STRUCT TCF_EMATCH(9)

💅 struct tcf_ematch — the Kernel API Manual, bestie edition

okay so. we're looking at struct tcf_ematch(9) today and ngl this lil struct is lowkey the main character of extended matching in the kernel. "ematch" = extended match, iykyk. it's giving traffic-classifier royalty 👑

---

✨ NAME ✨

struct tcf_ematch — extended match (ematch). that's it, that's the whole vibe 🎀

---

🦋 SYNOPSIS 🦋

here's the whole thing, copy it exactly, don't @ me:

struct tcf_ematch {
    struct tcf_ematch_ops * ops;
    unsigned long           data;
    unsigned int            datalen;
    u16 matchid;
    u16 flags;
    struct net              *net;
 };

literally all of it. six whole members. slay.

---

🌸 Members 🌸

• ops — the operations lookup table of the corresponding ematch module. like, this is where all the actual behaviour lives. the struct itself is just the paperwork 💅
• data — ematch specific data. yes it's vague, no I can't elaborate, that's literally what the page says 🙈
• datalen — length of the ematch specific configuration data. a size for the data above, periodt.
• matchid — identifier to allow userspace to reidentify a match. so userspace can point at it later and go "that one" 👑
• flags — flags specifying attributes and the relation to other matches. the "how do I relate to my siblings" field, highkey relatable 😭
• net — the network namespace. which world this match lives in 🌈

---

🔥 SEE ALSO 🔥

• Kernel file ./include/net/pkt_cls.h
• tcf_exts_has_actions(9)
• tcf_exts_exec(9)
• struct tcf_pkt_info(9)
• struct tcf_ematch_tree(9)
• struct tcf_ematch_ops(9)
• tcf_em_tree_match(9)

go read those next, bestie, they're the extended universe 🫶

---

kay that's the whole page!! source is ./include/net, dated October 2026, and the version tag is literally struct tcf_ematch(9) — same as the title, iconic behaviour honestly. mwah, bye bestie 💖✨🦋🌸🎀