mirror of
https://github.com/eunomia-bpf/bpf-developer-tutorial.git
synced 2026-10-29 19:58:08 +08:00
Add eBPF tutorial templates and update SUMMARY files
- Created SUMMARY.md.template and SUMMARY.zh.md.template for eBPF tutorial. - Updated generate_toc.py to generate table of contents for English and Chinese versions. - Added configuration files for new eBPF examples, categorizing them by level and type. - Updated SUMMARY.md and SUMMARY.zh.md to reflect new lessons and reorganized sections. - Introduced new features related to GPU and tracing in the tutorial.
This commit is contained in:
yunwei37
141
src/SUMMARY.md
141
src/SUMMARY.md
@@ -6,87 +6,94 @@ This tutorial does not cover complex concepts and scenario introductions. Its ma
|
||||
|
||||
For the complete source code of the tutorial, please refer to the repo [https://github.com/eunomia-bpf/bpf-developer-tutorial](https://github.com/eunomia-bpf/bpf-developer-tutorial) on GitHub. **If you find this tutorial helpful, please give us a star!**
|
||||
|
||||
# Getting Started Examples
|
||||
## Table of Contents
|
||||
|
||||
### Getting Started Examples
|
||||
|
||||
This section contains simple eBPF program examples and introductions. It primarily utilizes the `eunomia-bpf` framework to simplify development and introduces the basic usage and development process of eBPF.
|
||||
|
||||
- [lesson 0-introduce](0-introduce/README.md) Introduction to Core Concepts and Tools
|
||||
- [lesson 1-helloworld](1-helloworld/README.md) Hello World, Framework and Development
|
||||
- [lesson 2-kprobe-unlink](2-kprobe-unlink/README.md) Monitoring unlink System Calls with kprobe
|
||||
- [lesson 3-fentry-unlink](3-fentry-unlink/README.md) Monitoring unlink System Calls with fentry
|
||||
- [lesson 4-opensnoop](4-opensnoop/README.md) Capturing Opening Files and Filter with Global Variables
|
||||
- [lesson 5-uprobe-bashreadline](5-uprobe-bashreadline/README.md) Capturing readline Function Calls with Uprobe
|
||||
- [lesson 6-sigsnoop](6-sigsnoop/README.md) Capturing Signal Sending and Store State with Hash Maps
|
||||
- [lesson 7-execsnoop](7-execsnoop/README.md) Capturing Process Execution, Output with perf event array
|
||||
- [lesson 8-exitsnoop](8-exitsnoop/README.md) Monitoring Process Exit Events, Output with Ring Buffer
|
||||
- [lesson 9-runqlat](9-runqlat/README.md) Capturing Scheduling Latency and Recording as Histogram
|
||||
- [lesson 10-hardirqs](10-hardirqs/README.md) Capturing Interrupts with hardirqs or softirqs
|
||||
|
||||
# Advanced Documents and Examples
|
||||
- [lesson 0-introduce](src/0-introduce/README.md) Introduction to Core Concepts and Tools
|
||||
- [lesson 1-helloworld](src/1-helloworld/README.md) Hello World, Framework and Development
|
||||
- [lesson 2-kprobe-unlink](src/2-kprobe-unlink/README.md) Monitoring unlink System Calls with kprobe
|
||||
- [lesson 3-fentry-unlink](src/3-fentry-unlink/README.md) Monitoring unlink System Calls with fentry
|
||||
- [lesson 4-opensnoop](src/4-opensnoop/README.md) Capturing Opening Files and Filter with Global Variables
|
||||
- [lesson 5-uprobe-bashreadline](src/5-uprobe-bashreadline/README.md) Capturing readline Function Calls with Uprobe
|
||||
- [lesson 6-sigsnoop](src/6-sigsnoop/README.md) Capturing Signal Sending and Store State with Hash Maps
|
||||
- [lesson 7-execsnoop](src/7-execsnoop/README.md) Capturing Process Execution, Output with perf event array
|
||||
- [lesson 8-exitsnoop](src/8-exitsnoop/README.md) Monitoring Process Exit Events, Output with Ring Buffer
|
||||
- [lesson 9-runqlat](src/9-runqlat/README.md) Capturing Scheduling Latency and Recording as Histogram
|
||||
- [lesson 10-hardirqs](src/10-hardirqs/README.md) Capturing Interrupts with hardirqs or softirqs
|
||||
### Advanced Documents and Examples
|
||||
|
||||
We start to build complete eBPF projects mainly based on `libbpf` and combine them with various application scenarios for practical use.
