FOSSMeet'25

Prerequisites:

• A Linux based operating system(Any GNU+Linux distro would do). We can run eBPF on Windows/Macos but this is usually over a virtuallized Linux middleware.
• Basic understanding of system calls, kernel and user space contexts
• C Programming

The workshop structure closely resembles the first few chapters of https://eunomia.dev/en/tutorials/.

Code samples, snippets and other resources will be provided, it will be a hands on session.

Estimated time: ~180 minutes

What is eBPF?

(Duration: 25-30 minutes)

BPF is a technology that can run programs in a privileged context such as the operating system kernel. It is the successor to the Berkeley Packet Filter (BPF, with the “e” originally meaning “extended”) filtering mechanism in Linux and is also used in non-networking parts of the Linux kernel as well.

It is used to safely and efficiently extend the capabilities of the kernel at runtime without requiring changes to kernel source code or loading kernel modules. Safety is provided through an in-kernel verifier which performs static code analysis and rejects programs which crash, hang or otherwise interfere with the kernel negatively.

Broadly, the agenda would be:

• Understand what eBPF is? Why do we need it? Can’t we use kernel modules?
• What functions does it have? What can it do in the Linux kernel? What are the types of eBPF programs and helpers (not all of them need to be known, but need to know where to find them)?
• What can it be used for? For example, in which scenarios can it be used? Networking, security, observability?

(Content sourced from wikipedia)

Basic setup and Tools

(Duration: 10-15 minutes)

We would install and setup for enumoia-bpf, including any other dependencies.

Writing eBPF Porgrams, theory, concepts and code

1. Basic Code structure (10-15mins)

• Basic structure to writing ebpf programs

2. Printing a message in the kernel (10mins)

• Using printk to log events in the kernel logs

3. Different ways to probe kernel routines (20-25mins)

• kprobe
• fentry
• tracepoints

4. Storing state (20-25mins)

• Global Variables
• BPF Maps

5. User space programs and eBPF (20-25mins)

• Writing a simple metric collector

eBPF Applications and tools in the industry (15-20mins)

• Custom metric collectors
• Pefromance monitors / observability
• Load balancers

QnA / Discussion

• Lets try to leave no doubts