Make the Web Fun Again on Erich's Site

eBPF, XDP and Kernel Bypass

Sat, 14 Jun 2025 00:00:00 +0000

🧠 Is eBPF a Kernel Bypass? Clearing the Confusion

eBPF (extended Berkeley Packet Filter) has exploded in popularity for observability, security, and networking on Linux. But if you’ve browsed Reddit or Hacker News, you’ve probably seen people claim:

“eBPF runs in userspace.”
“eBPF is a kernel bypass.”
“eBPF replaces DPDK!”

Let’s clear the fog. In this post, we’ll walk through what eBPF really is, where it runs, and whether it qualifies as a “kernel bypass.” 🔍 What Is eBPF?

At its core, eBPF is a virtual machine inside the Linux kernel that allows you to attach tiny programs to key parts of the system — like syscalls, network packet processing, or tracing events.

You write these eBPF programs in userspace, typically in C, and then load them into the kernel via a syscall (bpf()), where they are verified and JIT-compiled to native code.

So:

📦 Written in userspace

🚀 Executed in kernel space

🤔 So… Is eBPF a Kernel Bypass?

No. eBPF is not a kernel bypass. In fact, it’s the opposite.

eBPF runs inside the kernel and operates with kernel cooperation.

It extends the kernel's capabilities safely and dynamically.

It is sandboxed, verified, and runs in specific hook points (e.g., network ingress, syscall entry, kprobes, tracepoints, etc.).

✅ eBPF Enhances Kernel Behavior ❌ eBPF Does Not Bypass the Kernel 🧵 Why Do People Say eBPF “Runs in Userspace”?

There’s a grain of truth, but it’s misleading.

eBPF code is developed and compiled in userspace.

You use userspace tools like clang, bpftool, bcc, libbpf, or bpftool prog load to load programs into the kernel.

But once loaded, eBPF programs run in kernel context, not in userspace.

Saying “eBPF runs in userspace” is like saying “drivers run in Notepad because you wrote them there.” It’s true that you write them in userspace, but they run in kernelspace. ⚡ But What About XDP or AF_XDP?

Good question!

These are part of the eBPF ecosystem, especially in networking. Technology Runs In Description XDP Kernel (very early) Processes packets in the driver before the kernel stack. Used for fast packet filtering and redirection. AF_XDP Userspace A socket type that allows zero-copy packet I/O between NIC and userspace. Can act as a true kernel bypass. DPDK Userspace Full kernel bypass. Userland packet processing with direct NIC access via UIO or VFIO.

So if you want true kernel bypass, you’ll use DPDK or AF_XDP in zero-copy mode. eBPF + XDP can drop or redirect packets before they hit the TCP/IP stack, but it’s still happening inside the kernel. 🧠 Summary Statement ✅ / ❌ Clarification eBPF runs in kernel space ✅ After loading, eBPF executes in the kernel eBPF is a kernel bypass ❌ It extends the kernel, not bypasses it You write eBPF in userspace ✅ Then it’s loaded into kernel XDP can avoid the kernel network stack ⚠️ Partially true — it avoids the full stack but is still in kernel AF_XDP and DPDK bypass the kernel ✅ These give userland access to NICs 🛠️ Want to Go Deeper?

Build an XDP program to drop or redirect packets

Compare DPDK vs AF_XDP vs XDP in real benchmarks

Trace syscalls with eBPF using tools like bcc or bpftrace

🔚 Conclusion

eBPF is a powerful in-kernel extension mechanism, not a bypass. If you’re aiming for extreme packet throughput or latency reduction in userland, consider AF_XDP or DPDK. But for safety, flexibility, and observability — eBPF is unmatched.

If you’re confused by what runs where, just remember:

You write in userspace, but eBPF thinks in kernelspace.

Open Source as an Ideology

Thu, 24 Apr 2025 00:00:00 +0000

As a tech enthusiast or IT engineer, we are already familiar with Open Source Software (OSS). Open-source software (OSS) is computer software that is released under a license in which the copyright holder grants users the rights to use, study, change, and distribute the software and its source code to anyone and for any purpose. Open source is a concept of accessible code base and we can modify the code by every one, also we can contribute to the development of the prject as a community (with some license of course). This concept was spread after linux was introduced to the world. As an IT concept open source was proven to accelerate the development for new technology by its opennes concept.

Open Source as an Ideology

As I explained earlier, open source is about transparancy, collaboration and freedom. Let’s think about it, if we contemplate this idea and then remove the code or software development concept, it becomes a powerful philosophical approach.

Transparancy: Everyone can see how something works.
Collaboration: Everyone can contribute to make it better or bigger, not just expert but anyone who have insight or ideas.
Freedom: Anyone can modify or adopt the system to suit their needs.

This models contrasts sharply with many traditional system-corporate, governemental, also educational that often operate under hierarchy, secrecy and control.

