bcc Documentation

Mailing List:

docker run -d --name bcc --restart always iovisor/bcc:latest
# ./bitehist.py
Tracing... Hit Ctrl-C to end.
^C
     kbytes          : count     distribution
       0 -> 1        : 3        |                                      |
       2 -> 3        : 0        |                                      |
       4 -> 7        : 211      |**********                            |
       8 -> 15       : 0        |                                      |
      16 -> 31       : 0        |                                      |
      32 -> 63       : 0        |                                      |
      64 -> 127      : 1        |                                      |
     128 -> 255      : 800      |**************************************|
git grep HAVE_EBPF_JIT arch/
git grep -W 'bpf_prog_type {' include/uapi/linux/bpf.h
git grep -W 'bpf_map_type {' include/uapi/linux/bpf.h
git grep -W 'bpf_cmd {' include/uapi/linux/bpf.h
git grep -l XDP_SETUP_PROG drivers/
git grep '	FN(' include/uapi/linux/bpf.h
git grep -W 'func_proto(enum bpf_func_id func_id' kernel/ net/ drivers/
int kprobe__tcp_v4_connect(struct pt_regs *ctx, struct sock *sk) {
    [...]
}
int kretprobe__tcp_v4_connect(struct pt_regs *ctx)
{
    int ret = PT_REGS_RC(ctx);
    [...]
}
TRACEPOINT_PROBE(random, urandom_read) {
    // args is from /sys/kernel/debug/tracing/events/random/urandom_read/format
    bpf_trace_printk("%d\\n", args->got_bits);
    return 0;
}
int count(struct pt_regs *ctx) {
    char buf[64];
    bpf_probe_read_user(&buf, sizeof(buf), (void *)PT_REGS_PARM1(ctx));
    bpf_trace_printk("%s %d", buf, PT_REGS_PARM2(ctx));
    return(0);
}
BPF_HISTOGRAM(dist);
int count(struct pt_regs *ctx) {
    dist.increment(PT_REGS_RC(ctx));
    return 0;
}
int do_trace(struct pt_regs *ctx) {
    uint64_t addr;
    char path[128];
    bpf_usdt_readarg(6, ctx, &addr);
    bpf_probe_read_user(&path, sizeof(path), (void *)addr);
    bpf_trace_printk("path:%s\\n", path);
    return 0;
};
RAW_TRACEPOINT_PROBE(sched_switch)
{
    // TP_PROTO(bool preempt, struct task_struct *prev, struct task_struct *next)
    struct task_struct *prev = (struct task_struct *)ctx->args[1];
    struct task_struct *next= (struct task_struct *)ctx->args[2];
    s32 prev_tgid, next_tgid;

    bpf_probe_read_kernel(&prev_tgid, sizeof(prev->tgid), &prev->tgid);
    bpf_probe_read_kernel(&next_tgid, sizeof(next->tgid), &next->tgid);
    bpf_trace_printk("%d -> %d\\n", prev_tgid, next_tgid);
}
int syscall__execve(struct pt_regs *ctx,
    const char __user *filename,
    const char __user *const __user *__argv,
    const char __user *const __user *__envp)
{
    [...]
}
b = BPF(text=bpf_text)
execve_fnname = b.get_syscall_fnname("execve")
b.attach_kprobe(event=execve_fnname, fn_name="syscall__execve")
KFUNC_PROBE(do_sys_open, int dfd, const char *filename, int flags, int mode)
{
    ...
KRETFUNC_PROBE(do_sys_open, int dfd, const char *filename, int flags, int mode, int ret)
{
    ...
LSM_PROBE(bpf, int cmd, union bpf_attr *attr, unsigned int size)
{
    return -EPERM;
}
BPF_ITER(task)
{
  struct seq_file *seq = ctx->meta->seq;
  struct task_struct *task = ctx->task;

  if (task == (void *)0)
    return 0;

  ... task->pid, task->tgid, task->comm, ...
  return 0;
}
#include <linux/sched.h>

int do_trace(struct pt_regs *ctx) {
    char comm[TASK_COMM_LEN];
    bpf_get_current_comm(&comm, sizeof(comm));
[...]
#define randomized_struct_fields_start  struct {
#define randomized_struct_fields_end    };
#include <linux/sched.h>

int do_trace(void *ctx) {
    struct task_struct *t = (struct task_struct *)bpf_get_current_task();
[...]
int kprobe__io_ctl_init(void *ctx) {
	bpf_override_return(ctx, -ENOMEM);
	return 0;
}
struct data_t {
    u32 pid;
    u64 ts;
    char comm[TASK_COMM_LEN];
};
BPF_PERF_OUTPUT(events);

int hello(struct pt_regs *ctx) {
    struct data_t data = {};

    data.pid = bpf_get_current_pid_tgid();
    data.ts = bpf_ktime_get_ns();
    bpf_get_current_comm(&data.comm, sizeof(data.comm));

    events.perf_submit(ctx, &data, sizeof(data));

    return 0;
}
struct data_t {
    u32 pid;
    u64 ts;
    char comm[TASK_COMM_LEN];
};

// Creates a ringbuf called events with 8 pages of space, shared across all CPUs
BPF_RINGBUF_OUTPUT(events, 8);

int first_api_example(struct pt_regs *ctx) {
    struct data_t data = {};

    data.pid = bpf_get_current_pid_tgid();
    data.ts = bpf_ktime_get_ns();
    bpf_get_current_comm(&data.comm, sizeof(data.comm));

    events.ringbuf_output(&data, sizeof(data), 0 /* flags */);

    return 0;
}

int second_api_example(struct pt_regs *ctx) {
    struct data_t *data = events.ringbuf_reserve(sizeof(struct data_t));
    if (!data) { // Failed to reserve space
        return 1;
    }

    data->pid = bpf_get_current_pid_tgid();
    data->ts = bpf_ktime_get_ns();
    bpf_get_current_comm(&data->comm, sizeof(data->comm));

    events.ringbuf_submit(data, 0 /* flags */);

    return 0;
}
BPF_TABLE_PINNED("hash", u64, u64, ids, 1024, "/sys/fs/bpf/ids");
BPF_HASH(start, struct request *);
BPF_ARRAY(counts, u64, 32);
BPF_HISTOGRAM(dist);
BPF_STACK_TRACE(stack_traces, 1024);
text="""
BPF_PERF_ARRAY(cpu_cycles, NUM_CPUS);
"""
b = bcc.BPF(text=text, cflags=["-DNUM_CPUS=%d" % multiprocessing.cpu_count()])
b["cpu_cycles"].open_perf_event(b["cpu_cycles"].HW_CPU_CYCLES)
BPF_PERCPU_HASH(start, struct request *);
BPF_PERCPU_ARRAY(counts, u64, 32);
BPF_LPM_TRIE(trie, struct key_v6);
BPF_DEVMAP(devmap, 10);
BPF_CPUMAP(cpumap, 16);
BPF_XSKMAP(xsks_map, 8);
BPF_TABLE("hash", int, int, ex1, 1024);
BPF_TABLE("hash", int, int, ex2, 1024);
BPF_ARRAY_OF_MAPS(maps_array, "ex1", 10);
BPF_ARRAY(ex1, int, 1024);
BPF_ARRAY(ex2, int, 1024);
BPF_HASH_OF_MAPS(maps_hash, struct custom_key, "ex1", 10);
BPF_STACK(stack, struct event, 10240);
BPF_QUEUE(queue, struct event, 10240);
struct sock_key {
  u32 remote_ip4;
  u32 local_ip4;
  u32 remote_port;
  u32 local_port;
};
BPF_HASH(skh, struct sock_key, 65535);
BPF_PROG_ARRAY(prog_array, 10);

int tail_call(void *ctx) {
    bpf_trace_printk("Tail-call\n");
    return 0;
}

int do_tail_call(void *ctx) {
    bpf_trace_printk("Original program\n");
    prog_array.call(ctx, 2);
    return 0;
}
b = BPF(src_file="example.c")
tail_fn = b.load_func("tail_call", BPF.KPROBE)
prog_array = b.get_table("prog_array")
prog_array[c_int(2)] = c_int(tail_fn.fd)
b.attach_kprobe(event="some_kprobe_event", fn_name="do_tail_call")
BPF_DEVMAP(devmap, 1);

int redirect_example(struct xdp_md *ctx) {
    return devmap.redirect_map(0, 0);
}
int xdp_dummy(struct xdp_md *ctx) {
    return XDP_PASS;
}
ip = pyroute2.IPRoute()
idx = ip.link_lookup(ifname="eth1")[0]

b = bcc.BPF(src_file="example.c")

devmap = b.get_table("devmap")
devmap[c_uint32(0)] = c_int(idx)

in_fn = b.load_func("redirect_example", BPF.XDP)
out_fn = b.load_func("xdp_dummy", BPF.XDP)
b.attach_xdp("eth0", in_fn, 0)
b.attach_xdp("eth1", out_fn, 0)
BPF_NOEXIST: The entry for key must not exist in the map.
BPF_EXIST: The entry for key must already exist in the map.
BPF_ANY: No condition on the existence of the entry for key.
// SPDX-License-Identifier: GPL-2.0+
#define BPF_LICENSE GPL
// SPDX-License-Identifier: GPL-2.0+ OR BSD-2-Clause
#define BPF_LICENSE Dual BSD/GPL
# define entire BPF program in one line:
BPF(text='int do_trace(void *ctx) { bpf_trace_printk("hit!\\n"); return 0; }');

# define program as a variable:
prog = """
int hello(void *ctx) {
    bpf_trace_printk("Hello, World!\\n");
    return 0;
}
"""
b = BPF(text=prog)

# source a file:
b = BPF(src_file = "vfsreadlat.c")

# include a USDT object:
u = USDT(pid=int(pid))
[...]
b = BPF(text=bpf_text, usdt_contexts=[u])

# add include paths:
u = BPF(text=prog, cflags=["-I/path/to/include"])
# include a USDT object:
u = USDT(pid=int(pid))
[...]
b = BPF(text=bpf_text, usdt_contexts=[u])
b.attach_kprobe(event="sys_clone", fn_name="do_trace")
b.attach_kretprobe(event="vfs_read", fn_name="do_return")
# define BPF program
bpf_text = """
#include 

struct urandom_read_args {
    // from /sys/kernel/debug/tracing/events/random/urandom_read/format
    u64 __unused__;
    u32 got_bits;
    u32 pool_left;
    u32 input_left;
};

int printarg(struct urandom_read_args *args) {
    bpf_trace_printk("%d\\n", args->got_bits);
    return 0;
};
"""

