In a previous post we followed BPF code from C source all the way to a fully-resolved bytecode stream handed to the kernel. But the kernel does not just run that bytecode. First it has to be convinced the program is safe. That job belongs to the verifier, and it is the reason you can load your own code into the kernel’s hottest paths — every network packet, every system call — without the risk of crashing the machine. ...
In this post, we are going to learn how BPF code written in C is loaded into the Linux kernel. We will deep dive into everything that happens in the process of turning C source code into a running kernel program. Before diving into the details, there are some prerequisites. I will briefly touch on each concept so we are all on the same page. What is an ELF? Note: This section introduces ELF concepts in the abstract. If terms like “relocation entries” or “symbol table” feel fuzzy on first read, don’t worry — they will click once we inspect a real compiled ELF in the Inspecting the ELF with readelf section. Come back here as a reference when you need it. ...