bpf_convert_filter(9)

💅 bpf_convert_filter — a Kernel API Manual moment ✨

okay so bestie, welcome to bpf_convert_filter, brought to you by the Kernel API Manual. this one's a converter, and it's giving "glow-up technician for filter programs." let's get into it 🫶

---

✨ NAME ✨

bpf_convert_filter — convert filter program. literally that's the whole job. iconic.

---

🦋 SYNOPSIS 🦋

int bpf_convert_filter (struct sock_filter *prog , int len , struct
       bpf_prog *new_prog , int *new_len , bool *seen_ld_abs );

---

🎀 ARGUMENTS 🎀

• prog — the user passed filter program. yes, the user handed this to you, be nice to it 💖
• len — the length of the user passed filter program. how much of it there is, basically.
• new_prog — an allocated 'struct bpf_prog' or NULL. and yes, NULL is a vibe here, not a mistake (more on that in a sec 👀).
• new_len — pointer to store length of converted program. you give it a pointer, it fills in the number.
• seen_ld_abs — bool whether we've seen ld_abs/ind. just a little flag that remembers if that happened 🌸

---

🔥 DESCRIPTION 🔥

the whole mission: remap the 'sock_filter' style classic BPF (cBPF) instruction set over to the 'bpf_insn' style extended BPF (eBPF). glow-up of instruction sets, no cap. ✨

here's the conversion workflow, step by step:

1. First pass for calculating the new program length:

bpf_convert_filter(old_prog, old_len, NULL, new_len, seen_ld_abs)

2. 2nd pass to remap in two passes: the 1st pass finds new jump offsets, then the 2nd pass does the remapping:

bpf_convert_filter(old_prog, old_len, new_prog, new_len, seen_ld_abs)

so yeah — one pass to size it up, then a two-pass remap to actually do the thing. it's giving "measure twice, cut once" but make it eBPF 💅

---

👑 SEE ALSO 👑

Kernel file ./net/core/filter.c — and bestie, the whole friend group is here too:

• sk_filter_trim_cap(9)
• bpf_check_classic(9)
• sk_filter_release_rcu(9)
• sk_filter_release(9)
• bpf_prog_create(9)
• bpf_prog_create_from_user(9)
• sk_attach_filter(9)
• xdp redirect(9)
• bpf_skb_meta_pointer(9)
• bpf_dynptr_from_skb_meta(9)
• bpf_xdp_pull_data(9)
• bpf_icmp_send(9)

---

ngl, this page does not mention any warnings or bugs, so don't go inventing drama that isn't there 🙈 all the details above are the details, fr fr.

---

that's the whole page, bestie 🎀 source-version-wise, this one lives in ./net/core, and it's dated October 2026 — bookmark it, screenshot it, put it in the group chat. slay 💅🌟