kernel/bpf-developer-tutorial
1
0
Fork 0
mirror of https://github.com/eunomia-bpf/bpf-developer-tutorial.git synced 2026-05-07 22:21:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add User ring post (#93)

Browse Source 
* update

* update ci

* update link to eunomia.dev

* Update documents
This commit is contained in:
云微
2024-01-20 16:57:48 +00:00
committed by GitHub
parent deee286952
commit fe5b53d6cd
40 changed files with 541 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/5-uprobe-bashreadline/README_en.md
View File

@@ -12,7 +12,7 @@ uprobe is file-based. When a function in a binary file is traced, all processes
uprobe is suitable for parsing some traffic in user mode that cannot be resolved by kernel mode probes, such as HTTP/2 traffic (where the header is encoded and cannot be decoded by the kernel) and HTTPS traffic (which is encrypted and cannot be decrypted by the kernel). For more information, see the example in [eBPF Tutorial by Example: Capturing SSL/TLS Plaintext Data from Multiple Libraries with Uprobe](../30-sslsniff).
Uprobe in kernel mode eBPF runtime may also cause relatively large performance overhead. In this case, you can also consider using user mode eBPF runtime, such as [bpftime](https://github.com/eunomia-bpf/bpftime). bpftime is a user mode eBPF runtime based on LLVM JIT/AOT. It can run eBPF programs in user mode and is compatible with kernel mode eBPF, avoiding context switching between kernel mode and user mode, thereby improving the execution efficiency of eBPF programs.
Uprobe in kernel mode eBPF runtime may also cause relatively large performance overhead. In this case, you can also consider using user mode eBPF runtime, such as [bpftime](https://github.com/eunomia-bpf/bpftime). bpftime is a user mode eBPF runtime based on LLVM JIT/AOT. It can run eBPF programs in user mode and is compatible with kernel mode eBPF, avoiding context switching between kernel mode and user mode, thereby improving the execution efficiency of eBPF programs by 10 times.
## Capturing readline Function Calls in bash using uprobe