has eBPF programs (parser and verdict), those will
1449 be inherited by the socket being added. If the socket is
1450 already attached to eBPF programs, this results in an error.
1453 0 on success, or a negative error in case of failure.
1456 .B \fBint bpf_xdp_adjust_meta(struct xdp_buff *\fP\fIxdp_md\fP\fB, int\fP \fIdelta\fP\fB)\fP
1460 Adjust the address pointed by \fIxdp_md\fP\fB\->data_meta\fP by
1461 \fIdelta\fP (which can be positive or negative). Note that this
1462 operation modifies the address stored in \fIxdp_md\fP\fB\->data\fP,
1463 so the latter must be loaded only after the helper has been
1466 The use of \fIxdp_md\fP\fB\->data_meta\fP is optional and programs
1467 are not required to use it. The rationale is that when the
1468 packet is processed with XDP (e.g. as DoS filter), it is
1469 possible to push further meta data along with it before passing
1470 to the stack, and to give the guarantee that an ingress eBPF
1471 program attached as a TC classifier on the same device can pick
1472 this up for further post\-processing. Since TC works with socket
1473 buffers, it remains possible to set from XDP the \fBmark\fP or
1474 \fBpriority\fP pointers, or other pointers for the socket buffer.
1475 Having this scratch space generic and programmable allows for
1476 more flexibility as the user is free to store whatever meta
1479 A call to this helper is susceptible to change the underlying
1480 packet buffer. Therefore, at load time, all checks on pointers
1481 previously done by the verifier are invalidated and must be
1482 performed again, if the helper is used in combination with
1483 direct packet access.
1486 0 on success, or a negative error in case of failure.
1489 .B \fBint bpf_perf_event_read_value(struct bpf_map *\fP\fImap\fP\fB, u64\fP \fIflags\fP\fB, struct bpf_perf_event_value *\fP\fIbuf\fP\fB, u32\fP \fIbuf_size\fP\fB)\fP
1493 Read the value of a perf event counter, and store it into \fIbuf\fP
1494 of size \fIbuf_size\fP\&. This helper relies on a \fImap\fP of type
1495 \fBBPF_MAP_TYPE_PERF_EVENT_ARRAY\fP\&. The nature of the perf event
1496 counter is selected when \fImap\fP is updated with perf event file
1497 descriptors. The \fImap\fP is an array whose size is the number of
1498 available CPUs, and each cell contains a value relative to one
1499 CPU. The value to retrieve is indicated by \fIflags\fP, that
1500 contains the index of the CPU to look up, masked with
1501 \fBBPF_F_INDEX_MASK\fP\&. Alternatively, \fIflags\fP can be set to
1502 \fBBPF_F_CURRENT_CPU\fP to indicate that the value for the
1503 current CPU should be retrieved.
1505 This helper behaves in a way close to
1506 \fBbpf_perf_event_read\fP() helper, save that instead of
1507 just returning the value observed, it fills the \fIbuf\fP
1508 structure. This allows for additional data to be retrieved: in
1509 particular, the enabled and running times (in \fIbuf\fP\fB\->enabled\fP and \fIbuf\fP\fB\->running\fP, respectively) are
1510 copied. In general, \fBbpf_perf_event_read_value\fP() is
1511 recommended over \fBbpf_perf_event_read\fP(), which has some
1512 ABI issues and provides fewer functionalities.
1514 These values are interesting, because hardware PMU (Performance
1515 Monitoring Unit) counters are limited resources. When there are
1516 more PMU based perf events opened than available counters,
1517 kernel will multiplex these events so each event gets certain
1518 percentage (but not all) of the PMU time. In case that
1519 multiplexing happens, the number of samples or counter value
1520 will not reflect the case compared to when no multiplexing
1521 occurs. This makes comparison between different runs difficult.
1522 Typically, the counter value should be normalized before
1523 comparing to other experiments. The usual normalization is done
1530 normalized_counter = counter * t_enabled / t_running
1536 Where t_enabled is the time enabled for event and t_running is
1537 the time running for event since last normalization. The
1538 enabled and running times are accumulated since the perf event
1539 open. To achieve scaling factor between two invocations of an
1540 eBPF program, users can can use CPU id as the key (which is
1541 typical for perf array usage model) to remember the previous
1542 value and do the calculation inside the eBPF program.
1545 0 on success, or a negative error in case of failure.
1548 .B \fBint bpf_perf_prog_read_value(struct bpf_perf_event_data *\fP\fIctx\fP\fB, struct bpf_perf_event_value *\fP\fIbuf\fP\fB, u32\fP \fIbuf_size\fP\fB)\fP
1552 For en eBPF program attached to a perf event, retrieve the
1553 value of the event counter associated to \fIctx\fP and store it in
1554 the structure pointed by \fIbuf\fP and of size \fIbuf_size\fP\&. Enabled
1555 and running times are also stored in the structure (see
1556 description of helper \fBbpf_perf_event_read_value\fP() for
1560 0 on success, or a negative error in case of failure.
1563 .B \fBint bpf_getsockopt(struct bpf_sock_ops *\fP\fIbpf_socket\fP\fB, int\fP \fIlevel\fP\fB, int\fP \fIoptname\fP\fB, void *\fP\fIoptval\fP\fB, int\fP \fIoptlen\fP\fB)\fP
1567 Emulate a call to \fBgetsockopt()\fP on the socket associated to
1568 \fIbpf_socket\fP, which must be a full socket. The \fIlevel\fP at
1569 which the option resides and the name \fIoptname\fP of the option
1570 must be specified, see \fBgetsockopt(2)\fP for more information.
1571 The retrieved value is stored in the structure pointed by
1572 \fIopval\fP and of length \fIoptlen\fP\&.
1574 This helper actually implements a subset of \fBgetsockopt()\fP\&.
1575 It supports the following \fIlevel\fPs:
1578 \fBIPPROTO_TCP\fP, which supports \fIoptname\fP
1579 \fBTCP_CONGESTION\fP\&.
1581 \fBIPPROTO_IP\fP, which supports \fIoptname\fP \fBIP_TOS\fP\&.
1583 \fBIPPROTO_IPV6\fP, which supports \fIoptname\fP \fBIPV6_TCLASS\fP\&.
1587 0 on success, or a negative error in case of failure.
1590 .B \fBint bpf_override_return(struct pt_regs *\fP\fIregs\fP\fB, u64\fP \fIrc\fP\fB)\fP
1594 Used for error injection, this helper uses kprobes to override
1595 the return value of the probed function, and to set it to \fIrc\fP\&.
1596 The first argument is the context \fIregs\fP on which the kprobe
1599 This helper works by setting setting the PC (program counter)
1600 to an override function which is run in place of the original
1601 probed function. This means the probed function is not run at
1602 all. The replacement function just returns with the required
1605 This helper has security implications, and thus is subject to
1606 restrictions. It is only available if the kernel was compiled
1607 with the \fBCONFIG_BPF_KPROBE_OVERRIDE\fP configuration
1608 option, and in this case it only works on functions tagged with
1609 \fBALLOW_ERROR_INJECTION\fP in the kernel code.
1611 Also, the helper is only available for the architectures having
1612 the CONFIG_FUNCTION_ERROR_INJECTION option. As of this writing,
1613 x86 architecture is the only one to support this feature.
1619 .B \fBint bpf_sock_ops_cb_flags_set(struct bpf_sock_ops *\fP\fIbpf_sock\fP\fB, int\fP \fIargval\fP\fB)\fP
1623 Attempt to set the value of the \fBbpf_sock_ops_cb_flags\fP field
1624 for the full TCP socket associated to \fIbpf_sock_ops\fP to
1627 The primary use of this field is to determine if there should
1628 be calls to eBPF programs of type
1629 \fBBPF_PROG_TYPE_SOCK_OPS\fP at various points in the TCP
1630 code. A program of the same type can change its value, per
1631 connection and as necessary, when the connection is
1632 established. This field is directly accessible for reading, but
1633 this helper must be used for updates in order to return an
1634 error if an eBPF program tries to set a callback that is not
1635 supported in the current kernel.
1637 \fIargval\fP is a flag array which can combine these flags:
1640 \fBBPF_SOCK_OPS_RTO_CB_FLAG\fP (retransmission time out)
1642 \fBBPF_SOCK_OPS_RETRANS_CB_FLAG\fP (retransmission)
1644 \fBBPF_SOCK_OPS_STATE_CB_FLAG\fP (TCP state change)
1646 \fBBPF_SOCK_OPS_RTT_CB_FLAG\fP (every RTT)
1649 Therefore, this function can be used to clear a callback flag by
1650 setting the appropriate bit to zero. e.g. to disable the RTO
1654 .B \fBbpf_sock_ops_cb_flags_set(bpf_sock,\fP
1655 \fBbpf_sock\->bpf_sock_ops_cb_flags & ~BPF_SOCK_OPS_RTO_CB_FLAG)\fP
1658 Here are some examples of where one could call such eBPF
1664 When a packet is retransmitted.
1666 When the connection terminates.
1668 When a packet is sent.
1670 When a packet is received.
1674 Code \fB\-EINVAL\fP if the socket is not a full TCP socket;
1675 otherwise, a positive number containing the bits that could not
1676 be set is returned (which comes down to 0 if all bits were set
1680 .B \fBint bpf_msg_redirect_map(struct sk_msg_buff *\fP\fImsg\fP\fB, struct bpf_map *\fP\fImap\fP\fB, u32\fP \fIkey\fP\fB, u64\fP \fIflags\fP\fB)\fP
1684 This helper is used in programs implementing policies at the
1685 socket level. If the message \fImsg\fP is allowed to pass (i.e. if
1686 the verdict eBPF program returns \fBSK_PASS\fP), redirect it to
1687 the socket referenced by \fImap\fP (of type
1688 \fBBPF_MAP_TYPE_SOCKMAP\fP) at index \fIkey\fP\&. Both ingress and
1689 egress interfaces can be used for redirection. The
1690 \fBBPF_F_INGRESS\fP value in \fIflags\fP is used to make the
1691 distinction (ingress path is selected if the flag is present,
1692 egress path otherwise). This is the only flag supported for now.
