mirror of
https://github.com/eunomia-bpf/bpf-developer-tutorial.git
synced 2026-05-08 14:52:40 +08:00
@@ -166,7 +166,7 @@ $ sudo su
|
|||||||
面对创建一个 eBPF 项目,您是否对如何开始搭建环境以及选择编程语言感到困惑?别担心,我们为您准备了一系列 GitHub 模板,以便您快速启动一个全新的eBPF项目。只需在GitHub上点击 `Use this template` 按钮,即可开始使用。
|
面对创建一个 eBPF 项目,您是否对如何开始搭建环境以及选择编程语言感到困惑?别担心,我们为您准备了一系列 GitHub 模板,以便您快速启动一个全新的eBPF项目。只需在GitHub上点击 `Use this template` 按钮,即可开始使用。
|
||||||
|
|
||||||
- <https://github.com/eunomia-bpf/libbpf-starter-template>:基于C语言和 libbpf 框架的eBPF项目模板
|
- <https://github.com/eunomia-bpf/libbpf-starter-template>:基于C语言和 libbpf 框架的eBPF项目模板
|
||||||
- <https://github.com/eunomia-bpf/cilium-ebpf-starter-template>:基于C语言和cilium/ebpf框架的eBPF项目模板
|
- <https://github.com/eunomia-bpf/cilium-ebpf-starter-template>:基于Go语言和cilium/ebpf框架的eBPF项目模板
|
||||||
- <https://github.com/eunomia-bpf/libbpf-rs-starter-template>:基于Rust语言和libbpf-rs框架的eBPF项目模板
|
- <https://github.com/eunomia-bpf/libbpf-rs-starter-template>:基于Rust语言和libbpf-rs框架的eBPF项目模板
|
||||||
- <https://github.com/eunomia-bpf/eunomia-template>:基于C语言和eunomia-bpf框架的eBPF项目模板
|
- <https://github.com/eunomia-bpf/eunomia-template>:基于C语言和eunomia-bpf框架的eBPF项目模板
|
||||||
|
|
||||||
|
|||||||
@@ -16,7 +16,7 @@ Before starting to write eBPF programs, we need to prepare a suitable developmen
|
|||||||
|
|
||||||
To develop eBPF programs, you need to install the following software and tools:
|
To develop eBPF programs, you need to install the following software and tools:
|
||||||
|
|
||||||
- Linux kernel: Since eBPF is a kernel technology, you need to have a relatively new version of the Linux kernel (minimium version 4.8 and above, suggested version is 5.15+ or 6.2+) to support eBPF functionality.
|
- Linux kernel: Since eBPF is a kernel technology, you need to have a relatively new version of the Linux kernel (minimum version 4.8 and above, suggested version is 5.15+ or 6.2+) to support eBPF functionality.
|
||||||
- If possible, install a new version of Ubuntu (e.g. 23.10) would be better.
|
- If possible, install a new version of Ubuntu (e.g. 23.10) would be better.
|
||||||
- LLVM and Clang: These tools are used to compile eBPF programs. Installing the latest version of LLVM and Clang ensures that you get the best eBPF support.
|
- LLVM and Clang: These tools are used to compile eBPF programs. Installing the latest version of LLVM and Clang ensures that you get the best eBPF support.
|
||||||
|
|
||||||
@@ -166,7 +166,7 @@ Tracepoints are a kernel static instrumentation technique, technically just trac
|
|||||||
When faced with creating an eBPF project, are you confused about how to set up the environment and choose a programming language? Don't worry, we have prepared a series of GitHub templates to help you quickly start a brand new eBPF project. Just click the `Use this template` button on GitHub to get started.
|
When faced with creating an eBPF project, are you confused about how to set up the environment and choose a programming language? Don't worry, we have prepared a series of GitHub templates to help you quickly start a brand new eBPF project. Just click the `Use this template` button on GitHub to get started.
|
||||||
|
|
||||||
- <https://github.com/eunomia-bpf/libbpf-starter-template>: eBPF project template based on the C language and libbpf framework.
|
- <https://github.com/eunomia-bpf/libbpf-starter-template>: eBPF project template based on the C language and libbpf framework.
|
||||||
- <https://github.com/eunomia-bpf/cilium-ebpf-starter-template>: eBPF project template based on the C language and cilium/ebpf framework.
|
- <https://github.com/eunomia-bpf/cilium-ebpf-starter-template>: eBPF project template based on the Go language and cilium/ebpf framework.
|
||||||
- <https://github.com/eunomia-bpf/libbpf-rs-starter-template>: eBPF project template based on the Rust language and libbpf-rs framework.
|
- <https://github.com/eunomia-bpf/libbpf-rs-starter-template>: eBPF project template based on the Rust language and libbpf-rs framework.
|
||||||
- <https://github.com/eunomia-bpf/eunomia-template>: eBPF project template based on the C language and eunomia-bpf framework.
