Helper functions
Helper functions are functions defined by the kernel which can be invoked from eBPF programs. These helper functions allow eBPF programs to interact with the kernel as if calling a function. The kernel places restrictions on the usage of these helper functions to prevent misuse. Check the pages of the individual calls for details on its usage.
Helper functions can have a large variety of purposes. This page attempts to categorize them by function.
Stability guarantees
Although helper functions are not to be used from userspace, but from eBPF programs, they are declared as part of the UAPI (the userspace API): include/uapi/linux/bpf.h.
As a consequence, helper functions enjoy the well-known stability guarantees of the Linux Kernel (userspace) API. Meaning that you can rely on helper functions not disappearing or changing across kernel versions.
If the stability of the interaction between the eBPF program and the kernel (across different versions) is a concern, then usage of KFuncs should be avoided whenever feasible. KFuncs are considered though the future API of the kernel for eBPF programs and therefore they will slowly become unavoidable. They can be expected to become more stable over time.
Map helpers
These are helpers with the primary purpose involves the interaction with a map.
Generic map helpers
These helpers can be used on a lot of different maps, especially the generic map types like array and hash maps.
bpf_map_lookup_elembpf_map_update_elembpf_map_delete_elembpf_for_each_map_elembpf_map_lookup_percpu_elembpf_spin_lockbpf_spin_unlock
Perf event array helpers
These helpers are used with BPF_MAP_TYPE_PERF_EVENT_ARRAY maps.
Tail call helpers
These helpers are used with BPF_MAP_TYPE_PROG_ARRAY maps.
Timer helpers
These helpers are used to manage timers.
Queue and stack helpers
These helpers are used with BPF_MAP_TYPE_QUEUE and BPF_MAP_TYPE_STACK maps.
Ring buffer helper
These helpers are used with BPF_MAP_TYPE_RINGBUF maps.
bpf_ringbuf_outputbpf_ringbuf_reservebpf_ringbuf_submitbpf_ringbuf_discardbpf_ringbuf_querybpf_ringbuf_reserve_dynptrbpf_ringbuf_submit_dynptrbpf_ringbuf_discard_dynptr
Socket map helpers
These helpers are used with BPF_MAP_TYPE_SOCKMAP
Socket hash helpers
These helpers are used with BPF_MAP_TYPE_SOCKHASH
Task storage helpers
These helpers are used with BPF_MAP_TYPE_TASK_STORAGE maps.
Inode storage helpers
These helpers are used with BPF_MAP_TYPE_INODE_STORAGE maps.
Socket storage helpers
These helpers are used with BPF_MAP_TYPE_SK_STORAGE maps.
Local cGroup storage helpers
These helpers are used with BPF_MAP_TYPE_CGROUP_STORAGE and BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE maps.
Global cGroup storage helpers
These helpers are used with BPF_MAP_TYPE_CGRP_STORAGE maps.
User ring buffer
These helpers are related to BPF_MAP_TYPE_USER_RINGBUF maps.
Probe and trace helpers
These helpers are used in probing and tracing functions like kprobes, tracepoints and uprobes.
Memory helpers
These helpers are used to read from or write to kernel or userspace memory.
bpf_probe_readbpf_probe_write_userbpf_probe_read_strbpf_get_stackbpf_probe_read_userbpf_probe_read_kernelbpf_probe_read_user_strbpf_probe_read_kernel_strbpf_copy_from_userbpf_copy_from_user_taskbpf_copy_from_user_taskbpf_find_vma
Process influencing helpers
These helpers are used to influence processes.
Tracing helpers
These helpers return information specific to BPF_PROG_TYPE_TRACING programs.
Perf event helpers
These helpers return information specific to BPF_PROG_TYPE_PERF_EVENT programs.
Information helpers
These helpers return information from the kernel which is otherwise not available to eBPF programs.
Time helpers
These helpers return time information.
