BPF Documentation and Resources
The following resources will help you get familiar with BPF, its architecture, history, API, and the many tools that have been built on BPF.
BPF documentation
The BPF Reference Guide is a great place to get started learning about BPF, its architecture, helper functions, and utilities that have been built using BPF.
The following pages contain additional info about BPF and its development process:
API
BPF consists of programs written in restricted C language, then attached to one of several kernel hooks and run in reaction to specified events. It has the ability to call special functions (or "helpers") from within a program, from a white-list of helpers defined in the kernel.
These helpers are used by BPF programs to interact with the system, or with the context in which they work. For instance, they can be used to print debugging messages, to get the time since the system was booted, to interact with BPF maps, or to manipulate network packets.
See BPF's API docs for a list and descriptions of BPF helper functions.
Tools built on BPF
The following are tools built on BPF functionality: