In this lesson, you will learn how to bypass the host CPU entirely by offloading your eBPF programs directly onto programmable SmartNIC hardware.
From Software to Silicon
Up until now, we have focused on running eBPF programs within the kernel's JIT-compiled environment. While highly efficient, this still consumes host CPU cycles to inspect every incoming packet. When processing 100Gbps+ traffic, the host CPU becomes the bottleneck. Hardware-specific offloading solves this by pushing the eBPF bytecode down into the NIC's own processor or FPGA-based logic.
When you offload a program, the NIC hardware itself acts as the "verifier" and "execution engine." The hardware parses the packet header, executes your logic, and decides whether to drop, forward, or redirect the packet before it ever reaches the kernel's networking stack.
How It Works
To offload a program, you must specify the xdp_dev flag during program loading. The driver checks if the NIC supports the specific eBPF instructions required by your program. If the hardware can execute your bytecode, the instructions are translated into the NIC’s native instruction set.
Consider a simple XDP drop rule. Instead of the kernel handling the packet, the offloaded version looks like this:
SEC("xdp")
int drop_unwanted_traffic(struct xdp_md *ctx) {
// This logic runs on the NIC silicon
return XDP_DROP;
}
When you load this with the offload flag, the ip tool communicates with the NIC firmware:
ip link set dev eth0 xdp obj my_prog.o sec xdp offload
Constraints and Reality
Because the hardware has limited memory and a different instruction set than the LLVM-generated bytecode, offloading comes with strict limitations:
- Helper Functions: Only a subset of eBPF helper functions are supported by hardware.
- Complexity: You cannot use complex loops or large eBPF maps that don't fit in the NIC's local SRAM.
- Driver Support: The underlying NIC driver must explicitly support the offload hook.
If your program is too complex for the hardware, the loader will return an error, forcing you to fallback to standard XDP. By shifting the processing to the edge, you gain massive throughput improvements while keeping the CPU free for application logic.
Key Takeaway: Hardware eBPF offloading allows your SmartNIC to handle packet processing at line rate, removing the host CPU from the data plane entirely.