12之前 initial RTO是⼀个常数1s • 应⽤类型BPF_PROG_TYPE_SOCK_OPS • HOOK BPF_SOCK_OPS_TIMEOUT_INIT • 内核中调⽤栈 • tcp_timeout_init • tcp_call_bpf(BPF_SOCK_OPS_TIMEOUT_INI T) • bpf_cgrougp_run_sock_ops • … • 写cache流程基于inode cache优化 • bpf程序类型 BPF_PROG_TYPE_EXTFUSE • Hook点及⽅法 • fuse_request_send • FUSE_LOOKUP / FUSE_GETATTR / FUSE_SETATTR / • map 结构 • dentry map BPF_MAP_TYPE_HASH • key (inode (inode id, node name) • value inode id • inode map BPF_MAP_TYPE_HASH • key inode id • value fuse_attr (⽂件属性)基于data cache部分 • bpf程序类型 BPF_PROG_TYPE_EXTFUSE • Hook点及⽅法 • fuse_file_read_iter, fuse_file_write_iter

sealfs 直接从容器拦截 IO，对接 sealfs 分布式文件系统，避免 fuse 用户态内核态反复横跳 在 Sealos 上使用 GPU 在 Sealos 上利用 Cilium + BPF 实现流量统计 Slide source credit to: How to Make Linux Microservice-Aware with Cilium and eBPF (InfoQ, 2019)

growing complexity © 2021, YUNSHAN Networks Technology Co., Ltd. All rights reserved. 实战 实战1 采集器怎么运行 实战2 BPF和eBPF怎么配合 实战3 如何与eBPF交互 实战4 eBPF kprobe挂在哪 实战5 eBPF uprobe挂在哪 实战6 怎样编码 实战7 怎样传输 实战8 怎样打标签 实战9 怎样存储与检索

interfaces report operstate UP only when they have VMs at- tached (bug #14526) • Mac OS X hosts: fix bpf capture and accounting of traffic on bridged and host-only inter- faces (bug #14553) • Windows guests:

interfaces report operstate UP only when they have VMs at- tached (bug #14526) • Mac OS X hosts: fix bpf capture and accounting of traffic on bridged and host-only inter- faces (bug #14553) • Windows guests:

supported Berkeley Packet Filter (BPF). Therefore, you can choose proper tools to conduct an in-depth analysis based on the results in In 60 seconds. Compared with perf/ftrace, BPF provides programmability and performance overhead. Compared with kprobe, BPF provides higher security and is more suitable for the production environments. For detailed usage of the BCC toolkit, see BPF Compiler Collection (BCC). 1857 11

supported Berkeley Packet Filter (BPF). Therefore, you can choose proper tools to conduct an in-depth analysis based on the results in In 60 seconds. Compared with perf/ftrace, BPF provides programmability and performance overhead. Compared with kprobe, BPF provides higher security and is more suitable for the production environments. For detailed usage of the BCC toolkit, see BPF Compiler Collection (BCC). 1438 11

supported Berkeley Packet Filter (BPF). Therefore, you can choose proper tools to conduct an in-depth analysis based on the results in In 60 seconds. Compared with perf/ftrace, BPF provides programmability and performance overhead. Compared with kprobe, BPF provides higher security and is more suitable for the production environments. For detailed usage of the BCC toolkit, see BPF Compiler Collection (BCC). 1446 11

supported Berkeley Packet Filter (BPF). Therefore, you can choose proper tools to conduct an in-depth analysis based on the results in In 60 seconds. Compared with perf/ftrace, BPF provides programmability and performance overhead. Compared with kprobe, BPF provides higher security and is more suitable for the production environments. For detailed usage of the BCC toolkit, see BPF Compiler Collection (BCC). 1559 11

supported Berkeley Packet Filter (BPF). Therefore, you can choose proper tools to conduct an in-depth analysis based on the results in In 60 seconds. Compared with perf/ftrace, BPF provides programmability and performance overhead. Compared with kprobe, BPF provides higher security and is more suitable for the production environments. For detailed usage of the BCC toolkit, see BPF Compiler Collection (BCC). 1435 11