BPF: Introduction, Programming Tips and Tricks

This talk introduces BPF and shares practical techniques for developing BPF tools with libbpf. It covers the BPF application lifecycle, selective loading and attachment, handling kernel structure fields and API changes, and controlling map behavior.

Syllabus

Intro
Speaker
What's BPF CO-RE?
"Hello world" with libbpf
BPF skeleton and BPF app lifecycle
Combining the open and load phases
Selective attach
Selective load
Custom load and attach
Multiple handlers for the same event
Reading kernel structure's fields
How to tell if a field exists?
How to deal with kernel API changes?
Control BPF behavior with global variable
Reduce map pre-allocation overhead
Determine the map size at runtime
Use global variables instead of map