eBPF
Sign in to saveAlso known as extended Berkeley Packet Filter
eBPF is a technology that can run programs in a privileged context such as the operating system kernel. It is the successor to the Berkeley Packet Filter (BPF, with the "e" originally meaning "extended") filtering mechanism in Linux and is also used in non-networking parts of the Linux kernel.
Wikidata facts
- Official website
- ebpf.io
Show 2 more facts
- official blog URL
- ebpf.io/blog
- inception
- 2014-00-00
via Wikidata · CC0
~18 min read
Article
17 sectionsContents
- Design
- History
- Architecture and concepts
- eBPF maps
- eBPF virtual machine
- Tail calls
- BPF to BPF calls
- eBPF verifier
- eBPF CO-RE (Compile Once - Run Everywhere)
- Branding
- Governance
- Adoption
- Security
- See also
- References
- Further reading
- External links
eBPF is a technology that can run programs in a privileged context such as the operating system kernel. It is the successor to the Berkeley Packet Filter (BPF, with the "e" originally meaning "extended") filtering mechanism in Linux and is also used in non-networking parts of the Linux kernel.
It is used to safely and efficiently extend the capabilities of the kernel at runtime without requiring changes to kernel source code or loading kernel modules. Safety is provided through an in-kernel verifier which performs static code analysis and rejects programs which crash, hang or otherwise interfere with the kernel negatively.