【实例简介】OReilly.Linux.Observability.with.BPF.

介绍了如何在linux中使用bpf观测程序性能以及分析相关的问题

【实例截图】

【核心代码】

Table of Contents Foreword. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix 1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 BPF’s History 3 Architecture 4 Conclusion 5 2. Running Your First BPF Programs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Writing BPF Programs 8 BPF Program Types 10 Socket Filter Programs 11 Kprobe Programs 11 Tracepoint Programs 12 XDP Programs 12 Perf Event Programs 13 Cgroup Socket Programs 13 Cgroup Open Socket Programs 13 Socket Option Programs 13 Socket Map Programs 14 Cgroup Device Programs 14 Socket Message Delivery Programs 15 Raw Tracepoint Programs 15 Cgroup Socket Address Programs 15 Socket Reuseport Programs 15 Flow Dissection Programs 16 Other BPF Programs 16 iii The BPF Verifier 17 BPF Type Format 19 BPF Tail Calls 19 Conclusion 20 3. BPF Maps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Creating BPF Maps 21 ELF Conventions to Create BPF Maps 22 Working with BFP Maps 23 Updating Elements in a BPF Map 24 Reading Elements from a BPF Map 26 Removing an Element from a BPF Map 27 Iterating Over Elements in a BPF Map 28 Looking Up and Deleting Elements 30 Concurrent Access to Map Elements 31 Types of BPF Maps 33 Hash-Table Maps 33 Array Maps 34 Program Array Maps 34 Perf Events Array Maps 36 Per-CPU Hash Maps 37 Per-CPU Array Maps 37 Stack Trace Maps 37 Cgroup Array Maps 37 LRU Hash and Per-CPU Hash Maps 38 LPM Trie Maps 38 Array of Maps and Hash of Maps 39 Device Map Maps 39 CPU Map Maps 39 Open Socket Maps 40 Socket Array and Hash Maps 40 Cgroup Storage and Per-CPU Storage Maps 40 Reuseport Socket Maps 41 Queue Maps 41 Stack Maps 42 The BPF Virtual Filesystem 43 Conclusion 46 4. Tracing with BPF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Probes 48 Kernel Probes 49 Tracepoints 51 iv | Table of Contents User-Space Probes 53 User Statically Defined Tracepoints 56 Visualizing Tracing Data 61 Flame Graphs 61 Histograms 67 Perf Events 69 Conclusion 71 5. BPF Utilities. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 BPFTool 73 Installation 74 Feature Display 74 Inspecting BPF Programs 75 Inspecting BPF Maps 78 Inspecting Programs Attached to Specific Interfaces 80 Loading Commands in Batch Mode 81 Displaying BTF Information 82 BPFTrace 83 Installation 83 Language Reference 83 Filtering 84 Dynamic Mapping 85 kubectl-trace 86 Installation 87 Inspecting Kubernetes Nodes 87 eBPF Exporter 88 Installation 88 Exporting Metrics from BPF 88 Conclusion 90 6. Linux Networking and BPF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 BPF and Packet Filtering 92 tcpdump and BPF Expressions 92 Packet Filtering for Raw Sockets 97 BPF-Based Traffic Control Classifier 103 Terminology 103 Traffic Control Classifier Program Using cls_bpf 106 Differences Between Traffic Control and XDP 112 Conclusion 112 7. Express Data Path. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 XDP Programs Overview 114 Table of Contents | v Operation Modes 114 The Packet Processor 116 XDP and iproute2 as a Loader 119 XDP and BCC 124 Testing XDP Programs 127 XDP Testing Using the Python Unit Testing Framework 128 XDP Use Cases 133 Monitoring 133 DDoS Mitigation 133 Load Balancing 133 Firewalling 134 Conclusion 134 8. Linux Kernel Security, Capabilities, and Seccomp. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Capabilities 135 Seccomp 139 Seccomp Errors 140 Seccomp BPF Filter Example 142 BPF LSM Hooks 146 Conclusion 147 9. Real-World Use Cases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Sysdig eBPF God Mode 149 Flowmill 152 Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155