Understanding The Linux Kernel's BPF In-Kernel Virtual Machine

BPF continues marching forward as a universal, in-kernel virtual machine for the Linux kernel. The Berkeley Packet Filter was originally designed for network packet filtering but has since been extended as eBPF to support other non-network subsystems via the bpf syscall. Here's some more details on this in-kernel virtual machine.

Alexei Starovoitov presented at last month's Linux Foundation Collaboration Summit in Santa Rosa about BPF as an in-kernel virtual machine. The slides have been published for those wishing to learn more about its state and capabilities.

The JIT support for BPF has been upstreamed for x86_64 and ARM64 within the Linux kernel while the s390 and PPC Just-In-Time support is still a work-in-progress. On the compiler side, the LLVM back-end is upstream while the GCC back-end remains a work-in-progress.

Besides networking, BPF can be useful for tracing, analytics / monitoring / debugging, in-kernel optimizations, hardware modeling, and "crazy stuff."

If you're interested in more technical information on BPF as an in-kernel virtual machine, see the PDF slides by
Alexei Starovoitov.