diff --git a/src/15-javagc/README.md b/src/15-javagc/README.md index e6e7381..762fc55 100644 --- a/src/15-javagc/README.md +++ b/src/15-javagc/README.md @@ -77,7 +77,7 @@ Java, as a high-level programming language, has automatic garbage collection (GC In the following tutorial, we will demonstrate how to use eBPF and USDT to monitor and analyze the duration of Java GC events. We hope this content will be helpful to you in your work with eBPF for application performance analysis. -USDT in kernel mode eBPF runtime may also cause relatively large performance overhead. In this case, you can also consider using user mode eBPF runtime, such as [bpftime](https://github.com/eunomia-bpf/bpftime). bpftime is a user mode eBPF runtime based on LLVM JIT/AOT. It can run eBPF programs in user mode and is compatible with kernel mode eBPF, avoiding context switching between kernel mode and user mode, thereby improving the execution efficiency of eBPF programs by 10 times. +USDT can also be used with a user-space eBPF runtime such as [bpftime](https://github.com/eunomia-bpf/bpftime) to reduce overhead; for uprobe examples, see [5-uprobe-bashreadline](../5-uprobe-bashreadline/README.md). ## eBPF Implementation Mechanism diff --git a/src/15-javagc/README.zh.md b/src/15-javagc/README.zh.md index 7dd1e27..74237c2 100644 --- a/src/15-javagc/README.zh.md +++ b/src/15-javagc/README.zh.md @@ -71,7 +71,7 @@ Notes at offset 0x00c43058 with length 0x00000494: 在这一点上，你可以使用 SystemTap 或者 LTTng 来跟踪这些探针。然而，内置的 Linux 跟踪器，比如 ftrace 和 perf_events，目前还无法做到这一点（尽管 perf_events 的支持正在开发中）。 -USDT 在内核态 eBPF 运行时，也可能产生比较大的性能开销，这时候也可以考虑使用用户态 eBPF 运行时，例如 [bpftime](https://github.com/eunomia-bpf/bpftime)。bpftime 是一个基于 LLVM JIT/AOT 的用户态 eBPF 运行时，它可以在用户态运行 eBPF 程序，和内核态的 eBPF 兼容，避免了内核态和用户态之间的上下文切换，从而提高了 eBPF 程序的执行效率。对于 uprobe 而言，bpftime 的性能开销比 kernel 小一个数量级。 +USDT 也可配合用户态 eBPF 运行时（如 [bpftime](https://github.com/eunomia-bpf/bpftime)）使用，以降低开销；uprobe 相关的示例详见 [5-uprobe-bashreadline](../5-uprobe-bashreadline/README.zh.md)。 ## Java GC 介绍 diff --git a/src/16-memleak/README.md b/src/16-memleak/README.md index 6b36c2e..a78438f 100644 --- a/src/16-memleak/README.md +++ b/src/16-memleak/README.md @@ -44,7 +44,7 @@ Over time, it becomes evident that the `main` function of the `allocs` process i At a basic level, `memleak` operates by installing monitoring devices on the memory allocation and deallocation paths. It achieves this by inserting eBPF programs into memory allocation and deallocation functions. This means that when these functions are called, `memleak` will record important information, such as the caller's process ID (PID), the allocated memory address, and the size of the allocated memory. When the function for freeing memory is called, `memleak` will delete the corresponding memory allocation record in its internal map. This mechanism allows `memleak` to accurately trace which memory blocks have been allocated but not deallocated.For commonly used memory allocation functions in user space, such as `malloc` and `calloc`, `memleak` uses user space probing (uprobe) technology for monitoring. Uprobe is a dynamic tracing technology for user space applications, which can set breakpoints at any location at runtime without modifying the binary files, thus achieving tracing of specific function calls. -Uprobe in kernel mode eBPF runtime may also cause relatively large performance overhead. In this case, you can also consider using user mode eBPF runtime, such as [bpftime](https://github.com/eunomia-bpf/bpftime). bpftime is a user mode eBPF runtime based on LLVM JIT/AOT. It can run eBPF programs in user mode and is compatible with kernel mode eBPF, avoiding context switching between kernel mode and user mode, thereby improving the execution efficiency of eBPF programs by 10 times. +Uprobe can also be used with a user-space eBPF runtime such as [bpftime](https://github.com/eunomia-bpf/bpftime) to reduce overhead; see [5-uprobe-bashreadline](../5-uprobe-bashreadline/README.md). For kernel space memory allocation functions, such as `kmalloc`, `memleak` chooses to use tracepoints for monitoring. Tracepoint is a dynamic tracing technology provided in the Linux kernel, which can dynamically trace specific events in the kernel at runtime without recompiling the kernel or loading kernel modules. diff --git a/src/16-memleak/README.zh.md b/src/16-memleak/README.zh.md index 6d78143..f04fd36 100644 --- a/src/16-memleak/README.zh.md +++ b/src/16-memleak/README.zh.md @@ -44,7 +44,7 @@ Attaching to pid 5193, Ctrl+C to quit. 