BPF Documentation

This directory contains documentation for the BPF (Berkeley Packet Filter) facility, with a focus on the extended BPF version (eBPF).

This kernel side documentation is still work in progress. The main textual documentation is (for historical reasons) described in Linux Socket Filtering aka Berkeley Packet Filter (BPF), which describe both classical and extended BPF instruction-set. The Cilium project also maintains a BPF and XDP Reference Guide that goes into great technical depth about the BPF Architecture.

libbpf

libbpf is a userspace library for loading and interacting with bpf programs.

BPF Type Format (BTF)

• BPF Type Format (BTF)

Frequently asked questions (FAQ)

Two sets of Questions and Answers (Q&A) are maintained.

• BPF Design Q&A
• HOWTO interact with BPF subsystem

Syscall API

The primary info for the bpf syscall is available in the man-pages for bpf(2). For more information about the userspace API, see eBPF Userspace API.

Helper functions

• bpf-helpers(7) maintains a list of helpers available to eBPF programs.

Program types

• BPF_PROG_TYPE_CGROUP_SOCKOPT
• BPF_PROG_TYPE_CGROUP_SYSCTL
• BPF_PROG_TYPE_FLOW_DISSECTOR
• LSM BPF Programs
• BPF sk_lookup program

Map types

• BPF_MAP_TYPE_CGROUP_STORAGE

Testing and debugging BPF

• BPF drgn tools
• Testing BPF on s390

Licensing

• BPF licensing

Other

• BPF ring buffer
• BPF LLVM Relocations