eBPF
E341122
eBPF is a powerful in-kernel virtual machine and programmable framework in the Linux kernel that enables safe, efficient, and dynamic instrumentation, networking, and security observability without modifying kernel source code.
All labels observed (4)
| Label | Occurrences |
|---|---|
| eBPF canonical | 2 |
| eBPF JIT compiler | 1 |
| eBPF maps | 1 |
| eBPF verifier | 1 |
How this entity was disambiguated
This entity first appeared as the object of triple T3245480 — resolving that mention is where its identity was fixed. The disambiguator weighed these candidate entities and picked the highlighted one (or “None”, minting a new entity). This is how homonymy is resolved: the same surface form can point to different entities.
NED1
Entity disambiguation (via context triple)
gpt-5-mini-2025-08-07
Target entity: eBPF Context triple: [DTrace, influenced, eBPF]
-
A.
Bytecode Alliance
Bytecode Alliance is a nonprofit industry consortium focused on advancing secure, modular, and portable software through technologies built around WebAssembly.
-
B.
Unbreakable Enterprise Kernel
Unbreakable Enterprise Kernel is Oracle’s optimized, enterprise-grade Linux kernel designed to deliver enhanced performance, stability, and support for Oracle workloads and cloud environments.
-
C.
BBR
BBR is the common abbreviation for Basketball-Reference.com, a comprehensive online database of basketball statistics and historical player and team information.
-
D.
B (bit-manipulation extension)
B (bit-manipulation extension) is a RISC-V ISA extension that adds specialized instructions to efficiently perform common bit-level operations such as shifts, rotates, and bitfield manipulation.
-
E.
BitC
BitC is a systems programming language designed for safety, low-level control, and formal verification, drawing on ideas from Modula-3 and capability-based security.
- F. None of above. chosen
- G. Unsure - the case is ambiguous/there is not enough information to decide.
NED2
Entity disambiguation (via description)
gpt-5-mini-2025-08-07
Target entity: eBPF Target entity description: eBPF is a powerful in-kernel virtual machine and programmable framework in the Linux kernel that enables safe, efficient, and dynamic instrumentation, networking, and security observability without modifying kernel source code.
-
A.
Bytecode Alliance
Bytecode Alliance is a nonprofit industry consortium focused on advancing secure, modular, and portable software through technologies built around WebAssembly.
-
B.
Unbreakable Enterprise Kernel
Unbreakable Enterprise Kernel is Oracle’s optimized, enterprise-grade Linux kernel designed to deliver enhanced performance, stability, and support for Oracle workloads and cloud environments.
-
C.
BBR
BBR is the common abbreviation for Basketball-Reference.com, a comprehensive online database of basketball statistics and historical player and team information.
-
D.
B (bit-manipulation extension)
B (bit-manipulation extension) is a RISC-V ISA extension that adds specialized instructions to efficiently perform common bit-level operations such as shifts, rotates, and bitfield manipulation.
-
E.
BitC
BitC is a systems programming language designed for safety, low-level control, and formal verification, drawing on ideas from Modula-3 and capability-based security.
