GetFuncArgCnt wraps the BPF helper `bpf_get_func_arg_cnt`. Get number of registers of the traced function (for tracing programs) where function arg

GetFuncIp wraps the BPF helper `bpf_get_func_ip`. Get address of the traced function (for tracing and kprobe programs). When called for kprobe pro

GetFuncRet wraps the BPF helper `bpf_get_func_ret`. Get return value of the traced function (for tracing programs) in **value**. Returns 0 on su

GetHashRecalc wraps the BPF helper `bpf_get_hash_recalc`. Retrieve the hash of the packet, *skb*\ **->hash**. If it is not set, in particular if th

GetListenerSock wraps the BPF helper `bpf_get_listener_sock`. Return a **struct bpf_sock** pointer in **TCP_LISTEN** state. **bpf_sk_release**\ ()

GetLocalStorage wraps the BPF helper `bpf_get_local_storage`. Get the pointer to the local storage area. The type and the size of the local storage

GetNetnsCookie wraps the BPF helper `bpf_get_netns_cookie`. Retrieve the cookie (generated by the kernel) of the network namespace the input *ctx*

GetNsCurrentPidTgid wraps the BPF helper `bpf_get_ns_current_pid_tgid`. Returns 0 on success, values for *pid* and *tgid* as seen from the current

GetNumaNodeId wraps the BPF helper `bpf_get_numa_node_id`. Return the id of the current NUMA node. The primary use case for this helper is the sele

GetOrCreate returns the entry for task, creating it (initialised from value) if it doesn't exist.

GetRetval wraps the BPF helper `bpf_get_retval`. Get the BPF program's return value that will be returned to the upper layers. This helper is curr

GetRouteRealm wraps the BPF helper `bpf_get_route_realm`. Retrieve the realm or the route, that is to say the **tclassid** field of the destination

GetSocketCookie wraps the BPF helper `bpf_get_socket_cookie`. If the **struct sk_buff** pointed by *skb* has a known socket, retrieve the cookie (g

GetSocketUid wraps the BPF helper `bpf_get_socket_uid`. Get the owner UID of the socked associated to *skb*. Returns The owner UID of the socket

GetStack wraps the BPF helper `bpf_get_stack`. Return a user or a kernel stack in bpf program provided buffer. To achieve this, the helper needs *c

GetStackid wraps the BPF helper `bpf_get_stackid`. Walk a user or a kernel stack and return its id. To achieve this, the helper needs *ctx*, which

GetTaskStack wraps the BPF helper `bpf_get_task_stack`. Return a user or a kernel stack in bpf program provided buffer. Note: the user stack will o

Getsockopt wraps the BPF helper `bpf_getsockopt`. Emulate a call to **getsockopt()** on the socket associated to *bpf_socket*, which must be a full

bpf:section tracepoint/syscalls/sys_enter_openat

Htonl converts a 32-bit value from host to network byte order.

Htons converts a 16-bit value from host to network byte order.

ImaFileHash wraps the BPF helper `bpf_ima_file_hash`. Returns a calculated IMA hash of the *file*. If the hash is larger than *size*, then only *si

ImaInodeHash wraps the BPF helper `bpf_ima_inode_hash`. Returns the stored IMA hash of the *inode* (if it's available). If the hash is larger than

InodeStorageDelete wraps the BPF helper `bpf_inode_storage_delete`. Delete a bpf_local_storage from an *inode*. Returns 0 on success. **-ENOENT

InodeStorageGet wraps the BPF helper `bpf_inode_storage_get`. Get a bpf_local_storage from an *inode*. Logically, it could be thought of as gettin

bpf:license GPL bpf:section sockops

bpf:section xdp

Jiffies64 wraps the BPF helper `bpf_jiffies64`. Obtain the 64bit jiffies Returns The 64 bit jiffies

KallsymsLookupName wraps the BPF helper `bpf_kallsyms_lookup_name`. Get the address of a kernel symbol, returned in *res*. *res* is set to 0 if th

KtimeGetBootNs wraps the BPF helper `bpf_ktime_get_boot_ns`. Return the time elapsed since system boot, in nanoseconds. Does include the time the s

KtimeGetCoarseNs wraps the BPF helper `bpf_ktime_get_coarse_ns`. Return a coarse-grained version of the time elapsed since system boot, in nanoseco

KtimeGetTaiNs wraps the BPF helper `bpf_ktime_get_tai_ns`. A nonsettable system-wide clock derived from wall-clock time but ignoring leap seconds.

