eunomia-bpf/bpf-developer-tutorial

Features

• eBPF Program Development - Provides a comprehensive tutorial on writing and loading eBPF programs using C, Go, and Rust.
• Learning Resources - Provides a comprehensive development tutorial for writing and loading eBPF programs using C, Go, and Rust.
• Kernel Tracing Manuals - Includes a detailed manual for implementing kprobes, uprobes, and tracepoints to capture real-time system events.
• Security Implementation Guides - Provides a handbook for developing security policies and intrusion detection via system call interception.
• Kernel Event Hooks - Provides interfaces for binding programs to kprobes and tracepoints to execute logic during specific system events.
• Load Balancing - Distributes incoming network traffic across backend servers by processing packets at the driver level.
• Network Traffic Engineering - Offers tutorials on implementing high-performance packet filtering, load balancing, and traffic redirection in the kernel.
• Safe Packet Header Parsers - Implements bounds-checked parsing of Ethernet and IP headers from raw packet data using safe pointer arithmetic.
• XDP Packet Processing - Implements high-performance packet processing and load balancing at the network interface driver level using XDP.
• eBPF Socket Filters - Implements eBPF programs attached to network sockets to restrict or prioritize traffic based on custom logic.
• Socket Redirections - Enables forwarding of network packets directly between sockets using rule maps to bypass the standard kernel network stack.
• Traffic Distribution - Routes incoming packets to multiple backend servers by hashing source IP and port addresses.
• Architecture-Agnostic Bytecode Execution - Translates a standardized instruction set into machine code for architecture-agnostic performance within the kernel.
• CPU Execution Analysis - Samples processor execution and stack traces to identify CPU bottlenecks and function-level hotspots.
• CPU Schedulers - Implements custom CPU scheduling algorithms and task dispatching logic directly within the kernel.
• Completely Fair Schedulers - Tracks task execution time relative to weights to ensure fair resource distribution in the kernel.
• Function Duration Measurement - Calculates function execution time distributions using nanosecond timestamps at function entry and exit.
• GPU Driver Debugging - Traces proprietary drivers and GPU pipelines to analyze memory allocation, scheduling, and interrupts.
• Bytecode Safety Verification - Validates bytecode properties and memory access before execution to ensure kernel stability and prevent crashes.
• Learning Resources - Offers a dedicated course on implementing packet filtering, load balancing, and traffic redirection using eBPF.
• Kernel Function Instrumentation - Demonstrates attaching custom logic to static kernel instrumentation points to monitor system events.
• eBPF Context Memory Copiers - Implements safe memory copying from kernel structures into eBPF context to prevent system crashes.
• Kernel State Maps - Utilizes shared hash maps and arrays to store and retrieve persistent state across program executions.
• Unprivileged Kernel Instrumentation - Executes kernel monitoring logic using probes and tracepoints from an unprivileged userspace context.
• Userspace Bytecode Interpretation - Runs eBPF programs within a userspace process using interpreters or JIT compilers for testing.
• Userspace Application Tracing - Captures function calls and application state in user-space using a combination of uprobes and USDT.
• Userspace Memory Verification - Validates that kernel programs correctly access userspace data structures using type information.
• eBPF Bytecode Compilers - Transforms source code into eBPF bytecode files and packs them for kernel loading.
• Bytecode Loading Toolchains - Provides specialized toolchains to compile custom logic into bytecode and load it into the kernel.
• BPF Program Chaining - Controls packet flow through a sequence of eBPF programs using tail-call chaining and specific return codes.
• Network Traffic Filtering - Provides capabilities for inspecting and modifying packet data at traffic control points to implement firewall-style filtering.
• Runtime Security Enforcement - Teaches real-time blocking and alerting of security-significant system events and malicious network traffic.
• Kernel Task - Buffers tasks in kernel-space queues to coordinate CPU workload assignment.
• eBPF-Based Tracing - Uses eBPF-based tracing to capture predefined static tracepoints (USDT) in user-space programs.
• System Call Tracing - Intercepts kernel system calls to track arguments and return values via a trace pipe.
• Kernel Event Observability - Provides comprehensive guides on monitoring system events by attaching eBPF programs to kernel hooks.
• Learning Resources - Ships a comprehensive guide for monitoring system calls and hardware events to analyze kernel behavior.
• Dynamic User-Space Probes - Attaches dynamic probes to compiled binaries to monitor function calls without modifying source code.
• Function IO Tracing - Demonstrates logging function input arguments and recording task durations by attaching probes to kernel functions.
• Scheduler Performance Metrics - Collects periodic statistics on CPU core states to evaluate the effectiveness of the kernel scheduler.
