include/linux/bpf.h

File Facts

System

Linux kernel

Corpus path

include/linux/bpf.h

Extension

.h

Size

132668 bytes

Lines

4213

Domain

Core OS

Bucket

Core Kernel Interface

Inferred role

Core OS: operation-table or driver-model contract

Status

pattern implementation candidate

Why This File Exists

Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.

• Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
• Defines an operation table; this is where Linux turns generic core objects into subsystem-specific behavior.
• Touches user memory; correctness depends on fault-safe copying and privilege boundary handling.
• Uses kernel synchronization; read lock ordering, sleepability, and interrupt context assumptions before translating.
• Allocates kernel memory; connect allocation flags and lifetime to context constraints.
• Defines or uses C structs; map object ownership, embedded links, reference counts, and lock ownership.

Dependency Surface

• uapi/linux/bpf.h
• uapi/linux/filter.h
• linux/bpf_defs.h
• crypto/sha2.h
• linux/workqueue.h
• linux/file.h
• linux/percpu.h
• linux/err.h
• linux/rbtree_latch.h
• linux/numa.h
• linux/mm_types.h
• linux/wait.h
• linux/refcount.h
• linux/mutex.h
• linux/module.h
• linux/kallsyms.h
• linux/capability.h
• linux/sched/mm.h
• linux/slab.h
• linux/percpu-refcount.h
• linux/stddef.h
• linux/bpfptr.h
• linux/btf.h
• linux/rcupdate_trace.h
• linux/static_call.h
• linux/memcontrol.h
• linux/cfi.h
• linux/xattr.h
• linux/key.h
• linux/ftrace.h
• asm/rqspinlock.h
• linux/bpf_types.h

Detected Declarations

• struct bpf_verifier_env
• struct bpf_verifier_log
• struct perf_event
• struct bpf_prog
• struct bpf_prog_aux
• struct bpf_map
• struct bpf_arena
• struct sock
• struct seq_file
• struct btf
• struct btf_type
• struct exception_table_entry
• struct seq_operations
• struct bpf_iter_aux_info
• struct bpf_local_storage
• struct bpf_local_storage_map
• struct kobject
• struct mem_cgroup
• struct module
• struct bpf_func_state
• struct ftrace_ops
• struct cgroup
• struct bpf_token
• struct user_namespace
• struct super_block
• struct inode
• struct bpf_iter_seq_info
• struct bpf_map_ops
• struct btf_field_kptr
• struct btf_field_graph_root
• struct btf_field
• struct btf_record
• struct bpf_rb_node_kern
• struct bpf_list_node_kern
• struct bpf_map_owner
• struct bpf_map
• struct bpf_offload_dev
• struct bpf_offloaded_map
• struct bpf_map_dev_ops
• struct bpf_offloaded_map
• struct bpf_func_proto
• struct bpf_context
• struct bpf_insn_access_aux
• struct bpf_prog_ops
• struct bpf_reg_state
• struct bpf_verifier_ops
• struct bpf_prog_offload_ops
• struct bpf_prog_offload

Annotated Snippet

extern const struct file_operations bpf_map_fops;
extern const struct file_operations bpf_prog_fops;
extern const struct file_operations bpf_iter_fops;
extern const struct file_operations bpf_token_fops;

#define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type) \
	extern const struct bpf_prog_ops _name ## _prog_ops; \
	extern const struct bpf_verifier_ops _name ## _verifier_ops;
#define BPF_MAP_TYPE(_id, _ops) \
	extern const struct bpf_map_ops _ops;
#define BPF_LINK_TYPE(_id, _name)
#include <linux/bpf_types.h>
#undef BPF_PROG_TYPE
#undef BPF_MAP_TYPE
#undef BPF_LINK_TYPE

extern const struct bpf_prog_ops bpf_offload_prog_ops;
extern const struct bpf_verifier_ops tc_cls_act_analyzer_ops;
extern const struct bpf_verifier_ops xdp_analyzer_ops;

struct bpf_prog *bpf_prog_get(u32 ufd);
struct bpf_prog *bpf_prog_get_type_dev(u32 ufd, enum bpf_prog_type type,
				       bool attach_drv);
void bpf_prog_add(struct bpf_prog *prog, int i);
void bpf_prog_sub(struct bpf_prog *prog, int i);
void bpf_prog_inc(struct bpf_prog *prog);
struct bpf_prog * __must_check bpf_prog_inc_not_zero(struct bpf_prog *prog);
void bpf_prog_put(struct bpf_prog *prog);