|
||||
|
||||
- [lesson 11-bootstrap](11-bootstrap/README.md) Develop User-Space Programs with libbpf and Trace exec() and exit()
|
||||
- [lesson 12-profile](12-profile/README.md) Using eBPF Program Profile for Performance Analysis
|
||||
- [lesson 13-tcpconnlat](13-tcpconnlat/README.md) Statistics of TCP Connection Delay with libbpf
|
||||
- [lesson 14-tcpstates](14-tcpstates/README.md) Recording TCP Connection Status and TCP RTT
|
||||
- [lesson 15-javagc](15-javagc/README.md) Capturing User-Space Java GC Duration Using USDT
|
||||
- [lesson 16-memleak](16-memleak/README.md) Monitoring Memory Leaks
|
||||
- [lesson 17-biopattern](17-biopattern/README.md) Count Random/Sequential Disk I/O
|
||||
- [lesson 18-further-reading](18-further-reading/README.md) More Reference Materials： papers, projects
|
||||
- [lesson 19-lsm-connect](19-lsm-connect/README.md) Security Detection and Defense using LSM
|
||||
- [lesson 20-tc](20-tc/README.md) tc Traffic Control
|
||||
- [lesson 21-xdp](21-xdp/README.md) Programmable Packet Processing with XDP
|
||||
|
||||
# In-Depth Topics
|
||||
- [lesson 11-bootstrap](src/11-bootstrap/README.md) Develop User-Space Programs with libbpf and Trace exec() and exit()
|
||||
- [lesson 12-profile](src/12-profile/README.md) Using eBPF Program Profile for Performance Analysis
|
||||
- [lesson 13-tcpconnlat](src/13-tcpconnlat/README.md) Statistics of TCP Connection Delay with libbpf
|
||||
- [lesson 14-tcpstates](src/14-tcpstates/README.md) Recording TCP Connection Status and TCP RTT
|
||||
- [lesson 15-javagc](src/15-javagc/README.md) Capturing User-Space Java GC Duration Using USDT
|
||||
- [lesson 16-memleak](src/16-memleak/README.md) Monitoring Memory Leaks
|
||||
- [lesson 17-biopattern](src/17-biopattern/README.md) Count Random/Sequential Disk I/O
|
||||
- [lesson 18-further-reading](src/18-further-reading/README.md) More Reference Materials： papers, projects
|
||||
- [lesson 19-lsm-connect](src/19-lsm-connect/README.md) Security Detection and Defense using LSM
|
||||
- [lesson 20-tc](src/20-tc/README.md) tc Traffic Control
|
||||
- [lesson 21-xdp](src/21-xdp/README.md) Programmable Packet Processing with XDP
|
||||
### In-Depth Topics
|
||||
|
||||
This section covers advanced topics related to eBPF, including using eBPF programs on Android, possible attacks and defenses using eBPF programs, and complex tracing. Combining the user-mode and kernel-mode aspects of eBPF can bring great power (as well as security risks).
|
||||
|
||||
Android:
|
||||
|
||||
- [lesson 22-android](22-android/README.md) Using eBPF Programs on Android
|
||||
|
||||
Networking:
|
||||
|
||||
- [lesson 23-http](23-http/README.md) L7 Tracing with eBPF: HTTP and Beyond via Socket Filters and Syscall Tracepoints
|
||||
- [lesson 29-sockops](29-sockops/README.md) Accelerating Network Request Forwarding with Sockops
|
||||
- [lesson 41-xdp-tcpdump](41-xdp-tcpdump/README.md) Capturing TCP Information with XDP
|
||||
- [lesson 42-xdp-loadbalancer](42-xdp-loadbalancer/README.md) XDP Load Balancer
|
||||
|
||||
Security:
|
||||
|
||||
- [lesson 24-hide](24-hide/README.md) Hiding Process or File Information
|
||||
- [lesson 25-signal](25-signal/README.md) Using bpf_send_signal to Terminate Malicious Processes in eBPF
|
||||
- [lesson 26-sudo](26-sudo/README.md) Using eBPF to add sudo user
|
||||
- [lesson 27-replace](27-replace/README.md) Replace Text Read or Written by Any Program with eBPF
|
||||
- [lesson 28-detach](28-detach/README.md) Running eBPF After Application Exits: The Lifecycle of eBPF Programs
|
||||
- [lesson 34-syscall](34-syscall/README.md) Modifying System Call Arguments with eBPF
|
||||
|
||||
Scheduler:
|
||||
|
||||
- [lesson 44-scx-simple](44-scx-simple/README.md) Introduction to the BPF Scheduler
|
||||
- [lesson 45-scx-nest](45-scx-nest/README.md) Implementing the `scx_nest` Scheduler
|
||||
|
||||
GPU:
|
||||
|
||||
- [lesson 47-cuda-events](47-cuda-events/README.md) Using eBPF to trace CUDA operations for GPU
|
||||
