EBPF 101

Explore the fundamentals of eBPF, an in-kernel virtual machine, in this informative conference talk from linux.conf.au 2022. Delve into the safe and efficient programming model that allows for extracting telemetry data from kernel points and enhancing critical throughput areas. Learn about the advantages of eBPF over custom kernel modules, including its in-kernel verifier and restricted functionalities. Discover the evolution of eBPF from a network-focused tool to a versatile framework applicable throughout the kernel. Gain insights into novel uses such as writing TCP congestion control algorithms in user-space. Understand the lifecycle of an eBPF program, from writing in user-space to loading in the kernel and attaching to hooks or events. Examine various types of eBPF programs and the role of eBPF maps in enabling stateful decision-making. Perfect for non-kernel programmers, this talk provides a comprehensive introduction to the eBPF subsystem and its potential applications.