Extended BPF

BPF programs are a new type of software that makes a fundamental change to a 50-year old kernel model by introducing a new interface for applications to make kernel requests, alongside syscalls. post

YOUTUBE 7pmXdG8-7WU Published Nov 28, 2019.

At Netflix we have 15 BPF programs running on cloud servers by default; Facebook has 40. These programs are not processes or kernel modules, and don't appear in traditional observability tools.

BPF originally stood for Berkeley Packet Filter, but has been extended in Linux to become a generic kernel execution engine, capable of running a new type of user-defined and kernel-mode applications. This is what BPF is really about, and I described this for the first time in my Ubuntu Masters keynote.

Tools for BPF-based Linux IO analysis, networking, monitoring, and more. github

See Linux Systems Performance for more context.

See Little Language where BPF was mentioned years ago.

How to write cross-platform packet capture from scratch in 1000 LOC. medium

Linux Async I/O for eBPF with io_uring. post