BPF 101

Getting Linux superpowers

9 February 2024

History

• 1993: Berkeley Packet Filter (before FreeBSD)
• 1997: Added to the Linux kernel
• 2014: eBPF merged, released on Linux kernel 3.18
  • Syscall
  • Maps
  • Verifier

Naming

• Classic BPF
• eBPF
• BPF
  • bpf() syscall
  • bpf_* functions
  • BPF_MAP_*, BPF_PROG_* constants/opcodes

Kernel space vs. User space

Image: Learning eBPF

What it is

• Equivalent to JavaScript in the Linux kernel
  • Event-based invocation
• Kernel code:
  • Patches
  • Modules
  • BPF

How to use it

• BCC tools
• bpftrace
• libbpf
  • BTF
  • CO-RE

Network stack

Images: Learning eBPF

Demo

• Linux kernel firewall in ~100 lines of C
  • github.com/myhro/bpfirewall

Conclusion

• Platform, not a feature
• BPF... On Windows?

Further reading

• Andrii Nakryiko's Blog
• Brendan Gregg's Blog
• Brendan Gregg's BPF Performance Tools
• Liz Rice's Learning eBPF

Thank you