void bpf_prog_free_id(struct bpf_prog *prog);
void bpf_map_free_id(struct bpf_map *map);

struct btf_field *btf_record_find(const struct btf_record *rec,
				  u32 offset, u32 field_mask);
void btf_record_free(struct btf_record *rec);
void bpf_map_free_record(struct bpf_map *map);
struct btf_record *btf_record_dup(const struct btf_record *rec);
bool btf_record_equal(const struct btf_record *rec_a, const struct btf_record *rec_b);
void bpf_obj_free_timer(const struct btf_record *rec, void *obj);
void bpf_obj_free_workqueue(const struct btf_record *rec, void *obj);
void bpf_obj_free_task_work(const struct btf_record *rec, void *obj);
void bpf_obj_cancel_fields(struct bpf_map *map, void *obj);
void bpf_obj_free_fields(const struct btf_record *rec, void *obj);
void __bpf_obj_drop_impl(void *p, const struct btf_record *rec, bool percpu);

struct bpf_map *bpf_map_get(u32 ufd);
struct bpf_map *bpf_map_get_with_uref(u32 ufd);

/*
 * The __bpf_map_get() and __btf_get_by_fd() functions parse a file
 * descriptor and return a corresponding map or btf object.
 * Their names are double underscored to emphasize the fact that they
 * do not increase refcnt. To also increase refcnt use corresponding
 * bpf_map_get() and btf_get_by_fd() functions.
 */

static inline struct bpf_map *__bpf_map_get(struct fd f)
{
	if (fd_empty(f))
		return ERR_PTR(-EBADF);
	if (unlikely(fd_file(f)->f_op != &bpf_map_fops))
		return ERR_PTR(-EINVAL);
	return fd_file(f)->private_data;
}

static inline struct btf *__btf_get_by_fd(struct fd f)
{
	if (fd_empty(f))
		return ERR_PTR(-EBADF);
	if (unlikely(fd_file(f)->f_op != &btf_fops))
		return ERR_PTR(-EINVAL);
	return fd_file(f)->private_data;
}

void bpf_map_inc(struct bpf_map *map);
void bpf_map_inc_with_uref(struct bpf_map *map);
struct bpf_map *__bpf_map_inc_not_zero(struct bpf_map *map, bool uref);
struct bpf_map * __must_check bpf_map_inc_not_zero(struct bpf_map *map);
void bpf_map_put_with_uref(struct bpf_map *map);
void bpf_map_put(struct bpf_map *map);
void *bpf_map_area_alloc(u64 size, int numa_node);
void *bpf_map_area_mmapable_alloc(u64 size, int numa_node);
void bpf_map_area_free(void *base);
bool bpf_map_write_active(const struct bpf_map *map);
void bpf_map_init_from_attr(struct bpf_map *map, union bpf_attr *attr);
int  generic_map_lookup_batch(struct bpf_map *map,
			      const union bpf_attr *attr,
			      union bpf_attr __user *uattr);
int  generic_map_update_batch(struct bpf_map *map, struct file *map_file,
			      const union bpf_attr *attr,

Annotation

• Immediate include surface: `uapi/linux/bpf.h`, `uapi/linux/filter.h`, `linux/bpf_defs.h`, `crypto/sha2.h`, `linux/workqueue.h`, `linux/file.h`, `linux/percpu.h`, `linux/err.h`.
• Detected declarations: `struct bpf_verifier_env`, `struct bpf_verifier_log`, `struct perf_event`, `struct bpf_prog`, `struct bpf_prog_aux`, `struct bpf_map`, `struct bpf_arena`, `struct sock`, `struct seq_file`, `struct btf`.
• Atlas domain: Core OS / Core Kernel Interface.
• Implementation status: pattern implementation candidate.
• This snippet crosses the user/kernel memory boundary; validate fault handling and access checks before translating the pattern.
• Synchronization appears in or near this file; preserve lock ordering, sleepability, and interrupt-context constraints.

Implementation Notes

• This generated page is the file-by-file coverage layer; curated subsystem chapters should link here when they synthesize a multi-file control flow.
• Core OS pages should be promoted from atlas-only to deep-reviewed when they explain data structures, invariants, locking, lifecycle, and C implementation snippets.
• Driver-family pages are intentionally pattern-oriented unless they are part of the selected PCIe/NVMe representative device path.