How eBPF Works

How eBPF Works A workflow diagram generated by Archify. 01 / User space 02 / Kernel space Write program · C / Rust · User space Write program C / Rust Compile · bytecode · User space Compile bytecode bpf() syscall · load into kernel · User space bpf() syscall load into kernel Verifier · Verifier · Kernel space Verifier Verifier JIT compile · native code · Kernel space JIT compile native code Run program · at event hooks · Kernel space Run program at event hooks crosses boundary pass Legend Dev stages Kernel processing Verify

Event hook targets

  • • Network packets · system calls
  • • Function calls · tracepoints

Safety net

  • • The verifier blocks infinite loops and memory violations upfront
  • • Only verified code runs in the kernel