In-kernel virtual machine
# In-kernel virtual machine

In-Kernel Virtual Machine, in computer science, a Virtual machine is the virtualization/emulation of a computer system. Virtual machine applications may contain specialized hardware, software, or a combination of these. It is possible to come across virtual machines in structures called kernels.

## Examples

### eBPF

eBPF is an "in-kernel virtual machine" that allows users to load and run custom programs within the kernel of the operating system. That means it can extend or even modify the way the kernel behaves.

It is used as a backend for the libpcap library and performs packet filtering for tools like tcpdump. When tcpdump is executed with some filtering rules, it generates the eBPF bytecode for that rule and sends it to the kernel for inclusion in the early stages of network stack processing. This bytecode is then interpreted in the virtual machine and decides which packet will appear in the tcpdump output. This filtering mechanism is performant and safe by design. eBPF programs executed in isolation in the "in-kernel virtual machine". They are limited to 4096 commands, they cannot have cycles, and all memory accesses are checked for a valid range. Therefore, it is guaranteed that the execution of the BPF bytecode will be terminated. It cannot cause kernel error, denial of service, or memory damage.

### nftables

nftables is an in-kernel packet classification framework built on a network-specific Virtual Machine (VM) and the nft userspace command line tool.

It was introduced in the Linux kernel v3.13, and it improves the kernel's network stack with new bytecode filtering capabilities, where the filters are not statically coded into kernel modules. However, the rules are compiled and optimized in user space for small bytecode programs. Those small programs are then executed in an "in-kernel virtual machine" at runtime.

### DTrace

DTrace is a performance analysis and troubleshooting tool developed by Sun Microsystems. It has Dynamic Tracing that patches live running instructions with instrumentation code, including Solaris, Mac OS X, and FreeBSD. As distinct from other solutions for dynamic instrumentation that execute native instrumentation code, it implements a simple "in-kernel virtual machine" that interprets byte code generated by a compiler for the "D" language.

