---
description: https://www.youtube.com/watch?v=f-oTe-dmfyI
---

# eBPF: rethinking the linux kernel

* Programmability essentials&#x20;
  * Safety --> sandboxing&#x20;
  * Continuous Delivery --> deploy anytime with seamless upgrades&#x20;
  * Performance --> native execution (JIT compiler)&#x20;
* Kernel architecture&#x20;
  * Kernel abstracts using driver: enable the H/W, but don't want to expose&#x20;
    * Block device, network device&#x20;
  * System calls: application invokes to communicate with kernels&#x20;
  * Middle logic: business logic&#x20;
    * Virtual file system
    * TCP / IP&#x20;
  * Last piece: someone operates the system, through configuration APIs&#x20;
    * Interact from the kernel through the APIs&#x20;

![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FsDMvvTVuV9Yp8KO2moS7%2Fimage.png?alt=media\&token=3a079e2f-c313-48e0-930b-1f68b09a74e1)

#### Kernel Development 101&#x20;

* Option 1: native support&#x20;
  * Change kernel source code
  * Expose configuration API&#x20;
  * Wait 5 years for your users to upgrade&#x20;
  * Cons: nobody wants to wait&#x20;
* Option 2: kernel module&#x20;
  * Write kernel module
  * Every kernel release will break it&#x20;
  * Cons
    * You likely to ship a different module for each kernel version
    * Might crash your kernel&#x20;

#### How about we add JS-like capabilities to the Linux Kernel?

*   eBPF

    * Take that syscall, and run a program that takes over on behalf of the system call and then returns&#x20;
    * ![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2F9rq0cXiFAmrIDxCZgZUG%2Fimage.png?alt=media\&token=54d938b8-2534-4348-be3e-ee00387ff047)
    * Extract the metadata from the system call, and send that through a bpf map, for tracing purpose and provide context&#x20;


* **eBPF runtime**: how does that work?&#x20;
  * Runtime: ensure that we fulfill all the programmability essentials that we cover earlier
  * BPF bytecode: the compiled version of the code above &#x20;
    * Safety & security: the verifier will reject any unsafe program and provides a sandbox&#x20;
      * Major difference compared to the Linux module&#x20;
      * Privilege, access / expose control&#x20;
      * Similar to JS (software-based sandbox)&#x20;
    * Performance: JIT compiler --> ensures native execution performance&#x20;
      * Portable&#x20;
    * Continuous Delivery&#x20;
      * Programs can be exchanged without disrupting workloads&#x20;

![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FvmGUbqa07bnOzcei8C00%2Fimage.png?alt=media\&token=cf711276-2b25-417f-9fd0-25b18afabffd)

* eBPF Hooks&#x20;

![Hooks](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FbuwaWnT3C66HybNaQh8s%2Fimage.png?alt=media\&token=a656b7b9-5a5a-460d-93ff-944465eb2223)

* **What can you hook?**&#x20;
  * Kernel functions (kprobes)
  * Userspace functions (uprobes)&#x20;
    * Functions in your application! Profile application&#x20;
  * System calls&#x20;
  * Tracepoints&#x20;
    * Function names in kernel that will stay stable&#x20;
    * Instrument the entire Linux kernel
  * Network devices (tc / xdp)
  * Network routes&#x20;
  * TCP congestion algorithms
  * Sockets (data level)&#x20;

#### eBPF Maps&#x20;

![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FK4RTNxGLgRoAOnDsKfmv%2Fimage.png?alt=media\&token=cba95d1e-8260-46b3-b305-e46ba0c34f75)

* BPF program: only instructions, no data&#x20;
* States are stored in BPF maps, separate from the programs&#x20;
  * Keep the maps alive, while replacing the programs
    * E.x. LPM --> routing table&#x20;
  * Seamless upgrades&#x20;
* Used for&#x20;
  * Retrieve and configure&#x20;

#### eBPF helpers&#x20;

![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FK2ZamkzASJWg0l1Sm4Sh%2Fimage.png?alt=media\&token=c2665168-1b22-4aa1-bfc0-d95819b7942e)

* Linux module can call any kernel functions&#x20;
  * Downsides: abuse or misuse --> crash the kernel, and are not stable&#x20;
* BPF programs
  * Helpers: used to interact with OS, and they are stable over time&#x20;
  * Interactions with OS are done via helpers
  * Portable across kernel versions&#x20;

#### eBPF Tail and Function calls&#x20;

![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FSct6uwP6lrgnv2Ta6KGQ%2Fimage.png?alt=media\&token=338a5e18-8b20-4f79-bcfd-4c11cc750a4c)

* Tail calls: chain, and will not return to the old programs&#x20;
  * Hook: run multiple logical pieces&#x20;
*   Tail / function calls&#x20;

    * Composable&#x20;
    * Reduce the size of the programs&#x20;



![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2Fi0zrtWmaFsP8D1vIklIA%2Fimage.png?alt=media\&token=3fe9ee4d-6f4b-4936-9815-e5c8c253ba21)

#### Applications&#x20;

* Tracing & Profiling with eBPF&#x20;
  * BCC: BPF compiler collection&#x20;
    * Allow application developers to run a python program, which contains the actual BPF program and the logic in python to read the state / metrics from BPF maps and displays it in some way&#x20;
  * bpftrace - Dtrace for Linux&#x20;
    * Creating BPF maps, read it, and so on&#x20;
  * Cilium: networking, load-balancing, and security for Kubernetes&#x20;
    * Network policies, Kubernetes services and so on&#x20;
    * Introspect the data&#x20;

![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FTMmL7e14JOekJlDT2SbL%2Fimage.png?alt=media\&token=a461e71d-81e4-4652-8676-ead8ba225b31)

![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FnC3oXixde0LWTvmiMtOn%2Fimage.png?alt=media\&token=6bd249df-b86b-4f1b-8bb0-961f525cfa29)

![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FyusPW6ExaECXBifP9nRm%2Fimage.png?alt=media\&token=29ee2501-f56e-46ca-b972-5b0eb43ab8ec)

![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FLb6QyK8ebu4tod8ssVx3%2Fimage.png?alt=media\&token=722f86ee-db88-4b14-978a-1431fa5f1501)

![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FcF9TA8QCLif9xsquj4vN%2Fimage.png?alt=media\&token=ca2c9dca-133a-4961-991b-dfa3832e6457)
