Linux Observability with BPF Reading Notes
I read Linux Observability with BPF, so I’ll leave some notes. This month, Brendan Gregg’s BPF book is also coming out, so I’d like to read that too. Using BPF allows hooking kernel events and safely executing code BPF verifies that the code won’t destroy or crash the system Unlike kernel modules, BPF programs don’t require kernel recompilation After BPF code is verified, BPF bytecode is JIT-compiled to machine instructions BPF programs are loaded into the BPF VM by the bpf syscall Alexei Starovoitov introduced eBPF in early 2014 Old BPF only allowed 2 32-bit registers, but eBPF allows up to 10 64-bit registers In June 2014, eBPF was also extended to user space BPF program types: Can be broadly classified into tracing and networking Socket Filter: First program type to enter the kernel....