A Gentle Introduction to [e]BPF

BPF is a Linux in-kernel virtual machine that is used for networking, tracing, seccomp and more. This talk will explore BPF in Linux from the bottom up, going from its roots in the BSD Packet Filter ( …

BPF is a Linux in-kernel virtual machine that is used for networking, tracing, seccomp and more. This talk will explore BPF in Linux from the bottom up, going from its roots in the BSD Packet Filter (now often called classic or cBPF) to today’s [e]xtended BPF. Starting with an overview of the the BPF instruction set, helper functions and data stores (maps), the presentation will give an approachable introduction into development, debugging and usage of BPF programs on Linux.