BPF program
also: eBPF, extended BPF, Berkeley Packet Filter program
A BPF (Berkeley Packet Filter) program is a small, sandboxed bytecode application that runs in the Linux kernel, used for safe in-kernel computation without recompiling the kernel.
BPF is an in-kernel virtual machine that allows safe execution of custom programs at various kernel attachment points. BPF programs are written in C or Rust, compiled to BPF bytecode, and verified by the kernel before loading to ensure they cannot crash the system or access invalid memory.
BPF programs commonly perform networking (packet filtering, load balancing), observability (tracing syscalls, monitoring performance), and security (firewalling, intrusion detection). For example, tcpdump uses BPF to filter packets without context-switching to userspace, while observability tools like bpftrace use BPF to dynamically instrument kernel functions.
The kernel's BPF verifier statically analyzes the bytecode before execution, ensuring termination and safety. Programs attach to hooks like network interfaces, syscall entry/exit points, or kernel functions via eBPF (extended BPF), the modern variant that supports loops, multiple functions, and maps for state storage.