Ruby with BPF eBPF Summit ## Why BPF? ## Why BPF? ## - Flexibility ## Why BPF? - Flexibility - Low overhead ## Why BPF? - Flexibility - Low overhead - Continuous profiling ## Why BPF? - Flexibility stack walking for a dynamic language - Supporting multiple Ruby versions - Correctness testing - BPF safety features ## Future plans - Integrate in Facebook’s profiling infra - Rewrite OSS driver program

## Containers and BPF: twagent story Andrey Ignatov, Facebook eBPF Summit ## twagent • a daemon - runs on every Facebook server • manages all Facebook containers - a part of the bigger TW system cgroup v2 • ... other usual building blocks ... • cgroup-bpf programs ## cgroup-bpf Vast majority of twagent tasks have one or more cgroup-bpf features enabled: • mostly networking: ☐ IP assignment but not only: - sysctl access control Let's look at some of them ... ## Example of cgroup-bpf programs (bpftool cgroup tree): ![Image](/uploads/documents/1/4/a/7/14a78f1665ead57299ddbea78431f846/p3_1

## Debugging the BPF Virtual Machine eBPF Summit ## Why? ● Debugging is useful to understand how things work ● Sometimes, eBPF programs can’t even load - I couldn’t find good resources on this, so so, here I am ● I break lots of eBPF programs - The BPF Virtual machine is not easy to understand ## The approach ## The BPF subsystem lives in the kernel  target remote localhost:1234 (gdb) bpf/syscall.c:4180 (gdb) bpf/syscall.c:796 (gdb) b bpf/syscall.c:121 (gdb) b kernel/bpf/ringbuf.c:159 ## Remember to: - Load the eBPF program

## North-South Load Balancing of Kubernetes Services with eBPF/XDP Martynas Pumputis (Isovalent) eBPF Summit  ![Image](

to ship BPF with your Go project Lorenz Bauer eBPF Summit ## Goal • Count the number of packets on lo • Print the count to the console • From a single Go binary #### github.com/lmb/ship-bpf-with-go

## Steering connections to sockets with BPF socket lookup hook Jakub Sitnicki, Cloudflare @jkbs0 @cloudflare eBPF Summit ## Who am I? - Software Engineer at Cloudflare Spectrum TCP/UDP reverse proxy proxy, Linux kernel, ... - Contributor to Linux kernel networking & BPF subsystems Goal Fun? ## We will need VM running Linux kernel 5.9+ bpftool 5.9+ libbpf headers ☐ kernel headers ## vm $ uname dispatch with BPF socket lookup packet metadata struct bpf_sk_lookup { __u32 family; __u32 protocol; __u32 remote_ip4; __u32 remote_port; __u32 local_ip4; __u32 local_port; /* ... */ }; BPF program

Describes how to troubleshoot Cilium in different deployment modes. BPF and XDP Reference Guide : Provides a technical deep dive of BPF and XDP technology, primarily focused at developers. API Reference : Details Automatically run unit tests on code changes BPF and XDP Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain Development bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP tc (traffic control) Further Reading Kernel Developer FAQ Projects using BPF XDP Newbies BPF Newsletter

Describes how to troubleshoot Cilium in different deployment modes. BPF and XDP Reference Guide : Provides a technical deep dive of BPF and XDP technology, primarily focused at developers. API Reference : Details Container ImagesDocumentationCI / JenkinsRelease ManagementDeveloper's Certificate of OriginBPF and XDP Reference GuideBPF ArchitectureToolchainProgram TypesFurther ReadingAPI ReferenceIntroductionHow to is a new Linux kernel technology called BPF, which enables the dynamic insertion of powerful security visibility and control logic within Linux itself. Because BPF runs inside the Linux kernel, Cilium security

Describes how to troubleshoot Cilium in different deployment modes. BPF and XDP Reference Guide : Provides a technical deep dive of BPF and XDP technology, primarily focused at developers. API Reference : Details Automatically run unit tests on code changes BPF and XDP Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain Development bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP tc (traffic control) Further Reading Kernel Developer FAQ Projects using BPF XDP Newbies BPF Newsletter

Describes how to troubleshoot Cilium in different deployment modes. BPF and XDP Reference Guide : Provides a technical deep dive of eBPF and XDP technology, primarily focused at developers. API Reference : Details Automatically run unit tests on code changes BPF and XDP Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain Development bpftool BPF sysctls Kernel Testing JIT Debugging Introspection Tracing pipe Miscellaneous Program Types XDP tc (traffic control) Further Reading Kernel Developer FAQ Projects using BPF XDP Newbies BPF Newsletter