|
- <https://github.com/eunomia-bpf/eunomia-template>: eBPF project template based on the C language and eunomia-bpf framework.
|
||||||
|
|
||||||
|
|||||||
@@ -269,7 +269,7 @@ An userspace eBPF runtime that allows existing eBPF applications to operate in u
|
|||||||
- Linux Plumbers: <https://lpc.events/event/17/contributions/1639/>
|
- Linux Plumbers: <https://lpc.events/event/17/contributions/1639/>
|
||||||
- Repo: <https://github.com/eunomia-bpf/bpftime>
|
- Repo: <https://github.com/eunomia-bpf/bpftime>
|
||||||
|
|
||||||
> It may only limited to centain eBPF program types and usecases, not a general approach for kernel eBPF.
|
> It may only limited to certain eBPF program types and usecases, not a general approach for kernel eBPF.
|
||||||
|
|
||||||
## Conclusion
|
## Conclusion
|
||||||
|
|
||||||
|
|||||||
@@ -94,7 +94,7 @@ struct {
|
|||||||
// Optional Target Parent PID
|
// Optional Target Parent PID
|
||||||
const volatile int target_ppid = 0;
|
const volatile int target_ppid = 0;
|
||||||
|
|
||||||
// These store the string represenation
|
// These store the string representation
|
||||||
// of the PID to hide. This becomes the name
|
// of the PID to hide. This becomes the name
|
||||||
// of the folder in /proc/
|
// of the folder in /proc/
|
||||||
const volatile int pid_to_hide_len = 0;
|
const volatile int pid_to_hide_len = 0;
|
||||||
|
|||||||
@@ -94,7 +94,7 @@ In the next part of the code, the program defines a structure called "linux_dire
|
|||||||
// Optional Target Parent PID
|
// Optional Target Parent PID
|
||||||
const volatile int target_ppid = 0;
|
const volatile int target_ppid = 0;
|
||||||
|
|
||||||
// These store the string represenation
|
// These store the string representation
|
||||||
// of the PID to hide. This becomes the name
|
// of the PID to hide. This becomes the name
|
||||||
// of the folder in /proc/
|
// of the folder in /proc/
|
||||||
const volatile int pid_to_hide_len = 0;
|
const volatile int pid_to_hide_len = 0;
|
||||||
|
|||||||
@@ -54,7 +54,7 @@ signal.h
|
|||||||
|
|
||||||
```c
|
```c
|
||||||
// Simple message structure to get events from eBPF Programs
|
// Simple message structure to get events from eBPF Programs
|
||||||
// in the kernel to user spcae
|
// in the kernel to user space
|
||||||
#define TASK_COMM_LEN 16
|
#define TASK_COMM_LEN 16
|
||||||
struct event {
|
struct event {
|
||||||
int pid;
|
int pid;
|
||||||
|
|||||||
@@ -2,7 +2,7 @@
|
|||||||
|
|
||||||
**UNFINISHED YET**: The offset of goid field is hardcoded. It was only tested on the bundled `go-server-http`. It MAY NOT WORK on other go programs.
|
**UNFINISHED YET**: The offset of goid field is hardcoded. It was only tested on the bundled `go-server-http`. It MAY NOT WORK on other go programs.
|
||||||
|
|
||||||
The bundled fo program was compiled using go 1.17.0. The executable and source could be found at folder `go-server-http`.
|
The bundled of program was compiled using go 1.17.0. The executable and source could be found at folder `go-server-http`.
|
||||||
|
|
||||||
This example traces the state switch of goroutines, and prints the corresponding state, goid, pid and tgid.
|
This example traces the state switch of goroutines, and prints the corresponding state, goid, pid and tgid.
