BPF Documentation

This directory contains documentation for the BPF (Berkeley Packet Filter) facility, with a focus on the extended BPF version (eBPF).

This kernel side documentation is still work in progress. The main textual documentation is (for historical reasons) described in Documentation/networking/filter.txt, which describe both classical and extended BPF instruction-set. The Cilium project also maintains a BPF and XDP Reference Guide that goes into great technical depth about the BPF Architecture.

The primary info for the bpf syscall is available in the man-pages for bpf(2).

BPF Type Format (BTF)

Frequently asked questions (FAQ)

Two sets of Questions and Answers (Q&A) are maintained.

Testing BPF