1695 \fBSK_PASS\fP on success, or \fBSK_DROP\fP on error.
1698 .B \fBint bpf_msg_apply_bytes(struct sk_msg_buff *\fP\fImsg\fP\fB, u32\fP \fIbytes\fP\fB)\fP
1702 For socket policies, apply the verdict of the eBPF program to
1703 the next \fIbytes\fP (number of bytes) of message \fImsg\fP\&.
1705 For example, this helper can be used in the following cases:
1708 A single \fBsendmsg\fP() or \fBsendfile\fP() system call
1709 contains multiple logical messages that the eBPF program is
1710 supposed to read and for which it should apply a verdict.
1712 An eBPF program only cares to read the first \fIbytes\fP of a
1713 \fImsg\fP\&. If the message has a large payload, then setting up
1714 and calling the eBPF program repeatedly for all bytes, even
1715 though the verdict is already known, would create unnecessary
1719 When called from within an eBPF program, the helper sets a
1720 counter internal to the BPF infrastructure, that is used to
1721 apply the last verdict to the next \fIbytes\fP\&. If \fIbytes\fP is
1722 smaller than the current data being processed from a
1723 \fBsendmsg\fP() or \fBsendfile\fP() system call, the first
1724 \fIbytes\fP will be sent and the eBPF program will be re\-run with
1725 the pointer for start of data pointing to byte number \fIbytes\fP
1726 \fB+ 1\fP\&. If \fIbytes\fP is larger than the current data being
1727 processed, then the eBPF verdict will be applied to multiple
1728 \fBsendmsg\fP() or \fBsendfile\fP() calls until \fIbytes\fP are
1731 Note that if a socket closes with the internal counter holding
1732 a non\-zero value, this is not a problem because data is not
1733 being buffered for \fIbytes\fP and is sent as it is received.
1739 .B \fBint bpf_msg_cork_bytes(struct sk_msg_buff *\fP\fImsg\fP\fB, u32\fP \fIbytes\fP\fB)\fP
1743 For socket policies, prevent the execution of the verdict eBPF
1744 program for message \fImsg\fP until \fIbytes\fP (byte number) have been
1747 This can be used when one needs a specific number of bytes
1748 before a verdict can be assigned, even if the data spans
1749 multiple \fBsendmsg\fP() or \fBsendfile\fP() calls. The extreme
1750 case would be a user calling \fBsendmsg\fP() repeatedly with
1751 1\-byte long message segments. Obviously, this is bad for
1752 performance, but it is still valid. If the eBPF program needs
1753 \fIbytes\fP bytes to validate a header, this helper can be used to
1754 prevent the eBPF program to be called again until \fIbytes\fP have
1761 .B \fBint bpf_msg_pull_data(struct sk_msg_buff *\fP\fImsg\fP\fB, u32\fP \fIstart\fP\fB, u32\fP \fIend\fP\fB, u64\fP \fIflags\fP\fB)\fP
1765 For socket policies, pull in non\-linear data from user space
1766 for \fImsg\fP and set pointers \fImsg\fP\fB\->data\fP and \fImsg\fP\fB\->data_end\fP to \fIstart\fP and \fIend\fP bytes offsets into \fImsg\fP,
1769 If a program of type \fBBPF_PROG_TYPE_SK_MSG\fP is run on a
1770 \fImsg\fP it can only parse data that the (\fBdata\fP, \fBdata_end\fP)
1771 pointers have already consumed. For \fBsendmsg\fP() hooks this
1772 is likely the first scatterlist element. But for calls relying
1773 on the \fBsendpage\fP handler (e.g. \fBsendfile\fP()) this will
1774 be the range (\fB0\fP, \fB0\fP) because the data is shared with
1775 user space and by default the objective is to avoid allowing
1776 user space to modify data while (or after) eBPF verdict is
1777 being decided. This helper can be used to pull in data and to
1778 set the start and end pointer to given values. Data will be
1779 copied if necessary (i.e. if data was not linear and if start
1780 and end pointers do not point to the same chunk).
1782 A call to this helper is susceptible to change the underlying
1783 packet buffer. Therefore, at load time, all checks on pointers
1784 previously done by the verifier are invalidated and must be
1785 performed again, if the helper is used in combination with
1786 direct packet access.
1788 All values for \fIflags\fP are reserved for future usage, and must
1792 0 on success, or a negative error in case of failure.
1795 .B \fBint bpf_bind(struct bpf_sock_addr *\fP\fIctx\fP\fB, struct sockaddr *\fP\fIaddr\fP\fB, int\fP \fIaddr_len\fP\fB)\fP
1799 Bind the socket associated to \fIctx\fP to the address pointed by
1800 \fIaddr\fP, of length \fIaddr_len\fP\&. This allows for making outgoing
1801 connection from the desired IP address, which can be useful for
1802 example when all processes inside a cgroup should use one
1803 single IP address on a host that has multiple IP configured.
1805 This helper works for IPv4 and IPv6, TCP and UDP sockets. The
1806 domain (\fIaddr\fP\fB\->sa_family\fP) must be \fBAF_INET\fP (or
1807 \fBAF_INET6\fP). Looking for a free port to bind to can be
1808 expensive, therefore binding to port is not permitted by the
1809 helper: \fIaddr\fP\fB\->sin_port\fP (or \fBsin6_port\fP, respectively)
1810 must be set to zero.
1813 0 on success, or a negative error in case of failure.
1816 .B \fBint bpf_xdp_adjust_tail(struct xdp_buff *\fP\fIxdp_md\fP\fB, int\fP \fIdelta\fP\fB)\fP
1820 Adjust (move) \fIxdp_md\fP\fB\->data_end\fP by \fIdelta\fP bytes. It is
1821 only possible to shrink the packet as of this writing,
1822 therefore \fIdelta\fP must be a negative integer.
1824 A call to this helper is susceptible to change the underlying
1825 packet buffer. Therefore, at load time, all checks on pointers
1826 previously done by the verifier are invalidated and must be
1827 performed again, if the helper is used in combination with
1828 direct packet access.
1831 0 on success, or a negative error in case of failure.
1834 .B \fBint bpf_skb_get_xfrm_state(struct sk_buff *\fP\fIskb\fP\fB, u32\fP \fIindex\fP\fB, struct bpf_xfrm_state *\fP\fIxfrm_state\fP\fB, u32\fP \fIsize\fP\fB, u64\fP \fIflags\fP\fB)\fP
1838 Retrieve the XFRM state (IP transform framework, see also
1839 \fBip\-xfrm(8)\fP) at \fIindex\fP in XFRM "security path" for \fIskb\fP\&.
1841 The retrieved value is stored in the \fBstruct bpf_xfrm_state\fP
1842 pointed by \fIxfrm_state\fP and of length \fIsize\fP\&.
1844 All values for \fIflags\fP are reserved for future usage, and must
1847 This helper is available only if the kernel was compiled with
1848 \fBCONFIG_XFRM\fP configuration option.
1851 0 on success, or a negative error in case of failure.
1854 .B \fBint bpf_get_stack(void *\fP\fIctx\fP\fB, void *\fP\fIbuf\fP\fB, u32\fP \fIsize\fP\fB, u64\fP \fIflags\fP\fB)\fP
1858 Return a user or a kernel stack in bpf program provided buffer.
1859 To achieve this, the helper needs \fIctx\fP, which is a pointer
1860 to the context on which the tracing program is executed.
1861 To store the stacktrace, the bpf program provides \fIbuf\fP with
1862 a nonnegative \fIsize\fP\&.
1864 The last argument, \fIflags\fP, holds the number of stack frames to
1865 skip (from 0 to 255), masked with
1866 \fBBPF_F_SKIP_FIELD_MASK\fP\&. The next bits can be used to set
1867 the following flags:
1870 .B \fBBPF_F_USER_STACK\fP
1871 Collect a user space stack instead of a kernel stack.
1873 .B \fBBPF_F_USER_BUILD_ID\fP
1874 Collect buildid+offset instead of ips for user stack,
1875 only valid if \fBBPF_F_USER_STACK\fP is also specified.
