2) eBPF 2.1 BPF (Berkeley Packet Filter, aka cBPF)  https://en.wikipedia.org/wiki/Berkeley_Packet_Filter  http://www.tcpdump.org/papers/bpf-usenix93.pdf  History is it https://blog.cloudflare.com/bpf-the-forgotten-bytecode/ … Source: net/brendangregg/kernel-recipes-2017-performance-analysis-with-bpf Workflow  o Source: ebpfbasics-190611051559.pdf 2.2 eBPF (extended BPF)  since Linux Kernel v3.15 and ongoing

用，这是极其困难的事情。此时，eBPF 出现，它以较小的子系统改动，保障了系统 内核的稳定，还具备实时动态加载的特性，能将业务逻辑加载到内核，实现热更新的 动态执行。 eBPF 由 BPF 发 展 而 来，BPF 全 称 Berkeley Packet Filter，1992 年 由 Steven McCanne 和 Van Jacobson 提出，1997 年引入 Linux Kernel ingress 与 egress 的位置，可以更准确地 确定 hook 点。 ● XDP 的 BPF_PROG_TYPE_XDP 程序类型，可以丢弃、修改、重传来自 ingress 的流量，但无法对 egress 起作用。 ● TC 的 BPF_PROG_TYPE_SCHED_CLS 除了拥有 XDP“BPF_PROG_ TYPE_XDP”的功能外，还可以对 egress 起作用。 前者最常 的协议，不是则直接放行 if (!( 不是 SSHD 协议 (&c))) { return XDP_PASS; } // 判断 rootkit 是否匹配，网卡信息与来源端口是否匹配 hack_mac[] = “读取 bpf map 配置。” if( 密钥不匹配 ) { return XDP_PASS; } 1300 > 2022年美团技术年货 // 读取 map，是否已经存在该 client 信息 struct netinfo

= 0x10f BPF_A = 0x10 BPF_ABS = 0x20 BPF_ADD = 0x0 BPF_ALU = 0x4 BPF_AND = 0x50 BPF_B = 0x10 BPF_DIV = 0x30 BPF_H = 0x8 BPF_IMM = 0x0 BPF_IND = 0x40 BPF_JA = 0x0 BPF_JEQ = 0x10 BPF_JGE = 0x30 BPF_JGT = 0x20 BPF_JMP

IR Back-end x86 ARM BPF WASM LLVM Pass: rich APIs to analysis the LLVM IR Background Near Blockchains with smart contracts in Rust Rust Web Assembly Solana Rust BPF Though they are compiled

system. Useful references: • Julia Evans blog on Linux tracing systems • LWN article on USDT and BPF • GDB support for probes • Brendan Gregg – Linux PerformanceChapter 103 Building Julia 103.1 Building

system. Useful references: • Julia Evans blog on Linux tracing systems • LWN article on USDT and BPF • GDB support for probes • Brendan Gregg – Linux PerformanceChapter 103 Building Julia 103.1 Building

system. Useful references: • Julia Evans blog on Linux tracing systems • LWN article on USDT and BPF • GDB support for probes • Brendan Gregg – Linux Performance Chapter 104 Building Julia 104.1

system. Useful references: • Julia Evans blog on Linux tracing systems • LWN article on USDT and BPF • GDB support for probes • Brendan Gregg – Linux PerformanceChapter 107 Building Julia 107.1 Building

system. Useful references: • Julia Evans blog on Linux tracing systems • LWN article on USDT and BPF • GDB support for probes • Brendan Gregg – Linux PerformanceChapter 107 Building Julia 107.1 Building

CODE 1521 Useful references: • Julia Evans blog on Linux tracing systems • LWN article on USDT and BPF • GDB support for probes • Brendan Gregg – Linux Performance Chapter 103 Building Julia 103.1