# load BPF program
b = BPF(text=bpf_text)
b.attach_tracepoint("random:urandom_read", "printarg")
b.attach_uprobe(name="c", sym="strlen", fn_name="count")
b.attach_uprobe(name="c", sym="getaddrinfo", fn_name="do_entry")
b.attach_uprobe(name="/usr/bin/python", sym="main", fn_name="do_main")
b.attach_uretprobe(name="c", sym="strlen", fn_name="count")
b.attach_uretprobe(name="c", sym="getaddrinfo", fn_name="do_return")
b.attach_uretprobe(name="/usr/bin/python", sym="main", fn_name="do_main")
# enable USDT probe from given PID
u = USDT(pid=int(pid))
u.enable_probe(probe="http__server__request", fn_name="do_trace")
b.attach_raw_tracepoint("sched_switch", "do_trace")
BPF.attach_raw_socket(bpf_func, ifname)
# from xdp_flags uapi/linux/if_link.h
XDP_FLAGS_UPDATE_IF_NOEXIST = (1 << 0)
XDP_FLAGS_SKB_MODE = (1 << 1)
XDP_FLAGS_DRV_MODE = (1 << 2)
XDP_FLAGS_HW_MODE = (1 << 3)
XDP_FLAGS_REPLACE = (1 << 4)
b.attach_xdp(dev="ens1", fn=b.load_func("do_xdp", BPF.XDP))
b.attach_func(fn, cgroup_fd, BPFAttachType.CGROUP_SOCK_OPS)
b.attach_func(fn, map_fd, BPFAttachType.SK_MSG_VERDICT)
b.detach_func(fn, cgroup_fd, BPFAttachType.CGROUP_SOCK_OPS)
b.detach_func(fn, map_fd, BPFAttachType.SK_MSG_VERDICT)
b.detach_kprobe(event="__page_cache_alloc", fn_name="trace_func_entry")
b.detach_kretprobe(event="__page_cache_alloc", fn_name="trace_func_return")
# print trace_pipe output as-is:
b.trace_print()

# print PID and message:
b.trace_print(fmt="{1} {5}")
while 1:
    try:
        (task, pid, cpu, flags, ts, msg) = b.trace_fields()
    except ValueError:
        continue
    [...]
# loop with callback to print_event
b["events"].open_perf_buffer(print_event)
while 1:
    try:
        b.perf_buffer_poll()
    except KeyboardInterrupt:
        exit();
# loop with callback to print_event
b["events"].open_ring_buffer(print_event)
while 1:
    try:
        b.ring_buffer_poll(30)
    except KeyboardInterrupt:
        exit();
# loop with callback to print_event
b["events"].open_ring_buffer(print_event)
while 1:
    try:
        b.ring_buffer_consume()
    except KeyboardInterrupt:
        exit();
counts = b.get_table("counts")

counts = b["counts"]
# process event
def print_event(cpu, data, size):
    event = ct.cast(data, ct.POINTER(Data)).contents
    [...]

# loop with callback to print_event
b["events"].open_perf_buffer(print_event)
while 1:
    try:
        b.perf_buffer_poll()
    except KeyboardInterrupt:
        exit()
// define output data structure in C
struct data_t {
    u32 pid;
    u64 ts;
    char comm[TASK_COMM_LEN];
};
BPF_PERF_OUTPUT(events);
[...]
def print_event(cpu, data, size):
    event = b["events"].event(data)
[...]
# define output data structure in Python
TASK_COMM_LEN = 16    # linux/sched.h
class Data(ct.Structure):
    _fields_ = [("pid", ct.c_ulonglong),
                ("ts", ct.c_ulonglong),
                ("comm", ct.c_char * TASK_COMM_LEN)]

def print_event(cpu, data, size):
    event = ct.cast(data, ct.POINTER(Data)).contents
[...]
# print output
print("%10s %s" % ("COUNT", "STRING"))
counts = b.get_table("counts")
for k, v in sorted(counts.items(), key=lambda counts: counts[1].value):
    print("%10d \"%s\"" % (v.value, k.c.encode('string-escape')))
# print map summary every second:
while True:
    time.sleep(1)
    print("%-8s\n" % time.strftime("%H:%M:%S"), end="")
    dist.print_log2_hist(sym + " return:")
    dist.clear()
# print call rate per second:
print("%9s-%9s-%8s-%9s" % ("PID", "COMM", "fname", "counter"))
while True:
    for k, v in sorted(b['map'].items_lookup_and_delete_batch(), key=lambda kv: (kv[0]).pid):
        print("%9s-%9s-%8s-%9d" % (k.pid, k.comm, k.fname, v.counter))
    sleep(1)
# print current value of map:
print("%9s-%9s-%8s-%9s" % ("PID", "COMM", "fname", "counter"))
while True:
    for k, v in sorted(b['map'].items_lookup_batch(), key=lambda kv: (kv[0]).pid):
        print("%9s-%9s-%8s-%9d" % (k.pid, k.comm, k.fname, v.counter))
b = BPF(text="""
BPF_HISTOGRAM(dist);

int kprobe__blk_account_io_done(struct pt_regs *ctx, struct request *req)
{
	dist.increment(bpf_log2l(req->__data_len / 1024));
	return 0;
}
""")
[...]

b["dist"].print_log2_hist("kbytes")
kbytes          : count     distribution
       0 -> 1        : 3        |                                      |
       2 -> 3        : 0        |                                      |
       4 -> 7        : 211      |**********                            |
       8 -> 15       : 0        |                                      |
      16 -> 31       : 0        |                                      |
      32 -> 63       : 0        |                                      |
      64 -> 127      : 1        |                                      |
     128 -> 255      : 800      |**************************************|
b = BPF(text="""
BPF_HISTOGRAM(dist);

int kprobe__blk_account_io_done(struct pt_regs *ctx, struct request *req)
{
	dist.increment(req->__data_len / 1024);
	return 0;
}
""")
[...]

b["dist"].print_linear_hist("kbytes")
kbytes        : count     distribution
        0          : 3        |******                                  |
        1          : 0        |                                        |
        2          : 0        |                                        |
        3          : 0        |                                        |
        4          : 19       |****************************************|
        5          : 0        |                                        |
        6          : 0        |                                        |
        7          : 0        |                                        |
        8          : 4        |********                                |
        9          : 0        |                                        |
        10         : 0        |                                        |
        11         : 0        |                                        |
        12         : 0        |                                        |
        13         : 0        |                                        |
        14         : 0        |                                        |
        15         : 0        |                                        |
        16         : 2        |****                                    |
[...]
# process event
def print_event(ctx, data, size):
    event = ct.cast(data, ct.POINTER(Data)).contents
    [...]

# loop with callback to print_event
b["events"].open_ring_buffer(print_event)
while 1:
    try:
        b.ring_buffer_poll()
    except KeyboardInterrupt:
        exit()
// define output data structure in C
struct data_t {
    u32 pid;
    u64 ts;
    char comm[TASK_COMM_LEN];
};
BPF_RINGBUF_OUTPUT(events, 8);
[...]
def print_event(ctx, data, size):
    event = b["events"].event(data)
[...]
# define output data structure in Python
TASK_COMM_LEN = 16    # linux/sched.h
class Data(ct.Structure):
    _fields_ = [("pid", ct.c_ulonglong),
                ("ts", ct.c_ulonglong),
                ("comm", ct.c_char * TASK_COMM_LEN)]

def print_event(ctx, data, size):
    event = ct.cast(data, ct.POINTER(Data)).contents
[...]
print("kernel function: " + b.ksym(addr))
print("kernel address: %x" % b.ksymname("vfs_read"))
print("function: " + b.sym(addr, pid))
b.attach_kprobe(event_re=pattern, fn_name="trace_count")
matched = b.num_open_kprobes()
if matched == 0:
    print("0 functions matched by \"%s\". Exiting." % args.pattern)
    exit()
print("The function name of %s in kernel is %s" % ("clone", b.get_syscall_fnname("clone")))
# sys_clone or __x64_sys_clone or ...
bpf: Permission denied
0: (bf) r6 = r1
1: (79) r7 = *(u64 *)(r6 +80)
2: (85) call 14
3: (bf) r8 = r0
[...]
23: (69) r1 = *(u16 *)(r7 +16)
R7 invalid mem access 'inv'

Traceback (most recent call last):
  File "./tcpaccept", line 179, in <module>
    b = BPF(text=bpf_text)
  File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 172, in __init__
    self._trace_autoload()
  File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 612, in _trace_autoload
    fn = self.load_func(func_name, BPF.KPROBE)
  File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 212, in load_func
    raise Exception("Failed to load BPF program %s" % func_name)
Exception: Failed to load BPF program kretprobe__inet_csk_accept
bpf: Failed to load program: Invalid argument
[...]
8: (85) call bpf_get_stackid#27
cannot call GPL only function from proprietary program
# ./opensnoop --cgroupmap /sys/fs/bpf/test01
# ./execsnoop --cgroupmap /sys/fs/bpf/test01
# ./tcpconnect --cgroupmap /sys/fs/bpf/test01
# ./tcpaccept --cgroupmap /sys/fs/bpf/test01
# ./tcptracer --cgroupmap /sys/fs/bpf/test01
# bpftool map create /sys/fs/bpf/test01 type hash key 8 value 8 entries 128 \
        name cgroupset flags 0
# systemd-run --pty --unit test bash
# cd examples/cgroupid
# make
# ./cgroupid hex /sys/fs/cgroup/unified/system.slice/test.service
# cd examples/cgroupid
# docker build -t cgroupid .
# docker run --rm --privileged -v /sys/fs/cgroup:/sys/fs/cgroup \
	cgroupid cgroupid hex /sys/fs/cgroup/unified/system.slice/test.service
# FILE=/sys/fs/bpf/test01
# CGROUPID_HEX="77 16 00 00 01 00 00 00"
# bpftool map update pinned $FILE key hex $CGROUPID_HEX value hex 00 00 00 00 00 00 00 00 any
# bpftool map create /sys/fs/bpf/mnt_ns_set type hash key 8 value 4 entries 128 \
        name mnt_ns_set flags 0
# tools/execsnoop.py --mntnsmap /sys/fs/bpf/mnt_ns_set
# unshare -m bash
FILE=/sys/fs/bpf/mnt_ns_set
if [ $(printf '\1' | od -dAn) -eq 1 ]; then
 HOST_ENDIAN_CMD=tac
else
  HOST_ENDIAN_CMD=cat
fi

