Skip to content

Helper functions

Helper functions are functions defined by the kernel which can be invoked from eBPF programs. These helper functions allow eBPF programs to interact with the kernel as if calling a function. The kernel places restrictions on the usage of these helper functions to prevent misuse. Check the pages of the individual calls for details on its usage.

Helper functions can have a large variety of purposes. This page attempts to categorize them by function.

Map helpers

These are helpers with the primary purpose involves the interaction with a map.

Generic map helpers

These helpers can be used on a lot of different maps, especially the generic map types like array and hash maps.

Perf event array helpers

These helpers are used with BPF_MAP_TYPE_PERF_EVENT_ARRAY maps.

Tail call helpers

These helpers are used with BPF_MAP_TYPE_PROG_ARRAY maps.

Timer helpers

These helpers are used to manage timers.

Queue and stack helpers

These helpers are used with BPF_MAP_TYPE_QUEUE and BPF_MAP_TYPE_STACK maps.

Ringbuffer helper

These helpers are used with BPF_MAP_TYPE_RINGBUF maps.

Socket map helpers

These helpers are used with BPF_MAP_TYPE_SOCKMAP

Socket hash helpers

These helpers are used with BPF_MAP_TYPE_SOCKHASH

Task storage helpers

These helpers are used with BPF_MAP_TYPE_TASK_STORAGE maps.

Inode storage helpers

These helpers are used with BPF_MAP_TYPE_INODE_STORAGE maps.

Socket storage helpers

These helpers are used with BPF_MAP_TYPE_SK_STORAGE maps.

Local cGroup storage helpers

These helpers are used with BPF_MAP_TYPE_CGROUP_STORAGE and BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE maps.

Global cGroup storage helpers

These helpers are used with BPF_MAP_TYPE_CGRP_STORAGE maps.

User ring buffer

These helpers are related to BPF_MAP_TYPE_USER_RINGBUF maps.

Probe and trace helpers

These helpers are used in probing and tracing functions like kprobes, tracepoints and uprobes.

Memory helpers

These helpers are used to read from or write to kernel or userspace memory.

Process influencing helpers

These helpers are used to influence processes.

Tracing helpers

These helpers return information specific to BPF_PROG_TYPE_TRACING programs.

Perf event helpers

These helpers return information specific to BPF_PROG_TYPE_PERF_EVENT programs.

Information helpers

These helpers return information from the kernel which is otherwise not available to eBPF programs.

Time helpers

These helpers return time information.

Process info helpers

These helpers return information about processes, particularly the one for which the current eBPF program is invoked.

CPU info helpers

These helpers return information about the current state of the CPU.

These helpers are used to print logs from an eBPF program which will appear in the kernel tracing log.

Iterator print helpers

These helpers are used to print logs to the sequence files used by eBPF iterator programs.

Network helpers

These helpers are related to networking.

Socket buffer helpers

These helpers read from, write to, or modify socket buffers in some way.

Checksum helpers

These helpers calculate and/or update checksums.

Redirect helpers

These helpers redirect the flow of packets in some way.

XDP helpers

These helpers are specific to BPF_PROG_TYPE_XDP programs.

Sk msg helpers

These helpers are specific to BPF_PROG_TYPE_SK_MSG programs.

LWT helpers

These helpers are specific to BPF_PROG_TYPE_LWT_* programs.

SYNCookie helpers

These helpers are related to syn cookies.

Socket helpers

These helpers are related to socket.

Socket ops helpers

These helpers are specific to BPF_PROG_TYPE_SOCK_OPS programs.

These helpers are specific to BPF_PROG_TYPE_LIRC_MODE2 programs.

Syscall helpers

These helpers are specific to BPF_PROG_TYPE_SYSCALL programs.

LSM helpers

These helpers are specific to BPF_PROG_TYPE_LSM programs.

Sysctl helpers

These helpers are specific to BPF_PROG_TYPE_CGROUP_SYSCTL programs.

Dynptr

These helpers are related to dynamic pointers

Loop helpers

These helpers are used to execute loops.

Utility helpers

These helpers are smaller utility functions which don't really fit in elsewhere.

Misc