EBPF

eBPF (Enhanced Berkeley Packet Filter) is a powerful toolchain capable of compiling high-level languages into a BPF bytecode, which is JITted into local machine code, and can be inserted into a running kernel. It builds atop kprobes, and is in the same family of tools as SystemTap and DTrace. It is driven through the bpf(2) system call, though it is usually more convenient to employ the libbpf library and bpftool binary.

eBPF supports its own BTF debugging information, a simplified form of DWARF.

Tools

• bpftool can be built in tools/bpf of the installed kernel's source.
• bpftrace provides a terse DSL that looks an awful lot like awk, allowing simple eBPF programs to be instantiated and attached directly from the command line.
• llvm-objdump can disassemble an ELF object to eBPF bytecode

Compiling eBPF

BCC

The BPF Compiler Collection automates much of the process of turning eBPF source into a kernel object, but much of this (as of 2019-09) requires Python. The BPF object of bcc.py can take raw eBPF text, and return an object which can be easily attached to a variety of eBPF targets.

LLVM

LLVM has enjoyed bpf backend support since 3.7. Compile using -target bpf to generate BPF bytecode, adding -g to generate BTF information.

readelf on the resulting object ought indicate a Machine of "Linux BPF" or "EM_BPF". The resulting object can be loaded into the kernel with bpftool prog load or libbpf's bpf_object__open(). When using bpftool prog load, you must specify a PATH within a mounted bpffs filesystem.

Kernel JIT

eBPF bytecode was designed to have one-to-one correspondences with most instruction sets. The kernel, when configured appropriately, will JIT the bytecode input into host machine code. JIT requires the net.core.bpf_jit_enable sysctl to be set.

See Also

• XDP
• Cilium.io's BPF and XDP Reference Guide
• zoidbergwill's awesome-ebpf list
• BCC reference guide