1878 \fBbpf_get_stack\fP() can collect up to
1879 \fBPERF_MAX_STACK_DEPTH\fP both kernel and user frames, subject
1880 to sufficient large buffer size. Note that
1881 this limit can be controlled with the \fBsysctl\fP program, and
1882 that it should be manually increased in order to profile long
1883 user stacks (such as stacks for Java programs). To do so, use:
1889 # sysctl kernel.perf_event_max_stack=<new value>
1896 A non\-negative value equal to or less than \fIsize\fP on success,
1897 or a negative error in case of failure.
1900 .B \fBint bpf_skb_load_bytes_relative(const void *\fP\fIskb\fP\fB, u32\fP \fIoffset\fP\fB, void *\fP\fIto\fP\fB, u32\fP \fIlen\fP\fB, u32\fP \fIstart_header\fP\fB)\fP
1904 This helper is similar to \fBbpf_skb_load_bytes\fP() in that
1905 it provides an easy way to load \fIlen\fP bytes from \fIoffset\fP
1906 from the packet associated to \fIskb\fP, into the buffer pointed
1907 by \fIto\fP\&. The difference to \fBbpf_skb_load_bytes\fP() is that
1908 a fifth argument \fIstart_header\fP exists in order to select a
1909 base offset to start from. \fIstart_header\fP can be one of:
1912 .B \fBBPF_HDR_START_MAC\fP
1913 Base offset to load data from is \fIskb\fP\(aqs mac header.
1915 .B \fBBPF_HDR_START_NET\fP
1916 Base offset to load data from is \fIskb\fP\(aqs network header.
1919 In general, "direct packet access" is the preferred method to
1920 access packet data, however, this helper is in particular useful
1921 in socket filters where \fIskb\fP\fB\->data\fP does not always point
1922 to the start of the mac header and where "direct packet access"
1926 0 on success, or a negative error in case of failure.
1929 .B \fBint bpf_fib_lookup(void *\fP\fIctx\fP\fB, struct bpf_fib_lookup *\fP\fIparams\fP\fB, int\fP \fIplen\fP\fB, u32\fP \fIflags\fP\fB)\fP
1933 Do FIB lookup in kernel tables using parameters in \fIparams\fP\&.
1934 If lookup is successful and result shows packet is to be
1935 forwarded, the neighbor tables are searched for the nexthop.
1936 If successful (ie., FIB lookup shows forwarding and nexthop
1937 is resolved), the nexthop address is returned in ipv4_dst
1938 or ipv6_dst based on family, smac is set to mac address of
1939 egress device, dmac is set to nexthop mac address, rt_metric
1940 is set to metric from route (IPv4/IPv6 only), and ifindex
1941 is set to the device index of the nexthop from the FIB lookup.
1943 \fIplen\fP argument is the size of the passed in struct.
1944 \fIflags\fP argument can be a combination of one or more of the
1948 .B \fBBPF_FIB_LOOKUP_DIRECT\fP
1949 Do a direct table lookup vs full lookup using FIB
1952 .B \fBBPF_FIB_LOOKUP_OUTPUT\fP
1953 Perform lookup from an egress perspective (default is
1957 \fIctx\fP is either \fBstruct xdp_md\fP for XDP programs or
1958 \fBstruct sk_buff\fP tc cls_act programs.
1963 < 0 if any input argument is invalid
1965 0 on success (packet is forwarded, nexthop neighbor exists)
1967 > 0 one of \fBBPF_FIB_LKUP_RET_\fP codes explaining why the
1968 packet is not forwarded or needs assist from full stack
1972 .B \fBint bpf_sock_hash_update(struct bpf_sock_ops *\fP\fIskops\fP\fB, struct bpf_map *\fP\fImap\fP\fB, void *\fP\fIkey\fP\fB, u64\fP \fIflags\fP\fB)\fP
1976 Add an entry to, or update a sockhash \fImap\fP referencing sockets.
1977 The \fIskops\fP is used as a new value for the entry associated to
1978 \fIkey\fP\&. \fIflags\fP is one of:
1981 .B \fBBPF_NOEXIST\fP
1982 The entry for \fIkey\fP must not exist in the map.
1985 The entry for \fIkey\fP must already exist in the map.
1988 No condition on the existence of the entry for \fIkey\fP\&.
1991 If the \fImap\fP has eBPF programs (parser and verdict), those will
1992 be inherited by the socket being added. If the socket is
1993 already attached to eBPF programs, this results in an error.
1996 0 on success, or a negative error in case of failure.
1999 .B \fBint bpf_msg_redirect_hash(struct sk_msg_buff *\fP\fImsg\fP\fB, struct bpf_map *\fP\fImap\fP\fB, void *\fP\fIkey\fP\fB, u64\fP \fIflags\fP\fB)\fP
2003 This helper is used in programs implementing policies at the
2004 socket level. If the message \fImsg\fP is allowed to pass (i.e. if
2005 the verdict eBPF program returns \fBSK_PASS\fP), redirect it to
2006 the socket referenced by \fImap\fP (of type
2007 \fBBPF_MAP_TYPE_SOCKHASH\fP) using hash \fIkey\fP\&. Both ingress and
2008 egress interfaces can be used for redirection. The
2009 \fBBPF_F_INGRESS\fP value in \fIflags\fP is used to make the
2010 distinction (ingress path is selected if the flag is present,
2011 egress path otherwise). This is the only flag supported for now.
2014 \fBSK_PASS\fP on success, or \fBSK_DROP\fP on error.
2017 .B \fBint bpf_sk_redirect_hash(struct sk_buff *\fP\fIskb\fP\fB, struct bpf_map *\fP\fImap\fP\fB, void *\fP\fIkey\fP\fB, u64\fP \fIflags\fP\fB)\fP
2021 This helper is used in programs implementing policies at the
2022 skb socket level. If the sk_buff \fIskb\fP is allowed to pass (i.e.
2023 if the verdeict eBPF program returns \fBSK_PASS\fP), redirect it
2024 to the socket referenced by \fImap\fP (of type
2025 \fBBPF_MAP_TYPE_SOCKHASH\fP) using hash \fIkey\fP\&. Both ingress and
2026 egress interfaces can be used for redirection. The
2027 \fBBPF_F_INGRESS\fP value in \fIflags\fP is used to make the
2028 distinction (ingress path is selected if the flag is present,
2029 egress otherwise). This is the only flag supported for now.
2032 \fBSK_PASS\fP on success, or \fBSK_DROP\fP on error.
2035 .B \fBint bpf_lwt_push_encap(struct sk_buff *\fP\fIskb\fP\fB, u32\fP \fItype\fP\fB, void *\fP\fIhdr\fP\fB, u32\fP \fIlen\fP\fB)\fP
2039 Encapsulate the packet associated to \fIskb\fP within a Layer 3
2040 protocol header. This header is provided in the buffer at
2041 address \fIhdr\fP, with \fIlen\fP its size in bytes. \fItype\fP indicates
2042 the protocol of the header and can be one of:
2045 .B \fBBPF_LWT_ENCAP_SEG6\fP
2046 IPv6 encapsulation with Segment Routing Header
2047 (\fBstruct ipv6_sr_hdr\fP). \fIhdr\fP only contains the SRH,
2048 the IPv6 header is computed by the kernel.
2050 .B \fBBPF_LWT_ENCAP_SEG6_INLINE\fP
2051 Only works if \fIskb\fP contains an IPv6 packet. Insert a
2052 Segment Routing Header (\fBstruct ipv6_sr_hdr\fP) inside
2055 .B \fBBPF_LWT_ENCAP_IP\fP
2056 IP encapsulation (GRE/GUE/IPIP/etc). The outer header
2057 must be IPv4 or IPv6, followed by zero or more
2058 additional headers, up to \fBLWT_BPF_MAX_HEADROOM\fP
2059 total bytes in all prepended headers. Please note that
2060 if \fBskb_is_gso\fP(\fIskb\fP) is true, no more than two
2061 headers can be prepended, and the inner header, if
2062 present, should be either GRE or UDP/GUE.
2065 \fBBPF_LWT_ENCAP_SEG6\fP* types can be called by BPF programs
2066 of type \fBBPF_PROG_TYPE_LWT_IN\fP; \fBBPF_LWT_ENCAP_IP\fP type can
2067 be called by bpf programs of types \fBBPF_PROG_TYPE_LWT_IN\fP and
2068 \fBBPF_PROG_TYPE_LWT_XMIT\fP\&.
2070 A call to this helper is susceptible to change the underlying
2071 packet buffer. Therefore, at load time, all checks on pointers
2072 previously done by the verifier are invalidated and must be
2073 performed again, if the helper is used in combination with
2074 direct packet access.
2077 0 on success, or a negative error in case of failure.
2080 .B \fBint bpf_lwt_seg6_store_bytes(struct sk_buff *\fP\fIskb\fP\fB, u32\fP \fIoffset\fP\fB, const void *\fP\fIfrom\fP\fB, u32\fP \fIlen\fP\fB)\fP
2084 Store \fIlen\fP bytes from address \fIfrom\fP into the packet
2085 associated to \fIskb\fP, at \fIoffset\fP\&. Only the flags, tag and TLVs
2086 inside the outermost IPv6 Segment Routing Header can be
2087 modified through this helper.
2089 A call to this helper is susceptible to change the underlying
2090 packet buffer. Therefore, at load time, all checks on pointers
2091 previously done by the verifier are invalidated and must be
2092 performed again, if the helper is used in combination with
2093 direct packet access.
