eBPF

Original author(s)	Alexei Starovoitov, Daniel Borkmann[1][2]
Developer(s)	Open source community, Meta, Google, Isovalent, Microsoft, Netflix[1]
Initial release	2014; 10 years ago (2014)[3]
Repository	Linux: git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ Windows: github.com/Microsoft/ebpf-for-windows/
Written in	C
Operating system	Linux, Windows[4]
Type	Runtime system, Sandboxing
License	Linux: GPL Windows: MIT License
Website	ebpf.io

eBPF, the extended Berkeley Packet Filter (often referred to by the pseudo-acronym BPF)^[2][5] is a technology that can run sandboxed programs in a privileged context such as the operating system kernel.^[6] It is used to safely and efficiently extend the capabilities of the kernel at runtime without requiring to change kernel source code or load kernel modules.^[7] Safety is provided through an in-kernel verifier which performs static code analysis and rejects programs which crash, hang or otherwise interfere with the kernel negatively.^[8][9] Examples of programs that are automatically rejected are programs without strong exit guarantees (i.e. for/while loops without exit conditions) and programs dereferencing pointers without safety-checks.^[10] Loaded programs which passed the verifier are either interpreted or in-kernel JIT compiled for native execution performance. The execution model is event-driven and with few exceptions run-to-completion,^[2] meaning, programs can be attached to various hook points in the operating system kernel and are run upon triggering of an event. eBPF use cases include (but are not limited to) networking such as XDP, tracing and security subsystems.^[6] Given eBPF's efficiency and flexibility opened up new possibilities to solve production issues, Brendan Gregg famously coined eBPF as "superpowers for Linux".^[11] Linus Torvalds expressed that "BPF has actually been really useful, and the real power of it is how it allows people to do specialized code that isn't enabled until asked for".^[12] Due to its success in Linux, the eBPF runtime has been ported to other operating systems such as Windows.^[4]

History

Evolution from classic BPF

eBPF was built on top of the Berkeley Packet Filter (cBPF). At the lowest level, it introduced the use of ten 64-bit registers (instead of two 32-bit long registers for cBPF), different jump semantics, a call instruction and corresponding register passing convention, new instructions, and a different encoding for these instructions.^[13] A number of additional features were subsequently added. The evolution of eBPF took many years and a large community of contributors, and is still ongoing. The table below summarizes some of the most significant milestones of this evolution:

Most significant milestones in the evolution of eBPF

Date	Event
April 2011	The first in-kernel Linux JIT compiler for the classic Berkeley Packet Filter got merged.[14]
January 2012	The first non-networking use case of the classic Berkeley Packet Filter, seccomp-bpf,[15] appeared; it allows filtering of system calls using a configurable policy implemented through BPF instructions.
March 2014	David S. Miller, primary maintainer of the Linux networking stack, accepted the rework of the old in-kernel BPF interpreter. It was replaced by an eBPF interpreter and the Linux kernel internally translates classic BPF (cBPF) into eBPF instructions.[16]
March 2015	The ability to attach eBPF to kprobes as first tracing use case was merged.[18] In the same month, initial infrastructure work got accepted to attach eBPF to the networking traffic control (tc) layer allowing to attach eBPF to the core ingress and later also egress paths of the network stack, later heavily used by projects such as Cilium.[19][20][21]
August 2015	The eBPF compiler backend got merged into LLVM 3.7.0 release.[22]
September 2015	Brendan Gregg announced a collection of new eBPF-based tracing tools as the bcc project, providing a front-end for eBPF to make it easier to write programs.[23]
July 2016	eBPF got the ability to be attached into network driver's core receive path. This layer is known today as eXpress DataPath (XDP) and was added as a response to DPDK to create a fast data path which works in combination with the Linux kernel rather than bypassing it.[24][25][26]
August 2016	Cilium was initially announced during LinuxCon as a project providing fast IPv6 container networking with eBPF and XDP. Today, Cilium has been adopted by major cloud provider's Kubernetes offerings and is one of the most widely used CNIs.[27][21][28]
November 2016	Netronome added offload of eBPF programs for XDP and tc BPF layer to their NIC.[29]
May 2017	Meta's layer 4 load-balancer, Katran, went live. Every packet towards facebook.com since then has been processed by eBPF & XDP.[30]
November 2017	eBPF becomes its own kernel subsystem to ease the continuously growing kernel patch management. The first pull request by eBPF maintainers was submitted.[31]
September 2017	Bpftool was added to the Linux kernel as a user space utility to introspect the eBPF subsystem.[32]
January 2018	A new socket family called AF_XDP was published, allowing for high performance packet processing with zero-copy semantics at the XDP layer.[33] Today, DPDK has an official AF_XDP poll-mode driver support.[34]
February 2018	The bpfilter prototype has been published, allowing translation of a subset of iptables rulesets into eBPF via a newly developed user mode driver. The work has caused controversies due to the ongoing nftables development effort and has not been merged into mainline.[35][36]
October 2018	The new bpftrace tool has been announced by Brendan Gregg as DTrace 2.0 for Linux.[37]
November 2018	eBPF introspection has been added for kTLS in order to support the ability for in-kernel TLS policy enforcement.[38]
November 2018	BTF (BPF Type Format) has been added to the Linux kernel as an efficient meta data format which is approximately 100x smaller in size than DWARF.[39]
December 2019	The first 880-page long book on BPF, written by Brendan Gregg, was released.[40]
March 2020	Google upstreamed BPF LSM support into the Linux kernel, enabling programmable LSMs through eBPF.[41]
September 2020	The eBPF compiler backend for GCC was merged.[42]

