EBPF

eBPF
Original author(s)Alexei Starovoitov,
Daniel Borkmann[1][2]
Developer(s)Open source community, Meta, Google, Isovalent, Microsoft, Netflix[1]
Initial release2014; 10 years ago (2014)[3]
RepositoryLinux: git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
Windows: github.com/Microsoft/ebpf-for-windows/
Written inC
Operating systemLinux, Windows[4]
TypeRuntime system
LicenseLinux: GPL
Windows: MIT License
Websiteebpf.io

eBPF is a technology that can run programs in a privileged context such as the operating system kernel.[5] It is the successor to the Berkeley Packet Filter (BPF, with the "e" originally meaning "extended") filtering mechanism in Linux and is also used in non-networking parts of the Linux kernel as well.

It is used to safely and efficiently extend the capabilities of the kernel at runtime without requiring changes to kernel source code or loading kernel modules.[6] Safety is provided through an in-kernel verifier which performs static code analysis and rejects programs which crash, hang or otherwise interfere with the kernel negatively.[7][8]

This validation model differs from sandboxed environments, where the execution environment is restricted and the runtime has no insight about the program.[9] Examples of programs that are automatically rejected are programs without strong exit guarantees (i.e. for/while loops without exit conditions) and programs dereferencing pointers without safety checks.[10]

  1. ^ a b "Meta, Google, Isovalent, Microsoft and Netflix Launch eBPF Foundation as Part of the Linux Foundation". Linux Foundation. 12 August 2021. Retrieved 1 July 2022.
  2. ^ "BPF Internals". USENIX LISA 2021 conference. 1 June 2021. Retrieved 1 July 2022.
  3. ^ "eBPF and Kubernetes: Little Helper Minions for Scaling Microservices". CNCF KubeCon + CloudNativeCon Europe 2020. 19 August 2020. Retrieved 1 July 2022.
  4. ^ "Making eBPF work on Windows". Microsoft Open Source Blog. 10 May 2021. Retrieved 1 July 2022.
  5. ^ "eBPF Documentation: What is eBPF?". eBPF.io. Retrieved 1 July 2022.
  6. ^ "eBPF - Rethinking the Linux Kernel". QCon 2020. Retrieved 1 July 2022.
  7. ^ "Safe Programs The Foundation of BPF". eBPF Summit 2021. 8 November 2020. Retrieved 1 July 2022.
  8. ^ "BPF and Spectre: Mitigating transient execution attacks". POPL 2022 conference. 22 January 2022. Retrieved 1 July 2022.
  9. ^ "eBPF - The Silent Platform Revolution from Cloud Native" (PDF). SIGCOMM 2023, 1st Workshop on eBPF and Kernel Extensions. 10 September 2023. Retrieved 5 October 2023.
  10. ^ Hedam, Niclas (26 May 2023). "eBPF - From a Programmer's Perspective" (PDF). doi:10.13140/RG.2.2.33688.11529/4.