Process info helpers
These helpers return information about processes, particularly the one for which the current eBPF program is invoked.
bpf_get_current_pid_tgidbpf_get_current_uid_gidbpf_get_current_commbpf_get_cgroup_classidbpf_get_ns_current_pid_tgidbpf_get_current_taskbpf_get_stackidbpf_current_task_under_cgroupbpf_get_current_cgroup_idbpf_get_current_ancestor_cgroup_idbpf_get_task_stackbpf_get_current_task_btfbpf_task_pt_regs
CPU info helpers
These helpers return information about the current state of the CPU.
bpf_get_smp_processor_idbpf_get_numa_node_idbpf_read_branch_recordsbpf_get_branch_snapshotbpf_per_cpu_ptrbpf_this_cpu_ptr
Print helpers
These helpers are used to print logs from an eBPF program which will appear in the kernel tracing log.
Iterator print helpers
These helpers are used to print logs to the sequence files used by eBPF iterator programs.
Network helpers
These helpers are related to networking.
Socket buffer helpers
These helpers read from, write to, or modify socket buffers in some way.
bpf_skb_store_bytesbpf_skb_load_bytesbpf_skb_vlan_pushbpf_skb_vlan_popbpf_skb_get_tunnel_keybpf_skb_set_tunnel_keybpf_skb_get_tunnel_optbpf_skb_set_tunnel_optbpf_skb_change_protobpf_skb_change_typebpf_skb_under_cgroupbpf_skb_change_tailbpf_skb_pull_databpf_skb_adjust_roombpf_skb_change_headbpf_skb_get_xfrm_statebpf_skb_load_bytes_relativebpf_skb_cgroup_idbpf_skb_ancestor_cgroup_idbpf_skb_ecn_set_cebpf_skb_cgroup_classidbpf_skb_set_tstampbpf_set_hashbpf_get_hash_recalcbpf_set_hash_invalid
Checksum helpers
These helpers calculate and/or update checksums.
Redirect helpers
These helpers redirect the flow of packets in some way.
bpf_clone_redirectbpf_redirectbpf_redirect_mapbpf_sk_redirect_mapbpf_msg_redirect_mapbpf_redirect_peerbpf_sk_redirect_hashbpf_msg_redirect_hashbpf_redirect_neighbpf_sk_assignbpf_sk_select_reuseport
XDP helpers
These helpers are specific to BPF_PROG_TYPE_XDP programs.
bpf_xdp_adjust_headbpf_xdp_adjust_tailbpf_xdp_adjust_metabpf_xdp_get_buff_lenbpf_xdp_load_bytesbpf_xdp_store_bytes
Socket message helpers
These helpers are specific to BPF_PROG_TYPE_SK_MSG programs.
LWT helpers
These helpers are specific to BPF_PROG_TYPE_LWT_* programs.
SYN cookie helpers
These helpers are related to syn cookies.
bpf_tcp_check_syncookiebpf_tcp_gen_syncookiebpf_tcp_raw_gen_syncookie_ipv4bpf_tcp_raw_gen_syncookie_ipv6bpf_tcp_raw_check_syncookie_ipv4bpf_tcp_raw_check_syncookie_ipv6
Socket helpers
These helpers are related to socket.
bpf_sk_lookup_tcpbpf_sk_lookup_udpbpf_sk_releasebpf_sk_fullsockbpf_sk_cgroup_idbpf_sk_ancestor_cgroup_idbpf_get_socket_cookiebpf_get_socket_uidbpf_setsockoptbpf_getsockoptbpf_sock_ops_cb_flags_setbpf_tcp_sockbpf_get_listener_sockbpf_tcp_send_ackbpf_skc_lookup_tcpbpf_skc_to_tcp6_sockbpf_skc_to_tcp_sockbpf_skc_to_tcp_timewait_sockbpf_skc_to_tcp_request_sockbpf_skc_to_udp6_sockbpf_skc_to_mptcp_sockbpf_skc_to_unix_sockbpf_bind
Socket ops helpers
These helpers are specific to BPF_PROG_TYPE_SOCK_OPS programs.
Infrared related helpers
These helpers are specific to BPF_PROG_TYPE_LIRC_MODE2 programs.
Syscall helpers
These helpers are specific to BPF_PROG_TYPE_SYSCALL programs.
LSM helpers
These helpers are specific to BPF_PROG_TYPE_LSM programs.
Sysctl helpers
These helpers are specific to BPF_PROG_TYPE_CGROUP_SYSCTL programs.
Dynptr
These helpers are related to dynamic pointers
Loop helpers
These helpers are used to execute loops.
Utility helpers
These helpers are smaller utility functions which don't really fit in elsewhere.