When treated as a movement, open source embodies principles that align closely with decentralization, community-driven action and equity. This movement pushes back the centralized and monopolization of knowledge and power, against the monopolar hegemony and encourage the uni-polar system to distributed ownership.

Education: Open Knowledge for All The rise of Open Educational Resources (OER) is democratizing access to learning. Free textbooks, courses (like MIT OpenCourseWare or Khan Academy), and community-driven teaching platforms embody open-source ideals. Education becomes a shared responsibility—not a commodity.
Government: Open Data and Civic Tech In the public sector, movements for open data and open governance allow citizens to access and interpret information, hold institutions accountable, and even co-develop policies. Projects like Code for America apply open-source approaches to civic engagement.
Science and Research: Collaborative Discovery The traditional academic publishing model is being disrupted by open-access journals and platforms like arXiv and Sci-Hub. Researchers are increasingly sharing methods, data, and results in real-time, accelerating the pace of innovation.
Art and Culture: Creative Commons Platforms like Creative Commons allow artists to license their work in ways that encourage remixing, reuse, and collaboration. The idea of rigid copyright is softened, and creativity becomes more communal.

Open Source in Daily Life (Even if You’re Not a Developer)

Many people are already living “open source” lives—they just don’t call it that.

A gardener who shares plant cuttings and cultivation tips.
A teacher uploading free worksheets online.
An activist creating a toolkit for organizing that others can use and adapt.

The open-source ideology empowers individuals and communities to own their tools, their knowledge, and their future.

Governemnt and Geopolotics with Open Source Principles

We have several governement system that applied to the nations. On a bigger picture there are 2 systems that widely used, Republic and Monarchy. Those systems have its inheritance, but mostly it is republic and monarchy. If we saw the open source principle, it is closely to the republic idea but is it republic decentralized? community-driven? The republican enthusiast would say “yes!!!”, but is it really true? I don’t think so. As Socrates critics to the republic, it will only produce the demagog. I saw in some countries that Socrates’s words come true. No community words taken, centralized system and disrepancy that occured.

For me, open source priciple as an ideology is a “patch” for current republic idea. If we can apply the open source principle combined with republic idea, I think it will be a game changer for current governement system. As world growing, and world become monopolar that means only one super power country that acts as a world governmet (reminds me on one piece btw). This situation already predicted by Socrates, that even democratic system at some point would be worst as another system if a power lays on a single subject. Another block from east try to against this mono-polar like system with idea of collaboration, decentralization and transparancy. This head-to-head ideas brings by a powerful countries worth to wait, prepare the pop corn and cola to watch what look like this world ended up.

But There Are Challenges…

Open source isn’t perfect. Whether in software or society, it comes with tough questions:

Who maintains and moderates open systems?
How do we fund contributions in a world driven by profit?
How do we prevent exploitation of free labor and ideas?
How do we ensure open doesn’t mean “lawless” or “unstructured”?

These are ongoing debates—even within the software world—and they become even more complex when applied to broader societal models. Yeah there are no perfect or ideal concept o ideology, we just need to rethink and patch our ideology to fit our necesities.

References

jBPF for RIC with srsRAN

Thu, 10 Apr 2025 00:00:00 +0000

What is jBPF?

jBPF stands for Janus BPF, an eBPF like program as part of janus project provided by microsoft. jBPF runs in user space mode unlike eBPF that runs in kernel stack, it is based on userspace BPF (uBPF). just like the developer said:

Userspace eBPF instrumentation and control framework for deploying control and monitoring functions in a secure manner. It is part of Project Janus and provides probes for eBPF-like functionality outside of the Linux kernel.

As Telecom technology require low latency in such manner, eBPF comes for accomplish this requirement. eBPF already implemented in several usecases that require low latency and take control or modify metadata without interupt the process. In this telecom scenario also require this manner, and eBPF already proven to resolve this requirements, such as linux scheduler modification without interupt the entire process or kernel.

jBPF that part of janus project provided by microsoft already gives us the way to use eBPF instrumentation for Radio Access Network monitor and control utilization. The project you can find at here: https://github.com/microsoft/jbpf.git

The jbpf instrumentation and control library provides a flexible and safe user-mode instrumentation framework built on eBPF technology. It splits responsibilities between the core application developers and a potentially broader community of developers who want safe access to instrumentation and control, similar to eBPF in Linux kernel. However, jbpf operates entirely in user mode and makes no calls to Linux kernel.

The core application developers define common instrumentation points with access to important internal application structures and APIs, but without prescribing how these will be consumed. Other developers can deploy their own code, inlined, at the instrumentation points. It allows them to efficiently process internal application data in an arbitrary way to extract particular information without needing to copy it elsewhere. The instrumentation code is statically verified before executed to enforce safety.

jBPF Architecture

jBPF literaly same with BPF workflow, there are metadatas that we can receive and also can be modify by the bpf prog. If you’re familiar with eBPF or uBPF, that eBPF code will be compiled into bpf object file and could be load using bpftool or something else. In jBPF we don’t use bppftool to load the program, and the bpf object will called codelet in jBPF.

