How and When You Should Measure CPU Overhead of eBPF Programs Bryce Kahle, Datadog October 28, 2020 Why should I profile eBPF programs? CI variance tracking Tools kernel.bpf_stats_enabled kernel bpf_stats_enabled sysctl – Added in kernel v5.1 (off by default) – Turns on stats collection for all eBPF programs – exposes total run_time_ns and run_cnt – Use cases: – Benchmarking + CI/CD – Sampling profiler it work? – Adds ~20ns of overhead per run Two ways to enable kernel eBPF stats sysctl procfs Three ways to access kernel eBPF stats bpftool prog show bpf syscall BPF_OBJ_GET_INFO_BY_FD procfs BPF_ENABLE_STATS

eBPF at LINE’s Private Cloud Yutaro Hayakawa October 28, 2020 • Messaging & many family services • 185 million global MAU • 3Tbps+ network traffic in total LINE Verda: LINE’s Private Cloud Service

eBPF Summit October 28, 2020 Debugging Go in production using eBPF ABOUT ME ? i’m Zain @zainasgar Co-Founder/CEO Pixie (@pixie_run) & Adjunct Professor of CS @ Stanford DEVELOPER PROBLEM You’re Delve Option 3: Linux tracing utility ○ strace/ftrace ○ LTTng/USDT Option 4: eBPF ? What are we going to build? eBPF [0] % objdump --syms app|grep computeE 00000000006609a0 g F .text 000000000000004b 6609b2: f2 0f 10 0d 36 a6 0f movsd 0xfa636(%rip),%xmm1 Diving into the details eBPF Using uprobes eBPF ... ... main.computeE 0x6609a0 { App Binary main.main { 0x6609f0 ... ... main

? ? In This Talk… • Different “types” of BPF programs • Write BPF programs in Rust • Add new feature in RedBPF • Use BPF maps to make stateful decisions • Load the program and protect the Rabbit(MQ) the limit is hit RedBPF • Most frameworks require C for BPF programs • RedBPF uses Rust for both in-kernel and user- space programs - benefits from LLVM integration • Rust: expressive type system but most importantly, I love Rust! • For networking, RedBPF supports XDP and SocketFilter programs, however… Traffic Control for Real • XDP doesn’t seem would work (full TCP packet hasn’t been

Can eBPF save us from the Data Deluge? A case for file filtering in eBPF Giulia Frascaria October 28, 2020 1 The data deluge on modern storage 2 Compute node CPU Network Storage node Flash research group ● Work with eBPF 4 whoami ● Giulia Frascaria ● PhD student in Vrije Universiteit Amsterdam ● atLarge research group ● Work with eBPF for storage! 5 eBPF and DoS 6 Compute node CPU CPU Network Storage node Flash eBPF and DoS 7 Compute node CPU Network Storage node Flash DoS eBPF and DoS 8 Compute node CPU Network Storage node Flash DoS DoS in reverse! 9 Compute

Precise Process Confinement with eBPF and KRSI William Findlay October 28, 2020 bpfbox at a Glance ▶ bpfbox is a novel process confinement mechanism for Linux using eBPF ▶ Users write per-application per-application policy in a simple policy language ▶ Policy is enforced by attaching BPF programs to LSM hooks ▶ Integrates userspace and kernelspace state into policy decisions 1 / 7 Motivation ▶ Existing process mechanisms are difficult to use SELinux AppArmor TOMOYO ▶ Can we do any better? 2 / 7 eBPF Changes the Game eBPF enables: ▶ Fine-grained system introspection ▶ Integration of cross-layer state (kprobes

Zero instrumentation monitoring with your first steps in eBPF Beatriz Martínez, Isovalent - @beatrizmrg October 28, 2020 2 What will we be doing? 3 How are we going to do it? 4 Demo time 5 Tracing Tracing Go function with uprobes 6 Demo time 7 Conclusions ● eBPF programs can be attached to different events: ○ Kprobes ○ uprobes ○ Tracepoints ○ network packets… ● Frameworks, Go bindings $curl 34.70.147.68:8083 Let’s represent the attendees in the map! https://github.com/b3a-dev/ebpf-geoip-demo

Enabling eBPF Super Powers on ARM64 with Cilium Jianlin Lv Trevor Tao October 28, 2020 Preface Arm ecosystem of CNI Support Arm64 • Cilium enable on aarch64 • https://github.com/cilium/cilium/issues/9898

Identity Aware Threat Detection and Network Monitoring by using eBPF Natalia Reka Ivanko, Isovalent October 28, 2020 ● ● ○ ● ○ ○ ○ ○ ● ● ● ● ● ● ● ● ○ ● ○ ○ ○ ● ● ● ○ ● ○ ○ ● ●

North-South Load Balancing of Kubernetes Services with eBPF/XDP Martynas Pumputis (Isovalent) October 28, 2020 10.0.0.1 10.0.0.2 10.0.0.3 httpd httpd “httpd” service 10.0.0.1:30000 10.0.0.2:30000