eBPF 101
summary
Introduction to eBPF covers the actual lifecycle: write user-space C, compile to eBPF bytecode, load via the bpf syscall and attach to hook points like tracepoints, kprobes, perf-events or XDP at the NIC. The in-kernel verifier rejects unsafe or infinite-loop programs, then a JIT emits native code. Programs are event-driven and run to completion and are mostly stateless but use eBPF maps (hash, array, prog_array) for shared state. Use cases: high-performance networking (XDP), telemetry, syscall filtering; ports exist beyond Linux (Windows support added).
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:38Agenda
- 1:57Design Goals
- 3:08The Problem
- 5:29PSD Packet Filter
- 5:50VM
- 6:37Userspace Programs
- 8:05How do ppf programs run
- 11:57Where does the e come from
- 14:29eBPF
- 14:40Where did it come from
- 15:58Hook points
- 18:52Networking
- 20:16eBPF verifier
- 23:20eBPF programs
- 26:48eBPF maps
- 28:30Conclusion
related talks
32meBPF: BPF kernel infrastructure
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
16mWhy Everyone Should Care About eBPF
32meBPF: The Next Power Tool of SREs
39meBPF Superpowers for Go programmers
50mIntroduction to eBPF
20mGentle Introduction to EBPF
47mInto the Heart of the eBPF Hive!