mirror of
https://github.com/eunomia-bpf/bpf-developer-tutorial.git
synced 2026-02-02 17:59:47 +08:00
@@ -166,7 +166,7 @@ $ sudo su
|
||||
面对创建一个 eBPF 项目,您是否对如何开始搭建环境以及选择编程语言感到困惑?别担心,我们为您准备了一系列 GitHub 模板,以便您快速启动一个全新的eBPF项目。只需在GitHub上点击 `Use this template` 按钮,即可开始使用。
|
||||
|
||||
- <https://github.com/eunomia-bpf/libbpf-starter-template>:基于C语言和 libbpf 框架的eBPF项目模板
|
||||
- <https://github.com/eunomia-bpf/cilium-ebpf-starter-template>:基于C语言和cilium/ebpf框架的eBPF项目模板
|
||||
- <https://github.com/eunomia-bpf/cilium-ebpf-starter-template>:基于Go语言和cilium/ebpf框架的eBPF项目模板
|
||||
- <https://github.com/eunomia-bpf/libbpf-rs-starter-template>:基于Rust语言和libbpf-rs框架的eBPF项目模板
|
||||
- <https://github.com/eunomia-bpf/eunomia-template>:基于C语言和eunomia-bpf框架的eBPF项目模板
|
||||
|
||||
|
||||
@@ -16,7 +16,7 @@ Before starting to write eBPF programs, we need to prepare a suitable developmen
|
||||
|
||||
To develop eBPF programs, you need to install the following software and tools:
|
||||
|
||||
- Linux kernel: Since eBPF is a kernel technology, you need to have a relatively new version of the Linux kernel (minimium version 4.8 and above, suggested version is 5.15+ or 6.2+) to support eBPF functionality.
|
||||
- Linux kernel: Since eBPF is a kernel technology, you need to have a relatively new version of the Linux kernel (minimum version 4.8 and above, suggested version is 5.15+ or 6.2+) to support eBPF functionality.
|
||||
- If possible, install a new version of Ubuntu (e.g. 23.10) would be better.
|
||||
- LLVM and Clang: These tools are used to compile eBPF programs. Installing the latest version of LLVM and Clang ensures that you get the best eBPF support.
|
||||
|
||||
@@ -166,7 +166,7 @@ Tracepoints are a kernel static instrumentation technique, technically just trac
|
||||
When faced with creating an eBPF project, are you confused about how to set up the environment and choose a programming language? Don't worry, we have prepared a series of GitHub templates to help you quickly start a brand new eBPF project. Just click the `Use this template` button on GitHub to get started.
|
||||
|
||||
- <https://github.com/eunomia-bpf/libbpf-starter-template>: eBPF project template based on the C language and libbpf framework.
|
||||
- <https://github.com/eunomia-bpf/cilium-ebpf-starter-template>: eBPF project template based on the C language and cilium/ebpf framework.
|
||||
- <https://github.com/eunomia-bpf/cilium-ebpf-starter-template>: eBPF project template based on the Go language and cilium/ebpf framework.
|
||||
- <https://github.com/eunomia-bpf/libbpf-rs-starter-template>: eBPF project template based on the Rust language and libbpf-rs framework.
|
||||
- <https://github.com/eunomia-bpf/eunomia-template>: eBPF project template based on the C language and eunomia-bpf framework.
|
||||
|
||||
|
||||
@@ -269,7 +269,7 @@ An userspace eBPF runtime that allows existing eBPF applications to operate in u
|
||||
- Linux Plumbers: <https://lpc.events/event/17/contributions/1639/>
|
||||
- Repo: <https://github.com/eunomia-bpf/bpftime>
|
||||
|
||||
> It may only limited to centain eBPF program types and usecases, not a general approach for kernel eBPF.
|
||||
> It may only limited to certain eBPF program types and usecases, not a general approach for kernel eBPF.
|
||||
|
||||
## Conclusion
|
||||
|
||||
|
||||
@@ -94,7 +94,7 @@ struct {
|
||||
// Optional Target Parent PID
|
||||
const volatile int target_ppid = 0;
|
||||
|
||||
// These store the string represenation
|
||||
// These store the string representation
|
||||
// of the PID to hide. This becomes the name
|
||||
// of the folder in /proc/
|
||||
const volatile int pid_to_hide_len = 0;
|
||||
|
||||
@@ -94,7 +94,7 @@ In the next part of the code, the program defines a structure called "linux_dire
|
||||
// Optional Target Parent PID
|
||||
const volatile int target_ppid = 0;
|
||||
|
||||
// These store the string represenation
|
||||
// These store the string representation
|
||||
// of the PID to hide. This becomes the name
|
||||
// of the folder in /proc/
|
||||
const volatile int pid_to_hide_len = 0;
|
||||
|
||||
@@ -54,7 +54,7 @@ signal.h
|
||||
|
||||
```c
|
||||
// Simple message structure to get events from eBPF Programs
|
||||
// in the kernel to user spcae
|
||||
// in the kernel to user space
|
||||
#define TASK_COMM_LEN 16
|
||||
struct event {
|
||||
int pid;
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
**UNFINISHED YET**: The offset of goid field is hardcoded. It was only tested on the bundled `go-server-http`. It MAY NOT WORK on other go programs.
