eBPF: exploring use case of BPF kernel infrastructure
summary
Starts with a concrete claim: eBPF runs safe bytecode in‑kernel with a verifier, maps and helper calls loaded via the bpf syscall and compiled by LLVM/libbpf, enabling tracing with bcc-tools and Bpftrace and user↔kernel state sharing. Shows a working datapath: XDP hooks at the driver, keeps kernel stack available and powers in‑kernel load balancing used by Facebook and CloudFlare. Provides benchmarks: single‑queue 5.6Mpps vs ~2Mpps (XDP vs iptables) on a 40Gb testbed and explains verifier, maps and helper usage.
AI-written summary · about
chapters (20)
- 0:00Start
- 0:16About me
- 2:57Why BPF/tcpdump?
- 5:20eBPFlextended-Berkeley packet filter
- 7:00eBPF use-case
- 11:02BPF Map types
- 11:54In-kernel Helper functions
- 12:13BPF Program types
- 13:40eBPF verifier
- 15:06System requirements
- 16:43BCC(BPF compiler collection)
- 24:05XDP actions
- 24:33Loading XDP program
- 25:02DDoS test comparison
- 25:30System configs for Device Under Test
- 25:41Test setup
- 27:36bpfilter
- 28:46BPF is exciting
- 29:39Takeaways
- 30:34Resources
related talks
32meBPF: The Next Power Tool of SREs
47mInto the Heart of the eBPF Hive!
29meBPF on the Rise - Getting Started
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
29mBuzzing Across the Cloud Native Landscape with eBPF
16mWhy Everyone Should Care About eBPF
46mThe eBPF Revolution: A Dynamic Linux Kernel- 40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools