eBPF: BPF kernel infrastructure
summary
eBPF compiles restricted C to kernel bytecode, loads via the BPF syscall, and enforces safety with a verifier that forbids unbounded loops and limits program chaining to 32 tail calls; maps expose data via a map file descriptor and helper functions like lookup/update. XDP runs at driver entry and shows big gains: IPtables hits ~1.33M pps vs XDP ~5.59 million pps (single CPU), and routing prototypes jump from ~1.9M to ~7 million pps. Tools: BCC, bpftrace, Prometheus eBPF exporter, Facebook Katran.
AI-written summary · about
chapters (6)
related talks
31meBPF 101
16mWhy Everyone Should Care About eBPF
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
48mInto the hive of eBPF!
28mDeveloping Modern eBPF Applications
39meBPF Superpowers for Go programmers
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
37mEfficient and Flexible Virtual Machine Networking Through eBPF