- F. None of above. chosen
Statements (114)
| Predicate | Object |
|---|---|
| instanceOf |
Linux kernel subsystem
ⓘ
kernel technology ⓘ programming framework ⓘ virtual machine ⓘ |
| abbreviationOf | extended Berkeley Packet Filter ⓘ |
| basedOn | Berkeley Packet Filter ⓘ |
| compiledWith |
Clang
ⓘ
LLVM ⓘ |
| designedFor |
Linux
ⓘ
surface form:
Linux operating system
high-performance packet processing ⓘ low-overhead observability ⓘ runtime programmability ⓘ |
| enables |
attaching programs to kernel hooks
ⓘ
attaching programs to user-space probes ⓘ dynamic tracing of kernel events ⓘ dynamic tracing of user-space events ⓘ fine-grained security monitoring ⓘ in-kernel data processing ⓘ per-application observability ⓘ per-cgroup observability ⓘ per-container observability ⓘ policy enforcement in kernel fast path ⓘ programmable networking data plane ⓘ |
| fullName | extended Berkeley Packet Filter ⓘ |
| governedBy | kernel verifier rules ⓘ |
| hasComponent |
eBPF
self-linksurface differs
ⓘ
surface form:
eBPF JIT compiler
eBPF bytecode ⓘ eBPF helper functions ⓘ eBPF hooks ⓘ eBPF self-linksurface differs ⓘ
surface form:
eBPF maps
eBPF program types ⓘ eBPF self-linksurface differs ⓘ
surface form:
eBPF verifier
|
| hasLanguageBinding |
C
ⓘ
Go ⓘ LLVM ⓘ
surface form:
LLVM IR
Python ⓘ Rust ⓘ |
| hasMapType |
LRU hash map
ⓘ
array map ⓘ hash map ⓘ per-CPU array map ⓘ per-CPU hash map ⓘ queue map ⓘ ring buffer map ⓘ stack map ⓘ stack trace map ⓘ |
| hasProgramType |
LSM program
ⓘ
XDP program ⓘ cgroup program ⓘ kprobe program ⓘ kretprobe program ⓘ perf event program ⓘ socket filter program ⓘ tc classifier program ⓘ tracepoint program ⓘ uprobes program ⓘ |
| hasProperty |
event-driven
ⓘ
in-kernel virtual machine ⓘ interpreted bytecode ⓘ just-in-time compiled ⓘ no kernel source modification required ⓘ privilege-separated ⓘ safe execution model ⓘ sandboxed ⓘ verifier-based safety checks ⓘ |
| hasUseCase |
DDoS mitigation
ⓘ
Kubernetes observability ⓘ application profiling ⓘ container networking ⓘ intrusion detection ⓘ network observability ⓘ runtime security enforcement ⓘ security monitoring ⓘ service mesh acceleration ⓘ system call filtering ⓘ system performance monitoring ⓘ |
| hasUserSpaceComponent |
BCC
ⓘ
Linux kernel tools ⓘ
surface form:
bpftool
bpftrace ⓘ libbpf ⓘ |
| introducedIn |
Linux kernel
ⓘ
surface form:
Linux kernel 3.x series
|
| relatedTo |
Linux Security Modules API
ⓘ
surface form:
Linux Security Modules
XDP ⓘ netfilter ⓘ perf events ⓘ tc (traffic control) ⓘ |
| replaces | classic BPF ⓘ |
| runsIn | Linux kernel ⓘ |
| securityProperty |
prevents arbitrary pointer dereferences
ⓘ
prevents unbounded loops in older kernels ⓘ requires privileged loading by default ⓘ restricts memory access to maps and stack ⓘ |
| standardizedBy | Linux kernel community ⓘ |
| supports |
dynamic instrumentation
ⓘ
load balancing ⓘ networking ⓘ packet filtering ⓘ performance observability ⓘ policy enforcement ⓘ profiling ⓘ sandboxed program execution ⓘ security observability ⓘ tracing ⓘ traffic control ⓘ |
| usedBy |
Cilium CNI plugin
ⓘ
surface form:
Cilium
Falco ⓘ Hubble ⓘ Katran ⓘ Pixie ⓘ many cloud-native observability tools ⓘ |
| uses |
bytecode instruction set
ⓘ
kernel helper calls ⓘ maps for data storage ⓘ restricted instruction set ⓘ |
How these facts were elicited
The pipeline generated the facts above by prompting gpt-5.1 with this entity's name + description and the instruction below.
Instruction
You are a knowledge base construction expert. Given a subject entity and a description of it, return factual statements that you know for the subject as a JSON list of dictionaries(triples), where keys must be "subject", "predicate" and "object". The number of facts may be very high, between 25 to 50 or more, for very popular subjects. For less popular subjects, the number of facts can be very low, like 5 or 10. # Requirements - If you don't know the subject at all, return an empty list. - If the subject is not a named entity, return an empty list. - Include at least one triple where predicate is "instanceOf". - Do not get too wordy. - Separate several objects into multiple triples with one object.
Input
Subject: eBPF Description of subject: eBPF is a powerful in-kernel virtual machine and programmable framework in the Linux kernel that enables safe, efficient, and dynamic instrumentation, networking, and security observability without modifying kernel source code.
Referenced by (5)
Full triples — surface form annotated when it differs from this entity's canonical label.
this entity surface form:
eBPF verifier
this entity surface form:
eBPF JIT compiler
this entity surface form:
eBPF maps