NS_ID_HEX="$(printf '%016x' $(stat -Lc '%i' /proc/self/ns/mnt) | sed 's/.\{2\}/&\n/g' | $HOST_ENDIAN_CMD)"
bpftool map update pinned $FILE key hex $NS_ID_HEX value hex 00 00 00 00 any
# ping kinvolk.io
# tools/execsnoop.py --mntnsmap /sys/fs/bpf/mnt_ns_set
[sudo] password for mvb:
PCOMM            PID    PPID   RET ARGS
ping             8096   7970     0 /bin/ping kinvolk.io
# ./execsnoop
PCOMM            PID    RET ARGS
supervise        9660     0 ./run
supervise        9661     0 ./run
mkdir            9662     0 /bin/mkdir -p ./main
run              9663     0 ./run
[...]
# ./opensnoop
PID    COMM               FD ERR PATH
1565   redis-server        5   0 /proc/1565/stat
1565   redis-server        5   0 /proc/1565/stat
1565   redis-server        5   0 /proc/1565/stat
1603   snmpd               9   0 /proc/net/dev
1603   snmpd              11   0 /proc/net/if_inet6
1603   snmpd              -1   2 /sys/class/net/eth0/device/vendor
1603   snmpd              11   0 /proc/sys/net/ipv4/neigh/eth0/retrans_time_ms
1603   snmpd              11   0 /proc/sys/net/ipv6/neigh/eth0/retrans_time_ms
1603   snmpd              11   0 /proc/sys/net/ipv6/conf/eth0/forwarding
[...]
# ./ext4slower
Tracing ext4 operations slower than 10 ms
TIME     COMM           PID    T BYTES   OFF_KB   LAT(ms) FILENAME
06:35:01 cron           16464  R 1249    0          16.05 common-auth
06:35:01 cron           16463  R 1249    0          16.04 common-auth
06:35:01 cron           16465  R 1249    0          16.03 common-auth
06:35:01 cron           16465  R 4096    0          10.62 login.defs
06:35:01 cron           16464  R 4096    0          10.61 login.defs
# ./biolatency
Tracing block device I/O... Hit Ctrl-C to end.
^C
     usecs           : count     distribution
       0 -> 1        : 0        |                                      |
       2 -> 3        : 0        |                                      |
       4 -> 7        : 0        |                                      |
       8 -> 15       : 0        |                                      |
      16 -> 31       : 0        |                                      |
      32 -> 63       : 0        |                                      |
      64 -> 127      : 1        |                                      |
     128 -> 255      : 12       |********                              |
     256 -> 511      : 15       |**********                            |
     512 -> 1023     : 43       |*******************************       |
    1024 -> 2047     : 52       |**************************************|
    2048 -> 4095     : 47       |**********************************    |
    4096 -> 8191     : 52       |**************************************|
    8192 -> 16383    : 36       |**************************            |
   16384 -> 32767    : 15       |**********                            |
   32768 -> 65535    : 2        |*                                     |
   65536 -> 131071   : 2        |*                                     |
# ./biosnoop
TIME(s)        COMM           PID    DISK    T  SECTOR    BYTES   LAT(ms)
0.000004001    supervise      1950   xvda1   W  13092560  4096       0.74
0.000178002    supervise      1950   xvda1   W  13092432  4096       0.61
0.001469001    supervise      1956   xvda1   W  13092440  4096       1.24
0.001588002    supervise      1956   xvda1   W  13115128  4096       1.09
1.022346001    supervise      1950   xvda1   W  13115272  4096       0.98
1.022568002    supervise      1950   xvda1   W  13188496  4096       0.93
[...]
# ./cachestat
    HITS   MISSES  DIRTIES  READ_HIT% WRITE_HIT%   BUFFERS_MB  CACHED_MB
    1074       44       13      94.9%       2.9%            1        223
    2195      170        8      92.5%       6.8%            1        143
     182       53       56      53.6%       1.3%            1        143
   62480    40960    20480      40.6%      19.8%            1        223
       7        2        5      22.2%      22.2%            1        223
     348        0        0     100.0%       0.0%            1        223
[...]
# ./tcpconnect
PID    COMM         IP SADDR            DADDR            DPORT
1479   telnet       4  127.0.0.1        127.0.0.1        23
1469   curl         4  10.201.219.236   54.245.105.25    80
1469   curl         4  10.201.219.236   54.67.101.145    80
1991   telnet       6  ::1              ::1              23
2015   ssh          6  fe80::2000:bff:fe82:3ac fe80::2000:bff:fe82:3ac 22
[...]
# ./tcpaccept
PID    COMM         IP RADDR            LADDR            LPORT
907    sshd         4  192.168.56.1     192.168.56.102   22
907    sshd         4  127.0.0.1        127.0.0.1        22
5389   perl         6  1234:ab12:2040:5020:2299:0:5:0 1234:ab12:2040:5020:2299:0:5:0 7001
[...]
# ./tcpretrans
TIME     PID    IP LADDR:LPORT          T> RADDR:RPORT          STATE
01:55:05 0      4  10.153.223.157:22    R> 69.53.245.40:34619   ESTABLISHED
01:55:05 0      4  10.153.223.157:22    R> 69.53.245.40:34619   ESTABLISHED
01:55:17 0      4  10.153.223.157:22    R> 69.53.245.40:22957   ESTABLISHED
[...]
# ./runqlat
Tracing run queue latency... Hit Ctrl-C to end.
^C
     usecs               : count     distribution
         0 -> 1          : 233      |***********                             |
         2 -> 3          : 742      |************************************    |
         4 -> 7          : 203      |**********                              |
         8 -> 15         : 173      |********                                |
        16 -> 31         : 24       |*                                       |
        32 -> 63         : 0        |                                        |
        64 -> 127        : 30       |*                                       |
       128 -> 255        : 6        |                                        |
       256 -> 511        : 3        |                                        |
       512 -> 1023       : 5        |                                        |
      1024 -> 2047       : 27       |*                                       |
      2048 -> 4095       : 30       |*                                       |
      4096 -> 8191       : 20       |                                        |
      8192 -> 16383      : 29       |*                                       |
     16384 -> 32767      : 809      |****************************************|
     32768 -> 65535      : 64       |***                                     |
# ./profile
Sampling at 49 Hertz of all threads by user + kernel stack... Hit Ctrl-C to end.
^C
    00007f31d76c3251 [unknown]
    47a2c1e752bf47f7 [unknown]
    -                sign-file (8877)
        1

    ffffffff813d0af8 __clear_user
    ffffffff813d5277 iov_iter_zero
    ffffffff814ec5f2 read_iter_zero
    ffffffff8120be9d __vfs_read
    ffffffff8120c385 vfs_read
    ffffffff8120d786 sys_read
    ffffffff817cc076 entry_SYSCALL_64_fastpath
    00007fc5652ad9b0 read
    -                dd (25036)
        4

    0000000000400542 func_a
    0000000000400598 main
    00007f12a133e830 __libc_start_main
    083e258d4c544155 [unknown]
    -                func_ab (13549)
        5

[...]

    ffffffff8105eb66 native_safe_halt
    ffffffff8103659e default_idle
    ffffffff81036d1f arch_cpu_idle
    ffffffff810bba5a default_idle_call
    ffffffff810bbd07 cpu_startup_entry
    ffffffff8104df55 start_secondary
    -                swapper/1 (0)
        75
$ trace.py \
  'p::SyS_chown "file = %s, to_uid = %d, to_gid = %d, from_uid = %d", arg1, arg2, arg3, $uid' \
  'p::SyS_fchown "fd = %d, to_uid = %d, to_gid = %d, from_uid = %d", arg1, arg2, arg3, $uid' \
  'p::SyS_lchown "file = %s, to_uid = %d, to_gid = %d, from_uid = %d", arg1, arg2, arg3, $uid'
PID    TID    COMM         FUNC             -
1269255 1269255 python3.6    SyS_lchown       file = /tmp/dotsync-usisgezu/tmp, to_uid = 128203, to_gid = 100, from_uid = 128203
1269441 1269441 zstd         SyS_chown        file = /tmp/dotsync-vic7ygj0/dotsync-package.zst, to_uid = 128203, to_gid = 100, from_uid = 128203
1269255 1269255 python3.6    SyS_lchown       file = /tmp/dotsync-a40zd7ev/tmp, to_uid = 128203, to_gid = 100, from_uid = 128203
1269442 1269442 zstd         SyS_chown        file = /tmp/dotsync-gzp413o_/dotsync-package.zst, to_uid = 128203, to_gid = 100, from_uid = 128203
1269255 1269255 python3.6    SyS_lchown       file = /tmp/dotsync-whx4fivm/tmp/.bash_profile, to_uid = 128203, to_gid = 100, from_uid = 128203
!(!preempt && prev->state) // i.e., preempt || !prev->state
args->prev_state == TASK_STATE_MAX || args->prev_state == 0
$ trace.py -p 1134138 't:sched:sched_switch (args->prev_state == TASK_STATE_MAX || args->prev_state == 0)'
PID    TID    COMM         FUNC
1134138 1134140 contention_test sched_switch
1134138 1134142 contention_test sched_switch
...
$ trace.py -L 1134140 't:sched:sched_switch (args->prev_state == TASK_STATE_MAX || args->prev_state == 0)'
PID    TID    COMM         FUNC
1134138 1134140 contention_test sched_switch
1134138 1134140 contention_test sched_switch
...
$ strace trace.py 'r:bash:readline "%s", retval'
...
perf_event_open(0x7ffd968212f0, -1, 0, -1, 0x8 /* PERF_FLAG_??? */) = -1 EIO (Input/output error)
...
$ trace.py 'r::uprobe_register "ret = %d", retval'
$ trace.py 'r::uprobe_register "ret = %d", retval'
PID    TID    COMM         FUNC             -
1041401 1041401 python2.7    uprobe_register  ret = -5
if (!inode->i_mapping->a_ops->readpage && !shmem_mapping(inode->i_mapping))
        return -EIO;
bool shmem_mapping(struct address_space *mapping)
{
        return mapping->a_ops == &shmem_aops;
}
$ trace.py -I 'linux/fs.h' 'p::uprobe_register(struct inode *inode) "a_ops = %llx", inode->i_mapping->a_ops'
PID    TID    COMM         FUNC             -
814288 814288 python2.7    uprobe_register  a_ops = ffffffff81a2adc0
^C$ grep ffffffff81a2adc0 /proc/kallsyms
ffffffff81a2adc0 R empty_aops

