You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/SUMMARY_en.md
+42-27Lines changed: 42 additions & 27 deletions
Original file line number
Diff line number
Diff line change
@@ -12,49 +12,64 @@ For the complete source code of the tutorial, please refer to the repo [https://
12
12
13
13
This section contains simple eBPF program examples and introductions. It primarily utilizes the `eunomia-bpf` framework to simplify development and introduces the basic usage and development process of eBPF.
14
14
15
-
-[lesson 0-introduce](0-introduce/README_en.md) Introduces basic concepts of eBPF and common development tools
16
-
-[lesson 1-helloworld](1-helloworld/README_en.md) Develops the simplest "Hello World" program using eBPF and introduces the basic framework and development process of eBPF
17
-
-[lesson 2-kprobe-unlink](2-kprobe-unlink/README_en.md) Uses kprobe in eBPF to capture the unlink system call
18
-
-[lesson 3-fentry-unlink](3-fentry-unlink/README_en.md) Uses fentry in eBPF to capture the unlink system call
19
-
-[lesson 4-opensnoop](4-opensnoop/README_en.md) Uses eBPF to capture the system call collection of processes opening files, and filters process PIDs in eBPF using global variables
20
-
-[lesson 5-uprobe-bashreadline](5-uprobe-bashreadline/README_en.md) Uses uprobe in eBPF to capture the readline function calls in bash
21
-
-[lesson 6-sigsnoop](6-sigsnoop/README_en.md) Captures the system call collection of processes sending signals and uses a hash map to store states
22
-
-[lesson 7-execsnoop](7-execsnoop/README_en.md) Captures process execution times and prints output to user space through perf event array
23
-
-[lesson 8-exitsnoop](8-exitsnoop/README_en.md) Captures process exit events and prints output to user space using a ring buffer
24
-
-[lesson 9-runqlat](9-runqlat/README_en.md) Captures process scheduling delays and records them in histogram format
25
-
-[lesson 10-hardirqs](10-hardirqs/README_en.md) Captures interrupt events using hardirqs or softirqs
15
+
-[lesson 0-introduce](0-introduce/README.md) Introduces basic concepts of eBPF and common development tools
16
+
-[lesson 1-helloworld](1-helloworld/README.md) Develops the simplest "Hello World" program using eBPF and introduces the basic framework and development process of eBPF
17
+
-[lesson 2-kprobe-unlink](2-kprobe-unlink/README.md) Uses kprobe in eBPF to capture the unlink system call
18
+
-[lesson 3-fentry-unlink](3-fentry-unlink/README.md) Uses fentry in eBPF to capture the unlink system call
19
+
-[lesson 4-opensnoop](4-opensnoop/README.md) Uses eBPF to capture the system call collection of processes opening files, and filters process PIDs in eBPF using global variables
20
+
-[lesson 5-uprobe-bashreadline](5-uprobe-bashreadline/README.md) Uses uprobe in eBPF to capture the readline function calls in bash
21
+
-[lesson 6-sigsnoop](6-sigsnoop/README.md) Captures the system call collection of processes sending signals and uses a hash map to store states
22
+
-[lesson 7-execsnoop](7-execsnoop/README.md) Captures process execution times and prints output to user space through perf event array
23
+
-[lesson 8-exitsnoop](8-exitsnoop/README.md) Captures process exit events and prints output to user space using a ring buffer
24
+
-[lesson 9-runqlat](9-runqlat/README.md) Captures process scheduling delays and records them in histogram format
25
+
-[lesson 10-hardirqs](10-hardirqs/README.md) Captures interrupt events using hardirqs or softirqs
26
26
27
27
# Advanced Documents and Examples
28
28
29
29
We start to build complete eBPF projects mainly based on `libbpf` and combine them with various application scenarios for practical use.
30
30
31
-
-[lesson 11-bootstrap](11-bootstrap/README_en.md) Writes native libbpf user space code for eBPF using libbpf-bootstrap and establishes a complete libbpf project.
32
-
-[lesson 12-profile](12-profile/README_en.md) Performs performance analysis using eBPF
33
-
-[lesson 13-tcpconnlat](13-tcpconnlat/README_en.md) Records TCP connection latency and processes data in user space using libbpf
34
-
-[lesson 14-tcpstates](14-tcpstates/README_en.md) Records TCP connection state and TCP RTT.- [lesson 15-javagc](15-javagc/README_en.md) Capture user-level Java GC event duration using usdt
-[lesson 17-biopattern](17-biopattern/README_en.md) Capture disk IO patterns
37
-
-[lesson 18-further-reading](18-further-reading/README_en.md) Further reading: papers list, projects, blogs, etc.
