eBPF

Berkeley Packet Filter (BPF) was initially developed in 1992 to filter packets before they were received by the kernel or even worse by the user space; the tool was re-written and included in Linux Kernel in 2014, now named the extended Berkeley Packet Filter (eBPF). eBPF can be conceived as a lightweight, sandboxed virtual machine (VM) within the Linux kernel - eBPF programs are invoked by the kernel when certain events, called hooks, occur. Examples of such hooks include system calls, network events. These processes enable deep analysis into events, and even enable security actions to be performed with low overhead.

In addition to several architectural improvements, eBPF introduces the capability of handling generic event processing in the kernel, JIT compiling for increased performance, stateful processing using maps, and libraries (helpers) to handle more complex tasks, available within the kernel. When a certain event or hook happens, the eBPF application is invoked and run with an extremely low overhead, as there is JIT compiling. eBPF programs can be written in restricted C and compiled using the LLVM Clang compiler, or in eBPF assembly instructions and converted to bytecode using the bpf asm utility. The bytecode can then be loaded using the bpf() system call. A loaded eBPF program follows an event-driven architecture and it is therefore hooked to a particular type of event. Each occurrence of the event will trigger its execution, and, based on the type of event, the program might be able to alter the event context as shown in Fig. 2. In this case, we are able to perform an action if a specific condition is met; these actions are varied - for example, actions may cause events to be logged in a monitoring system, or perform security routines, etc.

eBPF is a revolutionary technology that allows developers to run sandboxed programs directly within the Linux kernel. Unlike traditional kernel code, eBPF programs are loaded into the kernel at runtime, offering a dynamic way to execute custom logic in response to various events. These programs are written in a restricted subset of C, compiled into eBPF bytecode, and run in a virtual machine-like environment provided by the kernel, ensuring safety and efficiency.

The Origins and Evolution of eBPF

The journey of eBPF began with the Berkeley Packet Filter (BPF), designed for efficient packet filtering. However, the modern eBPF extends far beyond its networking roots. Today, it can attach to almost any point in the kernel, providing unparalleled visibility into the system’s inner workings. This extension was driven by the need for a more programmable, universally applicable tool to meet modern high-performance applications’ demands.

Key Applications of eBPF

BPF’s capabilities make it a great tool across various domains:

Networking: eBPF excels in network packet processing, enabling the creation of highly customizable network applications directly in the kernel. Tools like XDP (eXpress Data Path) leverage eBPF to process packets at the network driver level, dramatically increasing performance.
Security: eBPF provides powerful facilities for implementing runtime security monitoring and policy enforcement, such as detecting and preventing unwanted behaviour in applications.
Observability: Perhaps one of the most powerful uses of eBPF is in observability. It can gather detailed and context-rich system metrics and logs, helping developers pinpoint performance bottlenecks and understand complex system behaviour.
Tracing and Profiling: eBPF can trace kernel functions and user-space applications with minimal overhead, making it ideal for performance analysis and debugging.

Boyang Yan

Explorer

eBPF

The Origins and Evolution of eBPF

Key Applications of eBPF

Reference List

Graph View

Table of Contents

Backlinks