Functionalities	Kernel Configuration	Description
Basic	CONFIG_BPF_SYSCALL	Enable the bpf() system call
	CONFIG_BPF_JIT	BPF programs are normally handled by a BPF interpreter. This option allows the kernel to generate native code when a program is loaded into the kernel. This will significantly speed-up processing of BPF programs
	CONFIG_HAVE_BPF_JIT	Enable BPF Just In Time compiler
	CONFIG_HAVE_EBPF_JIT	Extended BPF JIT (eBPF)
	CONFIG_HAVE_CBPF_JIT	Classic BPF JIT (cBPF)
	CONFIG_MODULES	Enable to build loadable kernel modules
	CONFIG_BPF	BPF VM interpreter
	CONFIG_BPF_EVENTS	Allow the user to attach BPF programs to kprobe, uprobe, and tracepoint events
	CONFIG_PERF_EVENTS	Kernel performance events and counters
	CONFIG_HAVE_PERF_EVENTS	Enable perf events
	CONFIG_PROFILING	Enable the extended profiling support mechanisms used by profilers
BTF	CONFIG_DEBUG_INFO_BTF	Generate deduplicated BTF type information from DWARF debug info
	CONFIG_PAHOLE_HAS_SPLIT_BTF	Generate BTF for each selected kernel module
	CONFIG_DEBUG_INFO_BTF_MODULES	Generate compact split BTF type information for kernel modules
Security	CONFIG_BPF_JIT_ALWAYS_ON	Enable BPF JIT and removes BPF interpreter to avoid speculative execution
	CONFIG_BPF_UNPRIV_DEFAULT_OFF	Disable unprivileged BPF by default by setting
Cgroup	CONFIG_CGROUP_BPF	Support for BPF programs attached to cgroups
Network	CONFIG_BPFILTER	BPF based packet filtering framework (BPFILTER)
	CONFIG_BPFILTER_UMH	This builds bpfilter kernel module with embedded user mode helper
	CONFIG_NET_CLS_BPF	BPF-based classifier - to classify packets based on programmable BPF (JIT'ed) filters as an alternative to ematches
	CONFIG_NET_ACT_BPF	Execute BPF code on packets. The BPF code will decide if the packet should be dropped or not
	CONFIG_BPF_STREAM_PARSER	Enable this to allow a TCP stream parser to be used with BPF_MAP_TYPE_SOCKMAP
	CONFIG_LWTUNNEL_BPF	Allow to run BPF programs as a nexthop action following a route lookup for incoming and outgoing packets
	CONFIG_NETFILTER_XT_MATCH_BPF	BPF matching applies a linux socket filter to each packet and accepts those for which the filter returns non-zero
	CONFIG_IPV6_SEG6_BPF	To support BPF seg6local hook. bpf: Add IPv6 Segment Routing helpersy. Reference
kprobes	CONFIG_KPROBE_EVENTS	This allows the user to add tracing events (similar to tracepoints) on the fly via the ftrace interface
	CONFIG_KPROBES	Enable kprobes-based dynamic events
	CONFIG_HAVE_KPROBES	Check if krpobes enabled
	CONFIG_HAVE_REGS_AND_STACK_ACCESS_API	This symbol should be selected by an architecture if it supports the API needed to access registers and stack entries from pt_regs. For example the kprobes-based event tracer needs this API.
	CONFIG_KPROBES_ON_FTRACE	Have kprobes on function tracer if arch supports full passing of pt_regs to function tracing
kprobe multi	CONFIG_FPROBE	Enable fprobe to attach the probe on multiple functions at once
kprobe override	CONFIG_BPF_KPROBE_OVERRIDE	Enable BPF programs to override a kprobed function
uprobes	CONFIG_UPROBE_EVENTS	Enable uprobes-based dynamic events
	CONFIG_ARCH_SUPPORTS_UPROBES	Arch specific uprobes support
	CONFIG_UPROBES	Uprobes is the user-space counterpart to kprobes: they enable instrumentation applications (such as 'perf probe') to establish unintrusive probes in user-space binaries and libraries, by executing handler functions when the probes are hit by user-space applications.
	CONFIG_MMU	MMU-based virtualised addressing space support by paged memory management
Tracepoints	CONFIG_TRACEPOINTS	Enable inserting tracepoints in the kernel and connect to proble functions
	CONFIG_HAVE_SYSCALL_TRACEPOINTS	Enable syscall enter/exit tracing
Raw Tracepoints	Same as Tracepoints
LSM	CONFIG_BPF_LSM	Enable instrumentation of the security hooks with BPF programs for implementing dynamic MAC and Audit Policies
LIRC	CONFIG_BPF_LIRC_MODE2	Allow attaching BPF programs to a lirc device

Feature / Architecture	Kernel version	Commit
x86_64	3.16	`622582786c9e`
ARM64	3.18	`e54bcde3d69d`
s390	4.1	`054623105728`
Constant blinding for JIT machines	4.7	`4f3446bb809f`
PowerPC64	4.8	`156d0e290e96`
Constant blinding - PowerPC64	4.9	`b7b7013cac55`
Sparc64	4.12	`7a12b5031c6b`
MIPS	4.13	`f381bf6d82f0`
ARM32	4.14	`39c13c204bb1`
x86_32	4.18	`03f5781be2c7`
RISC-V RV64G	5.1	`2353ecc6f91f`
RISC-V RV32G	5.7	`5f316b65e99f`
PowerPC32	5.13	`51c66ad849a7`
LoongArch	6.1	`5dc615520c4d`

Feature	Kernel version	Commit
`AF_PACKET` (libpcap/tcpdump, `cls_bpf` classifier, netfilter's `xt_bpf`, team driver's load-balancing mode…)	3.15	`bd4cf0ed331a`
Kernel helpers	3.15	`bd4cf0ed331a`
`bpf()` syscall	3.18	`99c55f7d47c0`
Maps (a.k.a. Tables; details below)	3.18	`99c55f7d47c0`
BPF attached to sockets	3.19	`89aa075832b0`
BPF attached to `kprobes`	4.1	`2541517c32be`
`cls_bpf` / `act_bpf` for `tc`	4.1	`e2e9b6541dd4`
Tail calls	4.2	`04fd61ab36ec`
Non-root programs on sockets	4.4	`1be7f75d1668`
Persistent maps and programs (virtual FS)	4.4	`b2197755b263`
`tc`'s `direct-action` (`da`) mode	4.4	`045efa82ff56`
`tc`'s `clsact` qdisc	4.5	`1f211a1b929c`
BPF attached to tracepoints	4.7	`98b5c2c65c29`
Direct packet access	4.7	`969bf05eb3ce`
XDP (see below)	4.8	`6a773a15a1e8`
BPF attached to perf events	4.9	`0515e5999a46`
Hardware offload for `tc`'s `cls_bpf`	4.9	`332ae8e2f6ec`
Verifier exposure and internal hooks	4.9	`13a27dfc6697`
BPF attached to cgroups for socket filtering	4.10	`0e33661de493`
Lightweight tunnel encapsulation	4.10	`3a0af8fd61f9`
eBPF support for `xt_bpf` module (iptables)	4.10	`2c16d6033264`
BPF program tag	4.10	`7bd509e311f4`
Tracepoints to debug BPF	4.11 (removed in 4.18)	`a67edbf4fb6d` `4d220ed0f814`
Testing / benchmarking BPF programs	4.12	`1cf1cae963c2`
BPF programs and maps IDs	4.13	`dc4bb0e23561`
BPF support for `sock_ops`	4.13	`40304b2a1567`
BPF support for skbs on sockets	4.14	`b005fd189cec`
bpftool utility in kernel sources	4.15	`71bb428fe2c1`
BPF attached to cgroups as device controller	4.15	`ebc614f68736`
bpf2bpf function calls	4.16	`cc8b0b92a169`
BPF used for monitoring socket RX/TX data	4.17	`4f738adba30a`
BPF attached to raw tracepoints	4.17	`c4f6699dfcb8`
BPF attached to `bind()` system call	4.17	`4fbac77d2d09` `aac3fc320d94`
BPF attached to `connect()` system call	4.17	`d74bad4e74ee`
BPF Type Format (BTF)	4.18	`69b693f0aefa`
AF_XDP	4.18	`fbfc504a24f5`
bpfilter	4.18	`d2ba09c17a06`
End.BPF action for seg6local LWT	4.18	`004d4b274e2a`
BPF attached to LIRC devices	4.18	`f4364dcfc86d`
Pass map values to map helpers	4.18	`d71962f3e627`
BPF socket reuseport	4.19	`2dbb9b9e6df6`
BPF flow dissector	4.20	`d58e468b1112`
BPF 1M insn limit	5.2	`c04c0d2b968a`
BPF cgroup sysctl	5.2	`7b146cebe30c`
BPF raw tracepoint writable	5.2	`9df1c28bb752`
BPF bounded loop	5.3	`2589726d12a1`
BPF trampoline	5.5	`fec56f5890d9`
BPF LSM hook	5.7	`fc611f47f218` `641cd7b06c91`
BPF iterator	5.8	`180139dca8b3`
BPF socket lookup hook	5.9	`e9ddbb7707ff`
Sleepable BPF programs	5.10	`1e6c62a88215`
Mixing bpf2bpf function calls and tailcalls (x86_64)	5.10	`e411901c0b77`
Mixing bpf2bpf function calls and tailcalls (arm64)	6.0	`d4609a5d8c70`
Mixing bpf2bpf function calls and tailcalls (s390)	6.3	`dd691e847d28`
Mixing bpf2bpf function calls and tailcalls (loongarch)	6.4	`bb035ef0cc91`

Program type	Kernel version	Commit	Enum
Socket filter	3.19	`ddd872bc3098`	BPF_PROG_TYPE_SOCKET_FILTER
Kprobe	4.1	`2541517c32be`	BPF_PROG_TYPE_KPROBE
traffic control (TC)	4.1	`96be4325f443`	BPF_PROG_TYPE_SCHED_CLS
traffic control (TC)	4.1	`94caee8c312d`	BPF_PROG_TYPE_SCHED_ACT
Tracepoint	4.7	`98b5c2c65c29`	BPF_PROG_TYPE_TRACEPOINT
XDP	4.8	`6a773a15a1e8`	BPF_PROG_TYPE_XDP
Perf event	4.9	`0515e5999a46`	BPF_PROG_TYPE_PERF_EVENT
cgroup socket filtering	4.10	`0e33661de493`	BPF_PROG_TYPE_CGROUP_SKB
cgroup sock modification	4.10	`610236587600`	BPF_PROG_TYPE_CGROUP_SOCK
lightweight tunnel (IN)	4.10	`3a0af8fd61f9`	BPF_PROG_TYPE_LWT_IN
lightweight tunnel (OUT)	4.10	`3a0af8fd61f9`	BPF_PROG_TYPE_LWT_OUT
lightweight tunnel (XMIT)	4.10	`3a0af8fd61f9`	BPF_PROG_TYPE_LWT_XMIT
cgroup sock ops (per conn)	4.13	`40304b2a1567`	BPF_PROG_TYPE_SOCK_OPS
stream parser / stream verdict	4.14	`b005fd189cec`	BPF_PROG_TYPE_SK_SKB
cgroup device manager	4.15	`ebc614f68736`	BPF_PROG_TYPE_CGROUP_DEVICE
socket msg verdict	4.17	`4f738adba30a`	BPF_PROG_TYPE_SK_MSG
Raw tracepoint	4.17	`c4f6699dfcb8`	BPF_PROG_TYPE_RAW_TRACEPOINT
socket binding	4.17	`4fbac77d2d09`	BPF_PROG_TYPE_CGROUP_SOCK_ADDR
LWT seg6local	4.18	`004d4b274e2a`	BPF_PROG_TYPE_LWT_SEG6LOCAL
lirc devices	4.18	`f4364dcfc86d`	BPF_PROG_TYPE_LIRC_MODE2
lookup SO_REUSEPORT socket	4.19	`2dbb9b9e6df6`	BPF_PROG_TYPE_SK_REUSEPORT
flow dissector	4.20	`d58e468b1112`	BPF_PROG_TYPE_FLOW_DISSECTOR
cgroup sysctl	5.2	`7b146cebe30c`	BPF_PROG_TYPE_CGROUP_SYSCTL
writable raw tracepoints	5.2	`9df1c28bb752`	BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE
cgroup getsockopt/setsockopt	5.3	`0d01da6afc54`	BPF_PROG_TYPE_CGROUP_SOCKOPT
Tracing (BTF/BPF trampoline)	5.5	`f1b9509c2fb0`	BPF_PROG_TYPE_TRACING
struct ops	5.6	`27ae7997a661`	BPF_PROG_TYPE_STRUCT_OPS
extensions	5.6	`be8704ff07d2`	BPF_PROG_TYPE_EXT
LSM	5.7	`fc611f47f218`	BPF_PROG_TYPE_LSM
lookup listening socket	5.9	`e9ddbb7707ff`	BPF_PROG_TYPE_SK_LOOKUP
Allow executing syscalls	5.15	`79a7f8bdb159`	BPF_PROG_TYPE_SYSCALL

