Kernel Analysis Using eBPF
summary
eBPF runs as an in-kernel VM that attaches to kprobes and tracepoints, loads LLVM/clang-compiled bytecode, and uses maps act like dictionaries to move data to user space; the verifier enforces safety (no arbitrary reads, verifier forbids loops, checks register/stack use) and there is a 4096-opcode limit. Tools differ: kernel samples show kprobe-based leak tracking and stack-aggregation, bcc combines Python+clang for dynamic probes, bpftrace exposes C headers via clang libs, and systemtap’s eBPF backend remains experimental.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:22Background
- 3:49Inside eBPF
- 8:39Verification
- 12:22Code
- 15:15Kernel Examples
- 22:15BC
- 29:53Examples
- 30:18Power States
- 34:07Stack Tracking
- 36:44Tools Trace
related talks
25mKernel tracing with BPF
38mLinux Kernel Tracing Using eBPF
36mDebugging with eBPF on Arm Platforms
38mThe Next Linux Superpower: eBPF Primer
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
36mDebugging with eBPF on Arm Platforms
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
36mObservability and performance analysis with BPF