What Is eBPF?

Chapter 2. Changing the Kernel Is Hard

Since eBPF allows running custom code in the Linux kernel, let’s make sure you’re up to speed on what the kernel does. Then we can cover why eBPF changes the game when it comes to modifying how the kernel behaves.

The Linux Kernel

The Linux kernel is the software layer between your applications and the hardware they’re running on. Applications run in an unprivileged layer called user space, which can’t access hardware directly. Instead, an application makes requests using the system call (syscall) interface to request the kernel to act on its behalf. That hardware access can involve reading and writing to files, sending or receiving network traffic, or even just accessing memory. The kernel is also responsible for coordinating concurrent processes, enabling many applications to run at once.

As application developers, we typically don’t use the system call interface directly, because programming languages give us high-level abstractions and standard libraries that are easier interfaces to program. As a result, a lot of people are blissfully unaware of how much the kernel is doing while our programs run. If you want to get a sense of how often the kernel is invoked, you can use the strace utility to show all the system calls an application makes. Here’s an example, where using cat to read the word hello from a file and write it to the screen involves over 100 system calls:

liz@liz-ebpf-demo-1:~$ strace -c cat liz.txt hello % time seconds ...