EBPF 101

Explore the fundamentals of eBPF, an in-kernel virtual machine, in this informative conference talk from linux.conf.au 2022. Delve into the safe and efficient programming model that allows for extracting telemetry data from kernel points and enhancing critical throughput areas. Learn about the advantages of eBPF over custom kernel modules, including its in-kernel verifier and restricted functionalities. Discover the evolution of eBPF from a network-focused tool to a versatile framework applicable throughout the kernel. Gain insights into novel uses such as writing TCP congestion control algorithms in user-space. Understand the lifecycle of an eBPF program, from writing in user-space to loading in the kernel and attaching to hooks or events. Examine various types of eBPF programs and the role of eBPF maps in enabling stateful decision-making. Perfect for non-kernel programmers, this talk provides a comprehensive introduction to the eBPF subsystem and its potential applications.

Introduction
Agenda
Design Goals
The Problem
PSD Packet Filter
VM
Userspace Programs
How do ppf programs run
Where does the e come from
eBPF
Where did it come from
Hook points
Networking
eBPF verifier
eBPF programs
eBPF maps
Conclusion