eBPF enables: ▶ Fine-grained system introspection ▶ Integration of cross-layer state (kprobes, uprobes, etc.) with policy enforcement (LSM probes) ▶ Rapid prototyping ▶ Safe production deployment of the Python3 bcc framework ▶ Kernelspace components are all eBPF ▶ LSM probes (KRSI), kprobes, uprobes, tracepoints ▶ Under 2000 source lines of kernelspace code Thanks to eBPF, bpfbox is light-weight

[Image](/uploads/documents/6/7/f/b/67fb97f40f52a63942230afc50af9547/p4_1.jpg) ## Tracing Go function with uprobes  ## Demo time ! 7/p6_1.jpg) ## Conclusions • eBPF programs can be attached to different events: ☐ Kprobes ☐ uprobes Tracepoints ☐ network packets... • Frameworks. Go bindings. options make it easier: ☐ First approach:

colspan="10">Tracepointsuprobesuprobesuprobesuprobesuprobesuprobesuprobesuprobesuprobesuprobes

0 码力 | 84 页 | 9.60 MB | 2 年前

3

6609b1:00 6609b2: f2 0f 10 0d 36 a6 0f movsd 0xfe636(%rip),%xmm1 ## Using uprobes  ## What does the The function is simply invoked whenever main.computeE is called. - The registration is done via UProbes - It attaches to every running version of the binary #include B

Go applications without having to modify their source code. Instrumentation is done by using eBPF uprobes. Automatic instrumentation is available for a wide range of Go applications: Go version 1.12 and

Dynamic Event Static Event Perfevent instrumentations Ftrace (Function trace) kprobes uprobes Tracepoint Performance counter Source: “Dynamic Probes for Linux”, Masami Hiramatsu, Tracing

programs, there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsections provide further details on individual aspects of the upon BPF programs hooking into kernel infrastructure based upon kprobes, kretprobes, tracepoints, uprobes, uretprobes as well as USDT probes. The collection provides close to hundred tools targeting different linux-bpf-superpowers.html Feb 2016, Linux eBPF/bcc uprobes, Brendan Gregg, http://www.brendangregg.com/blog/2016-02-08/linux-ebpf-bcc-uprobes.html Feb 2016, Who is waking the waker? (Linux chain

programs, there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsections provide further details on individual aspects of the upon BPF programs hooking into kernel infrastructure based upon kprobes, kretprobes, tracepoints, uprobes, uretprobes as well as USDT probes. The collection provides close to hundred tools targeting different x-bpf-superpowers.html 10. Feb 2016, Linux eBPF/bcc uprobes, Brendan Gregg, http://www.brendangregg.com/blog/2016-02-08/linux-ebpf-bcc-uprobes.html 9. Feb 2016, Who is waking the waker? (Linux chain

programs, there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsections provide further details on individual aspects of the upon BPF programs hooking into kernel infrastructure based upon kprobes, kretprobes, tracepoints, uprobes, uretprobes as well as USDT probes. The collection provides close to hundred tools targeting different nux-bpf-superpowers.html 10. Feb 2016, Linux eBPF/bcc uprobes, Brendan Gregg, http://www.brendangregg.com/blog/2016-02-08/linux-ebpf-bcc- uprobes.html 9. Feb 2016, Who is waking the waker? (Linux chain

programs, there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsections provide further details on individual aspects of the upon BPF programs hooking into kernel infrastructure based upon kprobes, kretprobes, tracepoints, uprobes, uretprobes as well as USDT probes. The collection provides close to hundred tools targeting different nux-bpf-superpowers.html 10. Feb 2016, Linux eBPF/bcc uprobes, Brendan Gregg, http://www.brendangregg.com/blog/2016-02-08/linux-ebpf-bcc- uprobes.html 9. Feb 2016, Who is waking the waker? (Linux chain