Understanding Ruby with BPF Javier Honduvilla Coto October 28th-29th, 2020 Why BPF? Why BPF? - Flexibility Why BPF? - Flexibility - Low overhead Why BPF? - Flexibility - Low Low overhead - Continuous profiling Why BPF? - Flexibility - Low overhead - Continuous profiling - No modifications of the tracee rbperf rbperf - Profile Ruby programs rbperf - Profile Ruby programs syscall, etc) BPF code (bpf/rbperf.c) Read frame Driver (rbperf.py) 1. Adds info (pid to profile, thread address) 3. Receives stacktrace 4. Serialisation and persistence BPF tail-calls Bounded

Containers and BPF: twagent story Andrey Ignatov, Facebook October 28, 2020 1 ● a daemon ● runs on every Facebook server ● manages all Facebook containers ● a part of the bigger TW system, see the ● cgroup v2 ● ... other usual building blocks ... ● cgroup-bpf programs 2 Vast majority of twagent tasks have one or more cgroup-bpf features enabled: ● mostly networking: ○ IP assignment (when sysctl access control Let’s look at some of them .. Example of cgroup-bpf programs (bpftool cgroup tree ): cgroup-bpf 3 Task IP assignment (aka IP-per-task) ● Facebook DC network is IPv6

Debugging the BPF Virtual Machine Lorenzo Fontana October 28, 2020 ● Debugging is useful to understand how things work ● Sometimes, eBPF programs can’t even load ● I couldn’t find good resources on this this, so, here I am ● I break lots of eBPF programs ● The BPF Virtual machine is not easy to understand Why ? The BPF subsystem lives in the kernel AND The kernel can be debugged using gdb The build/vmlinux (gdb) target remote localhost:1234 (gdb) bpf/syscall.c:4180 (gdb) bpf/syscall.c:796 (gdb) b bpf/syscall.c:121 (gdb) b kernel/bpf/ringbuf.c:159 Debug! Remember to: - Load the eBPF program

How to ship BPF with your Go project Lorenz Bauer October 28, 2020 Goal ● Count the number of packets on lo ● Print the count to the console ● From a single Go binary Use the source, Luke github github.com/lmb/ship-bpf-with-go github.com/cilium/ebpf

Steering connections to sockets with BPF socket lookup hook Jakub Sitnicki, Cloudflare @jkbs0 @cloudflare October 28-29, 2020 Who am I? ● Software Engineer at Cloudflare Spectrum TCP/UDP reverse proxy proxy, Linux kernel, ... ● Contributor to Linux kernel networking & BPF subsystems Goal Run a TCP echo service on ports 7, 77, and 777 … using one TCP listening socket. Fun? We will need… ❏ VM Networking Receive path for local delivery Service dispatch with BPF socket lookup packet metadata BPF program lookup result 010 101 010 struct bpf_sk_lookup { __u32 family; __u32 protocol; __u32

Describes how to troubleshoot Cilium in different deployment modes. BPF and XDP Reference Guide : Provides a technical deep dive of BPF and XDP technology, primarily focused at developers. API Reference Images Documenta�on CI / Jenkins Release Management Developer’s Cer�ficate of Origin BPF and XDP Reference Guide BPF Architecture Toolchain Program Types Further Reading API Reference Introduc�on How to is a new Linux kernel technology called BPF, which enables the dynamic inser�on of powerful security visibility and control logic within Linux itself. Because BPF runs inside the Linux kernel, Cilium security

Describes how to troubleshoot Cilium in different deployment modes. BPF and XDP Reference Guide : Provides a technical deep dive of BPF and XDP technology, primarily focused at developers. API Reference Builds With Jenkins Using Jenkins for testing CI Failure Triage Infrastructure details BPF and XDP Reference Guide BPF Architecture Toolchain Program Types Further Reading API Reference Introduction How is a new Linux kernel technology called BPF, which enables the dynamic insertion of powerful security visibility and control logic within Linux itself. Because BPF runs inside the Linux kernel, Cilium security

Describes how to troubleshoot Cilium in different deployment modes. BPF and XDP Reference Guide : Provides a technical deep dive of BPF and XDP technology, primarily focused at developers. API Reference Automatically run unit tests on code changes BPF and XDP Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain iproute2 bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP tc (traffic control) Further Reading Kernel Developer FAQ Projects using BPF XDP Newbies

Describes how to troubleshoot Cilium in different deployment modes. BPF and XDP Reference Guide : Provides a technical deep dive of BPF and XDP technology, primarily focused at developers. API Reference Automatically run unit tests on code changes BPF and XDP Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain iproute2 bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP tc (traffic control) Further Reading Kernel Developer FAQ Projects using BPF XDP Newbies

from Cilium. Troubleshooting : Describes how to troubleshoot Cilium in different deployment modes. BPF and XDP Reference Guide : Provides a technical deep dive of eBPF and XDP technology, primarily focused Automatically run unit tests on code changes BPF and XDP Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain iproute2 bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP tc (traffic control) Further Reading Kernel Developer FAQ Projects using BPF XDP Newbies