eBPF for Developers

From Kernel Internals to Production Systems — A Complete Guide with Working Code

Introduction: The Kernel Is Now Programmable

1. The Promise of This Book
2. Who This Book Is For
3. How This Book Is Structured
4. A Note on Code Examples
5. Getting Started

Chapter 1: What Is eBPF and Why It Matters

1. From Packet Filtering to Kernel Programming: A Brief History
2. The eBPF Virtual Machine: Architecture at a Glance
3. Why eBPF Changed Everything: Safety, Performance, and Flexibility
4. The Modern eBPF Ecosystem: Tools, Languages, and Use Cases
5. What You Will Build in This Book
6. Chapter Summary

Chapter 2: Your First eBPF Program – Hello World

1. Setting Up Your Development Environment
2. The Anatomy of a Minimal eBPF Program
3. Building and Loading: Clang, libbpf, and bpftool
4. Reading the Output and Understanding the Lifecycle
5. Common First-Time Pitfalls and How to Fix Them
6. Chapter Summary
7. Exercises

Chapter 3: The eBPF Instruction Set and Virtual Machine

1. The eBPF Register File and Stack
2. Instruction Categories: Arithmetic, Memory, Calls, Jumps, and Exits
3. JIT Compilation: From eBPF Bytes to Native Code
4. Reading Compiler Output: Understanding Generated eBPF Instructions
5. Performance Characteristics of the eBPF VM
6. Chapter Summary
7. Exercises
8. Chapter Summary

Chapter 4: The Verifier – Safety Without Sandboxing

1. What the Verifier Checks: Bounds, Types, and Control Flow
2. State Machine Analysis and Path Exploration
3. Reading Verification Logs and Decoding Errors
4. Common Verification Failures and How to Fix Them
5. Advanced Verifier Internals: Value Tracking and Scalar Ranges
6. Unprivileged BPF: Security Model and Limitations
7. Performance Implications of Verification
8. Chapter Summary
9. Exercises
10. Chapter Summary

Chapter 5: BPF Maps – The Data Layer

1. Map Types Overview: Hash, Array, Per-CPU, LRU, Ringbuf, and More
2. Creating and Using Maps from eBPF and User Space
3. Advanced Map Patterns: Aggregation, Counters, and Histograms
4. Map Performance: Sizing, Collisions, and Memory Overhead
5. Complete Working Example: A Traffic Counter with Hash Maps
6. Chapter Summary
7. Exercises
8. Chapter Summary

Chapter 6: BPF Helper Functions – Talking to the Kernel

1. How Helpers Work: The Calling Convention and ABI
2. Time, Random, and Logging Helpers
3. Networking Helpers: Socket Operations, Packet Manipulation, and Routing
4. Tracing Helpers: Reading Kernel Memory, Registers, and Stack Traces
5. Map Operation Helpers and User-Space Communication
6. Complete Working Example: A Helper Function Playground
7. Complete Working Example: Process Execution Monitor with Helpers
8. Chapter Summary
9. Exercises
10. Chapter Summary

Chapter 7: BPF Type Format (BTF) and CO-RE

1. The Portability Problem: Kernel Version Fragmentation
2. BTF Internals: Encoding Type Information in ELF Objects
3. CO-RE Relocations: How libbpf Patches Programs at Load Time
4. Writing CO-RE-Compatible Programs with libbpf Skeletons
5. Debugging BTF and CO-RE Issues
6. Split BTF: Out-of-Tree Modules and Distilled Base BTF
7. struct_ops: Extending Kernel Subsystems with eBPF
8. Chapter Summary
9. Exercises
10. Chapter Summary

Chapter 8: Tracing with eBPF – kprobes, uprobes, and Tracepoints

1. Kernel Probes (kprobes): Attaching to Any Kernel Function
2. User-Space Probes (uprobes): Observing Applications Without Modification
3. Tracepoints: Stable, Documented Kernel Instrumentation
4. Raw Tracepoints and Fentry/Fexit for High-Performance Tracing
5. Complete Working Project: A System Call Latency Analyzer
6. Chapter Summary
7. Exercises
8. Chapter Summary

