BPF Internals

Dive deep into the internals of Extended BPF (eBPF) in this 39-minute conference talk from USENIX LISA21. Explore the widespread adoption of this secure, performant, event-driven software technology used in networking, performance tools, security policies, device drivers, and application proxies. Discover how BPF works internally, including the kernel implementation, verifier, JIT compilation, and execution environment. Learn about the BPF instruction set, various event sources, and user space interactions. Examine real-world examples, such as bpftrace programs, to understand how BPF is compiled to LLVM IR and BPF bytecode, and how data is fetched from the kernel. Gain insights into why BPF is considered a transformative technology for Linux systems and cloud environments.

LISA21 - BPF Internals