These are the basic terms used in the project:

Hook: An instrumentation point at which we call user-provided code (see here for more on hooks).
Codelet: A piece of user-provided code that gets executed once a hook point is called in the application (see here for mo**re * on codelets).
Codelet set: A set of codelets that share maps or other things and have to be deployed together.
Map: A shared memory location that is accessible to one or more codelets, typically used to store data between in** vocaions, * share across codelets, or communicate with the rest of the system (see here for more on maps).
Helper function: A function implemented by the application and exposed to the codelet, typically used to affect the application behaviour or perform complex operations that are hard to verify (see here for more on helper functions).

srsRAN integration

There is project for srsran integration with jbpf, you can go to jbpf repository and find the repo at there. Otherwise, I just create my integration by my self with reference by that repo. In my integration, I focuse on retrieve CU_CP telemetry, such as du_index, plmn and ue_index.

Modify the gnb.cpp

We need to include jbpf headers file and our custom headers. Also we need to initialize the jbpf process. And the important part is you need to register the jbpf thread to srsran thread process, because jbpf is running inside it’s own thread.

  #include "srsran/jbpf/inc/jbpf.h"
  #include "srsran/jbpf/inc/jbpf_hook.h"
  #include "srsran/jbpf/inc/jbpf_defs.h"
  #include "srsran/jbpf/jbpf_context.h"
  #include "srsran/jbpf/common.h"
  #include "srsran/jbpf/jbpf_srsran_hooks.h"
  #include "srsran/jbpf/inc/jbpf.h"


  #define IPC_NAME "example_ipc_app"

  jbpf_io_stream_id_t control_input_stream_id = {
      .id = {0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,    0x11, 0x11, 0x11}};

  jbpf_io_stream_id_t output_data_stream_id = {
      .id = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC,    0xDD, 0xEE, 0xFF}};

  // Used to covert data of type Packet to JSON format
  boost::property_tree::ptree
  toPtree(const jbpf_cucp_uemgr_ctx_info& packet)
  {
      boost::property_tree::ptree pt;
      pt.put("ctx_id", packet.ctx_id);
      pt.put("du_index", packet.du_index);
      pt.put("plmn", packet.plmn);
      pt.put("ue_index", packet.ue_index);
      return pt;
  }

  std::string
  toJson(const boost::property_tree::ptree& pt)
  {
      std::ostringstream oss;
      boost::property_tree::write_json(oss, pt);
      return oss.str();
  };

  static void
  io_channel_print_output(jbpf_io_stream_id_t* stream_id, void** bufs, int num_bufs, void*    ctx)
  {
      if (stream_id && num_bufs > 0) {

      // Check that the data corresponds to a known output channel
      if (memcmp(&output_data_stream_id, stream_id, sizeof(jbpf_io_stream_id_t)) != 0)    {
              std::cout << "ERROR: Unknown stream_id" << std::endl;
              return;
      }

      // Fetch the data and print in JSON format
      for (auto i = 0; i < num_bufs; i++) {

          jbpf_cucp_uemgr_ctx_info p = *static_cast<jbpf_cucp_uemgr_ctx_info*>(bufs[i])   ;

          boost::property_tree::ptree pt = toPtree(p);
          std::string json = toJson(pt);

          std::cout << json << std::endl;

          // Send an acknowledgement message back to the codelet
          PacketResp resp = {1};
          jbpf_send_input_msg(&control_input_stream_id, &resp, sizeof(resp));
      }
      }
  }
  .
  .
  .
  // ======== START JBPF ========= //
    struct jbpf_config jbpf_config = {0};
    jbpf_set_default_config_options(&jbpf_config);

    // Enable LCM IPC interface using UNIX socket at the default socket path (the default is through C API)
    jbpf_config.lcm_ipc_config.has_lcm_ipc_thread = true;
    snprintf(
        jbpf_config.lcm_ipc_config.lcm_ipc_name,
        sizeof(jbpf_config.lcm_ipc_config.lcm_ipc_name) - 1,
        "%s",
        JBPF_DEFAULT_LCM_SOCKET);

    // Initialize jbpf
    if (jbpf_init(&jbpf_config) < 0) {
        exit(-1);
    }

    // Any thread that calls a hook must be registered
    jbpf_register_thread();
    jbpf_register_io_output_cb(io_channel_print_output);
  // ======== END JBPF ========= //

Write custom hook macro

As the documentation guide, to working with jBPF we need hook point. A hook function is a process to tell the codelet which process will be used by the codelet.