2096 0 on success, or a negative error in case of failure.
2099 .B \fBint bpf_lwt_seg6_adjust_srh(struct sk_buff *\fP\fIskb\fP\fB, u32\fP \fIoffset\fP\fB, s32\fP \fIdelta\fP\fB)\fP
2103 Adjust the size allocated to TLVs in the outermost IPv6
2104 Segment Routing Header contained in the packet associated to
2105 \fIskb\fP, at position \fIoffset\fP by \fIdelta\fP bytes. Only offsets
2106 after the segments are accepted. \fIdelta\fP can be as well
2107 positive (growing) as negative (shrinking).
2109 A call to this helper is susceptible to change the underlying
2110 packet buffer. Therefore, at load time, all checks on pointers
2111 previously done by the verifier are invalidated and must be
2112 performed again, if the helper is used in combination with
2113 direct packet access.
2116 0 on success, or a negative error in case of failure.
2119 .B \fBint bpf_lwt_seg6_action(struct sk_buff *\fP\fIskb\fP\fB, u32\fP \fIaction\fP\fB, void *\fP\fIparam\fP\fB, u32\fP \fIparam_len\fP\fB)\fP
2123 Apply an IPv6 Segment Routing action of type \fIaction\fP to the
2124 packet associated to \fIskb\fP\&. Each action takes a parameter
2125 contained at address \fIparam\fP, and of length \fIparam_len\fP bytes.
2126 \fIaction\fP can be one of:
2129 .B \fBSEG6_LOCAL_ACTION_END_X\fP
2130 End.X action: Endpoint with Layer\-3 cross\-connect.
2131 Type of \fIparam\fP: \fBstruct in6_addr\fP\&.
2133 .B \fBSEG6_LOCAL_ACTION_END_T\fP
2134 End.T action: Endpoint with specific IPv6 table lookup.
2135 Type of \fIparam\fP: \fBint\fP\&.
2137 .B \fBSEG6_LOCAL_ACTION_END_B6\fP
2138 End.B6 action: Endpoint bound to an SRv6 policy.
2139 Type of \fIparam\fP: \fBstruct ipv6_sr_hdr\fP\&.
2141 .B \fBSEG6_LOCAL_ACTION_END_B6_ENCAP\fP
2142 End.B6.Encap action: Endpoint bound to an SRv6
2143 encapsulation policy.
2144 Type of \fIparam\fP: \fBstruct ipv6_sr_hdr\fP\&.
2147 A call to this helper is susceptible to change the underlying
2148 packet buffer. Therefore, at load time, all checks on pointers
2149 previously done by the verifier are invalidated and must be
2150 performed again, if the helper is used in combination with
2151 direct packet access.
2154 0 on success, or a negative error in case of failure.
2157 .B \fBint bpf_rc_repeat(void *\fP\fIctx\fP\fB)\fP
2161 This helper is used in programs implementing IR decoding, to
2162 report a successfully decoded repeat key message. This delays
2163 the generation of a key up event for previously generated
2166 Some IR protocols like NEC have a special IR message for
2167 repeating last button, for when a button is held down.
2169 The \fIctx\fP should point to the lirc sample as passed into
2172 This helper is only available is the kernel was compiled with
2173 the \fBCONFIG_BPF_LIRC_MODE2\fP configuration option set to
2180 .B \fBint bpf_rc_keydown(void *\fP\fIctx\fP\fB, u32\fP \fIprotocol\fP\fB, u64\fP \fIscancode\fP\fB, u32\fP \fItoggle\fP\fB)\fP
2184 This helper is used in programs implementing IR decoding, to
2185 report a successfully decoded key press with \fIscancode\fP,
2186 \fItoggle\fP value in the given \fIprotocol\fP\&. The scancode will be
2187 translated to a keycode using the rc keymap, and reported as
2188 an input key down event. After a period a key up event is
2189 generated. This period can be extended by calling either
2190 \fBbpf_rc_keydown\fP() again with the same values, or calling
2191 \fBbpf_rc_repeat\fP().
2193 Some protocols include a toggle bit, in case the button was
2194 released and pressed again between consecutive scancodes.
2196 The \fIctx\fP should point to the lirc sample as passed into
2199 The \fIprotocol\fP is the decoded protocol number (see
2200 \fBenum rc_proto\fP for some predefined values).
2202 This helper is only available is the kernel was compiled with
2203 the \fBCONFIG_BPF_LIRC_MODE2\fP configuration option set to
2210 .B \fBu64 bpf_skb_cgroup_id(struct sk_buff *\fP\fIskb\fP\fB)\fP
2214 Return the cgroup v2 id of the socket associated with the \fIskb\fP\&.
2215 This is roughly similar to the \fBbpf_get_cgroup_classid\fP()
2216 helper for cgroup v1 by providing a tag resp. identifier that
2217 can be matched on or used for map lookups e.g. to implement
2218 policy. The cgroup v2 id of a given path in the hierarchy is
2219 exposed in user space through the f_handle API in order to get
2220 to the same 64\-bit id.
2222 This helper can be used on TC egress path, but not on ingress,
2223 and is available only if the kernel was compiled with the
2224 \fBCONFIG_SOCK_CGROUP_DATA\fP configuration option.
2227 The id is returned or 0 in case the id could not be retrieved.
2230 .B \fBu64 bpf_get_current_cgroup_id(void)\fP
2234 A 64\-bit integer containing the current cgroup id based
2235 on the cgroup within which the current task is running.
2238 .B \fBvoid *bpf_get_local_storage(void *\fP\fImap\fP\fB, u64\fP \fIflags\fP\fB)\fP
2242 Get the pointer to the local storage area.
2243 The type and the size of the local storage is defined
2244 by the \fImap\fP argument.
2245 The \fIflags\fP meaning is specific for each map type,
2246 and has to be 0 for cgroup local storage.
2248 Depending on the BPF program type, a local storage area
2249 can be shared between multiple instances of the BPF program,
2250 running simultaneously.
2252 A user should care about the synchronization by himself.
2253 For example, by using the \fBBPF_STX_XADD\fP instruction to alter
2257 A pointer to the local storage area.
2260 .B \fBint bpf_sk_select_reuseport(struct sk_reuseport_md *\fP\fIreuse\fP\fB, struct bpf_map *\fP\fImap\fP\fB, void *\fP\fIkey\fP\fB, u64\fP \fIflags\fP\fB)\fP
2264 Select a \fBSO_REUSEPORT\fP socket from a
2265 \fBBPF_MAP_TYPE_REUSEPORT_ARRAY\fP \fImap\fP\&.
2266 It checks the selected socket is matching the incoming
2267 request in the socket buffer.
2270 0 on success, or a negative error in case of failure.
2273 .B \fBu64 bpf_skb_ancestor_cgroup_id(struct sk_buff *\fP\fIskb\fP\fB, int\fP \fIancestor_level\fP\fB)\fP
2277 Return id of cgroup v2 that is ancestor of cgroup associated
2278 with the \fIskb\fP at the \fIancestor_level\fP\&. The root cgroup is at
2279 \fIancestor_level\fP zero and each step down the hierarchy
2280 increments the level. If \fIancestor_level\fP == level of cgroup
2281 associated with \fIskb\fP, then return value will be same as that
2282 of \fBbpf_skb_cgroup_id\fP().
2284 The helper is useful to implement policies based on cgroups
2285 that are upper in hierarchy than immediate cgroup associated
2288 The format of returned id and helper limitations are same as in
2289 \fBbpf_skb_cgroup_id\fP().
2292 The id is returned or 0 in case the id could not be retrieved.
2295 .B \fBstruct bpf_sock *bpf_sk_lookup_tcp(void *\fP\fIctx\fP\fB, struct bpf_sock_tuple *\fP\fItuple\fP\fB, u32\fP \fItuple_size\fP\fB, u64\fP \fInetns\fP\fB, u64\fP \fIflags\fP\fB)\fP
2299 Look for TCP socket matching \fItuple\fP, optionally in a child
2300 network namespace \fInetns\fP\&. The return value must be checked,
2301 and if non\-\fBNULL\fP, released via \fBbpf_sk_release\fP().
2303 The \fIctx\fP should point to the context of the program, such as
2304 the skb or socket (depending on the hook in use). This is used
2305 to determine the base network namespace for the lookup.
2307 \fItuple_size\fP must be one of:
2310 .B \fBsizeof\fP(\fItuple\fP\fB\->ipv4\fP)
2311 Look for an IPv4 socket.
2313 .B \fBsizeof\fP(\fItuple\fP\fB\->ipv6\fP)
2314 Look for an IPv6 socket.
2317 If the \fInetns\fP is a negative signed 32\-bit integer, then the
2318 socket lookup table in the netns associated with the \fIctx\fP will
2319 will be used. For the TC hooks, this is the netns of the device
2320 in the skb. For socket hooks, this is the netns of the socket.
2321 If \fInetns\fP is any other signed 32\-bit value greater than or
2322 equal to zero then it specifies the ID of the netns relative to
2323 the netns associated with the \fIctx\fP\&. \fInetns\fP values beyond the
2324 range of 32\-bit integers are reserved for future use.