• Zero-Copy Memory Mappings - Creates sparse memory regions shared between kernel and userspace to eliminate expensive system calls.
• Kernel-Level Complex Data Structures - Enables the construction of advanced data structures like linked lists and graphs using raw pointers in kernel memory.
• Interrupt-Driven Caching - Serves requests from a cache during hardware interrupts to increase network packet throughput.
• Kernel-Userspace Shared Memory - Creates sparse memory regions shared between kernel and userspace to avoid expensive system calls.
• eBPF-Based CPU Profilers - Samples kernel and user-space stack traces at regular intervals to identify execution hotspots.
• In-Kernel Event Aggregations - Implements the aggregation of occurrences into kernel maps and histograms for efficient performance analysis.
• Flamegraph Generators - Formats combined processor and graphics trace data into folded stack files for flamegraph visualization.
• Off-CPU Latency Analyzers - Measures thread wait times between scheduler events to identify blocking bottlenecks.
• Kernel Event Correlation - Links data across separate kernel entry and exit events by maintaining state in hash maps.
• CPU Scheduling Event Recorders - Captures fine-grained kernel scheduling events such as context switches and runnable transitions for analysis.
• In-Kernel Event Filtering - Implements in-kernel event filtering using global variables passed from user-space to reduce data noise.
• Packet Capture Implementations - Implements kernel-level interception and recording of raw TCP packet header information.
• Hardware-Accelerated Packet Forwarding - Translates bytecode into parallelized instructions for execution on hardware-based FPGA network cards.
• Malformed Packet Injection - Transmits arbitrary ethernet frames and malformed packets to verify system handling and stability.
• Round-Trip Time Measurement - Measures network round-trip time and aggregates latency data into histograms for connection analysis.
• Per-Connection Latency Measurements - Calculates round-trip time for individual TCP connections by tracing network stack events.
• Socket Lifecycle Monitoring - Monitors and restricts how applications handle connections by hooking socket-level events.
• TCP Connection Status Monitoring - Observes and tracks TCP state transitions using version-aware kernel programs.
• eBPF Traffic Analyzers - Analyzes connection states and HTTP traffic by attaching eBPF and XDP programs to network interfaces.
• Userspace Packet Processing - Integrates network traffic filtering logic within userspace data planes using kernel-assisted eBPF programs.
• BPF Filesystem Mount Delegations - Controls available BPF commands and map types via a bitmask-based delegation policy.
• Device Access Controls - Restricts hardware access by monitoring and intercepting device open, read, and write requests.
• Hardware Trace Correlation - Synchronizes processor stack traces and graphics activity records using shared timestamps for a unified view.
• I/O Trace Analysis - Includes tutorials on monitoring block-level storage operations to track the size and frequency of I/O requests.
• In-Kernel Storage Logic - Executes storage logic and index lookups directly within kernel drivers to reduce system stack overhead.
• eBPF Lifecycle Management - Manages the lifecycle of eBPF programs across a cluster using a privileged daemon for loading and unloading.
• Object Persistence - Allows pinning eBPF programs and maps to the filesystem to maintain persistence independently of the loader.
• eBPF Program Loading Delegations - Uses scoped delegation tokens to load eBPF programs without requiring full administrative privileges.
• Execution Ordering - Defines the sequence and execution order of multiple eBPF programs along a network data path.
• Userspace Program Orchestration - Controls kernel program execution and configures global variables from userspace to manage event notifications.
• Arena-Based Memory Management - Implements arena-based memory management using reference counting to optimize kernel performance.
• Variable-Length Memory Validation - Provides techniques for processing memory regions of dynamic sizes using handles to ensure safe bounds access.
• Heap Allocation Call Stack Recorders - Demonstrates recording full call stacks during allocation events to pinpoint memory leaks in the kernel.
• Argument Modification - Overwrites user space memory during system calls to redirect file access and change kernel request behavior.
• Kernel Object Manipulations - Alters system call arguments or hides process information by manipulating data flowing through the kernel.
• Asynchronous Kernel Data Streaming - Transfers captured kernel data to applications asynchronously using high-performance memory buffers.
• Interrupt Execution Analysis - Measures the timing, distribution, and performance of hardware and software interrupt handlers within the kernel.
• Kernel Extensions - Adds custom kernel behavior through specialized functions and schedulers without modifying core source code.
• Custom Kfunc Extensions - Provides guidance on defining new kernel functions within modules to implement specialized operations and optimizations.
• Kernel Object Iteration - Traverses internal kernel data structures via iterators to filter and format data for userspace export.
