Copyright © 2024 TOYOTA MOTOR CORPORATION All rights reserved.
Prepare for operating eBPF programs in prod
⚫ Confirm kernel facilities for eBPF
⚫ Available facilities for eBPF depend on kernel versions and architectures.
⚫ For example, eBPF tracing programs (fentry/fexit/fmod_ret/lsm) on
arm64 was not supported before introducing ftrace direct call
support(v6.4).
✓ https://lore.kernel.org/bpf/
[email protected]/
⚫ Observe eBPF utilization in prod
⚫ If you want to load it in prod, we should observe not only applications
but eBPF programs.
⚫ Understand Linux Kernel internals for eBPF
⚫ Ex1. Memory leak in bpffs
⚫ Ex2. The behavior of bpf_send_signal
⚫ Ex3. uprobes in a separated mount namespace
8