2326 All values for \fIflags\fP are reserved for future usage, and must
2329 This helper is available only if the kernel was compiled with
2330 \fBCONFIG_NET\fP configuration option.
2333 Pointer to \fBstruct bpf_sock\fP, or \fBNULL\fP in case of failure.
2334 For sockets with reuseport option, the \fBstruct bpf_sock\fP
2335 result is from \fIreuse\fP\fB\->socks\fP[] using the hash of the
2339 .B \fBstruct bpf_sock *bpf_sk_lookup_udp(void *\fP\fIctx\fP\fB, struct bpf_sock_tuple *\fP\fItuple\fP\fB, u32\fP \fItuple_size\fP\fB, u64\fP \fInetns\fP\fB, u64\fP \fIflags\fP\fB)\fP
2343 Look for UDP socket matching \fItuple\fP, optionally in a child
2344 network namespace \fInetns\fP\&. The return value must be checked,
2345 and if non\-\fBNULL\fP, released via \fBbpf_sk_release\fP().
2347 The \fIctx\fP should point to the context of the program, such as
2348 the skb or socket (depending on the hook in use). This is used
2349 to determine the base network namespace for the lookup.
2351 \fItuple_size\fP must be one of:
2354 .B \fBsizeof\fP(\fItuple\fP\fB\->ipv4\fP)
2355 Look for an IPv4 socket.
2357 .B \fBsizeof\fP(\fItuple\fP\fB\->ipv6\fP)
2358 Look for an IPv6 socket.
2361 If the \fInetns\fP is a negative signed 32\-bit integer, then the
2362 socket lookup table in the netns associated with the \fIctx\fP will
2363 will be used. For the TC hooks, this is the netns of the device
2364 in the skb. For socket hooks, this is the netns of the socket.
2365 If \fInetns\fP is any other signed 32\-bit value greater than or
2366 equal to zero then it specifies the ID of the netns relative to
2367 the netns associated with the \fIctx\fP\&. \fInetns\fP values beyond the
2368 range of 32\-bit integers are reserved for future use.
2370 All values for \fIflags\fP are reserved for future usage, and must
2373 This helper is available only if the kernel was compiled with
2374 \fBCONFIG_NET\fP configuration option.
2377 Pointer to \fBstruct bpf_sock\fP, or \fBNULL\fP in case of failure.
2378 For sockets with reuseport option, the \fBstruct bpf_sock\fP
2379 result is from \fIreuse\fP\fB\->socks\fP[] using the hash of the
2383 .B \fBint bpf_sk_release(struct bpf_sock *\fP\fIsock\fP\fB)\fP
2387 Release the reference held by \fIsock\fP\&. \fIsock\fP must be a
2388 non\-\fBNULL\fP pointer that was returned from
2389 \fBbpf_sk_lookup_xxx\fP().
2392 0 on success, or a negative error in case of failure.
2395 .B \fBint bpf_map_push_elem(struct bpf_map *\fP\fImap\fP\fB, const void *\fP\fIvalue\fP\fB, u64\fP \fIflags\fP\fB)\fP
2399 Push an element \fIvalue\fP in \fImap\fP\&. \fIflags\fP is one of:
2403 If the queue/stack is full, the oldest element is
2404 removed to make room for this.
2408 0 on success, or a negative error in case of failure.
2411 .B \fBint bpf_map_pop_elem(struct bpf_map *\fP\fImap\fP\fB, void *\fP\fIvalue\fP\fB)\fP
2415 Pop an element from \fImap\fP\&.
2418 0 on success, or a negative error in case of failure.
2421 .B \fBint bpf_map_peek_elem(struct bpf_map *\fP\fImap\fP\fB, void *\fP\fIvalue\fP\fB)\fP
2425 Get an element from \fImap\fP without removing it.
2428 0 on success, or a negative error in case of failure.
2431 .B \fBint bpf_msg_push_data(struct sk_msg_buff *\fP\fImsg\fP\fB, u32\fP \fIstart\fP\fB, u32\fP \fIlen\fP\fB, u64\fP \fIflags\fP\fB)\fP
2435 For socket policies, insert \fIlen\fP bytes into \fImsg\fP at offset
2438 If a program of type \fBBPF_PROG_TYPE_SK_MSG\fP is run on a
2439 \fImsg\fP it may want to insert metadata or options into the \fImsg\fP\&.
2440 This can later be read and used by any of the lower layer BPF
2443 This helper may fail if under memory pressure (a malloc
2444 fails) in these cases BPF programs will get an appropriate
2445 error and BPF programs will need to handle them.
2448 0 on success, or a negative error in case of failure.
2451 .B \fBint bpf_msg_pop_data(struct sk_msg_buff *\fP\fImsg\fP\fB, u32\fP \fIstart\fP\fB, u32\fP \fIlen\fP\fB, u64\fP \fIflags\fP\fB)\fP
2455 Will remove \fIlen\fP bytes from a \fImsg\fP starting at byte \fIstart\fP\&.
2456 This may result in \fBENOMEM\fP errors under certain situations if
2457 an allocation and copy are required due to a full ring buffer.
2458 However, the helper will try to avoid doing the allocation
2459 if possible. Other errors can occur if input parameters are
2460 invalid either due to \fIstart\fP byte not being valid part of \fImsg\fP
2461 payload and/or \fIpop\fP value being to large.
2464 0 on success, or a negative error in case of failure.
2467 .B \fBint bpf_rc_pointer_rel(void *\fP\fIctx\fP\fB, s32\fP \fIrel_x\fP\fB, s32\fP \fIrel_y\fP\fB)\fP
2471 This helper is used in programs implementing IR decoding, to
2472 report a successfully decoded pointer movement.
2474 The \fIctx\fP should point to the lirc sample as passed into
2477 This helper is only available is the kernel was compiled with
2478 the \fBCONFIG_BPF_LIRC_MODE2\fP configuration option set to
2485 .B \fBint bpf_spin_lock(struct bpf_spin_lock *\fP\fIlock\fP\fB)\fP
2489 Acquire a spinlock represented by the pointer \fIlock\fP, which is
2490 stored as part of a value of a map. Taking the lock allows to
2491 safely update the rest of the fields in that value. The
2492 spinlock can (and must) later be released with a call to
2493 \fBbpf_spin_unlock\fP(\fIlock\fP).
2495 Spinlocks in BPF programs come with a number of restrictions
2499 \fBbpf_spin_lock\fP objects are only allowed inside maps of
2500 types \fBBPF_MAP_TYPE_HASH\fP and \fBBPF_MAP_TYPE_ARRAY\fP (this
2501 list could be extended in the future).
2503 BTF description of the map is mandatory.
2505 The BPF program can take ONE lock at a time, since taking two
2506 or more could cause dead locks.
2508 Only one \fBstruct bpf_spin_lock\fP is allowed per map element.
2510 When the lock is taken, calls (either BPF to BPF or helpers)
2513 The \fBBPF_LD_ABS\fP and \fBBPF_LD_IND\fP instructions are not
2514 allowed inside a spinlock\-ed region.
2516 The BPF program MUST call \fBbpf_spin_unlock\fP() to release
2517 the lock, on all execution paths, before it returns.
2519 The BPF program can access \fBstruct bpf_spin_lock\fP only via
2520 the \fBbpf_spin_lock\fP() and \fBbpf_spin_unlock\fP()
2521 helpers. Loading or storing data into the \fBstruct
2522 bpf_spin_lock\fP \fIlock\fP\fB;\fP field of a map is not allowed.
2524 To use the \fBbpf_spin_lock\fP() helper, the BTF description
2525 of the map value must be a struct and have \fBstruct
2526 bpf_spin_lock\fP \fIanyname\fP\fB;\fP field at the top level.
2527 Nested lock inside another struct is not allowed.
2529 The \fBstruct bpf_spin_lock\fP \fIlock\fP field in a map value must
2530 be aligned on a multiple of 4 bytes in that value.
2532 Syscall with command \fBBPF_MAP_LOOKUP_ELEM\fP does not copy
2533 the \fBbpf_spin_lock\fP field to user space.
2535 Syscall with command \fBBPF_MAP_UPDATE_ELEM\fP, or update from
2536 a BPF program, do not update the \fBbpf_spin_lock\fP field.
2538 \fBbpf_spin_lock\fP cannot be on the stack or inside a
2539 networking packet (it can only be inside of a map values).
2541 \fBbpf_spin_lock\fP is available to root only.
2543 Tracing programs and socket filter programs cannot use
2544 \fBbpf_spin_lock\fP() due to insufficient preemption checks
2545 (but this may change in the future).
2547 \fBbpf_spin_lock\fP is not allowed in inner maps of map\-in\-map.
2554 .B \fBint bpf_spin_unlock(struct bpf_spin_lock *\fP\fIlock\fP\fB)\fP
2558 Release the \fIlock\fP previously locked by a call to
2559 \fBbpf_spin_lock\fP(\fIlock\fP).
2565 .B \fBstruct bpf_sock *bpf_sk_fullsock(struct bpf_sock *\fP\fIsk\fP\fB)\fP
2569 This helper gets a \fBstruct bpf_sock\fP pointer such
2570 that all the fields in this \fBbpf_sock\fP can be accessed.
