BPF: Introduction, Programming Tips and Tricks

Explore the world of Berkeley Packet Filter (BPF) in this informative 32-minute conference talk from KubeCon + CloudNativeCon Europe 2022. Delve into the past, present, and future of BPF, a crucial subsystem in the Linux kernel widely used for tracing, networking, and security. Learn how BPF safely and efficiently extends kernel capabilities without modifying source code or loading kernel modules. Discover practical programming tips and tricks for developing BPF tools using the libbpf library. Gain insights into BPF CO-RE, creating a "Hello world" example, understanding BPF skeleton and app lifecycle, and mastering advanced techniques such as selective attachment, custom loading, and handling multiple events. Explore methods for reading kernel structure fields, dealing with API changes, and optimizing performance through global variables and map pre-allocation strategies.

Syllabus

Intro
Speaker
What's BPF CO-RE?
"Hello world" with libbpf
BPF skeleton and BPF app lifecycle
Combining the open and load phases
Selective attach
Selective load
Custom load and attach
Multiple handlers for the same event
Reading kernel structure's fields
How to tell if a field exists?
How to deal with kernel API changes?
Control BPF behavior with global variable
Reduce map pre-allocation overhead
Determine the map size at runtime
Use global variables instead of map