This directory contains documentation for the BPF (Berkeley Packet Filter) facility, with a focus on the extended BPF version (eBPF).
This kernel side documentation is still work in progress. The main textual documentation is (for historical reasons) described in Documentation/networking/filter.txt, which describe both classical and extended BPF instruction-set. The Cilium project also maintains a BPF and XDP Reference Guide that goes into great technical depth about the BPF Architecture.
The primary info for the bpf syscall is available in the man-pages for bpf(2).
Frequently asked questions (FAQ)¶
Two sets of Questions and Answers (Q&A) are maintained.