It's pretty damm fast. Everything is JITed and there's codegen for the "trampoline" logic so that there aren't even indirect branches to get to the program code

It's pretty damm fast. Everything is JITed and there's codegen for the "trampoline" logic so that there aren't even indirect branches to get to the program code. The "overhead" comes from the fact that writing nontrivial BPF programs is quite hard. Getting programs to pass the verifier can become a bit of an art. This does tend to get easier if your production environment has few and recent kernel versions. And then of course this "overhead" totally pays for itself in terms of reliability. It's really hard to accidentally break machines with BPF, while a kernel module in your prod environment is a time bomb :D (Deliberately breaking machines with BPF is very easy though. This sometimes seems to surprise people but if your attacker gets CAP_BPF it's probably game over).