• Dynamic Subsystem Updating - Implements the replacement of kernel function pointers with eBPF programs to update logic without requiring system reboots.
• Kernel Structure Tracing - Allows dereferencing and inspecting internal kernel data structures using raw pointers and type information.
• User-Space Argument Extraction - Extracts arguments and return values from user-space functions using kernel-level probes.
• Library Function Hooking - Intercepts function calls within shared libraries via uprobes to aggregate data without restarting processes.
• Perf Event Array Streaming - Streams kernel events to userspace applications via perf event arrays and ring buffers.
• Process Execution Capture - Records process and user identifiers by intercepting system calls responsible for process execution.
• Shared Memory Management - Implements zero-copy shared memory regions and complex data structures using dynamic pointers.
• Traffic Control Interfaces - Provides utilities for manipulating kernel-level networking rules and traffic control settings using link-based semantics.
• User-Kernel Control Flow Correlation - Links high-level user API calls to corresponding low-level kernel ioctl implementations to reveal full control flow.
• Userspace to Kernel Data Transfer - Passes messages from user space to kernel mode using a single-producer consumer model.
• Stateful Filtering - Enforces security policies by maintaining filter state across multiple system call interpositions.
• Handshake Latency Analysis - Analyzes encryption establishment time by tracking the start and end of secure connection handshakes.
• Security Policy Enforcers - Implements access control and threat detection using security hooks and delegated privileges within the kernel.
• IP Blocking Middleware - Intercepts connection requests to block network traffic to specific forbidden IP addresses.
• ML-Based Detection - Runs machine learning models directly in the kernel to classify and detect malicious network flows.
• Goroutine Execution Tracing - Intercepts goroutine state transitions in Go programs using user-level probes to reveal concurrency issues.
• Task Execution Monitoring - Tracks the execution of the exec family of functions to monitor process spawning and execution flow.
• Device-Specific Event Filtering - Implements the ability to restrict I/O statistics tracking to specific hardware device identifiers.
• Driver Operation Tracing - Implements probes for kernel module functions to monitor execution flow and identify performance hot paths in drivers.
• Kernel Function Call Monitoring - Intercepts kernel function entry and exit points to capture arguments for auditing and tracing purposes.
• Latency Distribution Histograms - Provides histogram-based visualization of process scheduling delays to analyze latency distributions.
• Graphics API Tracing - Records sequences of graphics commands by intercepting runtime calls via shared library injection.
• Kernel Ring Buffer Streams - Transfers captured kernel data to user-space asynchronously using high-performance memory ring buffers.
• Probe Discovery Utilities - Provides utilities for discovering available kernel and user-space instrumentation points using wildcard searches.
• Process Lifecycle Tracing - Monitors the spawning and termination of processes to calculate resource statistics and durations.
• Network Traffic Analysis - Processes packets and monitors connection states to implement kernel-level load balancing and traffic control.
• Kernel Traffic Sketching - Implements compact, probabilistic data structures in the kernel to summarize high-volume network traffic efficiently.
• Disk I/O Performance Analysis - Provides analysis of disk I/O patterns by calculating the ratio of random to sequential requests via sector tracking.
• Process Resource Statistics - Gathers real-time metrics on CPU, memory, and resource consumption during the process termination phase.
• Driver Interaction Monitoring - Monitors operations between the kernel and hardware drivers to debug device activity and energy consumption.
• Scheduler Latency Analyzers - Quantifies the time between a process becoming runnable and its actual execution on a CPU.
• Scheduler Performance Monitoring - Aggregates task queue statistics in userspace to monitor real-time kernel scheduling behavior.
• SSL TLS Data Capture - Implements interception of plaintext data from SSL/TLS libraries using probes for observability.
• Process Duration Monitoring - Calculates the total elapsed time from the start to the termination of operating system processes.
• Execution Stack Samplers - Samples kernel and user-level stack traces at regular intervals to identify processor bottlenecks.
• Kernel Stack Trace Capture - Records full user-space call chains with nanosecond precision using kernel probes.
• Flame Graph Generators - Transforms kernel stack trace data into interactive flame graphs to visualize execution hotspots.
• Wall-Clock Flame Graphs - Generates normalized visualizations that merge processor samples and blocking time into wall-clock flame graphs.
• Memory Leak Detection - Tracks allocation and deallocation events in the kernel to identify memory blocks that are not freed.
• Isolated Program Testing - Validates BPF program logic using synthetic inputs without sending actual network traffic.
• Synthetic Traffic Generators - Injects synthetic packets directly into the kernel fast path to benchmark network stack stability.

Star history