Making Use Of eBPF In The Mainline Linux Kernel

One of the exciting innovations within the Linux kernel in the past few years has been extending the Berkeley Packet Filter (BPF) to become a more generalized in-kernel virtual machine. The eBPF work with recent versions of the Linux kernel allow it to be used by more than just networking so that these programs can be used for tracing, security, and more.

eBPF is quite exciting and all of its potential is likely not yet fully realized as a universal in-kernel virtual machine. The eBPF programs can be compiled for the kernel via LLVM Clang to make it easy to write these programs to be interpreted by this VM.

For developers not yet fully up to speed on (e)BPF, Brenden Blanco of the IOvisor project spoke at this week's LinuxCon 2016 Toronto conference about all of the possibilities and writing a few demos.

If you missed out on the event, the 33 page slide deck can be found in PDF form to learn more about Linux eBPF programs this weekend.