LCE-EU 2015

The Berkeley Packet Filter (BPF) is a generic assembler language that supports "filtering" network packets, so that only "interesting" packets are supplied to the software using BPF. For Linux, BPF has been developed further to make it useful outside of its traditional role as socket packet filter language. The new upstream variant "eBPF" extends the assembler language with a number of interesting capabilities, for example 64-bit support and a feature to call kernel functions. The new language is used for filtering system calls, creating user defined network statistics, and probably will also filter kernel traces soon. The Linux kernel provides a common code eBPF interpreter and architecture specific JIT compilers. This presentation explains the (e)BPF concepts and use cases. Furthermore, it shows how the kernel eBPF JIT compiler (Linux 4.1) is implemented on the mainframe.