Blog page
eBPF Updates #2: eBPF with Zig, libbpf-bootstrap, Rust Linker, BTF in Kernel Modules, Cgroup-Based Memory Accounting
Welcome to the second issue of the _eBPF Updates_! This time we have interesting resources about how to write eBPF programs with Zig, or with Rust, or on how to manage them with libbpf. On the kernel side, modules now support BTF, and improvements to memory accounting for eBPF should help to solve the limitations of rlimit. Did this just sound incomprehensible to you? Do not fear, we also have some gentle introductions to eBPF in the list. This issue also introduces a “Did You Know” section, and this time the focus is on CO-RE. Read, learn, trace, and filter!
Read moreeBPF Updates #1: eBPF Summit Coverage, libbpf 0.2, BTF Developments, Bulk API for XDP, Local Task Storage for eBPF LSM
Curious people, eBPF aficionados, kernel hackers, welcome! The eBPF Updates aim to be a regular publication providing news on the latest resources and developments in the eBPF world. This report is the first of the series. We will focus on the latest news over October and November 2020. From new tutorials to academic research and kernel discussions, everyone should find a good read or two!
Read more
The Top Reasons Why You Should Give eBPF a Chance
Find out where all the hype around eBPF is coming from
Read moreeBPF assembly with LLVM
Clang and LLVM, used to compile from C to eBPF, got support for eBPF assembly in version 6.0. Let's have a look at it.
Read moreUnderstanding tc “direct action” mode for BPF
The Linux Traffic Control subsystem, “TC”, got support for running eBPF programs as classifiers. Then a “direct-action” flag appeared. Let's see how it works.
Read moreHOWTO: BCC to libbpf conversion
A practical guide to converting your BCC-based BPF application to libbpf + BPF CO-RE.
Read moreBPF Portability and CO-RE
What does portability mean in BPF context? What are the challenges of writing portable BPF programs that developers need to deal with? This post will describe BPF portability problem and how BPF CO-RE (Compile Once – Run Everywhere) is helping to address this problem.
Read moreLifetime of BPF objects
The BPF verifier guarantees that program itself is safe for the kernel to execute, but in order to use BPF as a whole safely and surprise free the users need to understand the lifetime of BPF programs and maps. This post covers these details in depth.
Read more