  /* CUCP UE Manager */

  DECLARE_JBPF_HOOK(cucp_uemgr_ue_add,
      struct jbpf_ran_generic_ctx ctx,
      ctx,
      HOOK_PROTO(
          jbpf_cucp_uemgr_ctx_info *info,
          bool pci_set,
          uint16_t pci,
          bool rnti_set,
          uint16_t rnti),
      HOOK_ASSIGN(
          ctx.data = (uint64_t)info;
          ctx.data_end = (uint64_t) ((uint8_t*)info + sizeof(struct   jbpf_cucp_uemgr_ctx_info));
          ctx.srs_meta_data1 = ((uint64_t)pci_set) << 16 | pci;
          ctx.srs_meta_data2 = (uint64_t)rnti_set << 16 | rnti;
      )
  )

modify the file

then because in this docs, I will retrive data from cu_cp, I need to modify ue_manager_impl.cpp. You can modify anywhere, depends on what data we want to retrieve.

  DEFINE_JBPF_HOOK(cucp_uemgr_ue_add);
  .
  .
  .
  .
  struct jbpf_cucp_uemgr_ctx_info ctx_info = {0, (uint16_t)du_index, plmn.to_bcd(),   (uint64_t)new_ue_index};
  hook_cucp_uemgr_ue_add(&ctx_info, pci.has_value(), pci.value(), rnti.has_value(), to_value(rnti.value()));

Create Codelet

As I mentioned before, codelet is bascially eBPF prog.

#include <string.h>
#include "jbpf_defs.h"
#include "jbpf_helper.h"
#include "common.h"

jbpf_ringbuf_map(outmap, struct jbpf_cucp_uemgr_ctx_info, 100);
jbpf_control_input_map(inmap, struct PacketResp, 100);

// A map of type JBPF_MAP_TYPE_ARRAY, which is used
// to store internal codelet state.
struct jbpf_load_map_def SEC("maps") counter = {
  .type = JBPF_MAP_TYPE_ARRAY,
  .key_size = sizeof(int),
  .value_size = sizeof(int),
  .max_entries = 4,
};

SEC("jbpf_generic")
uint64_t
jbpf_main(void* state)
{
  struct jbpf_ran_generic_ctx* ctx;
  ctx = (struct jbpf_ran_generic_ctx*)state;

  struct jbpf_cucp_uemgr_ctx_info *p, *p_end;
  struct jbpf_cucp_uemgr_ctx_info echo;
  struct PacketResp resp = {0};

  jbpf_printf_debug(">>> UE ADD called: ctx_id=%u, d_index=%lu, plmn=%u\n", echo.ctx_id, echo.du_index, echo.plmn);
  void* c;
  int cnt;
  uint64_t index = 0;
  c = jbpf_map_lookup_elem(&counter, &index);
  if (!c)
      return 1;

  cnt = *(int*)c;
  cnt++;
  *(uint32_t*)c = cnt;

  p = (void*)ctx->data;
  p_end = (void*)ctx->data_end;
  if (p + 1 > p_end)
      return 1;

  echo = *p;
  if (jbpf_ringbuf_output(&outmap, &echo, sizeof(echo)) < 0) {
      return 1;
  }

  while(jbpf_control_input_receive(&inmap, &echo, sizeof(echo)) > 0) {
  	echo.du_index = 1;
  	jbpf_printf_debug("Got aggregate value %u\nh", echo.du_index);
  }
  return 0a;
}

Run the program

If the code modification already done, we can compile it and run it. First run the srsRAN gnb, try to load the codelet and finally, try to start UE and see what’s happen. If it shows the parameters we set, it indicates we successfully create our first RIC using jBPF.

the output should be like this.