2573 A \fBstruct bpf_sock\fP pointer on success, or \fBNULL\fP in
2577 .B \fBstruct bpf_tcp_sock *bpf_tcp_sock(struct bpf_sock *\fP\fIsk\fP\fB)\fP
2581 This helper gets a \fBstruct bpf_tcp_sock\fP pointer from a
2582 \fBstruct bpf_sock\fP pointer.
2585 A \fBstruct bpf_tcp_sock\fP pointer on success, or \fBNULL\fP in
2589 .B \fBint bpf_skb_ecn_set_ce(struct sk_buff *\fP\fIskb\fP\fB)\fP
2593 Set ECN (Explicit Congestion Notification) field of IP header
2594 to \fBCE\fP (Congestion Encountered) if current value is \fBECT\fP
2595 (ECN Capable Transport). Otherwise, do nothing. Works with IPv6
2599 1 if the \fBCE\fP flag is set (either by the current helper call
2600 or because it was already present), 0 if it is not set.
2603 .B \fBstruct bpf_sock *bpf_get_listener_sock(struct bpf_sock *\fP\fIsk\fP\fB)\fP
2607 Return a \fBstruct bpf_sock\fP pointer in \fBTCP_LISTEN\fP state.
2608 \fBbpf_sk_release\fP() is unnecessary and not allowed.
2611 A \fBstruct bpf_sock\fP pointer on success, or \fBNULL\fP in
2615 .B \fBstruct bpf_sock *bpf_skc_lookup_tcp(void *\fP\fIctx\fP\fB, struct bpf_sock_tuple *\fP\fItuple\fP\fB, u32\fP \fItuple_size\fP\fB, u64\fP \fInetns\fP\fB, u64\fP \fIflags\fP\fB)\fP
2619 Look for TCP socket matching \fItuple\fP, optionally in a child
2620 network namespace \fInetns\fP\&. The return value must be checked,
2621 and if non\-\fBNULL\fP, released via \fBbpf_sk_release\fP().
2623 This function is identical to \fBbpf_sk_lookup_tcp\fP(), except
2624 that it also returns timewait or request sockets. Use
2625 \fBbpf_sk_fullsock\fP() or \fBbpf_tcp_sock\fP() to access the
2628 This helper is available only if the kernel was compiled with
2629 \fBCONFIG_NET\fP configuration option.
2632 Pointer to \fBstruct bpf_sock\fP, or \fBNULL\fP in case of failure.
2633 For sockets with reuseport option, the \fBstruct bpf_sock\fP
2634 result is from \fIreuse\fP\fB\->socks\fP[] using the hash of the
2638 .B \fBint bpf_tcp_check_syncookie(struct bpf_sock *\fP\fIsk\fP\fB, void *\fP\fIiph\fP\fB, u32\fP \fIiph_len\fP\fB, struct tcphdr *\fP\fIth\fP\fB, u32\fP \fIth_len\fP\fB)\fP
2642 Check whether \fIiph\fP and \fIth\fP contain a valid SYN cookie ACK for
2643 the listening socket in \fIsk\fP\&.
2645 \fIiph\fP points to the start of the IPv4 or IPv6 header, while
2646 \fIiph_len\fP contains \fBsizeof\fP(\fBstruct iphdr\fP) or
2647 \fBsizeof\fP(\fBstruct ip6hdr\fP).
2649 \fIth\fP points to the start of the TCP header, while \fIth_len\fP
2650 contains \fBsizeof\fP(\fBstruct tcphdr\fP).
2653 0 if \fIiph\fP and \fIth\fP are a valid SYN cookie ACK, or a negative
2657 .B \fBint bpf_sysctl_get_name(struct bpf_sysctl *\fP\fIctx\fP\fB, char *\fP\fIbuf\fP\fB, size_t\fP \fIbuf_len\fP\fB, u64\fP \fIflags\fP\fB)\fP
2661 Get name of sysctl in /proc/sys/ and copy it into provided by
2662 program buffer \fIbuf\fP of size \fIbuf_len\fP\&.
2664 The buffer is always NUL terminated, unless it\(aqs zero\-sized.
2666 If \fIflags\fP is zero, full name (e.g. "net/ipv4/tcp_mem") is
2667 copied. Use \fBBPF_F_SYSCTL_BASE_NAME\fP flag to copy base name
2668 only (e.g. "tcp_mem").
2671 Number of character copied (not including the trailing NUL).
2673 \fB\-E2BIG\fP if the buffer wasn\(aqt big enough (\fIbuf\fP will contain
2674 truncated name in this case).
2677 .B \fBint bpf_sysctl_get_current_value(struct bpf_sysctl *\fP\fIctx\fP\fB, char *\fP\fIbuf\fP\fB, size_t\fP \fIbuf_len\fP\fB)\fP
2681 Get current value of sysctl as it is presented in /proc/sys
2682 (incl. newline, etc), and copy it as a string into provided
2683 by program buffer \fIbuf\fP of size \fIbuf_len\fP\&.
2685 The whole value is copied, no matter what file position user
2686 space issued e.g. sys_read at.
2688 The buffer is always NUL terminated, unless it\(aqs zero\-sized.
2691 Number of character copied (not including the trailing NUL).
2693 \fB\-E2BIG\fP if the buffer wasn\(aqt big enough (\fIbuf\fP will contain
2694 truncated name in this case).
2696 \fB\-EINVAL\fP if current value was unavailable, e.g. because
2697 sysctl is uninitialized and read returns \-EIO for it.
2700 .B \fBint bpf_sysctl_get_new_value(struct bpf_sysctl *\fP\fIctx\fP\fB, char *\fP\fIbuf\fP\fB, size_t\fP \fIbuf_len\fP\fB)\fP
2704 Get new value being written by user space to sysctl (before
2705 the actual write happens) and copy it as a string into
2706 provided by program buffer \fIbuf\fP of size \fIbuf_len\fP\&.
2708 User space may write new value at file position > 0.
2710 The buffer is always NUL terminated, unless it\(aqs zero\-sized.
2713 Number of character copied (not including the trailing NUL).
2715 \fB\-E2BIG\fP if the buffer wasn\(aqt big enough (\fIbuf\fP will contain
2716 truncated name in this case).
2718 \fB\-EINVAL\fP if sysctl is being read.
2721 .B \fBint bpf_sysctl_set_new_value(struct bpf_sysctl *\fP\fIctx\fP\fB, const char *\fP\fIbuf\fP\fB, size_t\fP \fIbuf_len\fP\fB)\fP
2725 Override new value being written by user space to sysctl with
2726 value provided by program in buffer \fIbuf\fP of size \fIbuf_len\fP\&.
2728 \fIbuf\fP should contain a string in same form as provided by user
2729 space on sysctl write.
2731 User space may write new value at file position > 0. To override
2732 the whole sysctl value file position should be set to zero.
2737 \fB\-E2BIG\fP if the \fIbuf_len\fP is too big.
2739 \fB\-EINVAL\fP if sysctl is being read.
2742 .B \fBint bpf_strtol(const char *\fP\fIbuf\fP\fB, size_t\fP \fIbuf_len\fP\fB, u64\fP \fIflags\fP\fB, long *\fP\fIres\fP\fB)\fP
2746 Convert the initial part of the string from buffer \fIbuf\fP of
2747 size \fIbuf_len\fP to a long integer according to the given base
2748 and save the result in \fIres\fP\&.
2750 The string may begin with an arbitrary amount of white space
2751 (as determined by \fBisspace\fP(3)) followed by a single
2752 optional \(aq\fB\-\fP\(aq sign.
2754 Five least significant bits of \fIflags\fP encode base, other bits
2755 are currently unused.
2757 Base must be either 8, 10, 16 or 0 to detect it automatically
2758 similar to user space \fBstrtol\fP(3).
2761 Number of characters consumed on success. Must be positive but
2762 no more than \fIbuf_len\fP\&.
2764 \fB\-EINVAL\fP if no valid digits were found or unsupported base
2767 \fB\-ERANGE\fP if resulting value was out of range.
2770 .B \fBint bpf_strtoul(const char *\fP\fIbuf\fP\fB, size_t\fP \fIbuf_len\fP\fB, u64\fP \fIflags\fP\fB, unsigned long *\fP\fIres\fP\fB)\fP
2774 Convert the initial part of the string from buffer \fIbuf\fP of
2775 size \fIbuf_len\fP to an unsigned long integer according to the
2776 given base and save the result in \fIres\fP\&.
2778 The string may begin with an arbitrary amount of white space
2779 (as determined by \fBisspace\fP(3)).
2781 Five least significant bits of \fIflags\fP encode base, other bits
2782 are currently unused.
2784 Base must be either 8, 10, 16 or 0 to detect it automatically
2785 similar to user space \fBstrtoul\fP(3).
2788 Number of characters consumed on success. Must be positive but
2789 no more than \fIbuf_len\fP\&.
2791 \fB\-EINVAL\fP if no valid digits were found or unsupported base
2794 \fB\-ERANGE\fP if resulting value was out of range.
