LISA21 - BPF Internals

BPF Internals
Brendan Gregg
Extended BPF (aka eBPF) is a new type of software for secure, performant, event-driven programs, and has seen widespread adoption. Your Linux servers may already be running BPF programs; Netflix cloud instances run 15 by default, and Facebook over 40. These programs are for networking, performance tools, security policies, device drivers, application proxies, and more. Many have said that BPF is taking over Linux.
This talk is a deep dive that describes how BPF works internally and dissects some modern performance observability tools. Details covered include the kernel BPF implementation: the verifier, JIT compilation, and the BPF execution environment; the BPF instruction set; different event sources; and how BPF is used by user space, using bpftrace programs as an example. This includes showing how bpftrace is compiled to LLVM IR and then BPF bytecode, and how per-event data and aggregated map data are fetched from the kernel.
View the full LISA21 program at www.usenix.org/conference/lis...

[@TerryMurray1]

"it's actually quite easy!" (flashes very complex slide for 300ms)

[@-long-]

While I only understand a few concepts, I'm glad I've made it to the end of the talk. Thanks so much Mr. Brendan Gregg for the "it's actually quite easy" (I trusted the man and I've tried)
From what I can see, eBPF is shifting cloud native computing's perspective since there are many projects starting to adopt this technology.

[@sokacsavok]

Wow! One of the best kernel-related presentation I have seen in a while.

[@nemartin1]

Very informative, thanks for this!

[@rongtao3322]

Thanks

[@anuragmahanta8768]

Thank you

[@kalimuthu6831]

it's awesome!!!!

[@murderdroll]

its cool!