Chapter 9: Networking with eBPF – XDP and TC Hooks

1. The Linux Networking Stack and Where eBPF Fits
2. XDP: Zero-Copy Packet Processing at Line Rate
3. TC Hooks: Traffic Control and Classification
4. Socket Filters: Application-Level Network Observability
5. Complete Working Project: A DDoS Mitigator with XDP
6. Chapter Summary
7. Exercises
8. Chapter Summary

Chapter 10: Advanced Tracing – Perf Events, Ring Buffers, and cgroups

1. Perf Event Arrays vs. Ring Buffers: When to Use Each
2. High-Throughput Tracing with Ring Buffers
3. cgroup-Based Attachment: Programs That Follow Workloads
4. BPF Program Types Beyond Tracing and Networking
5. Complete Working Project: A Container Resource Monitor
6. Chapter Summary
7. Exercises
8. Chapter Summary

Chapter 11: Security with eBPF – LSM, Audit, and Policy Enforcement

1. BPF LSM: Making Security Policies Programmable
2. File System Access Monitoring and Control
3. Network Security: Connection Tracking and Policy Enforcement
4. Audit Logging with eBPF
5. Complete Working Project: A Runtime Intrusion Detection System
6. Chapter Summary
7. Exercises
8. Chapter Summary

Chapter 12: Performance Analysis, Debugging, and Profiling

1. CPU Profiling with Hardware Counters and eBPF
2. I/O Latency Analysis and Bottleneck Identification
3. Lock Contention and Synchronization Debugging
4. Memory Allocation Tracking and Leak Detection
5. Complete Working Project: A Full-Stack Performance Dashboard
6. Chapter Summary
7. Exercises
8. Chapter Summary

Chapter 13: bpftrace, bpftool, and the Developer Toolchain

1. bpftool: Inspecting, Loading, and Managing eBPF Programs
2. bpftrace: Rapid Prototyping with a Domain-Specific Language
3. BCC Tools: The Classic eBPF Toolkit
4. Building Custom Tools: When to Use libbpf vs. bpftrace
5. Debugging Techniques: Verifier Logs, Crash Dumps, and Live Inspection
6. Chapter Summary

Chapter 14: Production Systems – Containers, Kubernetes, and Real-World Patterns

1. Unprivileged BPF and Security Tokens in Production
2. eBPF in Container Environments: Namespaces, cgroups, and Isolation
3. Kubernetes Integration: CNI, Observability, and Service Meshes
4. Building Production Observability Pipelines
5. Reliability, Scalability, and Operational Concerns
6. Case Studies: Cilium, Pixie, Tetragon, and Others
7. Container Runtime Hardening with eBPF
8. Chapter Summary

Chapter 15: Where eBPF Is Headed – The Future

1. Upcoming Kernel Features and Recent Developments
2. Beyond Linux: eBPF on Windows, macOS, and Other Platforms
3. User-Space eBPF (userspace_bpf) and New Frontiers
4. Limitations and Open Research Questions
5. Building Your eBPF Expertise: Learning Path and Resources
6. Chapter Summary

Conclusion: The Programmable Kernel Era

Appendix A: Exercise Solutions

1. Chapter 2 Solutions
2. Chapter 3 Solutions
3. Chapter 4 Solutions
4. Chapter 5 Solutions
5. Chapter 6 Solutions
6. Chapter 7 Solutions
7. Chapter 8 Solutions
8. Chapter 9 Solutions
9. Chapter 10 Solutions
10. Chapter 11 Solutions
11. Chapter 12 Solutions

Appendix B: Glossary

Appendix C: Quick Reference Tables

1. C.1 BPF Helper Functions by Category
2. C.2 BPF Map Types
3. C.3 BPF Program Types and Attachment
4. C.4 Kernel Version Feature Matrix

Appendix D: Index

1. A
2. B
3. C
4. D
5. E
6. F
7. G
8. H
9. I
10. J
11. K
12. L
13. M
14. N
15. O
16. P
17. R
18. S
19. T
20. U
21. V
22. X

References