2797 .B \fBvoid *bpf_sk_storage_get(struct bpf_map *\fP\fImap\fP\fB, struct bpf_sock *\fP\fIsk\fP\fB, void *\fP\fIvalue\fP\fB, u64\fP \fIflags\fP\fB)\fP
2801 Get a bpf\-local\-storage from a \fIsk\fP\&.
2803 Logically, it could be thought of getting the value from
2804 a \fImap\fP with \fIsk\fP as the \fBkey\fP\&. From this
2805 perspective, the usage is not much different from
2806 \fBbpf_map_lookup_elem\fP(\fImap\fP, \fB&\fP\fIsk\fP) except this
2807 helper enforces the key must be a full socket and the map must
2808 be a \fBBPF_MAP_TYPE_SK_STORAGE\fP also.
2810 Underneath, the value is stored locally at \fIsk\fP instead of
2811 the \fImap\fP\&. The \fImap\fP is used as the bpf\-local\-storage
2812 "type". The bpf\-local\-storage "type" (i.e. the \fImap\fP) is
2813 searched against all bpf\-local\-storages residing at \fIsk\fP\&.
2815 An optional \fIflags\fP (\fBBPF_SK_STORAGE_GET_F_CREATE\fP) can be
2816 used such that a new bpf\-local\-storage will be
2817 created if one does not exist. \fIvalue\fP can be used
2818 together with \fBBPF_SK_STORAGE_GET_F_CREATE\fP to specify
2819 the initial value of a bpf\-local\-storage. If \fIvalue\fP is
2820 \fBNULL\fP, the new bpf\-local\-storage will be zero initialized.
2823 A bpf\-local\-storage pointer is returned on success.
2825 \fBNULL\fP if not found or there was an error in adding
2826 a new bpf\-local\-storage.
2829 .B \fBint bpf_sk_storage_delete(struct bpf_map *\fP\fImap\fP\fB, struct bpf_sock *\fP\fIsk\fP\fB)\fP
2833 Delete a bpf\-local\-storage from a \fIsk\fP\&.
2838 \fB\-ENOENT\fP if the bpf\-local\-storage cannot be found.
2841 .B \fBint bpf_send_signal(u32\fP \fIsig\fP\fB)\fP
2845 Send signal \fIsig\fP to the process of the current task.
2846 The signal may be delivered to any of this process\(aqs threads.
2849 0 on success or successfully queued.
2851 \fB\-EBUSY\fP if work queue under nmi is full.
2853 \fB\-EINVAL\fP if \fIsig\fP is invalid.
2855 \fB\-EPERM\fP if no permission to send the \fIsig\fP\&.
2857 \fB\-EAGAIN\fP if bpf program can try again.
2860 .B \fBs64 bpf_tcp_gen_syncookie(struct bpf_sock *\fP\fIsk\fP\fB, void *\fP\fIiph\fP\fB, u32\fP \fIiph_len\fP\fB, struct tcphdr *\fP\fIth\fP\fB, u32\fP \fIth_len\fP\fB)\fP
2864 Try to issue a SYN cookie for the packet with corresponding
2865 IP/TCP headers, \fIiph\fP and \fIth\fP, on the listening socket in \fIsk\fP\&.
2867 \fIiph\fP points to the start of the IPv4 or IPv6 header, while
2868 \fIiph_len\fP contains \fBsizeof\fP(\fBstruct iphdr\fP) or
2869 \fBsizeof\fP(\fBstruct ip6hdr\fP).
2871 \fIth\fP points to the start of the TCP header, while \fIth_len\fP
2872 contains the length of the TCP header.
2875 On success, lower 32 bits hold the generated SYN cookie in
2876 followed by 16 bits which hold the MSS value for that cookie,
2877 and the top 16 bits are unused.
2879 On failure, the returned value is one of the following:
2881 \fB\-EINVAL\fP SYN cookie cannot be issued due to error
2883 \fB\-ENOENT\fP SYN cookie should not be issued (no SYN flood)
2885 \fB\-EOPNOTSUPP\fP kernel configuration does not enable SYN cookies
2887 \fB\-EPROTONOSUPPORT\fP IP packet version is not 4 or 6
2890 .B \fBint bpf_skb_output(void *\fP\fIctx\fP\fB, struct bpf_map *\fP\fImap\fP\fB, u64\fP \fIflags\fP\fB, void *\fP\fIdata\fP\fB, u64\fP \fIsize\fP\fB)\fP
2894 Write raw \fIdata\fP blob into a special BPF perf event held by
2895 \fImap\fP of type \fBBPF_MAP_TYPE_PERF_EVENT_ARRAY\fP\&. This perf
2896 event must have the following attributes: \fBPERF_SAMPLE_RAW\fP
2897 as \fBsample_type\fP, \fBPERF_TYPE_SOFTWARE\fP as \fBtype\fP, and
2898 \fBPERF_COUNT_SW_BPF_OUTPUT\fP as \fBconfig\fP\&.
2900 The \fIflags\fP are used to indicate the index in \fImap\fP for which
2901 the value must be put, masked with \fBBPF_F_INDEX_MASK\fP\&.
2902 Alternatively, \fIflags\fP can be set to \fBBPF_F_CURRENT_CPU\fP
2903 to indicate that the index of the current CPU core should be
2906 The value to write, of \fIsize\fP, is passed through eBPF stack and
2907 pointed by \fIdata\fP\&.
2909 \fIctx\fP is a pointer to in\-kernel struct sk_buff.
2911 This helper is similar to \fBbpf_perf_event_output\fP() but
2912 restricted to raw_tracepoint bpf programs.
2915 0 on success, or a negative error in case of failure.
2918 .B \fBint bpf_probe_read_user(void *\fP\fIdst\fP\fB, u32\fP \fIsize\fP\fB, const void *\fP\fIunsafe_ptr\fP\fB)\fP
2922 Safely attempt to read \fIsize\fP bytes from user space address
2923 \fIunsafe_ptr\fP and store the data in \fIdst\fP\&.
2926 0 on success, or a negative error in case of failure.
2929 .B \fBint bpf_probe_read_kernel(void *\fP\fIdst\fP\fB, u32\fP \fIsize\fP\fB, const void *\fP\fIunsafe_ptr\fP\fB)\fP
2933 Safely attempt to read \fIsize\fP bytes from kernel space address
2934 \fIunsafe_ptr\fP and store the data in \fIdst\fP\&.
2937 0 on success, or a negative error in case of failure.
2940 .B \fBint bpf_probe_read_user_str(void *\fP\fIdst\fP\fB, u32\fP \fIsize\fP\fB, const void *\fP\fIunsafe_ptr\fP\fB)\fP
2944 Copy a NUL terminated string from an unsafe user address
2945 \fIunsafe_ptr\fP to \fIdst\fP\&. The \fIsize\fP should include the
2946 terminating NUL byte. In case the string length is smaller than
2947 \fIsize\fP, the target is not padded with further NUL bytes. If the
2948 string length is larger than \fIsize\fP, just \fIsize\fP\-1 bytes are
2949 copied and the last byte is set to NUL.
2951 On success, the length of the copied string is returned. This
2952 makes this helper useful in tracing programs for reading
2953 strings, and more importantly to get its length at runtime. See
2954 the following snippet:
2960 SEC("kprobe/sys_open")
2961 void bpf_sys_open(struct pt_regs *ctx)
2963 char buf[PATHLEN]; // PATHLEN is defined to 256
2964 int res = bpf_probe_read_user_str(buf, sizeof(buf),
2967 // Consume buf, for example push it to
2968 // userspace via bpf_perf_event_output(); we
2969 // can use res (the string length) as event
2970 // size, after checking its boundaries.
2977 In comparison, using \fBbpf_probe_read_user()\fP helper here
2978 instead to read the string would require to estimate the length
2979 at compile time, and would often result in copying more memory
2982 Another useful use case is when parsing individual process
2983 arguments or individual environment variables navigating
2984 \fIcurrent\fP\fB\->mm\->arg_start\fP and \fIcurrent\fP\fB\->mm\->env_start\fP: using this helper and the return value,
2985 one can quickly iterate at the right offset of the memory area.
2988 On success, the strictly positive length of the string,
2989 including the trailing NUL character. On error, a negative
2993 .B \fBint bpf_probe_read_kernel_str(void *\fP\fIdst\fP\fB, u32\fP \fIsize\fP\fB, const void *\fP\fIunsafe_ptr\fP\fB)\fP
2997 Copy a NUL terminated string from an unsafe kernel address \fIunsafe_ptr\fP
2998 to \fIdst\fP\&. Same semantics as with bpf_probe_read_user_str() apply.
3001 On success, the strictly positive length of the string, including
3002 the trailing NUL character. On error, a negative value.
3005 .B \fBint bpf_tcp_send_ack(void *\fP\fItp\fP\fB, u32\fP \fIrcv_nxt\fP\fB)\fP
3009 Send out a tcp\-ack. \fItp\fP is the in\-kernel struct tcp_sock.
3010 \fIrcv_nxt\fP is the ack_seq to be sent out.
3013 0 on success, or a negative error in case of failure.
3016 .B \fBint bpf_send_signal_thread(u32\fP \fIsig\fP\fB)\fP
3020 Send signal \fIsig\fP to the thread corresponding to the current task.
3023 0 on success or successfully queued.
3025 \fB\-EBUSY\fP if work queue under nmi is full.
3027 \fB\-EINVAL\fP if \fIsig\fP is invalid.
