This document discusses the Linux kernel vs user space and provides examples of BPF and FUSE. It begins by explaining that the kernel manages hardware resources like the CPU, memory, storage and devices, while libraries and applications run in user space. It then discusses system calls as the interface between applications and the kernel, and how BPF and FUSE allow user space programs to interact with the kernel. It also briefly mentions some related projects like Gvisor and Cilium that use BPF.

1. Linux: kernel vs user space
BPF and FUSE as examples
Hervé Nicol - GFI
@hervenicol

2. What is an OS kernel?
HWCPU(s) RAM Storage Devices Whatever
Kernel
Libs
Apps
2
SW

3. Linux syscalls
http://man7.org/linux/man-pages/man2/syscalls.2.html
“The system call is the fundamental interface between an application
and the Linux kernel.”
● 123 in kernel 1.0
● 400+ in kernel 4.11

4. What can I do with syscalls?
● You don’t need to know it to code or use linux
● You may use it for perf analysis and debug (strace, perf, trace, sysdig)
○ See http://www.brendangregg.com/linuxperf.html
● You can filter them with seccomp (ie in containers)
○ Docker filters: https://docs.docker.com/engine/security/seccomp/
○ https://blog.yadutaf.fr/2014/05/29/introduction-to-seccomp-bpf-linux-s
yscall-filter/

5. Managed by the kernel
● CPU and memory = allocations, storage, OOM…
● Storage = block devices, volumes, filesystems…
● Devices = video, sound, usb, network…
HWCPU(s) RAM Storage Devices Whatever
Kernel
Libs
Apps
SW

6. Introducing FUSE
● File System in Userspace
https://en.wikipedia.org/wiki/Filesystem_in_Userspace
○ Sshfs
○ Ntfs
○ gmailfs

7. Prototype use case
When eBPF meets FUSE - Improving performance of user file systems
https://events.linuxfoundation.org/wp-content/uploads/2017/11/When-eBPF-Meets-FUSE-Improving-Performance-of-User-File-Sys
tems-Ashish-Bijlani-Georgia-Tech.pdf

8. Other interesting projects
● Gvisor - https://github.com/google/gvisor
“Userland kernel”
● Cilium - https://cilium.io/
“Bringing the BPF Revolution to Kubernetes Networking and Security”
● Brendan Gregg’s blog - http://www.brendangregg.com/ebpf.html
Linux Performance at Netflix