kfunc
also: kernel function (eBPF context), BPF kfunc
A kernel function that can be called directly from eBPF programs running in the Linux kernel, introduced in Linux 5.10 to allow safer and more flexible kernel introspection without requiring unstable kernel APIs.
A kfunc (kernel function) is a kernel function explicitly marked as safe for eBPF programs to call. Rather than relying on unstable kernel internal APIs or helper functions, eBPF developers can call kfuncs directly, provided the kernel has exposed them as callable.
Kfuncs are defined using the __bpf_kfunc macro or annotation in kernel source code. This allows kernel developers to intentionally create a stable, documented interface for eBPF use cases without committing to long-term stability for all kernel internals. Examples include networking stack functions, memory management routines, and time-related operations.
The key advantage over eBPF helpers is flexibility: instead of the kernel team pre-implementing every utility function, kfuncs let you call actual kernel code directly. However, unlike helpers, kfuncs are architecture or feature-dependent and may not be available on all kernel versions or configurations.