  ==== gNB started ===
  Type <h> to view help
  2025-04-24T06:54:21.825696Z [JBPF][IO][DEBUG]: Received 79640 bytes
  2025-04-24T06:54:21.844989Z [JBPF][CORE][DEBUG]: Creating codelet   cucp_uemgr_ue_add_codelet
  2025-04-24T06:54:21.845051Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_map_lookup
  2025-04-24T06:54:21.845057Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_map_lookup_reset
  2025-04-24T06:54:21.845060Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_map_update
  2025-04-24T06:54:21.845065Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_map_delete
  2025-04-24T06:54:21.845069Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_map_clear
  2025-04-24T06:54:21.845073Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_map_dump
  2025-04-24T06:54:21.845077Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_time_get_ns
  2025-04-24T06:54:21.845082Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_get_sys_time
  2025-04-24T06:54:21.845086Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_get_sys_time_diff_ns
  2025-04-24T06:54:21.845091Z [JBPF][CORE][DEBUG]: Registering helper function jbpf_hash
  2025-04-24T06:54:21.845094Z [JBPF][CORE][DEBUG]: Registering helper function jbpf_printf
  2025-04-24T06:54:21.845098Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_ringbuf_output
  2025-04-24T06:54:21.845102Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_mark_runtime_init
  2025-04-24T06:54:21.845107Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_runtime_limit_exceeded
  2025-04-24T06:54:21.845110Z [JBPF][CORE][DEBUG]: Registering helper function jbpf_rand
  2025-04-24T06:54:21.845113Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_control_input_receive
  2025-04-24T06:54:21.845117Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_get_output_buf
  2025-04-24T06:54:21.845121Z [JBPF][CORE][DEBUG]: Registering helper function  jbpf_send_output
  2025-04-24T06:54:21.845746Z [JBPF][CORE][DEBUG]: Map counter registered successfully for  codelet cucp_uemgr_ue_add_codelet
  2025-04-24T06:54:21.845765Z [JBPF][CORE][INFO]: Registered map counter to codelet   cucp_uemgr_ue_add_codelet
  2025-04-24T06:54:21.847736Z [JBPF][IO][INFO]: Creating channel  00112233445566778899aabbccddeeff
  2025-04-24T06:54:21.847781Z [JBPF][MEM_MGMT][INFO]: Added 63 elements to the ringbuf
  2025-04-24T06:54:21.847786Z [JBPF][MEM_MGMT][INFO]: The size of the mempool is 63 and   the capacity is 63
  2025-04-24T06:54:21.847795Z [JBPF][CORE][DEBUG]: Map outmap registered successfully for   codelet cucp_uemgr_ue_add_codelet
  2025-04-24T06:54:21.847802Z [JBPF][CORE][INFO]: Registered map outmap to codelet  cucp_uemgr_ue_add_codelet
  2025-04-24T06:54:21.847808Z [JBPF][IO][INFO]: Creating channel  11111111111111111111111111111111
  2025-04-24T06:54:21.847827Z [JBPF][MEM_MGMT][INFO]: Added 63 elements to the ringbuf
  2025-04-24T06:54:21.847831Z [JBPF][MEM_MGMT][INFO]: The size of the mempool is 63 and   the capacity is 63
  2025-04-24T06:54:21.847837Z [JBPF][CORE][DEBUG]: Map inmap registered successfully for  codelet cucp_uemgr_ue_add_codelet
  2025-04-24T06:54:21.847840Z [JBPF][CORE][INFO]: Registered map inmap to codelet   cucp_uemgr_ue_add_codelet
  2025-04-24T06:54:21.847844Z [JBPF][CORE][DEBUG]: Map inmap is already registered!
  2025-04-24T06:54:21.848432Z [JBPF][CORE][DEBUG]: Created codelet  cucp_uemgr_ue_add_codelet
  2025-04-24T06:54:21.848442Z [JBPF][CORE][INFO]: Registered codelet  cucp_uemgr_ue_add_codelet to hook cucp_uemgr_ue_add
  2025-04-24T06:54:21.848446Z [JBPF][CORE][INFO]: ----------------- cucp_uemgr_ue_add:  cucp_uemgr_ue_add_codelet ----------------------
  2025-04-24T06:54:21.848450Z [JBPF][CORE][INFO]: hook_name = cucp_uemgr_ue_add, priority   = 1, runtime_threshold = 0
  2025-04-24T06:54:21.848454Z [JBPF][CORE][INFO]: Codelet created and loaded successfully:  cucp_uemgr_ue_add_codelet
  2025-04-24T06:54:21.848459Z [JBPF][CORE][DEBUG]: Codeletset is loaded OK 0
  2025-04-24T06:54:21.848470Z [JBPF][IO][DEBUG]: Sent 516 bytes
  2025-04-24T06:54:25.520540Z [JBPF][CORE][DEBUG]: >>> UE ADD called: ctx_id=0, d_index=0,  plmn=4
  {
      "ctx_id": "0",
      "du_index": "1",
      "plmn": "61712",
      "ue_index": "0"
  }

  2025-04-24T06:54:25.735163Z [JBPF][CORE][DEBUG]: >>> UE ADD called: ctx_id=0, d_index=0,  plmn=4
  2025-04-24T06:54:25.735179Z [JBPF][CORE][DEBUG]: Got aggregate value 0
  {
      "ctx_id": "0",
      "du_index": "1",
      "plmn": "61712",
      "ue_index": "1"
  }

Self Employed

Wed, 02 Apr 2025 00:00:00 +0000

Maybe some of you have same issue like me, have a job but also have side project for fun. If you are like me, it means we are not alone. There are several people who like us, don’t worry :) “at first I thought I was alone LOL”. It is normal for a person who are incapable to do “a doing nothing” work. In this page, I would like to sharing my “Self Employed” work with you.

It’s began while I was studying my Diploma degree, or maybe when I was highschool student. I was a person that loves learning a new thing, especially strategy game. So despite I was going to school for study, sometimes I just go to school’s hall to play board game or became football tactic maker. And then this behavior continued until college. I’m very passionate in learning new thing and finally start my first self project, that I called “A Computer that can See”. It is basically just a computer vision.