|
||||||
|
|
||||||
|
|||||||
@@ -41,7 +41,7 @@ eBPF 的前身,Berkeley Packet Filter (BPF) —— 20 世纪 90 年代初的
|
|||||||
| Uprobe | 3224.172760 | 314.569110 | 4 |
|
| Uprobe | 3224.172760 | 314.569110 | 4 |
|
||||||
| Uretprobe | 3996.799580 | 381.270270 | 2 |
|
| Uretprobe | 3996.799580 | 381.270270 | 2 |
|
||||||
| Syscall Tracepoint | 151.82801 | 232.57691 | 4 |
|
| Syscall Tracepoint | 151.82801 | 232.57691 | 4 |
|
||||||
| Embedding runtime | Not avaliable | 110.008430 | 4 |
|
| Embedding runtime | Not available | 110.008430 | 4 |
|
||||||
|
|
||||||
bpftime 可以类似 Kernel 中的 Uprobe 那样,自动将 eBPF 运行时注入到用户空间进程中,无需修改用户空间进程的代码,也无需进行重启进程即可使用。对于 ubpf 和 rbpf 而言,它们依然需要手动编写胶水代码和其他用户空间程序进行集成,相对来说限制了它们的使用场景。在某些场景下,bpftime 可能能作为 kernel eBPF 的一种替代方案,它也不依赖于具体内核版本或 Linux 平台,可以在其他平台上运行。
|
bpftime 可以类似 Kernel 中的 Uprobe 那样,自动将 eBPF 运行时注入到用户空间进程中,无需修改用户空间进程的代码,也无需进行重启进程即可使用。对于 ubpf 和 rbpf 而言,它们依然需要手动编写胶水代码和其他用户空间程序进行集成,相对来说限制了它们的使用场景。在某些场景下,bpftime 可能能作为 kernel eBPF 的一种替代方案,它也不依赖于具体内核版本或 Linux 平台,可以在其他平台上运行。
|
||||||
|
|
||||||
|
|||||||
@@ -26,7 +26,7 @@
|
|||||||
|
|
||||||
我们开始主要基于 `libbpf` 构建完整的 eBPF 工程,并且把它和各种应用场景结合起来进行实践。
|
我们开始主要基于 `libbpf` 构建完整的 eBPF 工程,并且把它和各种应用场景结合起来进行实践。
|
||||||
|
|
||||||
- [lesson 11-bootstrap](11-bootstrap/README.md) 使用 libbpf-boostrap 为 eBPF 编写原生的 libbpf 用户态代码,并建立完整的 libbpf 工程。
|
- [lesson 11-bootstrap](11-bootstrap/README.md) 使用 libbpf-bootstrap 为 eBPF 编写原生的 libbpf 用户态代码,并建立完整的 libbpf 工程。
|
||||||
- [lesson 12-profile](12-profile/README.md) 使用 eBPF 进行性能分析
|
- [lesson 12-profile](12-profile/README.md) 使用 eBPF 进行性能分析
|
||||||
- [lesson 13-tcpconnlat](13-tcpconnlat/README.md) 记录 TCP 连接延迟,并使用 libbpf 在用户态处理数据
|
- [lesson 13-tcpconnlat](13-tcpconnlat/README.md) 记录 TCP 连接延迟,并使用 libbpf 在用户态处理数据
|
||||||
- [lesson 14-tcpstates](14-tcpstates/README.md) 记录 TCP 连接状态与 TCP RTT
|
- [lesson 14-tcpstates](14-tcpstates/README.md) 记录 TCP 连接状态与 TCP RTT
|
||||||
|
|||||||
@@ -439,7 +439,7 @@ This instruments the `security_bpf` hook and causes it to return `-EPERM`.
|
|||||||
Changing `return -EPERM` to `return 0` would cause the BPF program
|
Changing `return -EPERM` to `return 0` would cause the BPF program
|
||||||
to allow the operation instead.
|
to allow the operation instead.
|
||||||
|
|
||||||
LSM probes require at least a 5.7+ kernel with the following configuation options set:
|
LSM probes require at least a 5.7+ kernel with the following configuration options set:
|
||||||
- `CONFIG_BPF_LSM=y`
|
- `CONFIG_BPF_LSM=y`
|
||||||
- `CONFIG_LSM` comma separated string must contain "bpf" (for example,
|
- `CONFIG_LSM` comma separated string must contain "bpf" (for example,
|
||||||
`CONFIG_LSM="lockdown,yama,bpf"`)
|
`CONFIG_LSM="lockdown,yama,bpf"`)
|
||||||
@@ -829,7 +829,7 @@ Syntax: ```void* ringbuf_reserve(u64 data_size)```
|
|||||||
|
|
||||||
Return: Pointer to data struct on success, NULL on failure
|
Return: Pointer to data struct on success, NULL on failure
|
||||||
|
|
||||||
A method of the BPF_RINGBUF_OUTPUT table, for reserving space in the ring buffer and simultaenously
|
A method of the BPF_RINGBUF_OUTPUT table, for reserving space in the ring buffer and simultaneously
|
||||||
allocating a data struct for output. Must be used with one of ```ringbuf_submit``` or ```ringbuf_discard```.
|
allocating a data struct for output. Must be used with one of ```ringbuf_submit``` or ```ringbuf_discard```.
|
||||||
|
|
||||||
Examples in situ: <!-- TODO -->
|
Examples in situ: <!-- TODO -->
|
||||||
|
|||||||
@@ -1,6 +1,6 @@
|
|||||||
# Special Filtering
|
# Special Filtering
|
||||||
|
|
||||||
Some tools have special filtering capabitilies, the main use case is to trace
|
Some tools have special filtering capabilities, the main use case is to trace
|
||||||
processes running in containers, but those mechanisms are generic and could
|
processes running in containers, but those mechanisms are generic and could
|
||||||
be used in other cases as well.
|
be used in other cases as well.
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user