eBPF - From a Programmer’s Perspective

EasyChair Preprint 5198, version 2

Abstract

eBPF allows software developers to write programsthat are executed in the kernel without requiring re-compilation and system restart. These programs cancollect critical performance metrics when a kernel func-tion is invoked. In this paper, we will describe and dis-cuss the architecture of eBPF using libbpf as well asthe core components of it. We will look at key differ-ences between eBPF programs and typical user-spaceC programs. Lastly, we will look into some real-worlduse-cases of eBPF. We will, however, not discuss perfor-mance numbers or formal proofs. This paper is merelya summary of countless hours of reading through eBPFtextbooks, blog posts, eBPF samples and kernel code.

Keyphrases: Performance, eBPF, tracing

@booklet{EasyChair:5198,
  author    = {Niclas Hedam},
  title     = {eBPF - From a Programmer’s Perspective},
  howpublished = {EasyChair Preprint 5198},
  year      = {EasyChair, 2023}}