O'Reilly logo

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Linux Observability with BPF

Book Description

With Early Release ebooks, you get books in their earliest form—the author's raw and unedited content as he or she writes—so you can take advantage of these technologies long before the official release of these titles.

Want to master the BPF virtual machine in the Linux Kernel? This practical guide shows you how to write applications that use BPF to observe and modify the kernel’s behavior on demand—without having prior knowledge of Linux Kernel development. David Calavera and Lorenzo Fontana introduce concepts to help systems engineers understand the BPF program lifecycle.

If you have knowledge about performance optimization, networking, and security, this book shows you how to inject code to monitor, trace, and observe events in the kernel in a secure way—without the need to recompile the kernel or reboot the system. You’ll find code examples in C, Go, and Python.

Table of Contents

  1. 1. Running Your First BPF Programs
    1. Writing BPF programs
    2. BPF program types
      1. BPF_PROG_TYPE_SOCKET_FILTER
      2. BPF_PROG_TYPE_KPROBE
      3. BPF_PROG_TYPE_TRACEPOINT
      4. BPF_PROG_TYPE_XDP
      5. BPF_PROG_TYPE_PERF_EVENT
      6. BPF_PROG_TYPE_CGROUP_SKB
      7. BPF_PROG_TYPE_CGROUP_SOCK
      8. BPF_PROG_TYPE_SOCK_OPS
      9. BPF_PROG_TYPE_SK_SKB
      10. BPF_PROG_TYPE_CGROUP_DEVICE
      11. BPF_PROG_TYPE_SK_MSG
      12. BPF_PROG_TYPE_RAW_TRACEPOINT
      13. BPF_PROG_TYPE_CGROUP_SOCK_ADDR
      14. BPF_PROG_TYPE_SK_REUSEPORT
      15. BPF_PROG_TYPE_FLOW_DISSECTOR
      16. Uncovered programs
    3. The BPF verifier
    4. Conclusion
  2. 2. Understanding BPF Data Structures and User-Space Communication
    1. Creating BPF Maps
    2. Working with BFP Maps
    3. Types of BPF Maps
      1. BPF_MAP_TYPE_HASH
      2. BPF_MAP_TYPE_ARRAY
      3. BPF_MAP_TYPE_PROG_ARRAY
      4. BPF_MAP_TYPE_PERF_EVENT_ARRAY
      5. BPF_MAP_TYPE_PERCPU_HASH
      6. BPF_MAP_TYPE_PERCPU_ARRAY
      7. BPF_MAP_TYPE_STACK_TRACE
      8. BPF_MAP_TYPE_CGROUP_ARRAY
      9. BPF_MAP_TYPE_LPM_TRIE
      10. BPF_MAP_TYPE_DEVMAP
      11. BPF_MAP_TYPE_CPUMAP
      12. BPF_MAP_TYPE_XSKMAP
      13. BPF_MAP_TYPE_REUSEPORT_SOCKARRAY
      14. BPF_MAP_TYPE_QUEUE
      15. BPF_MAP_TYPE_STACK
      16. Concurrent access to map elements
    4. The BPF Virtual File System
    5. Conclusion
  3. 3. Tracing with BPF
    1. Probes
      1. Kernel probes
      2. Tracepoints
      3. User-space probes
      4. User Statically Defined Tracepoints
    2. Visualizing tracing data
      1. Histograms
      2. Perf events
    3. Conclusion
  4. 4. Linux Networking and BPF
    1. BPF and Packet filtering
      1. Tcpdmp and BPF expressions
      2. Packet filtering for raw sockets (BPF_PROG_TYPE_SOCKET_FILTER)
    2. BPF Based Traffic Control Classifier
      1. Terminology
      2. Traffic Control classifier program using cls_bpf
      3. Differences between TC and XDP
    3. Conclusion
  5. Index