[Image](/uploads/documents/3/6/5/d/365d2f9f030da83286feb37933dcafd1/p3_1.jpg) ## 02 ## I mplementation libbpf.c void bpf_attach_ breakpoint(uint64_t symbol_addr, int pid, int progfd, int bp_type) { struct

orking/filter.txt https://kernelnewbies.org/Linux_5.3 ### 6. Tracing, perf and BPF ## • BPF o libbpf: Add BTF-to-C dumping support, allowing to output a subset of BTF types as a compilable C type definitions bounded loops and other improvements commit • bpf: getsockopt and setsockopt hooks commit 🔗 - libbpf: add bpf_link and tracing attach APIs commit ☑ ||cBPF|eBPF| |---|---|---| |Register|Two 32 bit registers:A: er/src/cc The libbpf directory is a git submodule for repository https://github.com/libbpf/libbpf If you have any change in libbpf directory, please upstream to linux first as libbpf repo is a mirror

依靠运行时汇编，将整个大型LLVM/Clang库带入并嵌入其中 ☑ 编译过程中资源用量大，对Cpu、Mem有要求 ☑ 依赖内核的头包 ## libbpf + bpf + core 编程 ◆ bpf 程序跟其他的用户空间的程序没有太大区别 ☑ 编译成二进制文件，可以适应不同运行环境 libbpf 扮演bpf程序装载机角色 ☑ 开发人员只需要关注bpf程序的正确性和性能，不需要关注其他依赖关系 ## 通过Golang加载eBPF程序

Auto-detecting system features: ... libelf: [ on ] ... bpf: [ on ] CC libbpf.o CC bpf.o CC nlattr.o LD libbpf-in.o LINK libbpf.a make[1]: Leaving directory '/home/foo/trees/bpf/tools/lib/bpf' bpf_elf_map is specific to iproute2. Different BPF ELF loaders can have different formats, for example, the libbpf in the kernel source tree, which is mainly used by perf, has a different specification. iproute2 LLVM is a key part in the toolchain for developing BPF programs.| |---| |https://llvm.org/| |libBPF| |libBPF is a generic BPF library which is developed by the Linux kernel community as part of the kernel

Auto-detecting system features: ... libelf: [ on ] ... bpf: [ on ] CC libbpf.o CC bpf.o CC nlattr.o LD libbpf-in.o LINK libbpf.a make[1]: Leaving directory '/home/foo/trees/bpf/tools/lib/bpf' bpf_elf_map is specific to iproute2. Different BPF ELF loaders can have different formats, for example, the libbpf in the kernel source tree, which is mainly used by perf, has a different specification. iproute2 clang / LLVM is a key part in the toolchain for developing BPF programs. https://llvm.org/ ## • libbpf libbpf is a generic BPF library which is developed by the Linux kernel community as part of the kernel

probability • Used to test disaster recovery readiness ## cgroup-bpf infra • twagent is written in C++ • libbpf [0] for everything-BPF • BPF integration with buck [1] • BTF [2] is enabled everywhere - Programs

] ... bpf: [ on ] CC libbpf.o CC bpf.o CC nlattr.o LD libbpf-in.o LINK libbpf.a make[1]: Leaving directory '/home/foo/trees/bpf/tools/lib/bpf' bpf_elf_map is specific to iproute2. Different BPF ELF loaders can have different formats, for example, the libbpf in the kernel source tree, which is mainly used by perf, has a different specification. iproute2 community. clang / LLVM is a key part in the toolchain for developing BPF programs. https://llvm.org/ libbpf libbpf is a generic BPF library which is developed by the Linux kernel community as part of the kernel

networking & BPF subsystems Goal Fun? ## We will need VM running Linux kernel 5.9+ bpftool 5.9+ libbpf headers ☐ kernel headers ## vm $ uname -r 5.9.1-36.vanilla.1.fc32.x86_64 vm $ bpftool version

eBPF-specific questions #ebpf-lsm Questions on BPF LSM #ebpf-news Contributions to the eBPF Updates #libbpf-go Questions on the eBPF Go library Special Interest Groups All SIGs The following is a list of ] ... bpf: [ on ] CC libbpf.o CC bpf.o CC nlattr.o LD libbpf-in.o LINK libbpf.a make[1]: Leaving directory '/home/foo/trees/bpf/tools/lib/bpf' bpf_elf_map is specific to iproute2. Different BPF ELF loaders can have different formats, for example, the libbpf in the kernel source tree, which is mainly used by perf, has a different specification. iproute2

eBPF-specific questions #ebpf-lsm Questions on BPF LSM #ebpf-news Contributions to the eBPF Updates #libbpf-go Questions on the eBPF Go library Special Interest Groups All SIGs The following is a list of ] ... bpf: [ on ] CC libbpf.o CC bpf.o CC nlattr.o LD libbpf-in.o LINK libbpf.a make[1]: Leaving directory '/home/foo/trees/bpf/tools/lib/bpf' bpf_elf_map is specific to iproute2. Different BPF ELF loaders can have different formats, for example, the libbpf in the kernel source tree, which is mainly used by perf, has a different specification. iproute2