BPF Documentation

This directory contains documentation for the BPF (Berkeley Packet Filter) facility, with a focus on the extended BPF version (eBPF).

This kernel side documentation is still work in progress. The main textual documentation is (for historical reasons) described in Linux Socket Filtering aka Berkeley Packet Filter (BPF), which describe both classical and extended BPF instruction-set. The Cilium project also maintains a BPF and XDP Reference Guide that goes into great technical depth about the BPF Architecture.


libbpf is a userspace library for loading and interacting with bpf programs.

BPF Type Format (BTF)

Frequently asked questions (FAQ)

Two sets of Questions and Answers (Q&A) are maintained.

Syscall API

The primary info for the bpf syscall is available in the man-pages for bpf(2). For more information about the userspace API, see eBPF Userspace API.

Helper functions

  • bpf-helpers(7) maintains a list of helpers available to eBPF programs.

Testing and debugging BPF