Linux kernel's eBPF feature put to unexpected new uses
The Linux Plumbers Conference in Dublin ends today and some of the talks have revealed interesting new uses for the eBPF functionality.
Several different teams presented tools that all use a part of the kernel originally intended to control packet filtering for new and totally different purposes. Google's ghOSt allows for adjusting process scheduling, while Red Hat's HID-BPF will make it easier to accommodate new input devices.
Both of these use the eBPF facility introduced in kernel 3.18. The Register talked about eBPF when Microsoft introduced its own version for Windows. eBPF gives the kernel an intentionally limited register-based virtual machine, which allows tiny, strictly limited programs to execute inside the kernel itself.
It derives from the 30-year-old Berkeley Packet Filter tool, intended to provide flexible tools for filtering data flowing in and out of the Unix kernel. The Linux extended implementation is more general, and what's interesting about these projects is that they're not directly related to networking, firewalls or packet filtering at all.