BPF Documentation

This directory contains documentation for the BPF (Berkeley Packet Filter) facility, with a focus on the extended BPF version (eBPF).

This kernel side documentation is still work in progress. The main textual documentation is (for historical reasons) described in Linux Socket Filtering aka Berkeley Packet Filter (BPF), which describe both classical and extended BPF instruction-set. The Cilium project also maintains a BPF and XDP Reference Guide that goes into great technical depth about the BPF Architecture.

The primary info for the bpf syscall is available in the man-pages for bpf(2).

BPF Type Format (BTF)

Frequently asked questions (FAQ)

Two sets of Questions and Answers (Q&A) are maintained.

Helper functions

  • bpf-helpers(7) maintains a list of helpers available to eBPF programs.

Testing and debugging BPF