Map type	Kernel version	Commit	Enum
Hash	3.19	`0f8e4bd8a1fc`	BPF_MAP_TYPE_HASH
Array	3.19	`28fbcfa08d8e`	BPF_MAP_TYPE_ARRAY
Prog array	4.2	`04fd61ab36ec`	BPF_MAP_TYPE_PROG_ARRAY
Perf events	4.3	`ea317b267e9d`	BPF_MAP_TYPE_PERF_EVENT_ARRAY
Per-CPU hash	4.6	`824bd0ce6c7c`	BPF_MAP_TYPE_PERCPU_HASH
Per-CPU array	4.6	`a10423b87a7e`	BPF_MAP_TYPE_PERCPU_ARRAY
Stack trace	4.6	`d5a3b1f69186`	BPF_MAP_TYPE_STACK_TRACE
cgroup array	4.8	`4ed8ec521ed5`	BPF_MAP_TYPE_CGROUP_ARRAY
LRU hash	4.10	`29ba732acbee` `3a08c2fd7634`	BPF_MAP_TYPE_LRU_HASH
LRU per-CPU hash	4.10	`8f8449384ec3` `961578b63474`	BPF_MAP_TYPE_LRU_PERCPU_HASH
LPM trie (longest-prefix match)	4.11	`b95a5c4db09b`	BPF_MAP_TYPE_LPM_TRIE
Array of maps	4.12	`56f668dfe00d`	BPF_MAP_TYPE_ARRAY_OF_MAPS
Hash of maps	4.12	`bcc6b1b7ebf8`	BPF_MAP_TYPE_HASH_OF_MAPS
Netdevice references (array)	4.14	`546ac1ffb70d`	BPF_MAP_TYPE_DEVMAP
Socket references (array)	4.14	`174a79ff9515`	BPF_MAP_TYPE_SOCKMAP
CPU references	4.15	`6710e1126934`	BPF_MAP_TYPE_CPUMAP
AF_XDP socket (XSK) references	4.18	`fbfc504a24f5`	BPF_MAP_TYPE_XSKMAP
Socket references (hashmap)	4.18	`81110384441a`	BPF_MAP_TYPE_SOCKHASH
cgroup storage	4.19	`de9cbbaadba5`	BPF_MAP_TYPE_CGROUP_STORAGE
reuseport sockarray	4.19	`5dc4c4b7d4e8`	BPF_MAP_TYPE_REUSEPORT_SOCKARRAY
percpu cgroup storage	4.20	`b741f1630346`	BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE
queue	4.20	`f1a2e44a3aec`	BPF_MAP_TYPE_QUEUE
stack	4.20	`f1a2e44a3aec`	BPF_MAP_TYPE_STACK
socket local storage	5.2	`6ac99e8f23d4`	BPF_MAP_TYPE_SK_STORAGE
Netdevice references (hashmap)	5.4	`6f9d451ab1a3`	BPF_MAP_TYPE_DEVMAP_HASH
struct ops	5.6	`85d33df357b6`	BPF_MAP_TYPE_STRUCT_OPS
ring buffer	5.8	`457f44363a88`	BPF_MAP_TYPE_RINGBUF
inode storage	5.10	`8ea636848aca`	BPF_MAP_TYPE_INODE_STORAGE
task storage	5.11	`4cf1bc1f1045`	BPF_MAP_TYPE_TASK_STORAGE
Bloom filter	5.16	`9330986c0300`	BPF_MAP_TYPE_BLOOM_FILTER
user ringbuf	6.1	`583c1f420173`	BPF_MAP_TYPE_USER_RINGBUF

Feature	Kernel version	Commit
Basic operations (lookup, update, delete, `GET_NEXT_KEY`)	3.18	`db20fd2b0108`
Pass flags to `UPDATE_ELEM`	3.19	`3274f52073d8`
Pre-alloc map memory by default	4.6	`6c9059817432`
Pass `NULL` to `GET_NEXT_KEY`	4.12	`8fe45924387b`
Creation: select NUMA node	4.14	`96eabe7a40aa`
Restrict access from syscall side	4.15	`6e71b04a8224`
Creation: specify map name	4.15	`ad5b177bd73f`
`LOOKUP_AND_DELETE_ELEM`	4.20	`bd513cd08f10`
Creation: `BPF_F_ZERO_SEED`	5.0	`96b3b6c9091d`
`BPF_F_LOCK` flag for lookup / update	5.1	`96049f3afd50`
Restrict access from BPF side	5.2	`591fe9888d78`
`FREEZE`	5.2	`87df15de441b`
mmap() support for array maps	5.5	`fc9702273e2e`
`LOOKUP_BATCH`	5.6	`cb4d03ab499d`
`UPDATE_BATCH`, `DELETE_BATCH`	5.6	`aa2e93b8e58e`
`LOOKUP_AND_DELETE_BATCH`	5.6	`057996380a42`
`LOOKUP_AND_DELETE_ELEM` support for hash maps	5.14	`3e87f192b405`

Feature / Driver	Kernel version	Commit
XDP core architecture	4.8	`6a773a15a1e8`
Action: drop	4.8	`6a773a15a1e8`
Action: pass on to stack	4.8	`6a773a15a1e8`
Action: direct forwarding (on same port)	4.8	`6ce96ca348a9`
Direct packet data write	4.8	`4acf6c0b84c9`
Mellanox `mlx4` driver	4.8	`47a38e155037`
Mellanox `mlx5` driver	4.9	`86994156c736`
Netronome `nfp` driver	4.10	`ecd63a0217d5`
QLogic (Cavium) `qed*` drivers	4.10	`496e05170958`
`virtio_net` driver	4.10	`f600b6905015`
Broadcom `bnxt_en` driver	4.11	`c6d30e8391b8`
Intel `ixgbe*` drivers	4.12	`924708081629`
Cavium `thunderx` driver	4.12	`05c773f52b96`
Generic XDP	4.12	`b5cdae3291f7`
Intel `i40e` driver	4.13	`0c8493d90b6b`
Action: redirect	4.14	`6453073987ba`
Support for tap	4.14	`761876c857cb`
Support for veth	4.14	`d445516966dc`
Intel `ixgbevf` driver	4.17	`c7aec59657b6`
Freescale `dpaa2` driver	5.0	`7e273a8ebdd3`
Socionext `netsec` driver	5.3	`ba2b232108d3`
TI `cpsw` driver	5.3	`9ed4050c0d75`
Intel `ice` driver	5.5	`efc2214b6047`
Solarflare `sfc` driver	5.5	`eb9a36be7f3e`
Marvell `mvneta` driver	5.5	`0db51da7a8e9`
Microsoft `hv_netvsc` driver	5.6	`351e1581395f`
Amazon `ena` driver	5.6	`838c93dc5449`
`xen-netfront` driver	5.9	`6c5aa6fc4def`
Marvell `mvpp2` driver	5.9	`07dd0a7aae7f`
Intel `igb` driver	5.10	`9cbc948b5a20`
Freescale `dpaa` driver	5.11	`86c0c196cbe4`
Intel `igc` driver	5.13	`26575105d6ed`
Freescale `enetc` driver	5.13	`d1b15102dd16`
STMicro `stmmac` driver	5.13	`5fabb01207a2`
`bonding` driver	5.15	`9e2ee5c7e7c3`
Marvell `otx2`	5.16	`06059a1a9a4a`
Microsoft `mana` driver	5.17	`ed5356b53f07`
Fungible `fun` driver	5.18	`db37bc177dae`
Aquantia `atlantic` driver	5.19	`0d14657f4083`
Mediatek `mtk` driver	6.0	`7c26c20da5d4`
Freescale `fec_enet` driver	6.2	`6d6b39f180b8`
Microchip `lan966x` driver	6.2	`6a2159be7604`
Engleder `tsnep` driver	6.3	`d24bc0bcbbff`
Google `gve` driver	6.4	`2e80aeae9f80`
VMware `vmxnet3` driver	6.6	`54f00cce1178`