L3CsumReplace wraps the BPF helper `bpf_l3_csum_replace`. Recompute the layer 3 (e.g. IP) checksum for the packet associated to *skb*. Computation

L4CsumReplace wraps the BPF helper `bpf_l4_csum_replace`. Recompute the layer 4 (e.g. TCP, UDP or ICMP) checksum for the packet associated to *skb*

LoadHdrOpt wraps the BPF helper `bpf_load_hdr_opt`. Load header option. Support reading a particular TCP header option for bpf program (**BPF_PROG

Loop wraps the BPF helper `bpf_loop`. For **nr_loops**, call **callback_fn** function with **callback_ctx** as the context parameter. The **callba

LwtPushEncap wraps the BPF helper `bpf_lwt_push_encap`. Encapsulate the packet associated to *skb* within a Layer 3 protocol header. This header is

LwtSeg6Action wraps the BPF helper `bpf_lwt_seg6_action`. Apply an IPv6 Segment Routing action of type *action* to the packet associated to *skb*.

LwtSeg6AdjustSrh wraps the BPF helper `bpf_lwt_seg6_adjust_srh`. Adjust the size allocated to TLVs in the outermost IPv6 Segment Routing Header con

LwtSeg6StoreBytes wraps the BPF helper `bpf_lwt_seg6_store_bytes`. Store *len* bytes from address *from* into the packet associated to *skb*, at *o

bpf:section uprobe/libc.so.6:malloc

MapDeleteElem wraps the BPF helper `bpf_map_delete_elem`. Delete entry with *key* from *map*. Returns 0 on success, or a negative error in case o

MapLookupElem wraps the BPF helper `bpf_map_lookup_elem`. Perform a lookup in *map* for an entry associated to *key*. Returns Map value associate

MapLookupPercpuElem wraps the BPF helper `bpf_map_lookup_percpu_elem`. Perform a lookup in *percpu map* for an entry associated to *key* on *cpu*.

MapPeekElem wraps the BPF helper `bpf_map_peek_elem`. Get an element from *map* without removing it. Returns 0 on success, or a negative error in

MapPopElem wraps the BPF helper `bpf_map_pop_elem`. Pop an element from *map*. Returns 0 on success, or a negative error in case of failure.

MapPushElem wraps the BPF helper `bpf_map_push_elem`. Push an element *value* in *map*. *flags* is one of: **BPF_EXIST** If the queue/stack is f

MapUpdateElem wraps the BPF helper `bpf_map_update_elem`. Add or update the value of the entry associated to *key* in *map* with *value*. *flags* i

MsgApplyBytes wraps the BPF helper `bpf_msg_apply_bytes`. For socket policies, apply the verdict of the eBPF program to the next *bytes* (number of

MsgCorkBytes wraps the BPF helper `bpf_msg_cork_bytes`. For socket policies, prevent the execution of the verdict eBPF program for message *msg* un

MsgPopData wraps the BPF helper `bpf_msg_pop_data`. Will remove *len* bytes from a *msg* starting at byte *start*. This may result in **ENOMEM** er

MsgPullData wraps the BPF helper `bpf_msg_pull_data`. For socket policies, pull in non-linear data from user space for *msg* and set pointers *msg*

MsgPushData wraps the BPF helper `bpf_msg_push_data`. For socket policies, insert *len* bytes into *msg* at offset *start*. If a program of type

MsgRedirectHash wraps the BPF helper `bpf_msg_redirect_hash`. This helper is used in programs implementing policies at the socket level. If the mes

MsgRedirectMap wraps the BPF helper `bpf_msg_redirect_map`. This helper is used in programs implementing policies at the socket level. If the messa

Ntohs converts a 16-bit value from network to host byte order.

bpf:section tracepoint/syscalls/sys_enter_execve

bpf:section tracepoint/syscalls/sys_enter_execve

OnExecExit fires when execve returns. Successful exec replaces the process so this only meaningfully fires when execve FAILED — the return value is th

bpf:section tracepoint/syscalls/sys_enter_openat

bpf:section xdp

OnProcExit fires when a process calls exit_group(N). Args[0] is the exit status (curl=6 if it can't resolve a host, etc.). Doesn't catch signal-based

bpf:section kprobe/tcp_connect

bpf:section kretprobe/tcp_connect

Output emits one event into the per-CPU perf buffer. ctx is the BPF program's context pointer.