3029 \fB\-EPERM\fP if no permission to send the \fIsig\fP\&.
3031 \fB\-EAGAIN\fP if bpf program can try again.
3034 .B \fBu64 bpf_jiffies64(void)\fP
3038 Obtain the 64bit jiffies
3044 .B \fBint bpf_read_branch_records(struct bpf_perf_event_data *\fP\fIctx\fP\fB, void *\fP\fIbuf\fP\fB, u32\fP \fIsize\fP\fB, u64\fP \fIflags\fP\fB)\fP
3048 For an eBPF program attached to a perf event, retrieve the
3049 branch records (struct perf_branch_entry) associated to \fIctx\fP
3050 and store it in the buffer pointed by \fIbuf\fP up to size
3054 On success, number of bytes written to \fIbuf\fP\&. On error, a
3057 The \fIflags\fP can be set to \fBBPF_F_GET_BRANCH_RECORDS_SIZE\fP to
3058 instead return the number of bytes required to store all the
3059 branch entries. If this flag is set, \fIbuf\fP may be NULL.
3061 \fB\-EINVAL\fP if arguments invalid or \fBsize\fP not a multiple
3062 of sizeof(struct perf_branch_entry).
3064 \fB\-ENOENT\fP if architecture does not support branch records.
3067 .B \fBint bpf_get_ns_current_pid_tgid(u64\fP \fIdev\fP\fB, u64\fP \fIino\fP\fB, struct bpf_pidns_info *\fP\fInsdata\fP\fB, u32\fP \fIsize\fP\fB)\fP
3071 Returns 0 on success, values for \fIpid\fP and \fItgid\fP as seen from the current
3072 \fInamespace\fP will be returned in \fInsdata\fP\&.
3074 On failure, the returned value is one of the following:
3076 \fB\-EINVAL\fP if dev and inum supplied don\(aqt match dev_t and inode number
3077 with nsfs of current task, or if dev conversion to dev_t lost high bits.
3079 \fB\-ENOENT\fP if pidns does not exists for the current task.
3082 .B \fBint bpf_xdp_output(void *\fP\fIctx\fP\fB, struct bpf_map *\fP\fImap\fP\fB, u64\fP \fIflags\fP\fB, void *\fP\fIdata\fP\fB, u64\fP \fIsize\fP\fB)\fP
3086 Write raw \fIdata\fP blob into a special BPF perf event held by
3087 \fImap\fP of type \fBBPF_MAP_TYPE_PERF_EVENT_ARRAY\fP\&. This perf
3088 event must have the following attributes: \fBPERF_SAMPLE_RAW\fP
3089 as \fBsample_type\fP, \fBPERF_TYPE_SOFTWARE\fP as \fBtype\fP, and
3090 \fBPERF_COUNT_SW_BPF_OUTPUT\fP as \fBconfig\fP\&.
3092 The \fIflags\fP are used to indicate the index in \fImap\fP for which
3093 the value must be put, masked with \fBBPF_F_INDEX_MASK\fP\&.
3094 Alternatively, \fIflags\fP can be set to \fBBPF_F_CURRENT_CPU\fP
3095 to indicate that the index of the current CPU core should be
3098 The value to write, of \fIsize\fP, is passed through eBPF stack and
3099 pointed by \fIdata\fP\&.
3101 \fIctx\fP is a pointer to in\-kernel struct xdp_buff.
3103 This helper is similar to \fBbpf_perf_eventoutput\fP() but
3104 restricted to raw_tracepoint bpf programs.
3107 0 on success, or a negative error in case of failure.
3110 .B \fBu64 bpf_get_netns_cookie(void *\fP\fIctx\fP\fB)\fP
3114 Retrieve the cookie (generated by the kernel) of the network
3115 namespace the input \fIctx\fP is associated with. The network
3116 namespace cookie remains stable for its lifetime and provides
3117 a global identifier that can be assumed unique. If \fIctx\fP is
3118 NULL, then the helper returns the cookie for the initial
3119 network namespace. The cookie itself is very similar to that
3120 of bpf_get_socket_cookie() helper, but for network namespaces
3124 A 8\-byte long opaque number.
3127 .B \fBu64 bpf_get_current_ancestor_cgroup_id(int\fP \fIancestor_level\fP\fB)\fP
3131 Return id of cgroup v2 that is ancestor of the cgroup associated
3132 with the current task at the \fIancestor_level\fP\&. The root cgroup
3133 is at \fIancestor_level\fP zero and each step down the hierarchy
3134 increments the level. If \fIancestor_level\fP == level of cgroup
3135 associated with the current task, then return value will be the
3136 same as that of \fBbpf_get_current_cgroup_id\fP().
3138 The helper is useful to implement policies based on cgroups
3139 that are upper in hierarchy than immediate cgroup associated
3140 with the current task.
3142 The format of returned id and helper limitations are same as in
3143 \fBbpf_get_current_cgroup_id\fP().
3146 The id is returned or 0 in case the id could not be retrieved.
3149 .B \fBint bpf_sk_assign(struct sk_buff *\fP\fIskb\fP\fB, struct bpf_sock *\fP\fIsk\fP\fB, u64\fP \fIflags\fP\fB)\fP
3153 Assign the \fIsk\fP to the \fIskb\fP\&. When combined with appropriate
3154 routing configuration to receive the packet towards the socket,
3155 will cause \fIskb\fP to be delivered to the specified socket.
3156 Subsequent redirection of \fIskb\fP via \fBbpf_redirect\fP(),
3157 \fBbpf_clone_redirect\fP() or other methods outside of BPF may
3158 interfere with successful delivery to the socket.
3160 This operation is only valid from TC ingress path.
3162 The \fIflags\fP argument must be zero.
3165 0 on success, or a negative errno in case of failure.
3168 \fB\-EINVAL\fP Unsupported flags specified.
3170 \fB\-ENOENT\fP Socket is unavailable for assignment.
3172 \fB\-ENETUNREACH\fP Socket is unreachable (wrong netns).
3176 .B \fB\-EOPNOTSUPP\fP Unsupported operation, for example a
3177 call from outside of TC ingress.
3180 \fB\-ESOCKTNOSUPPORT\fP Socket type not supported (reuseport).
3186 Example usage for most of the eBPF helpers listed in this manual page are
3187 available within the Linux kernel sources, at the following locations:
3192 \fItools/testing/selftests/bpf/\fP
3196 eBPF programs can have an associated license, passed along with the bytecode
3197 instructions to the kernel when the programs are loaded. The format for that
3198 string is identical to the one in use for kernel modules (Dual licenses, such
3199 as "Dual BSD/GPL", may be used). Some helper functions are only accessible to
3200 programs that are compatible with the GNU Privacy License (GPL).
3202 In order to use such helpers, the eBPF program must be loaded with the correct
3203 license string passed (via \fBattr\fP) to the \fBbpf\fP() system call, and this
3204 generally translates into the C source code of the program containing a line
3205 similar to the following:
3211 char ____license[] __attribute__((section("license"), used)) = "GPL";
3218 This manual page is an effort to document the existing eBPF helper functions.
3219 But as of this writing, the BPF sub\-system is under heavy development. New eBPF
3220 program or map types are added, along with new helper functions. Some helpers
3221 are occasionally made available for additional program types. So in spite of
3222 the efforts of the community, this page might not be up\-to\-date. If you want to
3223 check by yourself what helper functions exist in your kernel, or what types of
3224 programs they can support, here are some files among the kernel tree that you
3225 may be interested in:
3228 \fIinclude/uapi/linux/bpf.h\fP is the main BPF header. It contains the full list
3229 of all helper functions, as well as many other BPF definitions including most
3230 of the flags, structs or constants used by the helpers.
3232 \fInet/core/filter.c\fP contains the definition of most network\-related helper
3233 functions, and the list of program types from which they can be used.
3235 \fIkernel/trace/bpf_trace.c\fP is the equivalent for most tracing program\-related
3238 \fIkernel/bpf/verifier.c\fP contains the functions used to check that valid types
3239 of eBPF maps are used with a given helper function.
3241 \fIkernel/bpf/\fP directory contains other files in which additional helpers are
3242 defined (for cgroups, sockmaps, etc.).
3245 Compatibility between helper functions and program types can generally be found
3246 in the files where helper functions are defined. Look for the \fBstruct
3247 bpf_func_proto\fP objects and for functions returning them: these functions
3248 contain a list of helpers that a given program type can call. Note that the
3249 \fBdefault:\fP label of the \fBswitch ... case\fP used to filter helpers can call
3250 other functions, themselves allowing access to additional helpers. The
3251 requirement for GPL license is also in those \fBstruct bpf_func_proto\fP\&.
3253 Compatibility between helper functions and map types can be found in the
3254 \fBcheck_map_func_compatibility\fP() function in file \fIkernel/bpf/verifier.c\fP\&.
3256 Helper functions that invalidate the checks on \fBdata\fP and \fBdata_end\fP
3257 pointers for network processing are listed in function
3258 \fBbpf_helper_changes_pkt_data\fP() in file \fInet/core/filter.c\fP\&.
3264 \fBperf_event_open\fP(2),
3268 .\" Generated by docutils manpage writer.
projects / thirdparty / man-pages.git / blob