This directory contains documentation for the BPF (Berkeley Packet Filter) facility, with a focus on the extended BPF version (eBPF).
This kernel side documentation is still work in progress. The main textual documentation is (for historical reasons) described in Linux Socket Filtering aka Berkeley Packet Filter (BPF), which describe both classical and extended BPF instruction-set. The Cilium project also maintains a BPF and XDP Reference Guide that goes into great technical depth about the BPF Architecture.
Libbpf is a userspace library for loading and interacting with bpf programs.
Frequently asked questions (FAQ)¶
Two sets of Questions and Answers (Q&A) are maintained.