eBPF at LINE’s Private Cloud Yutaro Hayakawa October 28, 2020 • Messaging & many family services • 185 million global MAU • 3Tbps+ network traffic in total LINE Verda: LINE’s Private Cloud Service

eBPF Summit October 28, 2020 Debugging Go in production using eBPF ABOUT ME ? i’m Zain @zainasgar Co-Founder/CEO Pixie (@pixie_run) & Adjunct Professor of CS @ Stanford DEVELOPER PROBLEM You’re Delve Option 3: Linux tracing utility ○ strace/ftrace ○ LTTng/USDT Option 4: eBPF ? What are we going to build? eBPF [0] % objdump --syms app|grep computeE 00000000006609a0 g F .text 000000000000004b 6609b2: f2 0f 10 0d 36 a6 0f movsd 0xfa636(%rip),%xmm1 Diving into the details eBPF Using uprobes eBPF ... ... main.computeE 0x6609a0 { App Binary main.main { 0x6609f0 ... ... main

Can eBPF save us from the Data Deluge? A case for file filtering in eBPF Giulia Frascaria October 28, 2020 1 The data deluge on modern storage 2 Compute node CPU Network Storage node Flash research group ● Work with eBPF 4 whoami ● Giulia Frascaria ● PhD student in Vrije Universiteit Amsterdam ● atLarge research group ● Work with eBPF for storage! 5 eBPF and DoS 6 Compute node CPU CPU Network Storage node Flash eBPF and DoS 7 Compute node CPU Network Storage node Flash DoS eBPF and DoS 8 Compute node CPU Network Storage node Flash DoS DoS in reverse! 9 Compute

Precise Process Confinement with eBPF and KRSI William Findlay October 28, 2020 bpfbox at a Glance ▶ bpfbox is a novel process confinement mechanism for Linux using eBPF ▶ Users write per-application mechanisms are difficult to use SELinux AppArmor TOMOYO ▶ Can we do any better? 2 / 7 eBPF Changes the Game eBPF enables: ▶ Fine-grained system introspection ▶ Integration of cross-layer state (kprobes framework ▶ Kernelspace components are all eBPF ▶ LSM probes (KRSI), kprobes, uprobes, tracepoints ▶ Under 2000 source lines of kernelspace code ▶ Thanks to eBPF, bpfbox is light-weight, flexible, and production-safe

Zero instrumentation monitoring with your first steps in eBPF Beatriz Martínez, Isovalent - @beatrizmrg October 28, 2020 2 What will we be doing? 3 How are we going to do it? 4 Demo time 5 Tracing Tracing Go function with uprobes 6 Demo time 7 Conclusions ● eBPF programs can be attached to different events: ○ Kprobes ○ uprobes ○ Tracepoints ○ network packets… ● Frameworks, Go bindings $curl 34.70.147.68:8083 Let’s represent the attendees in the map! https://github.com/b3a-dev/ebpf-geoip-demo

Enabling eBPF Super Powers on ARM64 with Cilium Jianlin Lv Trevor Tao October 28, 2020 Preface Arm ecosystem of CNI Support Arm64 • Cilium enable on aarch64 • https://github.com/cilium/cilium/issues/9898

Identity Aware Threat Detection and Network Monitoring by using eBPF Natalia Reka Ivanko, Isovalent October 28, 2020 ● ● ○ ● ○ ○ ○ ○ ● ● ● ● ● ● ● ● ○ ● ○ ○ ○ ● ● ● ○ ● ○ ○ ● ●

采⽤eBPF加速云原⽣环境中 Curve⽂件系统性能 ⽹易数帆科技 向东提纲 • 什么是Curve • Curve的应⽤场景及挑战 • Curve客户端⾯临问题及分析 • 什么是ebpf • 基于epbf的Curve Cache设计 • Curve社区介绍Curve是什么？ • Curve云原⽣软件定义存储 • Curve分布式块存储 • Curve分布式⽂件存储 共享data cache的映射 • GETATTR流程 • ⽂件读取流程 • 相关⼯作 • extFUSE • google android12 passthrough什么是eBPF • ebpf是不同环境下内核配置， 调试，监控⼯具 • map映射 • 验证器 • Hook • Helper api配置TCP Initial RTO • 场景 内核4.12之前 Curve⽂件系统采⽤cache来提升性能，对象存储来降低成本 • ⽬前⾯临Curve⽂件系统客户端延迟较⼤的问题 • 解决延迟有ld_preload以及ebpf的⽅式，各有优缺点 • 使⽤ebpf可以在内核中直接读取cache数据，并返回，降低了延迟。 • 介绍了ebpf基于FUSE的cache设计THANKS

How and When You Should Measure CPU Overhead of eBPF Programs Bryce Kahle, Datadog October 28, 2020 Why should I profile eBPF programs? CI variance tracking Tools kernel.bpf_stats_enabled kernel bpf_stats_enabled sysctl – Added in kernel v5.1 (off by default) – Turns on stats collection for all eBPF programs – exposes total run_time_ns and run_cnt – Use cases: – Benchmarking + CI/CD – Sampling it work? – Adds ~20ns of overhead per run Two ways to enable kernel eBPF stats sysctl procfs Three ways to access kernel eBPF stats bpftool prog show bpf syscall BPF_OBJ_GET_INFO_BY_FD procfs BPF_ENABLE_STATS