 Hi everyone, my name is Francis Laniel and today I will present you my work about adding kconfig support to Cilium eBPF. First of all, what is eBPF? According to Brandon Gregg, a counter developer, eBPF does to Linux what JavaScript does to HTML. And with eBPF, you can now write mini-programs that run on events like disk.io which are run in a safe virtual machine in the kernel. The eBPF is a C-helper library to interact with eBPF programs. In basicalian, there's the loading, some verifying and attaching the eBPF programs to kernel hooks. On another hand, Cilium eBPF is the golden counterpart to eBPF. In eBPF program, you may want to refer to some kernel config as depicted in the following eBPF program which can be found in the kernel sources. While this is possible in eBPF, it was sadly not the case with Cilium eBPF before this contribution. You had to use a workaround like adding a Boolean eBPF parameter to your program or using IfDevGuard and having then two different eBPF bytecodes. I will now detail how Kconfig support was aided to Cilium eBPF. First of all, after compiling the eBPF program, you get an eBPF bytecode. This bytecode contains several health sections like text or data. If your program's reefers kernel config, it will contain the Kconfig virtual section. When this section is present, Cilium eBPF creates a corresponding eBPF map. The first step was to set the correct size for the map and computing the good values offset. Then, Cilium eBPF computes the value of specific Kconfig variables like Linux kernel version or Linux as syscall wrapper. These values will be written as the map content. For example, Linux kernel version will be replaced by the VDSO value of Linux version code. For conventional config, we will need to first parse the Kconfig. The parser was based on initial work from Timo Baker's. The parser first searches for kernel config located under slashboot or in slashproc slashconfig.js. Once parsed, we will set the corresponding values in the map content. The final step consists in replacing the Kconfig variables read by loads to Kconfig maps at the corresponding offset. On this slide, you can see the eBPF source code of the profile block IO gadget of Inspector Gadget. Before this contribution, I had to use ifdef and then having two different eBPF bytecodes to handle different kernel version. With this contribution, I replaced the ifdef by a simple if, which is executed at runtime. The code is then easier and I only have one eBPF bytecode. Also the if could be optimized by the kernel verifier. As a conclusion, Kconfig support was aided to Celium eBPF in version 0.11.0. You can now use it to modify eBPF programs behavior at runtime rather than using a work around. I would like to thank Lawrence Barrer and Timo Baker for their review and suggestion regarding this work. I thank you for your attention.