Skip to content

Linux eBPF concepts

This is an index of Linux specific eBPF concepts and features. For more generic eBPF concepts that are not Linux specific, see the eBPF concepts page.

  • Maps

    Maps allow for data storage and communication

    Maps

  • Verifier

    The verifier checks the safety of eBPF programs

    Verifier

  • Functions

    This page explains how functions work for eBPF on Linux

    Functions

  • Concurrency

    This page explains the effects of concurrency on eBPF programs and how to handle it

    Concurrency

  • Pinning

    Pinning allows the file system to reference eBPF objects and keep them alive

    Pinning

  • Tail calls

    Tail calls allow for the chaining of eBPF programs

    Tail calls

  • Loops

    Loops in eBPF are not trivial, this page explains how to use different types of loops

    Loops

  • Timers

    Timers allow for the scheduling of eBPF functions to execute at a later time

    Timers

  • Resource Limit

    This page explains how the Linux kernel counts and restricts the resources used by eBPF

    Resource Limit

  • AF_XDP

    AF_XDP allows you to bypass the kernel network stack and process packets in userspace

    AF_XDP

  • KFuncs

    KFuncs allow for the calling of kernel functions from eBPF programs

    KFuncs

  • Dynamic pointers

    Dynamic pointers are pointers with metadata, moving memory safety checks to runtime

    Dynptrs

  • eBPF Tokens

    eBPF tokens are like authentication tokens for eBPF operations

    Token