In his linux.conf.au
2017 talk [YouTube] on the eBPF in-kernel virtual machine, Brendan Gregg
proclaimed that “super powers have finally come to Linux”. Getting
eBPF to that point has been a long road of evolution and design. While
eBPF was originally used for network packet filtering, it turns out
that running user-space code inside a sanity-checking virtual machine
is a powerful tool for kernel developers and production engineers.
Over time, new eBPF users have appeared to take advantage of its
performance and convenience. This article explains how eBPF evolved
how it works, and how it is used in the kernel.