BPF Documentation

This directory contains documentation for the BPF (Berkeley Packet Filter) facility, with a focus on the extended BPF version (eBPF).

This kernel side documentation is still work in progress. The main textual documentation is (for historical reasons) described in Linux Socket Filtering aka Berkeley Packet Filter (BPF), which describe both classical and extended BPF instruction-set. The Cilium project also maintains a BPF and XDP Reference Guide that goes into great technical depth about the BPF Architecture.

The primary info for the bpf syscall is available in the man-pages for bpf(2).

BPF Type Format (BTF)

• BPF Type Format (BTF)

Frequently asked questions (FAQ)

Two sets of Questions and Answers (Q&A) are maintained.

• BPF Design Q&A
• HOWTO interact with BPF subsystem

Helper functions

• bpf-helpers(7) maintains a list of helpers available to eBPF programs.

Program types

• BPF_PROG_TYPE_CGROUP_SOCKOPT
• BPF_PROG_TYPE_CGROUP_SYSCTL
• BPF_PROG_TYPE_FLOW_DISSECTOR
• LSM BPF Programs
• BPF sk_lookup program

Map types

• BPF_MAP_TYPE_CGROUP_STORAGE

Testing and debugging BPF

• BPF drgn tools
• Testing BPF on s390

Other

• BPF ring buffer