BPF: A New Type of Software (brendangregg.com)

Article summary

The article discusses BPF, a new type of software that introduces a new interface for applications to make kernel requests, alongside syscalls. BPF originally stood for Berkeley Packet Filter but has been extended in Linux to become a generic kernel execution engine. This change allows for a new type of user-defined and kernel-mode applications. BPF programs are not processes or kernel modules and do not appear in traditional observability tools.

Main themes

• BPF and kernel development
• System call overhead
• Security and sandboxing
• Kernel modules and alternatives
• Performance optimization
• Turing completeness and language design

What commenters say

• BPF programs are not Turing complete, which is a deliberate design choice to ensure they do not harm the system.
• The use of BPF programs can provide significant speed-ups by avoiding overheads associated with system calls.
• BPF programs are more isolated and less error-prone than kernel modules, making them easier to write and use.
• The security model of BPF is based on a virtual machine that sandboxes the programs, limiting their power and preventing them from causing harm to the system.
• Some commenters question the need for BPF, suggesting that kernel modules could be used instead, while others argue that BPF provides a more secure and isolated environment.
• The ability to load BPF programs without root privilege is seen as a potential benefit, allowing for more flexible and secure use of the technology.
• The trade-off between the benefits of BPF and the potential risks and limitations is a subject of debate among commenters.