OverrideReturn wraps the BPF helper `bpf_override_return`. Used for error injection, this helper uses kprobes to override the return value of the p

bpf:license GPL bpf:section classifier/ingress

PerCpuPtr wraps the BPF helper `bpf_per_cpu_ptr`. Take a pointer to a percpu ksym, *percpu_ptr*, and return a pointer to the percpu kernel variable

PerfEventOutput wraps the BPF helper `bpf_perf_event_output`. Write raw *data* blob into a special BPF perf event held by *map* of type **BPF_MAP_T

PerfEventRead wraps the BPF helper `bpf_perf_event_read`. Read the value of a perf event counter. This helper relies on a *map* of type **BPF_MAP_T

PerfEventReadValue wraps the BPF helper `bpf_perf_event_read_value`. Read the value of a perf event counter, and store it into *buf* of size *buf_s

PerfProgReadValue wraps the BPF helper `bpf_perf_prog_read_value`. For an eBPF program attached to a perf event, retrieve the value of the event co

ProbeRead wraps the BPF helper `bpf_probe_read`. For tracing programs, safely attempt to read *size* bytes from kernel space address *unsafe_ptr* a

ProbeReadKernel wraps the BPF helper `bpf_probe_read_kernel`. Safely attempt to read *size* bytes from kernel space address *unsafe_ptr* and store

ProbeReadKernelStr wraps the BPF helper `bpf_probe_read_kernel_str`. Copy a NUL terminated string from an unsafe kernel address *unsafe_ptr* to *ds

ProbeReadStr wraps the BPF helper `bpf_probe_read_str`. Copy a NUL terminated string from an unsafe kernel address *unsafe_ptr* to *dst*. See **bpf

ProbeReadUser wraps the BPF helper `bpf_probe_read_user`. Safely attempt to read *size* bytes from user space address *unsafe_ptr* and store the da

ProbeReadUserStr wraps the BPF helper `bpf_probe_read_user_str`. Copy a NUL terminated string from an unsafe user address *unsafe_ptr* to *dst*. Th

ProbeWriteUser wraps the BPF helper `bpf_probe_write_user`. Attempt in a safe way to write *len* bytes from the buffer *src* to *dst* in memory. It

bpf:section xdp

bpf:section xdp

RcKeydown wraps the BPF helper `bpf_rc_keydown`. This helper is used in programs implementing IR decoding, to report a successfully decoded key pre

RcPointerRel wraps the BPF helper `bpf_rc_pointer_rel`. This helper is used in programs implementing IR decoding, to report a successfully decoded

RcRepeat wraps the BPF helper `bpf_rc_repeat`. This helper is used in programs implementing IR decoding, to report a successfully decoded repeat ke

ReadBranchRecords wraps the BPF helper `bpf_read_branch_records`. For an eBPF program attached to a perf event, retrieve the branch records (**stru

bpf:section kprobe/__x64_sys_openat

bpf:license GPL bpf:section sockops

Redirect wraps the BPF helper `bpf_redirect`. Redirect the packet to another net device of index *ifindex*. This helper is somewhat similar to **bp

RedirectMap wraps the BPF helper `bpf_redirect_map`. Redirect the packet to the endpoint referenced by *map* at index *key*. Depending on its type,

RedirectNeigh wraps the BPF helper `bpf_redirect_neigh`. Redirect the packet to another net device of index *ifindex* and fill in L2 addresses from

RedirectPeer wraps the BPF helper `bpf_redirect_peer`. Redirect the packet to another net device of index *ifindex*. This helper is somewhat simila

bpf:section tracepoint/syscalls/sys_enter_execve