For honest doing programming or computer science is just a hobby, actually my passion lay on pure science. But the universe guide me to join telecommunication engineering, and I decided to focused on computer science as the project reference. For me, it is fun to worked in this field and I became passionate with this field. Until I got my first job in Telecom industry, I still working on my project for pure science and computer science. Fortunately, those fields are related each other so I can work on those project together. Yeas every knowledge must be related each other in some ways.

eBPF GTP Packet Filtering

Thu, 21 Nov 2024 00:00:00 +0000

What is GTP?

As wikipedia explanation, GPRS Tunnelling Protocol (GTP) is a group of IP-based communications protocols used to carry general packet radio service (GPRS) within GSM, UMTS, LTE and 5G NR radio networks. In 3GPP architectures, GTP and Proxy Mobile IPv6 based interfaces are specified on various interface points. GTP is a tunneling protocol is used for telecom technology for user plane, it means the users will access the Data Network (DN) using GTP Tunnel. This protocol similiar to VPN that create tunnel for each users, same with GTP, each user that already pass the registration by control plane will have user plane that allocate tunnel using GTP protocol.

GTP Packet Filtering with eBPF

We will continue the progress from previous documentation of eBPF Trace SCTP Socket. We will continue to filter the GTP Protocol. Here is the architecture I used to setup the development and testing.

Sniff GTP Packet

#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/udp.h>
#include <linux/gtp.h>
#include <linux/in.h>
#include <bpf/bpf_helpers.h>

#define GTP_PORT 2152

SEC("xdp_gtp_sniff")
int xdp_gtp_sniff(struct xdp_md *ctx) {
    // Pointers for accessing packet data
    void *data = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;

    // Ethernet header
    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end) return XDP_PASS;

    // Check if the packet is an IPv4 packet
    if (eth->h_proto != __constant_htons(ETH_P_IP)) return XDP_PASS;

    // IP header
    struct iphdr *ip = (struct iphdr *)(eth + 1);
    if ((void *)(ip + 1) > data_end) return XDP_PASS;

    // Check if it's a UDP packet
    if (ip->protocol != IPPROTO_UDP) return XDP_PASS;

    // UDP header
    struct udphdr *udp = (struct udphdr *)((void *)ip + ip->ihl * 4);
    if ((void *)(udp + 1) > data_end) return XDP_PASS;

    // Check if the destination port is GTP-U (2152)
    if (udp->dest != __constant_htons(GTP_PORT)) return XDP_PASS;

    // GTP header
    struct gtpuhdr *gtp = (struct gtpuhdr *)(udp + 1);
    if ((void *)(gtp + 1) > data_end) return XDP_PASS;

    // Verify that this is a valid GTP-U packet
    if (gtp->flags != 0x30 || gtp->message_type != 0xff) return XDP_PASS;

    // Here you can add logic to process the GTP packet

    // Example: Dropping the packet
    return XDP_DROP; // Drop the packet after sniffing

    // Otherwise, allow the packet to pass through
    return XDP_PASS;
}

char _license[] SEC("license") = "GPL";

UDP Trace from GTP

GTP-U is basically based on UDP packet. So to sniff packet of GTP, first and the foremost we need to parse UDP packet and decapsulate the GTP header to process the packet.

#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/udp.h>
#include <linux/gtp.h>
#include <linux/in.h>
#include <stddef.h>
#include <linux/tcp.h>
#include <bpf/bpf_endian.h>
#include <bpf/bpf_helpers.h>

#define GTP_PORT 2152

// GTP-U header definition (simplified)
struct gtpuhdr {
    __u8 flags;
    __u8 message_type;
    __u16 length;
    __u32 tid;  // Tunnel Endpoint Identifier (TEID)
};

SEC("xdp_gtp")
int xdp_gtp_sniff(struct xdp_md *ctx) {
    // Pointers for accessing packet data
    void *data = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;

    // Ethernet header
    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end) return XDP_PASS;

    // Check if the packet is an IPv4 packet
    if (eth->h_proto != __constant_htons(ETH_P_IP)) return XDP_PASS;

    // IP header
    struct iphdr *ip = (struct iphdr *)(eth + 1);
    if ((void *)(ip + 1) > data_end) return XDP_PASS;

    // Check if it's a UDP packet
    if (ip->protocol != IPPROTO_UDP) return XDP_PASS;

	struct udphdr *udpdata = (void *)ip + sizeof(*ip);
	if ((void *)udpdata + sizeof(*udpdata) > data_end) return XDP_PASS;

	if (udpdata->dest != __constant_htons(GTP_PORT)) return XDP_PASS;

    __be32 dst_ip = udpdata->dest;
	unsigned char *dst = (unsigned char *)&dst_ip;

    static const char fmt[] = "DST: %lld . ";

	for (int i = 0; i < sizeof(dst) / sizeof(dst[0]); i++) {
		bpf_trace_printk(fmt, sizeof(fmt), dst[i]);
	}

    return XDP_PASS;
}

char _license[] SEC("license") = "GPL";

GTP-U [IP UE and IP Destination]

In this scenario I have successfully sniff GTP-U packet from CU. As we can see as below, that eBPF already sniff UE IP and Destination IP, in example UE want to send ICMP packet(ping) to 8.8.8.8 IP.

eBPF Trace SCTP Socket

Wed, 21 Aug 2024 00:00:00 +0000

eBPF SCTP Trace

Trace the Protocol ID and print it in kernel

Protocol ID for SCTP is 132 and the program was successfully trace data that contain SCTP packet from CU to AMF.

