include/uapi/linux/bpf.h
Source file repositories/reference/linux-study-clean/include/uapi/linux/bpf.h
File Facts
- System
- Linux kernel
- Corpus path
include/uapi/linux/bpf.h- Extension
.h- Size
- 286482 bytes
- Lines
- 7736
- Domain
- Core OS
- Bucket
- Core Kernel Interface
- Inferred role
- Core OS: implementation source
- Status
- source implementation candidate
Why This File Exists
Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
- Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
- Touches user memory; correctness depends on fault-safe copying and privilege boundary handling.
- Uses kernel synchronization; read lock ordering, sleepability, and interrupt context assumptions before translating.
- Defines or uses C structs; map object ownership, embedded links, reference counts, and lock ownership.
Dependency Surface
linux/types.hlinux/bpf_common.h
Detected Declarations
struct bpf_insnstruct bpf_lpm_trie_keystruct bpf_lpm_trie_key_hdrstruct bpf_lpm_trie_key_u8struct bpf_cgroup_storage_keystruct bpf_stack_build_idstruct bpf_common_attrstruct __sk_buffstruct bpf_tunnel_keystruct bpf_xfrm_statestruct bpf_sockstruct bpf_tcp_sockstruct bpf_sock_tuplestruct bpf_xdp_sockstruct xdp_mdstruct bpf_devmap_valstruct bpf_cpumap_valstruct sk_msg_mdstruct sk_reuseport_mdstruct bpf_prog_infostruct bpf_map_infostruct bpf_btf_infostruct bpf_link_infostruct bpf_token_infostruct bpf_sock_addrstruct bpf_sock_opsstruct bpf_perf_event_valuestruct bpf_cgroup_dev_ctxstruct bpf_raw_tracepoint_argsstruct bpf_fib_lookupstruct bpf_redir_neighstruct bpf_flow_keysstruct bpf_func_infostruct bpf_line_infostruct bpf_spin_lockstruct bpf_timerstruct bpf_task_workstruct bpf_wqstruct bpf_dynptrstruct bpf_list_headstruct bpf_list_nodestruct bpf_rb_rootstruct bpf_rb_nodestruct bpf_refcountstruct bpf_sysctlstruct bpf_sockoptstruct bpf_pidns_infostruct bpf_sk_lookup
Annotated Snippet
struct bpf_insn {
__u8 code; /* opcode */
__u8 dst_reg:4; /* dest register */
__u8 src_reg:4; /* source register */
__s16 off; /* signed offset */
__s32 imm; /* signed immediate constant */
};
/* Deprecated: use struct bpf_lpm_trie_key_u8 (when the "data" member is needed for
* byte access) or struct bpf_lpm_trie_key_hdr (when using an alternative type for
* the trailing flexible array member) instead.
*/
struct bpf_lpm_trie_key {
__u32 prefixlen; /* up to 32 for AF_INET, 128 for AF_INET6 */
__u8 data[0]; /* Arbitrary size */
};
/* Header for bpf_lpm_trie_key structs */
struct bpf_lpm_trie_key_hdr {
__u32 prefixlen;
};
/* Key of an a BPF_MAP_TYPE_LPM_TRIE entry, with trailing byte array. */
struct bpf_lpm_trie_key_u8 {
union {
struct bpf_lpm_trie_key_hdr hdr;
__u32 prefixlen;
};
__u8 data[]; /* Arbitrary size */
};
struct bpf_cgroup_storage_key {
__u64 cgroup_inode_id; /* cgroup inode id */
__u32 attach_type; /* program attach type (enum bpf_attach_type) */
};
enum bpf_cgroup_iter_order {
BPF_CGROUP_ITER_ORDER_UNSPEC = 0,
BPF_CGROUP_ITER_SELF_ONLY, /* process only a single object. */
BPF_CGROUP_ITER_DESCENDANTS_PRE, /* walk descendants in pre-order. */
BPF_CGROUP_ITER_DESCENDANTS_POST, /* walk descendants in post-order. */
BPF_CGROUP_ITER_ANCESTORS_UP, /* walk ancestors upward. */
/*
* Walks the immediate children of the specified parent
* cgroup_subsys_state. Unlike BPF_CGROUP_ITER_DESCENDANTS_PRE,
* BPF_CGROUP_ITER_DESCENDANTS_POST, and BPF_CGROUP_ITER_ANCESTORS_UP
* the iterator does not include the specified parent as one of the
* returned iterator elements.
*/
BPF_CGROUP_ITER_CHILDREN,
};
union bpf_iter_link_info {
struct {
__u32 map_fd;
} map;
struct {
enum bpf_cgroup_iter_order order;
/* At most one of cgroup_fd and cgroup_id can be non-zero. If
* both are zero, the walk starts from the default cgroup v2
* root. For walking v1 hierarchy, one should always explicitly
* specify cgroup_fd.
*/
__u32 cgroup_fd;
__u64 cgroup_id;
} cgroup;
/* Parameters of task iterators. */
struct {
__u32 tid;
__u32 pid;
__u32 pid_fd;
} task;
};
/* BPF syscall commands, see bpf(2) man-page for more details. */
/**
* DOC: eBPF Syscall Preamble
*
* The operation to be performed by the **bpf**\ () system call is determined
* by the *cmd* argument. Each operation takes an accompanying argument,
* provided via *attr*, which is a pointer to a union of type *bpf_attr* (see
* below). The size argument is the size of the union pointed to by *attr*.
*/
/**
* DOC: eBPF Syscall Commands
*
* BPF_MAP_CREATE
* Description
* Create a map and return a file descriptor that refers to the
Annotation
- Immediate include surface: `linux/types.h`, `linux/bpf_common.h`.
- Detected declarations: `struct bpf_insn`, `struct bpf_lpm_trie_key`, `struct bpf_lpm_trie_key_hdr`, `struct bpf_lpm_trie_key_u8`, `struct bpf_cgroup_storage_key`, `struct bpf_stack_build_id`, `struct bpf_common_attr`, `struct __sk_buff`, `struct bpf_tunnel_key`, `struct bpf_xfrm_state`.
- Atlas domain: Core OS / Core Kernel Interface.
- Implementation status: source implementation candidate.
- This snippet crosses the user/kernel memory boundary; validate fault handling and access checks before translating the pattern.
- Synchronization appears in or near this file; preserve lock ordering, sleepability, and interrupt-context constraints.
Implementation Notes
- This generated page is the file-by-file coverage layer; curated subsystem chapters should link here when they synthesize a multi-file control flow.
- Core OS pages should be promoted from atlas-only to deep-reviewed when they explain data structures, invariants, locking, lifecycle, and C implementation snippets.
- Driver-family pages are intentionally pattern-oriented unless they are part of the selected PCIe/NVMe representative device path.