Speakers
Description
BPF-based agents aim to be as transparent as possible while minimizing CPU and memory overhead. Real-world experience from projects such as Cilium’s Tetragon has shown that moving more functionality directly into the kernel is an effective strategy. However, one remaining limitation for observability and logging is the lack of an API for sending data over the network directly from BPF programs, keeping user space in the critical path.
Efforts to provide BPF programs with networking capabilities through new kfuncs have been discussed at the past two LSF/MM/BPF summits in Montreal and Zagreb. An initial approach based on the netpoll infrastructure was proposed but ultimately rejected.
This talk will recap the motivation behind the current patch sets, summarize the discussions so far, and introduce the current design. We will then demonstrate several ways BPF programs can use the new API, ranging from basic examples to practical and more unexpected use cases. Finally, we will discuss possible future extensions to the API, such as support for additional BPF program types and TCP sockets.