Adoption

eBPF has been adopted by a number of large-scale production users, for example:

• Meta uses eBPF through their Katran layer 4 load-balancer for all traffic going to facebook.com^{[43][44][45][30]}
• Google uses eBPF in GKE, developed and uses BPF LSM to replace audit and it uses eBPF for networking^{[28][46][47][48]}
• Cloudflare uses eBPF for load-balancing and DDoS protection and security enforcement^{[49][50][51][52][53]}
• Netflix uses eBPF for fleet-wide network observability and performance diagnosis^[54][55]
• Dropbox uses eBPF through Katran for layer 4 load-balancing^[56]
• Android uses eBPF for NAT46 and traffic monitoring^[57][58][59]
• Alibaba uses eBPF for Kubernetes Pod load-balancing^[60]
• Datadog uses eBPF for Kubernetes Pod networking and security enforcement^[61][62][63]
• Trip.com uses eBPF for Kubernetes Pod networking^[64][65]
• Microsoft ported eBPF and XDP to Windows^[66][67][68]
• Seznam uses eBPF through Cilium for layer 4 load-balancing^[69]
• CapitalOne uses eBPF for Kubernetes Pod networking^[70]
• Apple uses eBPF for Kubernetes Pod security^[71]
• Sky uses eBPF for Kubernetes Pod networking^[72]
• Walmart uses eBPF for layer 4 load-balancing^[73][74]
• Huawei uses eBPF through their DIGLIM secure boot system^[75]
• Ikea uses eBPF for Kubernetes Pod networking^[76]

Logo

The bee is the official logo for eBPF. At the first eBPF Summit there was a vote taken and the bee mascot was named "eBee".^[77][78] The logo has originally been created by Vadim Shchekoldin.^[78] Earlier unofficial eBPF mascots have existed in the past,^[79] but haven't seen widespread adoption.

Naming

There has been controversy around the naming of eBPF. The alias eBPF is often interchangeably used with BPF, for example by the Linux kernel community. eBPF and BPF is referred to as a technology name like LLVM.^[2] eBPF evolved from the Berkeley Packet Filter as an extended version, but its use case outgrew networking, and today eBPF as a pseudo-acronym is preferred.^[2]

eBPF Foundation

The eBPF Foundation was created in August 2021 with the goal to expand the contributions being made to extend the powerful capabilities of eBPF and grow beyond Linux.^[1] Founding members include Meta, Google, Isovalent, Microsoft and Netflix. The purpose is to raise, budget and spend funds in support of various open source, open data and/or open standards projects relating to eBPF technologies^[80] to further drive the growth and adoption of the eBPF ecosystem. Since inception, Red Hat, Huawei, Crowdstrike, Tigera, DaoCloud, Datoms, FutureWei also joined.^[81]

Steering committee

With the creation of the eBPF Foundation,^[1] an eBPF steering committee (BSC) was established in order to take care of the technical direction and vision of eBPF.^[82] Tasks include the collaboration among projects, defining the minimal requirements of eBPF runtimes, overseeing community events, maintaining eBPF technical project lifecycle procedures, and communicating on behalf of the eBPF community.

Active members include:^[82]

• Alexei Starovoitov, Meta
• Andrii Nakryiko, Meta
• Brendan Gregg, Intel
• Daniel Borkmann, Isovalent
• Dave Thaler, Microsoft
• Joe Stringer, Isovalent
• KP Singh, Google
• Lorenz Bauer, formerly Cloudflare

There are currently no emeritus members.

eBPF standardization

Although eBPF is supported, to various degrees, on multiple platforms, there is no standard specification (as of January 2023) to formally define its components. However, there is currently some work in progress to define and publish a standard for the instruction set, under the auspices of the eBPF Foundation.^[83]

Security concerns

Due to the ease of programmability, eBPF has been used as a tool for implementing microarchitectural timing side-channel attacks such as Spectre against vulnerable microprocessors.^[84] While unprivileged eBPF implemented mitigations against transient execution attacks,^[85] unprivileged use has ultimately been disabled by the kernel community by default to protect from use against future hardware vulnerabilities.^[86]

Conferences

The eBPF community organises a number of technical workshops and conferences to discuss ongoing research, development efforts, and use cases around eBPF. They can broadly be categorised into user-focused conferences and more developer-focused conferences.

User-focused conferences:

• eBPF Summit, a user conference around eBPF production users and projects building upon eBPF^[87][88][89]
• Cloud Native eBPF Day, a CNCF event co-located with KubeCon for the cloud native community^[90][91]

Developer-focused conferences:

• LSF/MM/BPF workshop, an annual technical workshop for the BPF Linux kernel community^[92][93]
• BPF track at Linux Plumbers conference, a technical track for the BPF Linux kernel community and surrounding user space libraries and tooling^{[94][95][96][97][98][99]}

See also

• Express Data Path

References

Further reading

• Brendan Gregg (December 2019). BPF Performance Tools. ISBN 978-0136554820.
• David Calavera, Lorenzo Fontana (December 2019). Linux Observability With BPF. ISBN 978-1492050209.
• Brendan Gregg (December 2020). Systems Performance, Second edition. ISBN 978-0136820154.
• Liz Rice (April 2022). What Is eBPF?. ISBN 978-1492097259.
• Liz Rice (April 2023). Learning eBPF: Programming the Linux Kernel for Enhanced Observability, Networking, and Security. ISBN 978-1098135126.

External links

• eBPF.io - Introduction, tutorials & eBPF community resources
• eBPF.foundation - Linux Foundation's eBPF Foundation site