ebpf学习笔记

20210501_184216_89

仓库介绍

Something I hope you know before go into the coding~
First, please watch or star this repo, I'll be more happy if you follow me.
Bug report, questions and discussion are welcome, you can post an issue or pull a request.

基础知识
- clang与llvm
- BPF内核实现
- BPF指令集
- JIT即时编译
- llvm对ebpf的支持
- tracepoint
- ustd
- dtrace
- kprobe与kretprobe
- uprobe与uretprobe
- elf-ebpf解析
CVE漏洞
- CVE-2021-31440
- CVE-2021-3489
bpftrace
- 命令帮助
- 隐士规则
- 举栗子
BPF子系统
- tracing
  - kprobe
  - tracepoint
  - perf_event
- filter
  - sk_filter
  - sched_cls
  - sched_act
  - xdp
  - cg_skb
BPF辅助函数
kubeArmor
falco
tracee
cilium
datadog
goebpf
- 快速开始
- Demo样例拆解
libbpf
libbpf-bootstrap
- 快速开始
bcc
- argdist
- bashreadline
- bindsnoop
- biolatency
- biolatpcts
- biosnoop
- biotop
- bitesize
- bpflist
- cachestat
- cachetop
- capable
- cobjnew
- compactsnoop
- cpudist
- cpuunclaimed
- dbslower
- dbstat
- dcsnoop
- dcstat
- deadlock
- dirtop
- drsnoop
- execsnoop
- exitsnoop
- ext4dist
- ext4slower
- filelife
- fileslower
- filetop
- funccount
- funcinterval
- funclatency
- funcslower
- gethostlatency
- hardirqs
- javacalls
- javaflow
- javagc
- javaobjnew
- javastat
- javathreads
- killsnoop
- klockstat
- llcstat
- mdflush
- memleak
- mountsnoop
- mysqld_qslower
- netqtop
- nfsdist
- nfsslower
- nodegc
- nodestat
- offcputime
- offwaketime
- oomkill
- opensnoop
- perlcalls
- perlflow
- perlstat
- phpcalls
- phpflow
- phpstat
- pidpersec
- profile
- pythoncalls
- pythonflow
- pythongc
- pythonstat
- readahead
- reset-trace
- rubycalls
- rubyflow
- rubygc
- rubyobjnew
- rubystat
- runqlat
- runqlen
- runqslower
- shmsnoop
- slabratetop
- sofdsnoop
- softirqs
- solisten
- sslsniff
- stackcount
- statsnoop
- swapin
- syncsnoop
- syscount
- tclcalls
- tclflow
- tclobjnew
- tclstat
- tcpaccept
- tcpconnect
- tcpconnlat
- tcpdrop
- tcplife
- tcpretrans
- tcprtt
- tcpstates
- tcpsubnet
- tcpsynbl
- tcptop
- tcptracer
- threadsnoop
- tplist
- trace
- ttysnoop
- vfscount
- vfsstat
- virtiostat
- wakeuptime
- xfsdist
- xfsslower
公开课
- eBPF学习路线分享与LMP项目介绍
中国eBPF大会
- 观测内核行为的若干示例