The eBPF Runtime in the Linux Kernel
Bolaji Gbadamosi, Luigi Leonardi, Tobias Pulls, Toke, H{\o}iland-J{\o}rgensen, Simone Ferlin-Reiter, Simo Sorce, Anna Brunstr\"om

TL;DR
This paper provides a comprehensive overview of the design, implementation, and adoption of the eBPF runtime in the Linux kernel, highlighting its safety, flexibility, and growing use in kernel programming.
Contribution
It offers the first detailed description of eBPF's implementation in Linux, emphasizing its safety, versatility, and increasing role in kernel customization.
Findings
eBPF is a mature, safe, and flexible runtime for kernel programming.
Wide adoption of eBPF enables dynamic kernel modifications.
eBPF is used to program entire kernel components while maintaining safety.
Abstract
Extended Berkeley Packet Filter (eBPF) is a runtime that enables users to load programs into the operating system (OS) kernel, like Linux or Windows, and execute them safely and efficiently at designated kernel hooks. Each program passes through a verifier that reasons about the safety guarantees for execution. Hosting a safe virtual machine runtime within the kernel makes it dynamically programmable. Unlike the popular approach of bypassing or completely replacing the kernel, eBPF gives users the flexibility to modify the kernel on the fly, rapidly experiment and iterate, and deploy solutions to achieve their workload-specific needs, while working in concert with the kernel. In this paper, we present the first comprehensive description of the design and implementation of the eBPF runtime in the Linux kernel. We argue that eBPF today provides a mature and safe programming environment…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsDistributed and Parallel Computing Systems