Almost all telco protocols are SCTP based, like NGAP, F1AP, nFAPI, E1AP, E2AP, etc. With this filtering process using eBPF, I argue (hypothetically) that the filtering process is much faster because the process is not involve kernel. With this approach I also argue that this filtering process is useful in telco technology, it can be used for security in RAN, observable the packet to get data for Traffic Control, handover and for RIC use cases.

#include "vmlinux.h"
#include <bpf/bpf_endian.h>
#include <bpf/bpf_helpers.h>

#define ETH_P_IP 0x0800

SEC("xdp")
int xdp_prog(struct xdp_md *ctx) {
    void *data_end = (void *)(long)ctx->data_end;
    void *data = (void *)(long)ctx->data;
    struct ethhdr *eth = data;

    if ((void *)(eth + 1) > data_end)
        return XDP_PASS;

    if (eth->h_proto == bpf_htons(ETH_P_IP)) {
        struct iphdr *ipv4 = data + sizeof(*eth);

        if ((void *)(ipv4 + 1) > data_end)
            return XDP_PASS;

        // Print the protocol number
        bpf_printk("protocol: %u\n", ipv4->protocol);
    }

    return XDP_PASS;
}

char _license[] SEC("license") = "GPL";

This code will check the protocol, if protocol is SCTP, kernel will print sctp protocol id and the packet will PASS.

Trace Source IP and Destination IP and store the data in perf event

With some modification, we could filter tha packet like IP Src and IP Dst like below:

#include "vmlinux.h"
#include <bpf/bpf_endian.h>
#include <bpf/bpf_helpers.h>

#define ETH_P_IP 0x0800

struct flow_info {
    __u32 src_ip;
    __u32 dst_ip;
    __u16 src_port;
    __u16 dst_port;
    __u8 proto;
};

struct {
   __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
   __uint(key_size, sizeof(__u32));
   __uint(value_size, sizeof(__u32));
} events SEC(".maps");

SEC("xdp")
int xdp_prog(struct xdp_md *ctx) {
    void *data_end = (void *)(long)ctx->data_end;
    void *data = (void *)(long)ctx->data;
    struct ethhdr *eth = data;

    if ((void *)(eth + 1) > data_end)
        return XDP_PASS;

    if (eth->h_proto == bpf_htons(ETH_P_IP)) {
        struct iphdr *ipv4 = data + sizeof(*eth);

        if ((void *)(ipv4 + 1) > data_end)
            return XDP_PASS;

        // Print the protocol number
        // bpf_printk("protocol: %u\n", ipv4->protocol);
        // bpf_printk("IP Src: %d\n", bpf_ntohl(ipv4->saddr));
        // bpf_printk("IP Dst: %d\n", bpf_ntohl(ipv4->daddr));
	struct flow_info flow = {};
	flow.src_ip = ipv4->saddr;
	flow.dst_ip = ipv4->daddr;
	flow.proto = ipv4->protocol;
	bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &flow, sizeof(flow));
    }

    return XDP_PASS;
}

char _license[] SEC("license") = "GPL";

The data of the output will store in events file, to open the oytput or view the output we need the userspace application to view BPF_MAP_TYPE_PERF_EVENT_ARRAY like perf buffer in linux.

First thing to do before running the userspace program, we need to specify where the events of our bpf maps will store. To do this we need to do some commands like below:

The error bpf_obj_get: No such file or directory indicates that the BPF map at the specified path (/sys/fs/bpf/events) doesn’t exist or wasn’t created correctly.

To fix this issue, you need to ensure the following:

1. Ensure Your BPF Program Creates the Map

Make sure that your BPF program creates a BPF map and pins it to the BPF filesystem (usually mounted at /sys/fs/bpf/).

In your BPF program, you should define the map like this:

struct {
    __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
    __uint(max_entries, 128);  // Number of CPUs
    __type(key, u32);
    __type(value, u32);
} events SEC(".maps");

To pin the map to the BPF filesystem, you can use the following code in the user-space program that loads your BPF program:

int map_fd = bpf_map__fd(skel->maps.events);
bpf_obj_pin(map_fd, "/sys/fs/bpf/events");

Or, if you’re manually loading the BPF program and pinning the map:

bpftool prog load my_bpf_program.o /sys/fs/bpf/my_bpf_prog
bpftool map pin id <map_id> /sys/fs/bpf/events

2. Mount the BPF Filesystem (if not already mounted)

Ensure that the BPF filesystem is mounted:

sudo mount -t bpf bpf /sys/fs/bpf/

This step may be required if you don’t have the BPF filesystem mounted on your system.