在基本层面上，`memleak` 的工作方式类似于在内存分配和释放路径上安装监控设备。它通过在内存分配和释放函数中插入 eBPF 程序来达到这个目标。这意味着，当这些函数被调用时，`memleak` 就会记录一些重要信息，如调用者的进程 ID（PID）、分配的内存地址以及分配的内存大小等。当释放内存的函数被调用时，`memleak` 则会在其内部的映射表（map）中删除相应的内存分配记录。这种机制使得 `memleak` 能够准确地追踪到哪些内存块已被分配但未被释放。 -对于用户态的常用内存分配函数，如 `malloc` 和 `calloc` 等，`memleak` 利用了用户态探测（uprobe）技术来实现监控。uprobe 是一种用于用户空间应用程序的动态追踪技术，它可以在运行时不修改二进制文件的情况下在任意位置设置断点，从而实现对特定函数调用的追踪。Uprobe 在内核态 eBPF 运行时，也可能产生比较大的性能开销，这时候也可以考虑使用用户态 eBPF 运行时，例如 [bpftime](https://github.com/eunomia-bpf/bpftime)。bpftime 是一个基于 LLVM JIT/AOT 的用户态 eBPF 运行时，它可以在用户态运行 eBPF 程序，和内核态的 eBPF 兼容，避免了内核态和用户态之间的上下文切换，从而提高了 eBPF 程序的执行效率。对于 uprobe 而言，bpftime 的性能开销比 kernel 小一个数量级。 +对于用户态的常用内存分配函数，如 `malloc` 和 `calloc` 等，`memleak` 利用了用户态探测（uprobe）技术来实现监控。uprobe 是一种用于用户空间应用程序的动态追踪技术，它可以在运行时不修改二进制文件的情况下在任意位置设置断点，从而实现对特定函数调用的追踪。Uprobe 也可配合用户态 eBPF 运行时（如 [bpftime](https://github.com/eunomia-bpf/bpftime)）使用，以降低开销；详见 [5-uprobe-bashreadline](../5-uprobe-bashreadline/README.zh.md)。 对于内核态的内存分配函数，如 `kmalloc` 等，`memleak` 则选择使用了 tracepoint 来实现监控。Tracepoint 是一种在 Linux 内核中提供的动态追踪技术，它可以在内核运行时动态地追踪特定的事件，而无需重新编译内核或加载内核模块。 diff --git a/src/30-sslsniff/README.md b/src/30-sslsniff/README.md index 5b04128..f331d38 100644 --- a/src/30-sslsniff/README.md +++ b/src/30-sslsniff/README.md @@ -44,7 +44,7 @@ TLS and SSL don't perfectly align with any single layer of the OSI model or the eBPF (Extended Berkeley Packet Filter): It's a kernel technology that allows users to run predefined programs in the kernel space without modifying kernel source code or reloading modules. It creates a bridge that enables interaction between user space and kernel space, providing unprecedented capabilities for tasks like system monitoring, performance analysis, and network traffic analysis. -uprobes are a significant feature of eBPF, allowing dynamic insertion of probe points in user space applications, particularly useful for tracking function calls in SSL/TLS libraries. Uprobe in kernel mode eBPF runtime may also cause relatively large performance overhead. In this case, you can also consider using user mode eBPF runtime, such as [bpftime](https://github.com/eunomia-bpf/bpftime)。bpftime is a user mode eBPF runtime based on LLVM JIT/AOT. It can run eBPF programs in user mode and is compatible with kernel mode eBPF, avoiding context switching between kernel mode and user mode, thereby improving the execution efficiency of eBPF programs. bpftime can have a performance overhead that is one order of magnitude smaller than that of kernel mode eBPF. +uprobes are a significant feature of eBPF, allowing dynamic insertion of probe points in user space applications, particularly useful for tracking function calls in SSL/TLS libraries. Uprobe can also be used with a user-space eBPF runtime such as [bpftime](https://github.com/eunomia-bpf/bpftime) to reduce overhead; see [5-uprobe-bashreadline](../5-uprobe-bashreadline/README.md). ### User-Space Libraries diff --git a/src/30-sslsniff/README.zh.md b/src/30-sslsniff/README.zh.md index 4678810..d18f4c3 100644 --- a/src/30-sslsniff/README.zh.md +++ b/src/30-sslsniff/README.zh.md @@ -42,7 +42,7 @@ TLS 和 SSL 不完全适合 OSI 模型或 TCP/IP 模型的任何单一层次。T eBPF (Extended Berkeley Packet Filter): 是一种内核技术，允许用户在内核空间中运行预定义的程序，不需要修改内核源代码或重新加载模块。它创建了一个桥梁，使得用户空间和内核空间可以交互，从而为系统监控、性能分析和网络流量分析等任务提供了无前例的能力。 -uprobes 是eBPF的一个重要特性，允许我们在用户空间应用程序中动态地插入探测点，特别适用于跟踪SSL/TLS库中的函数调用。Uprobe 在内核态 eBPF 运行时，也可能产生比较大的性能开销，这时候也可以考虑使用用户态 eBPF 运行时，例如 [bpftime](https://github.com/eunomia-bpf/bpftime)。bpftime 是一个基于 LLVM JIT/AOT 的用户态 eBPF 运行时，它可以在用户态运行 eBPF 程序，和内核态的 eBPF 兼容，避免了内核态和用户态之间的上下文切换，从而提高了 eBPF 程序的执行效率。对于 uprobe 而言，bpftime 的性能开销比 kernel 小一个数量级。 +uprobes 是eBPF的一个重要特性，允许我们在用户空间应用程序中动态地插入探测点，特别适用于跟踪SSL/TLS库中的函数调用。Uprobe 也可配合用户态 eBPF 运行时（如 [bpftime](https://github.com/eunomia-bpf/bpftime)）使用，以降低开销；详见 [5-uprobe-bashreadline](../5-uprobe-bashreadline/README.zh.md)。 ### 用户态库