Understanding eBPF in a Hurry!

eBPF is an exciting new technology that is poised to transform Linux performance engineering. eBPF enables users to dynamically and programatically trace any kernel or user space code path, safely and efficiently. However, understanding eBPF is not so simple. The goal of this talk is to give audiences a fundamental understanding of eBPF and how it interconnects existing Linux tracing technologies, to provide a powerful and flexible platform to solve any Linux performance problem, in a hurry!

Transcript

2. @_rayjenkins github.com/rjenkins ray@segment.com
4. • • • •
8. http://www.brendangregg.com/ebpf.html
9. • • • • ◦
12. • ◦ • ◦ • ◦ • ◦ ◦
13. https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md
16. http://www.brendangregg.com/ebpf.html
17. • • • • https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/bpf.h#L145
18. • • • https://github.com/brendangregg/perf-tools
19. • • • • • •
20. https://vjordan.info/log/fpga/how-linux-kprobes-works.html
21. https://vjordan.info/log/fpga/how-linux-kprobes-works.html
24. • http://web.eece.maine.edu/~vweaver/projects/perf_events/ • •
25. • •
27. http://www.brendangregg.com/ebpf.html
35. https://github.com/torvalds/linux/blob/master/samples/bpf/sock_example.c
37. https://github.com/iovisor/bcc https://github.com/iovisor/gobpf
43. https://www.tcpdump.org/papers/bpf-usenix93.pdf
48. • • • •
49. https://blog.cloudflare.com/bpf-the-forgotten-bytecode/ http://www.networksorcery.com/enp/protocol/ip.htm
50. http://www.brendangregg.com/ebpf.html
51. • ◦ • ◦ ◦ ◦ ◦ • ◦ • ◦ • ◦ https://github.com/iovisor/bcc/blob/master/docs/reference_guide.md
52. • ◦ • ◦
55. http://www.brendangregg.com/ebpf.html
60. https://github.com/iovisor/bpf-docs/blob/master/eBPF.md
69. http://www.brendangregg.com/ebpf.html
71. • • • • • • • • • • ◦
74. • • • •
77. • https://lwn.net/Articles/740157/ • https://lwn.net/Articles/599755/ • https://www.collabora.com/news-and-blog/blog/2019/04/15/an-ebpf-overview-part-2-machine-and-bytecode/ • https://www.youtube.com/watch?v=2lbtr85Yrs4 • https://www.kernel.org/doc/Documentation/networking/filter.txt • http://www.brendangregg.com/ebpf.html • https://www.slideshare.net/vh21/meet-cutebetweenebpfandtracing • https://blog.cloudflare.com/bpf-the-forgotten-bytecode/ • https://www.oreilly.com/learning/using-linux-tracing-tools • https://lwn.net/Articles/742082/ • https://bolinfest.github.io/opensnoop-native/ • https://lwn.net/Articles/753601/ • http://brendangregg.com/perf.html