there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsec�ons provide further details on individual aspects of the BPF architecture provides various tracepoints around BPF and XDP which can be used for addi�onal introspec�on, for example, to trace interac�ons of user space programs with the bpf system call. Tracepoints for BPF: # perf Both tracepoint classes can also be inspected with a BPF program itself a�ached to one or more tracepoints, collec�ng further informa�on in a map or pun�ng such events to a user space collector through

there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsections provide further details on individual aspects of the BPF architecture provides various tracepoints around BPF and XDP which can be used for additional introspection, for example, to trace interactions of user space programs with the bpf system call. Tracepoints for BPF: # perf Both tracepoint classes can also be inspected with a BPF program itself attached to one or more tracepoints, collecting further information in a map or punting such events to a user space collector through

7 Conclusions ● eBPF programs can be attached to different events: ○ Kprobes ○ uprobes ○ Tracepoints ○ network packets… ● Frameworks, Go bindings, options make it easier: ○ First approach: C,

Python3 bcc framework ▶ Kernelspace components are all eBPF ▶ LSM probes (KRSI), kprobes, uprobes, tracepoints ▶ Under 2000 source lines of kernelspace code ▶ Thanks to eBPF, bpfbox is light-weight, flexible

com/pixie-labs/pixie/tree/main/demos/simple-gotracing/trace_example DEMO: Go Argument Tracer ● Utilizing tracepoints for dynamic logging allows for easy instrumentation of production binaries ● The complexities

there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsections provide further details on individual aspects of the BPF architecture provides various tracepoints around BPF and XDP which can be used for additional introspection, for example, to trace interactions of user space programs with the bpf system call. Tracepoints for BPF: # perf Both tracepoint classes can also be inspected with a BPF program itself attached to one or more tracepoints, collecting further information in a map or punting such events to a user space collector through

there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsections provide further details on individual aspects of the BPF architecture provides various tracepoints around BPF and XDP which can be used for additional introspection, for example, to trace interactions of user space programs with the bpf system call. Tracepoints for BPF: # perf Both tracepoint classes can also be inspected with a BPF program itself attached to one or more tracepoints, collecting further information in a map or punting such events to a user space collector through

there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsections provide further details on individual aspects of the BPF architecture provides various tracepoints around BPF and XDP which can be used for additional introspection, for example, to trace interactions of user space programs with the bpf system call. Tracepoints for BPF: # perf Both tracepoint classes can also be inspected with a BPF program itself attached to one or more tracepoints, collecting further information in a map or punting such events to a user space collector through

there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsections provide further details on individual aspects of the BPF architecture provides various tracepoints around BPF and XDP which can be used for additional introspection, for example, to trace interactions of user space programs with the bpf system call. Tracepoints for BPF: # perf Both tracepoint classes can also be inspected with a BPF program itself attached to one or more tracepoints, collecting further information in a map or punting such events to a user space collector through

there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsections provide further details on individual aspects of the BPF architecture provides various tracepoints around BPF and XDP which can be used for additional introspection, for example, to trace interactions of user space programs with the bpf system call. Tracepoints for BPF: # perf Both tracepoint classes can also be inspected with a BPF program itself attached to one or more tracepoints, collecting further information in a map or punting such events to a user space collector through