38
-
-[lesson 19-lsm-connect](19-lsm-connect/README_en.md) Use LSM for security detection and defense
39
-
-[lesson 20-tc](20-tc/README_en.md) Use eBPF for tc traffic control
40
-
-[lesson 21-xdp](21-xdp/README_en.md) Use eBPF for XDP packet processing
31
+
-[lesson 11-bootstrap](11-bootstrap/README.md) Writes native libbpf user space code for eBPF using libbpf-bootstrap and establishes a complete libbpf project.
32
+
-[lesson 12-profile](12-profile/README.md) Performs performance analysis using eBPF
33
+
-[lesson 13-tcpconnlat](13-tcpconnlat/README.md) Records TCP connection latency and processes data in user space using libbpf
34
+
-[lesson 14-tcpstates](14-tcpstates/README.md) Records TCP connection state and TCP RTT.- [lesson 15-javagc](15-javagc/README.md) Capture user-level Java GC event duration using usdt
-[lesson 17-biopattern](17-biopattern/README.md) Capture disk IO patterns
37
+
-[lesson 18-further-reading](18-further-reading/README.md) Further reading: papers list, projects, blogs, etc.
38
+
-[lesson 19-lsm-connect](19-lsm-connect/README.md) Use LSM for security detection and defense
39
+
-[lesson 20-tc](20-tc/README.md) Use eBPF for tc traffic control
40
+
-[lesson 21-xdp](21-xdp/README.md) Use eBPF for XDP packet processing
41
41
42
42
# In-Depth Topics
43
43
44
44
This section covers advanced topics related to eBPF, including using eBPF programs on Android, possible attacks and defenses using eBPF programs, and complex tracing. Combining the user-mode and kernel-mode aspects of eBPF can bring great power (as well as security risks).
45
45
46
+
<<<<<<< HEAD
46
47
-[Using eBPF programs on Android](22-android/README_en.md)
47
48
-[Tracing HTTP requests or other layer-7 protocols using eBPF socket filter or syscall trace](23-http/README_en.md)
48
49
-[Accelerating network request forwarding using sockops](29-sockops/README_en.md)
49
50
-[Capturing Plain Text Data of Various Libraries' SSL/TLS Using uprobe](30-sslsniff/README_en.md)
51
+
=======
52
+
Android:
53
+
54
+
-[Using eBPF programs on Android](22-android/README.md)
55
+
56
+
Networking and tracing:
57
+
58
+
-[Tracing HTTP requests or other layer-7 protocols using eBPF socket filter or syscall trace](23-http/README.md)
59
+
-[Accelerating network request forwarding using sockops](29-sockops/README.md)
60
+
-[Capturing Plain Text Data of Various Libraries' SSL/TLS Using uprobe](30-sslsniff/README.md)
61
+
62
+
Security:
63
+
64
+
>>>>>>> 89ab1d3 (fix index link in website)
50
65
-[Use eBPF to modify syscall parameters](34-syscall/README.md)
51
66
-[The Secure Path Forward for eBPF: Challenges and Innovations](18-further-reading/ebpf-security.md)
52
-
-[Hiding process or file information using eBPF](24-hide/README_en.md)
53
-
-[Terminating processes by sending signals using bpf_send_signal](25-signal/README_en.md)
54
-
-[Adding sudo users using eBPF](26-sudo/README_en.md)
55
-
-[Replacing text read or written by any program using eBPF](27-replace/README_en.md)
56
-
-[BPF lifecycle: Running eBPF programs continuously in Detached mode after user-mode applications exit](28-detach/README_en.md)
57
-
-[Userspace eBPF Runtimes: Overview and Applications](src\36-userspace-ebpf\README_en.md)
67
+
-[Hiding process or file information using eBPF](24-hide/README.md)
68
+
-[Terminating processes by sending signals using bpf_send_signal](25-signal/README.md)
69
+
-[Adding sudo users using eBPF](26-sudo/README.md)
70
+
-[Replacing text read or written by any program using eBPF](27-replace/README.md)
71
+
-[BPF lifecycle: Running eBPF programs continuously in Detached mode after user-mode applications exit](28-detach/README.md)
72
+
-[Userspace eBPF Runtimes: Overview and Applications](src\36-userspace-ebpf\README.md)
0 commit comments