EBPF

eBPF is a technology that can run programs in a privileged context such as the operating system kernel. It is the successor to the Berkeley Packet Filter (BPF, with the "e" originally meaning "extended") filtering mechanism in Linux and is also used in non-networking parts of the Linux kernel as well.

It is used to safely and efficiently extend the capabilities of the kernel at runtime without requiring changes to kernel source code or loading kernel modules. Safety is provided through an in-kernel verifier which performs static code analysis and rejects programs which crash, hang or otherwise interfere with the kernel negatively.

This validation model differs from sandboxed environments, where the execution environment is restricted and the runtime has no insight about the program. Examples of programs that are automatically rejected are programs without strong exit guarantees (i.e. for/while loops without exit conditions) and programs dereferencing pointers without safety checks.

Design
Loaded programs which passed the verifier are either interpreted or in-kernel just-in-time compiled (JIT compiled) for native execution performance. The execution model is event-driven and with few exceptions run-to-completion, meaning, programs can be attached to various hook points in the operating system kernel and are run upon triggering of an event. eBPF use cases include (but are not limited to) networking such as XDP, tracing and security subsystems. Given eBPF's efficiency and flexibility opened up new possibilities to solve production issues, Brendan Gregg famously dubbed eBPF "superpowers for Linux". Linus Torvalds said, "BPF has actually been really useful, and the real power of it is how it allows people to do specialized code that isn't enabled until asked for". Due to its success in Linux, the eBPF runtime has been ported to other operating systems such as Windows.

History
eBPF evolved from the classic Berkeley Packet Filter (cBPF, a retroactively-applied name). At the most basic level, it introduced the use of ten 64-bit registers (instead of two 32-bit long registers for cBPF), different jump semantics, a call instruction and corresponding register passing convention, new instructions, and a different encoding for these instructions.

Branding
The alias eBPF is often interchangeably used with BPF, for example by the Linux kernel community. eBPF and BPF is referred to as a technology name like LLVM. eBPF evolved from the Berkeley Packet Filter as an extended version, but as its use cases outgrew networking, today "eBPF" is preferentially interpreted as a pseudo-acronym.

The bee is the official logo for eBPF. At the first eBPF Summit there was a vote taken and the bee mascot was named "eBee". The logo has originally been created by Vadim Shchekoldin. Earlier unofficial eBPF mascots have existed in the past, but have not seen widespread adoption.

Governance
The eBPF Foundation was created in August 2021 with the goal to expand the contributions being made to extend the powerful capabilities of eBPF and grow beyond Linux. Founding members include Meta, Google, Isovalent, Microsoft and Netflix. The purpose is to raise, budget and spend funds in support of various open source, open data and/or open standards projects relating to eBPF technologies to further drive the growth and adoption of the eBPF ecosystem. Since inception, Red Hat, Huawei, Crowdstrike, Tigera, DaoCloud, Datoms, FutureWei also joined.

Adoption
eBPF has been adopted by a number of large-scale production users, for example:


 * Meta uses eBPF through their Katran layer 4 load-balancer for all traffic going to facebook.com
 * Google uses eBPF in GKE, developed and uses BPF LSM to replace audit and it uses eBPF for networking
 * Cloudflare uses eBPF for load-balancing and DDoS protection and security enforcement
 * Netflix uses eBPF for fleet-wide network observability and performance diagnosis
 * Dropbox uses eBPF through Katran for layer 4 load-balancing
 * Android uses eBPF for NAT46 and traffic monitoring
 * Samsung Galaxy uses eBPF for Networking solutions
 * Yahoo! Inc uses eBPF through Cilium for layer 4 load balancing
 * LinkedIn uses eBPF for infrastructure observability
 * Alibaba uses eBPF for Kubernetes Pod load-balancing
 * Datadog uses eBPF for Kubernetes Pod networking and security enforcement
 * Trip.com uses eBPF for Kubernetes Pod networking
 * Shopify uses eBPF for intrusion detection through Falco
 * DoorDash uses eBPF through BPFAgent for kernel level monitoring
 * Microsoft ported eBPF and XDP to Windows
 * Seznam uses eBPF through Cilium for layer 4 load-balancing
 * DigitalOcean uses eBPF and XDP to rate limit access to internal services in their virtual network
 * CapitalOne uses eBPF for Kubernetes Pod networking
 * Bell Canada uses eBPF to moderize telco networking with SRv6
 * Elastic_NV uses eBPF for code profiling as part of their observability offering
 * Apple uses eBPF for Kubernetes Pod security
 * Sky uses eBPF for Kubernetes Pod networking
 * Walmart uses eBPF for layer 4 load-balancing
 * Huawei uses eBPF through their DIGLIM secure boot system
 * Ikea uses eBPF for Kubernetes Pod networking
 * The New York Times uses eBPF for networking
 * Red Hat uses eBPF at scale for load balancing and tracing in their private cloud
 * Palantir Technologies uses eBPF to debug networking problems in large scale Kubernetes clusters

Security
Due to the ease of programmability, eBPF has been used as a tool for implementing microarchitectural timing side-channel attacks such as Spectre against vulnerable microprocessors. While unprivileged eBPF implemented mitigations against transient execution attacks, unprivileged use has ultimately been disabled by the kernel community by default to protect from use against future hardware vulnerabilities.