BPF Documentation

This directory contains documentation for the BPF (Berkeley Packet Filter) facility, with a focus on the extended BPF version (eBPF).

This kernel side documentation is still work in progress. The main textual documentation is (for historical reasons) described in Documentation/networking/filter.txt, which describe both classical and extended BPF instruction-set. The Cilium project also maintains a BPF and XDP Reference Guide that goes into great technical depth about the BPF Architecture.

The primary info for the bpf syscall is available in the man-pages for bpf(2).

BPF Type Format (BTF)

• BPF Type Format (BTF)

Frequently asked questions (FAQ)

Two sets of Questions and Answers (Q&A) are maintained.

• BPF Design Q&A
• HOWTO interact with BPF subsystem

Program types

• BPF_PROG_TYPE_CGROUP_SOCKOPT
• BPF_PROG_TYPE_CGROUP_SYSCTL
• BPF_PROG_TYPE_FLOW_DISSECTOR