3 ms·

I was thinking as EBPF as a way to enter in the Linux kernel development with a modern language, but I'm kinda confused by I read in the comments, it's not quit

• rhinoceraptor 6y ago
  eBPF is just an in-kernel VM. You can do a lot of things with it, which makes it hard to figure out what to do with it. Original BPF is in most Unix kernels, it was just a way of writing simple packet filtering programs that run in-kernel. For example, tcpdump is effectively just a frontend that emits BPF bytecode. eBPF expands the capabilities of the VM, but it still has tight restrictions on what can run: no unbounded loops, arbitrary memory access, etc. I would recommend trying out bpftrace as a first step: https://github.com/iovisor/bpftrace https://github.com/iovisor/bpftrace