Helper	Kernel version	License	Commit
`BPF_FUNC_bind()`	4.17		`d74bad4e74ee`
`BPF_FUNC_bprm_opts_set()`	5.11		`3f6719c7b62f`
`BPF_FUNC_btf_find_by_name_kind()`	5.14		`3d78417b60fb`
`BPF_FUNC_cgrp_storage_delete()`	6.2		`c4bcfb38a95e`
`BPF_FUNC_cgrp_storage_get()`	6.2		`c4bcfb38a95e`
`BPF_FUNC_check_mtu()`	5.12		`34b2021cc616`
`BPF_FUNC_clone_redirect()`	4.2		`3896d655f4d4`
`BPF_FUNC_copy_from_user()`	5.10		`07be4c4a3e7a`
`BPF_FUNC_copy_from_user_task()`	5.18	GPL	`376040e47334`
`BPF_FUNC_csum_diff()`	4.6		`7d672345ed29`
`BPF_FUNC_csum_level()`	5.7		`7cdec54f9713`
`BPF_FUNC_csum_update()`	4.9		`36bbef52c7eb`
`BPF_FUNC_current_task_under_cgroup()`	4.9		`60d20f9195b2`
`BPF_FUNC_d_path()`	5.10		`6e22ab9da793`
`BPF_FUNC_dynptr_data()`	5.19		`34d4ef5775f7`
`BPF_FUNC_dynptr_from_mem()`	5.19		`263ae152e962`
`BPF_FUNC_dynptr_read()`	5.19		`13bbbfbea759`
`BPF_FUNC_dynptr_write()`	5.19		`13bbbfbea759`
`BPF_FUNC_fib_lookup()`	4.18	GPL	`87f5fc7e48dd`
`BPF_FUNC_find_vma()`	5.17		`7c7e3d31e785`
`BPF_FUNC_for_each_map_elem()`	5.13		`69c087ba6225`
`BPF_FUNC_get_attach_cookie()`	5.15		`7adfc6c9b315`
`BPF_FUNC_get_branch_snapshot()`	5.16	GPL	`856c02dbce4f`
`BPF_FUNC_get_current_ancestor_cgroup_id()`	5.6		`b4490c5c4e02`
`BPF_FUNC_get_cgroup_classid()`	4.3		`8d20aabe1c76`
`BPF_FUNC_get_current_cgroup_id()`	4.18		`bf6fa2c893c5`
`BPF_FUNC_get_current_comm()`	4.2		`ffeedafbf023`
`BPF_FUNC_get_current_pid_tgid()`	4.2		`ffeedafbf023`
`BPF_FUNC_get_current_task()`	4.8	GPL	`606274c5abd8`
`BPF_FUNC_get_current_task_btf()`	5.11	GPL	`3ca1032ab7ab`
`BPF_FUNC_get_current_uid_gid()`	4.2		`ffeedafbf023`
`BPF_FUNC_get_func_arg()`	5.17		`f92c1e183604`
`BPF_FUNC_get_func_arg_cnt()`	5.17		`f92c1e183604`
`BPF_FUNC_get_func_ip()`	5.15		`5d8b583d04ae`
`BPF_FUNC_get_func_ret()`	5.17		`f92c1e183604`
`BPF_FUNC_get_retval()`	5.18		`b44123b4a3dc`
`BPF_FUNC_get_hash_recalc()`	4.8		`13c5c240f789`
`BPF_FUNC_get_listener_sock()`	5.1		`dbafd7ddd623`
`BPF_FUNC_get_local_storage()`	4.19		`cd3394317653`
`BPF_FUNC_get_netns_cookie()`	5.7		`f318903c0bf4`
`BPF_FUNC_get_ns_current_pid_tgid()`	5.7		`b4490c5c4e02`
`BPF_FUNC_get_numa_node_id()`	4.10		`2d0e30c30f84`
`BPF_FUNC_get_prandom_u32()`	4.1		`03e69b508b6f`
`BPF_FUNC_get_route_realm()`	4.4		`c46646d0484f`
`BPF_FUNC_get_smp_processor_id()`	4.1		`c04167ce2ca0`
`BPF_FUNC_get_socket_cookie()`	4.12		`91b8270f2a4d`
`BPF_FUNC_get_socket_uid()`	4.12		`6acc5c291068`
`BPF_FUNC_get_stack()`	4.18	GPL	`de2ff05f48af`
`BPF_FUNC_get_stackid()`	4.6	GPL	`d5a3b1f69186`
`BPF_FUNC_get_task_stack()`	5.9		`fa28dcb82a38`
`BPF_FUNC_getsockopt()`	4.15		`cd86d1fd2102`
`BPF_FUNC_ima_file_hash()`	5.18		`174b16946e39`
`BPF_FUNC_ima_inode_hash()`	5.11		`27672f0d280a`
`BPF_FUNC_inode_storage_delete()`	5.10		`8ea636848aca`
`BPF_FUNC_inode_storage_get()`	5.10		`8ea636848aca`
`BPF_FUNC_jiffies64()`	5.5		`5576b991e9c1`
`BPF_FUNC_kallsyms_lookup_name()`	5.16		`d6aef08a872b`
`BPF_FUNC_kptr_xchg()`	5.19		`c0a5a21c25f3`
`BPF_FUNC_ktime_get_boot_ns()`	5.8		`71d19214776e`
`BPF_FUNC_ktime_get_coarse_ns()`	5.11		`d05512618056`
`BPF_FUNC_ktime_get_ns()`	4.1		`d9847d310ab4`
`BPF_FUNC_ktime_get_tai_ns()`	6.1		`c8996c98f703`
`BPF_FUNC_l3_csum_replace()`	4.1		`91bc4822c3d6`
`BPF_FUNC_l4_csum_replace()`	4.1		`91bc4822c3d6`
`BPF_FUNC_load_hdr_opt()`	5.10		`0813a841566f`
`BPF_FUNC_loop()`	5.17		`e6f2dd0f8067`
`BPF_FUNC_lwt_push_encap()`	4.18		`fe94cc290f53`
`BPF_FUNC_lwt_seg6_action()`	4.18		`fe94cc290f53`
`BPF_FUNC_lwt_seg6_adjust_srh()`	4.18		`fe94cc290f53`
`BPF_FUNC_lwt_seg6_store_bytes()`	4.18		`fe94cc290f53`
`BPF_FUNC_map_delete_elem()`	3.19		`d0003ec01c66`
`BPF_FUNC_map_lookup_elem()`	3.19		`d0003ec01c66`
`BPF_FUNC_map_lookup_percpu_elem()`	5.19		`07343110b293`
`BPF_FUNC_map_peek_elem()`	4.20		`f1a2e44a3aec`
`BPF_FUNC_map_pop_elem()`	4.20		`f1a2e44a3aec`
`BPF_FUNC_map_push_elem()`	4.20		`f1a2e44a3aec`
`BPF_FUNC_map_update_elem()`	3.19		`d0003ec01c66`
`BPF_FUNC_msg_apply_bytes()`	4.17		`2a100317c9eb`
`BPF_FUNC_msg_cork_bytes()`	4.17		`91843d540a13`
`BPF_FUNC_msg_pop_data()`	5.0		`7246d8ed4dcc`
`BPF_FUNC_msg_pull_data()`	4.17		`015632bb30da`
`BPF_FUNC_msg_push_data()`	4.20		`6fff607e2f14`
`BPF_FUNC_msg_redirect_hash()`	4.18		`81110384441a`
`BPF_FUNC_msg_redirect_map()`	4.17		`4f738adba30a`
`BPF_FUNC_per_cpu_ptr()`	5.10		`eaa6bcb71ef6`
`BPF_FUNC_perf_event_output()`	4.4	GPL	`a43eec304259`
`BPF_FUNC_perf_event_read()`	4.3	GPL	`35578d798400`
`BPF_FUNC_perf_event_read_value()`	4.15	GPL	`908432ca84fc`
`BPF_FUNC_perf_prog_read_value()`	4.15	GPL	`4bebdc7a85aa`
`BPF_FUNC_probe_read()`	4.1	GPL	`2541517c32be`
`BPF_FUNC_probe_read_kernel()`	5.5	GPL	`6ae08ae3dea2`
`BPF_FUNC_probe_read_kernel_str()`	5.5	GPL	`6ae08ae3dea2`
`BPF_FUNC_probe_read_user()`	5.5	GPL	`6ae08ae3dea2`
`BPF_FUNC_probe_read_user_str()`	5.5	GPL	`6ae08ae3dea2`
`BPF_FUNC_probe_read_str()`	4.11	GPL	`a5e8c07059d0`
`BPF_FUNC_probe_write_user()`	4.8	GPL	`96ae52279594`
`BPF_FUNC_rc_keydown()`	4.18	GPL	`f4364dcfc86d`
`BPF_FUNC_rc_pointer_rel()`	5.0	GPL	`01d3240a04f4`
`BPF_FUNC_rc_repeat()`	4.18	GPL	`f4364dcfc86d`
`BPF_FUNC_read_branch_records()`	5.6	GPL	`fff7b64355ea`
`BPF_FUNC_redirect()`	4.4		`27b29f63058d`
`BPF_FUNC_redirect_map()`	4.14		`97f91a7cf04f`
`BPF_FUNC_redirect_neigh()`	5.10		`b4ab31414970`
`BPF_FUNC_redirect_peer()`	5.10		`9aa1206e8f48`
`BPF_FUNC_reserve_hdr_opt()`	5.10		`0813a841566f`
`BPF_FUNC_ringbuf_discard()`	5.8		`457f44363a88`
`BPF_FUNC_ringbuf_discard_dynptr()`	5.19		`bc34dee65a65`
`BPF_FUNC_ringbuf_output()`	5.8		`457f44363a88`
`BPF_FUNC_ringbuf_query()`	5.8		`457f44363a88`
`BPF_FUNC_ringbuf_reserve()`	5.8		`457f44363a88`
`BPF_FUNC_ringbuf_reserve_dynptr()`	5.19		`bc34dee65a65`
`BPF_FUNC_ringbuf_submit()`	5.8		`457f44363a88`
`BPF_FUNC_ringbuf_submit_dynptr()`	5.19		`bc34dee65a65`
`BPF_FUNC_send_signal()`	5.3		`8b401f9ed244`
`BPF_FUNC_send_signal_thread()`	5.5		`8482941f0906`
`BPF_FUNC_seq_printf()`	5.7	GPL	`492e639f0c22`
`BPF_FUNC_seq_printf_btf()`	5.10		`eb411377aed9`
`BPF_FUNC_seq_write()`	5.7	GPL	`492e639f0c22`
`BPF_FUNC_set_hash()`	4.13		`ded092cd73c2`
`BPF_FUNC_set_hash_invalid()`	4.9		`7a4b28c6cc9f`
`BPF_FUNC_set_retval()`	5.18		`b44123b4a3dc`
`BPF_FUNC_setsockopt()`	4.13		`8c4b4c7e9ff0`
`BPF_FUNC_sk_ancestor_cgroup_id()`	5.7		`f307fa2cb4c9`
`BPF_FUNC_sk_assign()`	5.6		`cf7fbe660f2d`
`BPF_FUNC_sk_cgroup_id()`	5.7		`f307fa2cb4c9`
`BPF_FUNC_sk_fullsock()`	5.1		`46f8bc92758c`
`BPF_FUNC_sk_lookup_tcp()`	4.20		`6acc9b432e67`
`BPF_FUNC_sk_lookup_udp()`	4.20		`6acc9b432e67`
`BPF_FUNC_sk_redirect_hash()`	4.18		`81110384441a`
`BPF_FUNC_sk_redirect_map()`	4.14		`174a79ff9515`
`BPF_FUNC_sk_release()`	4.20		`6acc9b432e67`
`BPF_FUNC_sk_select_reuseport()`	4.19		`2dbb9b9e6df6`
`BPF_FUNC_sk_storage_delete()`	5.2		`6ac99e8f23d4`
`BPF_FUNC_sk_storage_get()`	5.2		`6ac99e8f23d4`
`BPF_FUNC_skb_adjust_room()`	4.13		`2be7e212d541`
`BPF_FUNC_skb_ancestor_cgroup_id()`	4.19		`7723628101aa`
`BPF_FUNC_skb_change_head()`	4.10		`3a0af8fd61f9`
`BPF_FUNC_skb_change_proto()`	4.8		`6578171a7ff0`
`BPF_FUNC_skb_change_tail()`	4.9		`5293efe62df8`
`BPF_FUNC_skb_change_type()`	4.8		`d2485c4242a8`
`BPF_FUNC_skb_cgroup_classid()`	5.10		`b426ce83baa7`
`BPF_FUNC_skb_cgroup_id()`	4.18		`cb20b08ead40`
`BPF_FUNC_skb_ecn_set_ce()`	5.1		`f7c917ba11a6`
`BPF_FUNC_skb_get_tunnel_key()`	4.3		`d3aa45ce6b94`
`BPF_FUNC_skb_get_tunnel_opt()`	4.6		`14ca0751c96f`
`BPF_FUNC_skb_get_xfrm_state()`	4.18		`12bed760a78d`
`BPF_FUNC_skb_load_bytes()`	4.5		`05c74e5e53f6`
`BPF_FUNC_skb_load_bytes_relative()`	4.18		`4e1ec56cdc59`
`BPF_FUNC_skb_output()`	5.5		`a7658e1a4164`
`BPF_FUNC_skb_pull_data()`	4.9		`36bbef52c7eb`
`BPF_FUNC_skb_set_tstamp()`	5.18		`9bb984f28d5b`
`BPF_FUNC_skb_set_tunnel_key()`	4.3		`d3aa45ce6b94`
`BPF_FUNC_skb_set_tunnel_opt()`	4.6		`14ca0751c96f`
`BPF_FUNC_skb_store_bytes()`	4.1		`91bc4822c3d6`
`BPF_FUNC_skb_under_cgroup()`	4.8		`4a482f34afcc`
`BPF_FUNC_skb_vlan_pop()`	4.3		`4e10df9a60d9`
`BPF_FUNC_skb_vlan_push()`	4.3		`4e10df9a60d9`
`BPF_FUNC_skc_lookup_tcp()`	5.2		`edbf8c01de5a`
`BPF_FUNC_skc_to_mctcp_sock()`	5.19		`3bc253c2e652`
`BPF_FUNC_skc_to_tcp_sock()`	5.9		`478cfbdf5f13`
`BPF_FUNC_skc_to_tcp_request_sock()`	5.9		`478cfbdf5f13`
`BPF_FUNC_skc_to_tcp_timewait_sock()`	5.9		`478cfbdf5f13`
`BPF_FUNC_skc_to_tcp6_sock()`	5.9		`af7ec1383361`
`BPF_FUNC_skc_to_udp6_sock()`	5.9		`0d4fad3e57df`
`BPF_FUNC_skc_to_unix_sock()`	5.16		`9eeb3aa33ae0`
`BPF_FUNC_snprintf()`	5.13		`7b15523a989b`
`BPF_FUNC_snprintf_btf()`	5.10		`c4d0bfb45068`
`BPF_FUNC_sock_from_file()`	5.11		`4f19cab76136`
`BPF_FUNC_sock_hash_update()`	4.18		`81110384441a`
`BPF_FUNC_sock_map_update()`	4.14		`174a79ff9515`
`BPF_FUNC_spin_lock()`	5.1		`d83525ca62cf`
`BPF_FUNC_spin_unlock()`	5.1		`d83525ca62cf`
`BPF_FUNC_store_hdr_opt()`	5.10		`0813a841566f`
`BPF_FUNC_strncmp()`	5.17		`c5fb19937455`
`BPF_FUNC_strtol()`	5.2		`d7a4cb9b6705`
`BPF_FUNC_strtoul()`	5.2		`d7a4cb9b6705`
`BPF_FUNC_sys_bpf()`	5.14		`79a7f8bdb159`
`BPF_FUNC_sys_close()`	5.14		`3abea089246f`
`BPF_FUNC_sysctl_get_current_value()`	5.2		`1d11b3016cec`
`BPF_FUNC_sysctl_get_name()`	5.2		`808649fb787d`
`BPF_FUNC_sysctl_get_new_value()`	5.2		`4e63acdff864`
`BPF_FUNC_sysctl_set_new_value()`	5.2		`4e63acdff864`
`BPF_FUNC_tail_call()`	4.2		`04fd61ab36ec`
`BPF_FUNC_task_pt_regs()`	5.15	GPL	`dd6e10fbd9f`
`BPF_FUNC_task_storage_delete()`	5.11		`4cf1bc1f1045`
`BPF_FUNC_task_storage_get()`	5.11		`4cf1bc1f1045`
`BPF_FUNC_tcp_check_syncookie()`	5.2		`399040847084`
`BPF_FUNC_tcp_gen_syncookie()`	5.3		`70d66244317e`
`BPF_FUNC_tcp_raw_check_syncookie_ipv4()`	6.0		`33bf9885040c`
`BPF_FUNC_tcp_raw_check_syncookie_ipv6()`	6.0		`33bf9885040c`
`BPF_FUNC_tcp_raw_gen_syncookie_ipv4()`	6.0		`33bf9885040c`
`BPF_FUNC_tcp_raw_gen_syncookie_ipv6()`	6.0		`33bf9885040c`
`BPF_FUNC_tcp_send_ack()`	5.5		`206057fe020a`
`BPF_FUNC_tcp_sock()`	5.1		`655a51e536c0`
`BPF_FUNC_this_cpu_ptr()`	5.10		`63d9b80dcf2c`
`BPF_FUNC_timer_init()`	5.15		`b00628b1c7d5`
`BPF_FUNC_timer_set_callback()`	5.15		`b00628b1c7d5`
`BPF_FUNC_timer_start()`	5.15		`b00628b1c7d5`
`BPF_FUNC_timer_cancel()`	5.15		`b00628b1c7d5`
`BPF_FUNC_trace_printk()`	4.1	GPL	`9c959c863f82`
`BPF_FUNC_trace_vprintk()`	5.16	GPL	`10aceb629e19`
`BPF_FUNC_user_ringbuf_drain()`	6.1		`205715673844`
`BPF_FUNC_xdp_adjust_head()`	4.10		`17bedab27231`
`BPF_FUNC_xdp_adjust_meta()`	4.15		`de8f3a83b0a0`
`BPF_FUNC_xdp_adjust_tail()`	4.18		`b32cc5b9a346`
`BPF_FUNC_xdp_get_buff_len()`	5.18		`0165cc817075`
`BPF_FUNC_xdp_load_bytes()`	5.18		`3f364222d032`
`BPF_FUNC_xdp_store_bytes()`	5.18		`3f364222d032`
`BPF_FUNC_xdp_output()`	5.6	GPL	`d831ee84bfc9`
`BPF_FUNC_override_return()`	4.16	GPL	`9802d86585db`
`BPF_FUNC_sock_ops_cb_flags_set()`	4.16		`b13d88072172`

