Name: BPF/eBPF

Description

eBPF (which is no longer an acronym for anything), also commonly referred to as BPF, is a revolutionary technology with origins in the Linux kernel that can run sandboxed programs in a privileged context such as the operating system kernel. It is used to safely and efficiently extend the capabilities of the kernel without requiring changing kernel source code or load kernel modules.

(e)BPF is increasing being used beyond just the Linux kernel, with implementations in network interface cards, Windows, etc. As such, this effort aims to document and standardize existing (e)BPF use. The IETF should also define processes for future extensions since (e)BPF has constantly been added to over time.

Required Details

• Status: WG Forming?
• Responsible AD: Erik Kline
• BOF proponents: Dave Thaler <dthaler@microsoft.com>, Christoph Hellwig <hch@infradead.org>
• BOF chairs: Suresh Krishnan, Lorenzo Colitti
• Number of people expected to attend: 80
• Length of session (1 or 2 hours): 2 hours
• Conflicts (whole Areas and/or WGs)
• Chair Conflicts: TBD
• Technology Overlap: spring, intarea
• Key Participant Conflict: teep, suit, rats, nfsv4, 6man, v6ops

Information for IAB/IESG

The proposed work is to document existing practice, not define new protocols or mechanisms per se.

• The Linux kernel implementation is the de facto standard today
• The Linux implementation is also used in Android
• The eBPF for Windows project adds support on Windows
• https://ebpf.io/infrastructure shows other implementations
• https://ebpf.io/infrastructure shows a wide variety of open source applications built on top of eBPF as the core technology
• https://www.netronome.com/technology/ebpf/ is an example of a SmartNIC company that supports eBPF in their NICs
• Linux kernel BPF documentation is at https://www.kernel.org/doc/Documentation/bpf/
• eBPF Foundation is an open source foundation under the Linux Foundation, see https://ebpf.foundation/
• https://github.com/ebpffoundation/ebpf-docs is the eBPF Foundation's repository for documentation
• NVMe wants to reference a standard, which is one of the reasons to publish as an RFC rather than just an eBPF Foundation document
• Many IETF projects already use or reference (e)BPF. For example, a couple of IETF 115 hackathon presentations (not including anything from the BOF proponents) stated they used eBPF.
• Notes from IETF 115 side meeting (16 local attendees, 17 zoom attendees): https://mailarchive.ietf.org/arch/msg/bpf/VMU0nSo-T71QfXC50Q1Bu2ejD_g/

Agenda

• Problem statement
• Proposed scope of work
• Instruction Set Architecture
• (Time permitting) ELF file format
• Next steps

Links to the mailing list, draft charter if any, relevant Internet-Drafts, etc.

• Mailing List: https://www.ietf.org/mailman/listinfo/bpf
• Draft charter: https://github.com/ekline/bpf/blob/main/charter-ietf-bpf.txt
• Relevant drafts:
  • Instruction Set Architecture (to be posted as I-D):
    • https://github.com/ebpffoundation/ebpf-docs/blob/pdf/instruction-set.pdf
  • ELF file format (to be posted as I-D):
    • https://github.com/dthaler/ebpf-docs-1/blob/elf/rst/elf.rst