The GCC compiler set includes code for compiling programs for the eBPF bytecode interpreter built into the Linux kernel . With the use of JIT compilation, bytecode is translated into machine instructions on the fly and executed with the performance of native code. Patches with eBPF support are in the branch from which GCC 10 is developed.
In addition to the backend for bytecode generation, GCC includes a port of libgcc for eBPF and tools for creating ELF files, which enable code execution in the eBPF virtual machine using the loaders provided by the kernel. Patches for eBPF support in GCC have been prepared by engineers from Oracle, who previously eBPF support in GNU binutils. A simulator and patches for GDB are also in development, which will allow debugging eBPF programs without loading into the kernel.
Programs for eBPF can be defined in a subset of the C language, compiled, and loaded into the kernel. Before execution, the eBPF interpreter checks the bytecode for the use of permitted instructions and imposes certain rules on the code (for example, the absence of loops).
Initially, the LLVM-based toolchain was used for compiling eBPF in Linux. The support for eBPF in GCC is interesting because it allows using a single toolchain for building the Linux kernel and eBPF programs without installing additional dependencies.
In the form of eBPF programs, one can create network operation handlers, filter traffic, manage bandwidth, monitor system operations, intercept system calls, control access, count operation frequency and execution time, and perform tracing using kprobes/uprobes/tracepoints.
Source: opennet.ru