Program Type	Helper Functions
`BPF_PROG_TYPE_SOCKET_FILTER`	`BPF_FUNC_skb_load_bytes()` `BPF_FUNC_skb_load_bytes_relative()` `BPF_FUNC_get_socket_cookie()` `BPF_FUNC_get_socket_uid()` `BPF_FUNC_perf_event_output()` `Base functions`
`BPF_PROG_TYPE_KPROBE`	`BPF_FUNC_perf_event_output()` `BPF_FUNC_get_stackid()` `BPF_FUNC_get_stack()` `BPF_FUNC_perf_event_read_value()` `BPF_FUNC_override_return()` `Tracing functions`
`BPF_PROG_TYPE_SCHED_CLS` `BPF_PROG_TYPE_SCHED_ACT`	`BPF_FUNC_skb_store_bytes()` `BPF_FUNC_skb_load_bytes()` `BPF_FUNC_skb_load_bytes_relative()` `BPF_FUNC_skb_pull_data()` `BPF_FUNC_csum_diff()` `BPF_FUNC_csum_update()` `BPF_FUNC_l3_csum_replace()` `BPF_FUNC_l4_csum_replace()` `BPF_FUNC_clone_redirect()` `BPF_FUNC_get_cgroup_classid()` `BPF_FUNC_skb_vlan_push()` `BPF_FUNC_skb_vlan_pop()` `BPF_FUNC_skb_change_proto()` `BPF_FUNC_skb_change_type()` `BPF_FUNC_skb_adjust_room()` `BPF_FUNC_skb_change_tail()` `BPF_FUNC_skb_get_tunnel_key()` `BPF_FUNC_skb_set_tunnel_key()` `BPF_FUNC_skb_get_tunnel_opt()` `BPF_FUNC_skb_set_tunnel_opt()` `BPF_FUNC_redirect()` `BPF_FUNC_get_route_realm()` `BPF_FUNC_get_hash_recalc()` `BPF_FUNC_set_hash_invalid()` `BPF_FUNC_set_hash()` `BPF_FUNC_perf_event_output()` `BPF_FUNC_get_smp_processor_id()` `BPF_FUNC_skb_under_cgroup()` `BPF_FUNC_get_socket_cookie()` `BPF_FUNC_get_socket_uid()` `BPF_FUNC_fib_lookup()` `BPF_FUNC_skb_get_xfrm_state()` `BPF_FUNC_skb_cgroup_id()` `Base functions`
`BPF_PROG_TYPE_TRACEPOINT`	`BPF_FUNC_perf_event_output()` `BPF_FUNC_get_stackid()` `BPF_FUNC_get_stack()` `BPF_FUNC_d_path()` `Tracing functions`
`BPF_PROG_TYPE_XDP`	`BPF_FUNC_perf_event_output()` `BPF_FUNC_get_smp_processor_id()` `BPF_FUNC_csum_diff()` `BPF_FUNC_xdp_adjust_head()` `BPF_FUNC_xdp_adjust_meta()` `BPF_FUNC_redirect()` `BPF_FUNC_redirect_map()` `BPF_FUNC_xdp_adjust_tail()` `BPF_FUNC_fib_lookup()` `Base functions`
`BPF_PROG_TYPE_PERF_EVENT`	`BPF_FUNC_perf_event_output()` `BPF_FUNC_get_stackid()` `BPF_FUNC_get_stack()` `BPF_FUNC_perf_prog_read_value()` `Tracing functions`
`BPF_PROG_TYPE_CGROUP_SKB`	`BPF_FUNC_skb_load_bytes()` `BPF_FUNC_skb_load_bytes_relative()` `BPF_FUNC_get_socket_cookie()` `BPF_FUNC_get_socket_uid()` `Base functions`
`BPF_PROG_TYPE_CGROUP_SOCK`	`BPF_FUNC_get_current_uid_gid()` `Base functions`
`BPF_PROG_TYPE_LWT_IN`	`BPF_FUNC_lwt_push_encap()` `LWT functions` `Base functions`
`BPF_PROG_TYPE_LWT_OUT`	`LWT functions` `Base functions`
`BPF_PROG_TYPE_LWT_XMIT`	`BPF_FUNC_skb_get_tunnel_key()` `BPF_FUNC_skb_set_tunnel_key()` `BPF_FUNC_skb_get_tunnel_opt()` `BPF_FUNC_skb_set_tunnel_opt()` `BPF_FUNC_redirect()` `BPF_FUNC_clone_redirect()` `BPF_FUNC_skb_change_tail()` `BPF_FUNC_skb_change_head()` `BPF_FUNC_skb_store_bytes()` `BPF_FUNC_csum_update()` `BPF_FUNC_l3_csum_replace()` `BPF_FUNC_l4_csum_replace()` `BPF_FUNC_set_hash_invalid()` `LWT functions`
`BPF_PROG_TYPE_SOCK_OPS`	`BPF_FUNC_setsockopt()` `BPF_FUNC_getsockopt()` `BPF_FUNC_sock_ops_cb_flags_set()` `BPF_FUNC_sock_map_update()` `BPF_FUNC_sock_hash_update()` `BPF_FUNC_get_socket_cookie()` `Base functions`
`BPF_PROG_TYPE_SK_SKB`	`BPF_FUNC_skb_store_bytes()` `BPF_FUNC_skb_load_bytes()` `BPF_FUNC_skb_pull_data()` `BPF_FUNC_skb_change_tail()` `BPF_FUNC_skb_change_head()` `BPF_FUNC_get_socket_cookie()` `BPF_FUNC_get_socket_uid()` `BPF_FUNC_sk_redirect_map()` `BPF_FUNC_sk_redirect_hash()` `BPF_FUNC_sk_lookup_tcp()` `BPF_FUNC_sk_lookup_udp()` `BPF_FUNC_sk_release()` `Base functions`
`BPF_PROG_TYPE_CGROUP_DEVICE`	`BPF_FUNC_map_lookup_elem()` `BPF_FUNC_map_update_elem()` `BPF_FUNC_map_delete_elem()` `BPF_FUNC_get_current_uid_gid()` `BPF_FUNC_trace_printk()`
`BPF_PROG_TYPE_SK_MSG`	`BPF_FUNC_msg_redirect_map()` `BPF_FUNC_msg_redirect_hash()` `BPF_FUNC_msg_apply_bytes()` `BPF_FUNC_msg_cork_bytes()` `BPF_FUNC_msg_pull_data()` `BPF_FUNC_msg_push_data()` `BPF_FUNC_msg_pop_data()` `Base functions`
`BPF_PROG_TYPE_RAW_TRACEPOINT`	`BPF_FUNC_perf_event_output()` `BPF_FUNC_get_stackid()` `BPF_FUNC_get_stack()` `BPF_FUNC_skb_output()` `Tracing functions`
`BPF_PROG_TYPE_CGROUP_SOCK_ADDR`	`BPF_FUNC_get_current_uid_gid()` `BPF_FUNC_bind()` `BPF_FUNC_get_socket_cookie()` `Base functions`
`BPF_PROG_TYPE_LWT_SEG6LOCAL`	`BPF_FUNC_lwt_seg6_store_bytes()` `BPF_FUNC_lwt_seg6_action()` `BPF_FUNC_lwt_seg6_adjust_srh()` `LWT functions`
`BPF_PROG_TYPE_LIRC_MODE2`	`BPF_FUNC_rc_repeat()` `BPF_FUNC_rc_keydown()` `BPF_FUNC_rc_pointer_rel()` `BPF_FUNC_map_lookup_elem()` `BPF_FUNC_map_update_elem()` `BPF_FUNC_map_delete_elem()` `BPF_FUNC_ktime_get_ns()` `BPF_FUNC_tail_call()` `BPF_FUNC_get_prandom_u32()` `BPF_FUNC_trace_printk()`
`BPF_PROG_TYPE_SK_REUSEPORT`	`BPF_FUNC_sk_select_reuseport()` `BPF_FUNC_skb_load_bytes()` `BPF_FUNC_load_bytes_relative()` `Base functions`
`BPF_PROG_TYPE_FLOW_DISSECTOR`	`BPF_FUNC_skb_load_bytes()` `Base functions`

