eBPF

What eBPF Actually Is

eBPF is a sandboxed virtual machine inside the Linux kernel. It lets you run custom bytecode at kernel hook points without modifying kernel source or loading kernel modules. Programs are verified at load time for safety (no infinite loops, no invalid memory access), then JIT-compiled to native machine code.

The "extended" part matters: classic BPF (cBPF, 1992) was a simple packet filter with 2 registers and 32-bit ops. eBPF (2014+) is a general-purpose in-kernel execution engine with 11 registers, 64-bit ops, maps (key-value stores), helper functions, and tail calls.

Programs attach to hook points: kprobes (any kernel function), uprobes (any userspace function), tracepoints (stable kernel instrumentation), XDP (network driver ingress), tc (traffic control), cgroup hooks, LSM hooks, and more. Each hook type defines what context the program receives and what it can do.

Kernel Execution Pipeline

Core Concepts

Where BPF Programs Attach

BCC (BPF Compiler Collection)

BCC provides a Python (and Lua) frontend for writing BPF programs. C code is embedded as a string, compiled at runtime via LLVM, and loaded into the kernel. This is the fastest path from zero to working BPF instrumentation but has trade-offs.

Anatomy of a BCC Program

BCC Python
#!/usr/bin/env python3
from bcc import BPF

# ---- KERNEL SIDE (C) ----
prog = """
struct event_t {
    u32 pid;
    char comm[16];
    char fname[64];
    u64 size;
};

BPF_PERF_OUTPUT(events);              // declare perf buffer

int trace_read_entry(struct pt_regs *ctx,
                     struct file *file,
                     char __user *buf,
                     size_t count) {
    struct event_t evt = {};
    evt.pid = bpf_get_current_pid_tgid() >> 32;
    bpf_get_current_comm(&evt.comm, sizeof(evt.comm));
    bpf_probe_read_kernel_str(&evt.fname, sizeof(evt.fname),
                               file->f_path.dentry->d_name.name);
    evt.size = count;
    events.perf_submit(ctx, &evt, sizeof(evt));
    return 0;
}
"""

# ---- USERSPACE SIDE (Python) ----
b = BPF(text=prog)                           # compile + load
b.attach_kprobe(event="vfs_read",
                fn_name="trace_read_entry") # attach to hook

def handle_event(cpu, data, size):         # callback for events
    evt = b["events"].event(data)
    print(f"{evt.pid}  {evt.comm}  {evt.fname}  {evt.size}")

b["events"].open_perf_buffer(handle_event)
while True:
    b.perf_buffer_poll()                     # blocks, calls handle_event

Reference

BPF Verifier Errors & Fixes

Toolchains Compared

Cilium eBPF Go Library

cilium/ebpf is the Go library for loading and managing pre-compiled BPF programs. It's the production approach: write BPF C, compile with clang to .o, then load/attach/read from Go. No LLVM on the target machine. CO-RE + BTF handles cross-kernel portability.

This is what Cilium itself uses for Kubernetes network policy, service mesh, and observability (Hubble). Also used by Cloudflare, Meta, and Netflix for production eBPF tooling.

bpftrace One-Liners

bpftrace
# count syscalls by process
$ bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }'

# trace file opens with path
$ bpftrace -e 'tracepoint:syscalls:sys_enter_openat
  { printf("%s %s\n", comm, str(args.filename)); }'

# histogram of read() sizes
$ bpftrace -e 'tracepoint:syscalls:sys_exit_read /args.ret > 0/
  { @bytes = hist(args.ret); }'

# TCP connect with dest IP
$ bpftrace -e 'kprobe:tcp_v4_connect { printf("%s -> %s\n", comm,
    ntop(((struct sock *)arg0)->__sk_common.skc_daddr)); }'

# slow syscalls (>1ms)
$ bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @start[tid] = nsecs; }
  tracepoint:raw_syscalls:sys_exit /@start[tid]/
  { $d = nsecs - @start[tid];
    if ($d > 1000000) { printf("%s %dms\n", comm, $d/1000000); }
    delete(@start[tid]); }'

eBPF Evolution