|
||||
|
||||
The bundled fo program was compiled using go 1.17.0. The executable and source could be found at folder `go-server-http`.
|
||||
The bundled of program was compiled using go 1.17.0. The executable and source could be found at folder `go-server-http`.
|
||||
|
||||
This example traces the state switch of goroutines, and prints the corresponding state, goid, pid and tgid.
|
||||
|
||||
|
||||
@@ -41,7 +41,7 @@ eBPF 的前身,Berkeley Packet Filter (BPF) —— 20 世纪 90 年代初的
|
||||
| Uprobe | 3224.172760 | 314.569110 | 4 |
|
||||
| Uretprobe | 3996.799580 | 381.270270 | 2 |
|
||||
| Syscall Tracepoint | 151.82801 | 232.57691 | 4 |
|
||||
| Embedding runtime | Not avaliable | 110.008430 | 4 |
|
||||
| Embedding runtime | Not available | 110.008430 | 4 |
|
||||
|
||||
bpftime 可以类似 Kernel 中的 Uprobe 那样,自动将 eBPF 运行时注入到用户空间进程中,无需修改用户空间进程的代码,也无需进行重启进程即可使用。对于 ubpf 和 rbpf 而言,它们依然需要手动编写胶水代码和其他用户空间程序进行集成,相对来说限制了它们的使用场景。在某些场景下,bpftime 可能能作为 kernel eBPF 的一种替代方案,它也不依赖于具体内核版本或 Linux 平台,可以在其他平台上运行。
|
||||
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
|
||||
我们开始主要基于 `libbpf` 构建完整的 eBPF 工程,并且把它和各种应用场景结合起来进行实践。
|
||||
|
||||
- [lesson 11-bootstrap](11-bootstrap/README.md) 使用 libbpf-boostrap 为 eBPF 编写原生的 libbpf 用户态代码,并建立完整的 libbpf 工程。
|
||||
- [lesson 11-bootstrap](11-bootstrap/README.md) 使用 libbpf-bootstrap 为 eBPF 编写原生的 libbpf 用户态代码,并建立完整的 libbpf 工程。
|
||||
- [lesson 12-profile](12-profile/README.md) 使用 eBPF 进行性能分析
|
||||
- [lesson 13-tcpconnlat](13-tcpconnlat/README.md) 记录 TCP 连接延迟,并使用 libbpf 在用户态处理数据
|
||||
- [lesson 14-tcpstates](14-tcpstates/README.md) 记录 TCP 连接状态与 TCP RTT
|
||||
|
||||
@@ -439,7 +439,7 @@ This instruments the `security_bpf` hook and causes it to return `-EPERM`.
|
||||
Changing `return -EPERM` to `return 0` would cause the BPF program
|
||||
to allow the operation instead.
|
||||
|
||||
LSM probes require at least a 5.7+ kernel with the following configuation options set:
|
||||
LSM probes require at least a 5.7+ kernel with the following configuration options set:
|
||||
- `CONFIG_BPF_LSM=y`
|
||||
- `CONFIG_LSM` comma separated string must contain "bpf" (for example,
|
||||
`CONFIG_LSM="lockdown,yama,bpf"`)
|
||||
@@ -829,7 +829,7 @@ Syntax: ```void* ringbuf_reserve(u64 data_size)```
|
||||
|
||||
Return: Pointer to data struct on success, NULL on failure
|
||||
|
||||
A method of the BPF_RINGBUF_OUTPUT table, for reserving space in the ring buffer and simultaenously
|
||||
A method of the BPF_RINGBUF_OUTPUT table, for reserving space in the ring buffer and simultaneously
|
||||
allocating a data struct for output. Must be used with one of ```ringbuf_submit``` or ```ringbuf_discard```.
|
||||
|
||||
Examples in situ: <!-- TODO -->
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Special Filtering
|
||||
|
||||
Some tools have special filtering capabitilies, the main use case is to trace
|
||||
Some tools have special filtering capabilities, the main use case is to trace
|
||||
processes running in containers, but those mechanisms are generic and could
|
||||
be used in other cases as well.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user