Function Group	Functions
`Base functions`	`BPF_FUNC_map_lookup_elem()` `BPF_FUNC_map_update_elem()` `BPF_FUNC_map_delete_elem()` `BPF_FUNC_map_peek_elem()` `BPF_FUNC_map_pop_elem()` `BPF_FUNC_map_push_elem()` `BPF_FUNC_get_prandom_u32()` `BPF_FUNC_get_smp_processor_id()` `BPF_FUNC_get_numa_node_id()` `BPF_FUNC_tail_call()` `BPF_FUNC_ktime_get_boot_ns()` `BPF_FUNC_ktime_get_ns()` `BPF_FUNC_trace_printk()` `BPF_FUNC_spin_lock()` `BPF_FUNC_spin_unlock()`
`Tracing functions`	`BPF_FUNC_map_lookup_elem()` `BPF_FUNC_map_update_elem()` `BPF_FUNC_map_delete_elem()` `BPF_FUNC_probe_read()` `BPF_FUNC_ktime_get_boot_ns()` `BPF_FUNC_ktime_get_ns()` `BPF_FUNC_tail_call()` `BPF_FUNC_get_current_pid_tgid()` `BPF_FUNC_get_current_task()` `BPF_FUNC_get_current_uid_gid()` `BPF_FUNC_get_current_comm()` `BPF_FUNC_trace_printk()` `BPF_FUNC_get_smp_processor_id()` `BPF_FUNC_get_numa_node_id()` `BPF_FUNC_perf_event_read()` `BPF_FUNC_probe_write_user()` `BPF_FUNC_current_task_under_cgroup()` `BPF_FUNC_get_prandom_u32()` `BPF_FUNC_probe_read_str()` `BPF_FUNC_get_current_cgroup_id()` `BPF_FUNC_send_signal()` `BPF_FUNC_probe_read_kernel()` `BPF_FUNC_probe_read_kernel_str()` `BPF_FUNC_probe_read_user()` `BPF_FUNC_probe_read_user_str()` `BPF_FUNC_send_signal_thread()` `BPF_FUNC_get_ns_current_pid_tgid()` `BPF_FUNC_xdp_output()` `BPF_FUNC_get_task_stack()`
`LWT functions`	`BPF_FUNC_skb_load_bytes()` `BPF_FUNC_skb_pull_data()` `BPF_FUNC_csum_diff()` `BPF_FUNC_get_cgroup_classid()` `BPF_FUNC_get_route_realm()` `BPF_FUNC_get_hash_recalc()` `BPF_FUNC_perf_event_output()` `BPF_FUNC_get_smp_processor_id()` `BPF_FUNC_skb_under_cgroup()`

Docker & Self-Hosted Deployment Verified OCI

File: README.md Copy Chapter

BPF Compiler Collection (BCC)

Screenshot Copy Chapter

Installing Copy Chapter

FAQ Copy Chapter

Reference guide Copy Chapter

Contents Copy Chapter

Tracing Copy Section

Examples

Tools

Memory and Process Tools

Performance and Time Tools

CPU and Scheduler Tools

Network and Sockets Tools

Storage and Filesystems Tools

Filesystems Tools

Networking Copy Section

BPF Introspection Copy Section

Motivation Copy Chapter

Tutorials Copy Chapter

Networking Copy Section

Contributing Copy Chapter

External links Copy Chapter

File: docs/kernel_config.md Copy Chapter

Kernel Configuration for BPF Features

BPF Related Kernel Configurations Copy Chapter

File: docs/kernel-versions.md Copy Chapter

BPF Features by Linux Kernel Version

eBPF support Copy Chapter

JIT compiling Copy Chapter

Main features Copy Chapter

Program types Copy Section

Maps (_a.k.a._ Tables, in BCC lingo) Copy Chapter

Map types Copy Section

Map userspace API Copy Section

XDP Copy Chapter

Helpers Copy Chapter

Program Types Copy Chapter

File: docs/reference_guide.md Copy Chapter

bcc Reference Guide

Contents Copy Chapter

BPF C

Events & Arguments Copy Chapter

1. kprobes Copy Section

2. kretprobes Copy Section

3. Tracepoints Copy Section

4. uprobes Copy Section

5. uretprobes Copy Section

6. USDT probes Copy Section

7. Raw Tracepoints Copy Section

8. system call tracepoints Copy Section

9. kfuncs Copy Section

10. kretfuncs Copy Section

11. LSM Probes Copy Section

12. BPF ITERATORS Copy Section

Data Copy Chapter

1. bpf_probe_read_kernel() Copy Section

2. bpf_probe_read_kernel_str() Copy Section

3. bpf_ktime_get_ns() Copy Section

4. bpf_get_current_pid_tgid() Copy Section

5. bpf_get_current_uid_gid() Copy Section

6. bpf_get_current_comm() Copy Section

7. bpf_get_current_task() Copy Section

8. bpf_log2l() Copy Section

9. bpf_get_prandom_u32() Copy Section

10. bpf_probe_read_user() Copy Section

11. bpf_probe_read_user_str() Copy Section

12. bpf_get_ns_current_pid_tgid() Copy Section

Debugging Copy Chapter

1. bpf_override_return() Copy Section

Output Copy Chapter

1. bpf_trace_printk() Copy Section

2. BPF_PERF_OUTPUT Copy Section

3. perf_submit() Copy Section

4. perf_submit_skb() Copy Section

5. BPF_RINGBUF_OUTPUT Copy Section

6. ringbuf_output() Copy Section

7. ringbuf_reserve() Copy Section

8. ringbuf_submit() Copy Section

File: README.md

Screenshot

Installing

FAQ

Reference guide

Contents

Tracing

Networking

BPF Introspection

Motivation

Tutorials

Networking

Contributing

External links

File: docs/kernel_config.md

BPF Related Kernel Configurations

File: docs/kernel-versions.md

eBPF support

JIT compiling

Main features

Program types

Maps (_a.k.a._ Tables, in BCC lingo)

Map types

Map userspace API

XDP

Helpers

Program Types

File: docs/reference_guide.md

Contents

Events & Arguments

1. kprobes

2. kretprobes

3. Tracepoints

4. uprobes

5. uretprobes

6. USDT probes

7. Raw Tracepoints

8. system call tracepoints

9. kfuncs

10. kretfuncs

11. LSM Probes

12. BPF ITERATORS

Data

1. bpf_probe_read_kernel()

2. bpf_probe_read_kernel_str()

3. bpf_ktime_get_ns()

4. bpf_get_current_pid_tgid()

5. bpf_get_current_uid_gid()

6. bpf_get_current_comm()

7. bpf_get_current_task()

8. bpf_log2l()

9. bpf_get_prandom_u32()

10. bpf_probe_read_user()

11. bpf_probe_read_user_str()

12. bpf_get_ns_current_pid_tgid()

Debugging

1. bpf_override_return()

Output

1. bpf_trace_printk()

2. BPF_PERF_OUTPUT

3. perf_submit()

4. perf_submit_skb()

5. BPF_RINGBUF_OUTPUT

6. ringbuf_output()

7. ringbuf_reserve()

8. ringbuf_submit()

9. ringbuf_discard()

10. ringbuf_query()

Maps

1. BPF_TABLE

2. BPF_HASH

3. BPF_ARRAY

4. BPF_HISTOGRAM

5. BPF_STACK_TRACE

6. BPF_PERF_ARRAY

7. BPF_PERCPU_HASH

8. BPF_PERCPU_ARRAY

9. BPF_LPM_TRIE

10. BPF_PROG_ARRAY

11. BPF_DEVMAP