Topic: eBPF inside-out

Debojeet Das debojeetdas@cse.iitb.ac.in       
Sameer Ahmad sameerahmad@cse.iitb.ac.in
Purushottam Kulkarni puru@cse.iitb.ac.in

https://github.com/cloudarxiv/ebpf-inside-out

List of topics:

1. Principles of eBPF

1. What is eBPF? Why is eBPF needed? Can't we use kernel modules?
2. Description of the eBPF framework — What functions does it have? What are the types of eBPF programs, helpers, and hookpoints (not all need to be known, but we need to know where to find them)?
3. Use cases of eBPF – Networking, Security, and Observability.
4. Short brief on eBPF implementation details in the Linux Kernel.
   

2. Hands-on eBPF Programming

1. eBPF Development Frameworks and Basic Development Process
2. Introduction to hook points, usage and bpf helper functions
3. Introduction and usage of bpf maps
4. Use cases of the XDP hook point
5. Short-circuiting network sockets with the socket operation hook points
   

3. Miscellaneous

1. Recent eBPF Progress in Linux Kernel
2. Active research directions featuring eBPF

Pre-requisites:

• Familiarity with operating system concepts.
• Exposure to Linux and programming in C is recommended
• Basic knowledge of the Unix shell.

Content: (slides, reading material, etc.) [To be added]

Setup Requirements:

• Participants are expected to have VMware Workstation (Windows/Linux) or VMware Fusion (macOS):

• You can use the following scripts/links to download VMware Workstation (17.6.3+) or Fusion (13.6.3+) for personal use without logging in:

• Linux Script: https://gist.github.com/jetfir3/e25e74a42e7c7ac2c808a537b12dc768
• Windows Script https://gist.github.com/jetfir3/25a4693549473792b90cfbdf20f9b567
• macOS Link https://drive.google.com/file/d/1LQSDrouCt7IobGMbRBr-mw-B5MagrR2f/view?usp=share_link

• VM images:

• x86_64/amd64: https://drive.google.com/file/d/1I16AAHQlT4exU9EfPSeLH7UxF6wMdrGN/view?usp=share_link 
• arm: https://drive.google.com/file/d/1MJSfIu0QoQ-6j64wa2fse6J0O2QHb7ed/view?usp=share_link 
  

• (optional) You may use local Linux machines only if you have a relatively new version of the Linux kernel (minimum version 4.8 and above, suggested version is 5.15+ or 6.2+) to support eBPF functionality

Expected Outcomes:

Participants will get a brief introduction to eBPF design principles and implementation details. They will get familiar with important eBPF terminologies. They will be able to understand and write eBPF programs. They will be able to browse eBPF resources to learn more on eBPF. They will get familiar with active research fields featuring eBPF.

References

• https://ebpf.io/
• https://docs.ebpf.io/
• https://github.com/eunomia-bpf/eunomia-bpf
• https://github.com/eunomia-bpf