bpf-developer-tutorial

eBPF Developer Tutorial: A Step-by-Step Guide with Practical Examples

The eBPF Developer Tutorial serves as a comprehensive guide designed to help developers learn eBPF, a powerful Linux kernel technology, in an accessible and practical manner. The tutorial follows a "Compile Once, Run Everywhere" approach using CO-RE, providing practical eBPF development practices from foundational concepts to more advanced topics.

Overview

This tutorial is crafted to cater to developers ranging from beginners to those with advanced understanding, offering concise and practical eBPF development examples. Unlike older approaches like BCC, this guide uses modern frameworks including libbpf, Cilium, libbpf-rs, and eunomia-bpf. These frameworks present examples in various programming languages such as C, Go, and Rust.

The primary focus of this tutorial isn't to delve into complex eBPF scenarios, but to equip developers with tool examples—some as concise as twenty lines of code—that allow them to rapidly grasp eBPF development techniques. The tutorial includes numerous examples spanning areas like observability, security, and networking, each housed in independent directories for easy access.

Getting Started: Basic Examples

The tutorial begins with simple eBPF programs using the eunomia-bpf framework to ease the development process. Some introductory lessons include:

• Core Concepts and Tools: Offering a basic understanding of essential eBPF concepts and tools.
• HelloWorld Example: Introduces the fundamental development processes and frameworks.
• System Call Monitoring: Various examples demonstrate monitoring system calls like unlink using kprobe and fentry.
• File and Signal Capture: Samples like opensnoop and sigsnoop show capturing file operations and signal sendings.
• Process Observability: Programs like execsnoop and exitsnoop monitor process activities and further examples explore latency and interrupts.

Advanced Projects and Examples

For developers ready to dive deeper, the tutorial expands into building complete eBPF projects by leveraging libbpf. These projects link eBPF technology with practical application scenarios, covering subjects such as:

• User-Space Program Development: With libbpf, including trace execution and profiling for performance.
• Network Analysis and Security: Using eBPF for TCP connection statistics, Java garbage collection monitoring, and memory leak detection.
• Additional Resources: Links to extended references, papers, and projects to further explore eBPF's capabilities.

In-Depth Topics

For those with a strong grasp on the basics and looking to understand more intricate aspects of eBPF, the tutorial provides content on:

• Android Usage: Applying eBPF programs on Android.
• Advanced Networking: Techniques like L7 tracing with eBPF, network request acceleration, and load balancing using XDP.
• Security and Scheduler: Utilizing eBPF for security operations like hiding processes and modifying system call arguments, alongside scheduler implementations.

Learning Support and Tools

For simplified project initiation and setup, the tutorial offers several GitHub templates across different frameworks (libbpf, Cilium, libbpf-rs, eunomia-bpf) and languages, designed to provide an essential structure and automate build, test, and release processes. Additionally, interactive tools like GPTtrace use ChatGPT to help developers learn eBPF by tracing Linux systems through natural language commands.

Getting Started

Start developing with eBPF using clear instructions provided in dedicated sections, catering to both libbpf and eunomia-bpf frameworks. Each learning segment includes engaging examples and step-by-step guides, ensuring that learners can both understand and experiment with actual eBPF code.

Conclusion

Whether for beginner learning or advanced project development, the eBPF Developer Tutorial stands as a rich resource for those enthusiastic about mastering eBPF, bolstered by practical examples, modern frameworks, and robust development support.