July 10, 2017

BPF updates 08

This is issue 08 of the regular newsletter around BPF written by Alexander Alemayhu. It summarizes ongoing development, presentations, videos and other information related to BPF and XDP. It is released roughly once a week.

Linux 4.12 was released and net-next is closed. The Kernel Newbies release notes is still under construction but worth checking out for the BPF commits in 4.12.

Most of the new patches from the lists should show up in the next release candidate for 4.13. Some highlights from the recent activity are

  • i40e gets XDP support for drop, pass and tx actions.
  • Iterations of the alignment tracking work. The main changes; dropped RFC tag and added more tests.
  • NFP flag for XDP offload mode to offer more flexibility for programs that can be offloaded.
  • The new BPF_PROG_TYPE_SOCKET_OPS series got merged.

More interesting topics

  • iproute gets support for IFLA_XDP_PROG_ID. Also cls_bpf and act_bpf start using the BPF program id.
  • BPF program id available for i40e via XDP_QUERY_PROG.
  • A new function helper bpf_skb_adjust_room for adjusting net headroom.

One issue reoccurring is the header asm issue. While BPF can mix and match headers from kernel and userspace, the asm headers seem to be causing pain. Will one more hack be added on top of BPF, or will we see a clean / nice solution emerge from the disccusions?



SmartNIC Architecture, Open Programming Models Overview - DXDD Europe

Netronome has support for offloading XDP programs. The talk covers the options for programming their cards, and shows how BPF fits into their architecture.


Velocity 2017 Performance analysis superpowers with Linux eBPF

The slides are mostly focusing on the BCC tool chain. Very informative diagrams on the tracing options.

The BSD Packet Filter A New Architecture for User-level Packet Capture

This is walk-through of the original BPF paper. The slides are really good. This serves as a great introduction or reviewing the concepts of the old and new BPF.

In case you missed it

Notes on BPF & eBPF

The post describes the basics. Also nice to see a short explanation on control flow graph. The links to all of the example programs / code are useful for beginners.

[iovisor-dev] minutes: IO Visor TSC/Dev Call

Looks like there will be more XDP patches showing up soon :)


Below is a list of random projects on Github. Check them out and Remember to give a star, if you like the project ;)


Stateful packet processing: two-color token-bucket PoC in BPF

VALE BPF Extention Module

Vale-bpf module is an extention of VALE software switch.

This module makes VALE possible to program with eBPF.

Linux Tracing Workshops Materials

This repository contains examples and hands-on labs for various Linux tracing workshops, focusing on modern tracing tools


A small tool to generically introspect BPF maps without requiring to be aware of the specific data structures stored inside. Can print the metadata of the map or its contents in hexadecimal form.


A simple eBPF disassembler, based on rbpf.

It loads the compiled eBPF code from an ELF file and prints it out.


Please note that netdev receives a lot of patches and the list above is not meant to be comprehensive.

You can sign up for email notifcations on https://www.cilium.io/learn/

Happy eBPF hacking!