- [lesson 47-cuda-events](src/47-cuda-events/README.md) Tracing CUDA GPU Operations
|
||||
- [lesson xpu/gpu-kernel-driver](src/xpu/gpu-kernel-driver/README.md) Monitoring GPU Driver Activity with Kernel Tracepoints
|
||||
- [lesson xpu/npu-kernel-driver](src/xpu/npu-kernel-driver/README.md) Tracing Intel NPU Kernel Driver Operations
|
||||
|
||||
Other:
|
||||
|
||||
- [lesson 35-user-ringbuf](35-user-ringbuf/README.md) Asynchronously Send to Kernel with User Ring Buffer
|
||||
- [lesson 36-userspace-ebpf](36-userspace-ebpf/README.md) Userspace eBPF Runtimes: Overview and Applications
|
||||
- [lesson 38-btf-uprobe](38-btf-uprobe/README.md) Expanding eBPF Compile Once, Run Everywhere(CO-RE) to Userspace Compatibility
|
||||
- [lesson 43-kfuncs](43-kfuncs/README.md) Extending eBPF Beyond Its Limits: Custom kfuncs in Kernel Modules
|
||||
Scheduler:
|
||||
|
||||
- [lesson 44-scx-simple](src/44-scx-simple/README.md) Introduction to the BPF Scheduler
|
||||
- [lesson 45-scx-nest](src/45-scx-nest/README.md) Implementing the `scx_nest` Scheduler
|
||||
|
||||
|
||||
Networking:
|
||||
|
||||
- [lesson 23-http](src/23-http/README.md) L7 Tracing with eBPF: HTTP and Beyond via Socket Filters and Syscall Tracepoints
|
||||
- [lesson 29-sockops](src/29-sockops/README.md) Accelerating Network Request Forwarding with Sockops
|
||||
- [lesson 41-xdp-tcpdump](src/41-xdp-tcpdump/README.md) Capturing TCP Information with XDP
|
||||
- [lesson 42-xdp-loadbalancer](src/42-xdp-loadbalancer/README.md) XDP Load Balancer
|
||||
- [lesson 46-xdp-test](src/46-xdp-test/README.md) Building a High-Performance XDP Packet Generator
|
||||
|
||||
|
||||
Tracing:
|
||||
|
||||
- [lesson 48-energy](src/48-energy/README.md) Energy Monitoring for Process-Level Power Analysis
|
||||
|
||||
|
||||
Security:
|
||||
|
||||
- [lesson 24-hide](src/24-hide/README.md) Hiding Process or File Information
|
||||
- [lesson 25-signal](src/25-signal/README.md) Using bpf_send_signal to Terminate Malicious Processes in eBPF
|
||||
- [lesson 26-sudo](src/26-sudo/README.md) Using eBPF to add sudo user
|
||||
- [lesson 27-replace](src/27-replace/README.md) Replace Text Read or Written by Any Program with eBPF
|
||||
- [lesson 28-detach](src/28-detach/README.md) Running eBPF After Application Exits: The Lifecycle of eBPF Programs
|
||||
- [lesson 34-syscall](src/34-syscall/README.md) Modifying System Call Arguments with eBPF
|
||||
|
||||
|
||||
Features:
|
||||
|
||||
- [lesson 35-user-ringbuf](src/35-user-ringbuf/README.md) Asynchronously Send to Kernel with User Ring Buffer
|
||||
- [lesson 36-userspace-ebpf](src/36-userspace-ebpf/README.md) Userspace eBPF Runtimes: Overview and Applications
|
||||
- [lesson 38-btf-uprobe](src/38-btf-uprobe/README.md) Expanding eBPF Compile Once, Run Everywhere(CO-RE) to Userspace Compatibility
|
||||
- [lesson 43-kfuncs](src/43-kfuncs/README.md) Extending eBPF Beyond Its Limits: Custom kfuncs in Kernel Modules
|
||||
- [features bpf_iters](src/features/bpf_iters/README.md) BPF Iterators for Kernel Data Export
|
||||
- [features bpf_arena](src/features/bpf_arena/README.md) BPF Arena for Zero-Copy Shared Memory
|
||||
- [features bpf_wq](src/features/bpf_wq/README.md) BPF Workqueues for Asynchronous Sleepable Tasks
|
||||
|
||||
|
||||
Android:
|
||||
|
||||
- [lesson 22-android](src/22-android/README.md) Using eBPF Programs on Android
|
||||
|
||||
Continuously updating...
|
||||
|
||||
# bcc and bpftrace tutorial
|
||||
|
||||
For reference:
|
||||
|
||||
- [BPF Features by Linux Kernel Version](bcc-documents/kernel-versions.md)
|
||||
- [Kernel Configuration for BPF Features](bcc-documents/kernel_config.md)
|
||||
- [bcc Reference Guide](bcc-documents/reference_guide.md)
|
||||
- [Special Filtering](bcc-documents/special_filtering.md)
|
||||
- [bcc Tutorial](bcc-documents/tutorial.md)".- [bcc Python Developer Tutorial](bcc-documents/tutorial_bcc_python_developer.md)
|
||||
- [bpftrace Tutorial](bpftrace-tutorial/README.md)
|
||||
|
||||
Reference in New Issue
Block a user