3. Load and Pin the Map Correctly

Make sure your user-space program or manual commands correctly load and pin the map in the BPF filesystem.

If you load the program manually and want to pin the map, you can use the bpftool utility:

Load the BPF program:

sudo bpftool prog load my_bpf_program.o /sys/fs/bpf/my_bpf_prog

Pin the map:
```
sudo bpftool map pin id <map_id> /sys/fs/bpf/events
```
Replace <map_id> with the ID of your map, which you can find using:
```
sudo bpftool map show
```

4. Verify the Map Exists

Once you’ve pinned the map, verify that it exists in the expected location:

ls /sys/fs/bpf/events

If the file exists, your program should be able to access it without the bpf_obj_get error.

Recap

Ensure your BPF program creates and pins the map.
Ensure the BPF filesystem is mounted.
Load and pin the map correctly.

After following these steps, your user-space program should be able to access the BPF map without errors. If you still encounter issues, please provide more details about your BPF program setup.

Books

Mon, 01 Jan 0001 00:00:00 +0000

The lists of my books recommendations from time to time, which I’ve beed sharing on this page. This pages list the books that I ret and in my opinion it is good if I share it to you. I will keep this page up to date, so you can see my reference for the knowledge that I’ve learnt.

Math

Calculus-Brooks Cole (2002) - James Stewart

Science

Programming

Practical C Programming 3rd Ed. - Steve Oualline

UNIX and Linux System

UNIX Network Programming Vol.1 3rd Ed. - W. Richard Stevens, Bill Fenner, Andrew M. Rudoff
Systems Performance 2nd edition - Brendan Gregg (Addison-Wesley, 2021)
BPF Performance Tools - Brendan Gregg (Addison-Wesley, 2019)
Linux System Programming 2nd Ed. - Robert Love
Oracle Solaris 11.3 Programming Interfaces Guide - Oracle Solaris

Telecom

Open Radio Access Network (O-RAN) Systems Architecture and Design-Academic Press (2022) - Wim Rouwet

Phillosophy

The Art of War - Sun Tzu
Digital Minimalism - Cal Newport
Fihi Ma Fihi - Jalalludin Rumi
The Triple Deminism - Sun Yat Sen
The Moral and Sentiment - Adam Smith
Das Kapital - Karl marx
Ihya’ Ulumuddin - Al-Ghazali
Muqadimah - Ibn Khaldun
Ethics - Aristotle
Republic - Plato
Meditations on First Phillosophy - Rene Descartes

Security

Shell Scripting

Finance and Management

Comics and Novels

1984 - George Orwell
Fahrenheit- Ray Bradburry
Taiko - Eiji Yoshikawa
Musashi - Eiji Yosikawa
One Piece - Eichiro Oda [Comic]
Vagabond - Takehiko Inoe [Comic]
Nemesis - Agatha Christie
The Brothers Karamazov - Fyodor Dostoyevsky
Metamorphosis - Franz Kafka
The Sinking of the Van der Wijck - Hamka
Thus Spoke Zarathustra - Nietzsche
Attack on Titan - Hajime Isayama [Comic]
Naruto - Masashi Kisimoto [Comic]
Evil under the Sun - Agatha Christie
Towards Zero - Agatha Christie
Hercule Poirot’s Christmas - Agatha Christie

Contact

Mon, 01 Jan 0001 00:00:00 +0000

Sched-Ext a Game Changer for Linux Scheduler

Mon, 01 Jan 0001 00:00:00 +0000

Search

Mon, 01 Jan 0001 00:00:00 +0000

You must have Javascript enabled to use this function.

Loading search index…

Make the Web Fun Again on Erich's Site

eBPF, XDP and Kernel Bypass

Open Source as an Ideology

Open Source as an Ideology

Open Source as a Social Movement

Open Source in Daily Life (Even if You’re Not a Developer)

Governemnt and Geopolotics with Open Source Principles

But There Are Challenges…

References

jBPF for RIC with srsRAN

What is jBPF?

jBPF Architecture

srsRAN integration

Run the program

Self Employed

eBPF GTP Packet Filtering

What is GTP?

GTP Packet Filtering with eBPF

Sniff GTP Packet

UDP Trace from GTP

GTP-U [IP UE and IP Destination]

eBPF Trace SCTP Socket

eBPF SCTP Trace

Trace the Protocol ID and print it in kernel

Trace Source IP and Destination IP and store the data in perf event

1. Ensure Your BPF Program Creates the Map

2. Mount the BPF Filesystem (if not already mounted)

3. Load and Pin the Map Correctly

4. Verify the Map Exists

Recap

Books

Math

Science

Programming

UNIX and Linux System

Telecom

Phillosophy

Security

Shell Scripting

Finance and Management

Comics and Novels

Contact

Sched-Ext a Game Changer for Linux Scheduler

Search