Ruby with BPF eBPF Summit ## Why BPF? ## Why BPF? ## - Flexibility ## Why BPF? - Flexibility - Low overhead ## Why BPF? - Flexibility - Low overhead - Continuous profiling ## Why BPF? - Flexibility stack walking for a dynamic language - Supporting multiple Ruby versions - Correctness testing - BPF safety features ## Future plans - Integrate in Facebook’s profiling infra - Rewrite OSS driver program

## Containers and BPF: twagent story Andrey Ignatov, Facebook eBPF Summit ## twagent • a daemon - runs on every Facebook server • manages all Facebook containers - a part of the bigger TW system cgroup v2 • ... other usual building blocks ... • cgroup-bpf programs ## cgroup-bpf Vast majority of twagent tasks have one or more cgroup-bpf features enabled: • mostly networking: ☐ IP assignment but not only: - sysctl access control Let's look at some of them ... ## Example of cgroup-bpf programs (bpftool cgroup tree): ![Image](/uploads/documents/1/4/a/7/14a78f1665ead57299ddbea78431f846/p3_1

## Debugging the BPF Virtual Machine eBPF Summit ## Why? ● Debugging is useful to understand how things work ● Sometimes, eBPF programs can’t even load - I couldn’t find good resources on this, so so, here I am ● I break lots of eBPF programs - The BPF Virtual machine is not easy to understand ## The approach ## The BPF subsystem lives in the kernel  target remote localhost:1234 (gdb) bpf/syscall.c:4180 (gdb) bpf/syscall.c:796 (gdb) b bpf/syscall.c:121 (gdb) b kernel/bpf/ringbuf.c:159 ## Remember to: - Load the eBPF program

to ship BPF with your Go project Lorenz Bauer eBPF Summit ## Goal • Count the number of packets on lo • Print the count to the console • From a single Go binary #### github.com/lmb/ship-bpf-with-go

## Steering connections to sockets with BPF socket lookup hook Jakub Sitnicki, Cloudflare @jkbs0 @cloudflare eBPF Summit ## Who am I? - Software Engineer at Cloudflare Spectrum TCP/UDP reverse proxy proxy, Linux kernel, ... - Contributor to Linux kernel networking & BPF subsystems Goal Fun? ## We will need VM running Linux kernel 5.9+ bpftool 5.9+ libbpf headers ☐ kernel headers ## vm $ uname dispatch with BPF socket lookup packet metadata struct bpf_sk_lookup { __u32 family; __u32 protocol; __u32 remote_ip4; __u32 remote_port; __u32 local_ip4; __u32 local_port; /* ... */ }; BPF program

RedBPF eBPF Summit ## I n This Talk • Different “types” of BPF programs • Write BPF programs in Rust • Add new feature in RedBPF • Use BPF maps to make stateful decisions • Load the program and protect Engineer @ CCP Games • @aquarhead on GitHub, Twitter... • Rust (and Elixir) • Disclaimer: new to BPF & kernel networking, pardon my mistake and welcome corrections! ## Sad Rabbit Has No Memory • - But adding such a feature in RabbitMQ could be a long process... ## Build a Limiter in BPF • Let's use BPF to get a quick win! • Track how many “AMQP consumers” have been declared for each connection

Describes how to troubleshoot Cilium in different deployment modes. - BPF and XDP Reference Guide : Provides a technical deep dive of BPF and XDP technology, primarily focused at developers. • API Reference Jenkins for testing • CI Failure Triage • Infrastructure details • BPF and XDP Reference Guide • BPF Architecture • Toolchain • Program Types • Further Reading • is a new Linux kernel technology called BPF, which enables the dynamic insertion of powerful security visibility and control logic within Linux itself. Because BPF runs inside the Linux kernel, Cilium security

Describes how to troubleshoot Cilium in different deployment modes. BPF and XDP Reference Guide : Provides a technical deep dive of BPF and XDP technology, primarily focused at developers. API Reference Automatically run unit tests on code changes BPF and XDP Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain Development bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP tc (traffic control) Further Reading Kernel Developer FAQ Projects using BPF XDP Newbies BPF Newsletter

Describes how to troubleshoot Cilium in different deployment modes. BPF and XDP Reference Guide : Provides a technical deep dive of BPF and XDP technology, primarily focused at developers. API Reference is a new Linux kernel technology called BPF, which enables the dynamic insertion of powerful security visibility and control logic within Linux itself. Because BPF runs inside the Linux kernel, Cilium security drastically reduced lifetime of just a few seconds in microservices architectures. By leveraging Linux BPF, Cilium retains the ability to transparently insert security visibility + enforcement, but does so

Describes how to troubleshoot Cilium in different deployment modes. BPF and XDP Reference Guide : Provides a technical deep dive of BPF and XDP technology, primarily focused at developers. API Reference Automatically run unit tests on code changes BPF and XDP Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain Development bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP tc (traffic control) Further Reading Kernel Developer FAQ Projects using BPF XDP Newbies BPF Newsletter