{"id":18992786,"url":"https://github.com/yifengyou/ebpf","last_synced_at":"2025-04-22T11:47:38.031Z","repository":{"id":37370236,"uuid":"363384328","full_name":"yifengyou/ebpf","owner":"yifengyou","description":"eBPF学习","archived":false,"fork":false,"pushed_at":"2022-06-21T03:57:07.000Z","size":33126,"stargazers_count":18,"open_issues_count":0,"forks_count":4,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-04-17T00:18:27.205Z","etag":null,"topics":["ebpf","kernel","kprobe","tracepoint","uprobe","xdp"],"latest_commit_sha":null,"homepage":"https://github.com/yifengyou","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"unlicense","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/yifengyou.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-05-01T10:38:40.000Z","updated_at":"2025-01-02T05:19:29.000Z","dependencies_parsed_at":"2022-08-18T17:33:29.737Z","dependency_job_id":null,"html_url":"https://github.com/yifengyou/ebpf","commit_stats":null,"previous_names":["yifengyou/ebpf"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yifengyou%2Febpf","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yifengyou%2Febpf/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yifengyou%2Febpf/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yifengyou%2Febpf/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/yifengyou","download_url":"https://codeload.github.com/yifengyou/ebpf/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250237777,"owners_count":21397399,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf","kernel","kprobe","tracepoint","uprobe","xdp"],"created_at":"2024-11-08T17:18:53.154Z","updated_at":"2025-04-22T11:47:38.011Z","avatar_url":"https://github.com/yifengyou.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# ebpf学习笔记\n\n![20210501_184216_89](image/20210501_184216_89.png)\n\n## 仓库介绍\n\n```\nSomething I hope you know before go into the coding~\nFirst, please watch or star this repo, I'll be more happy if you follow me.\nBug report, questions and discussion are welcome, you can post an issue or pull a request.\n```\n\n## 目录\n\n* [基础知识](docs/基础知识.md)\n    * [clang与llvm](docs/基础知识/clang与llvm.md)\n    * [BPF内核实现](docs/基础知识/BPF内核实现.md)\n    * [BPF指令集](docs/基础知识/BPF指令集.md)\n    * [JIT即时编译](docs/基础知识/JIT即时编译.md)\n    * [llvm对ebpf的支持](docs/基础知识/llvm对ebpf的支持.md)\n    * [tracepoint](docs/基础知识/tracepoint.md)\n    * [ustd](docs/基础知识/ustd.md)\n    * [dtrace](docs/基础知识/dtrace.md)\n    * [kprobe与kretprobe](docs/基础知识/kprobe与kretprobe.md)\n    * [uprobe与uretprobe](docs/基础知识/uprobe与uretprobe.md)\n    * [elf-ebpf解析](docs/基础知识/elf-ebpf解析.md)\n* [CVE漏洞](docs/CVE漏洞.md)\n    * [CVE-2021-31440](docs/CVE漏洞/CVE-2021-31440.md)\n    * [CVE-2021-3489](docs/CVE漏洞/CVE-2021-3489.md)\n* [bpftrace](docs/bpftrace.md)\n    * [命令帮助](docs/bpftrace/命令帮助.md)\n    * [隐士规则](docs/bpftrace/隐士规则.md)\n    * [举栗子](docs/bpftrace/举栗子.md)\n* [BPF子系统](docs/BPF子系统.md)\n    * [tracing](docs/BPF子系统/tracing.md)\n        * [kprobe](docs/BPF子系统/tracing/kprobe.md)\n        * [tracepoint](docs/BPF子系统/tracing/tracepoint.md)\n        * [perf_event](docs/BPF子系统/tracing/perf_event.md)\n    * [filter](docs/BPF子系统/filter.md)\n        * [sk_filter](docs/BPF子系统/filter/sk_filter.md)\n        * [sched_cls](docs/BPF子系统/filter/sched_cls.md)\n        * [sched_act](docs/BPF子系统/filter/sched_act.md)\n        * [xdp](docs/BPF子系统/filter/xdp.md)\n        * [cg_skb](docs/BPF子系统/filter/xdp.md)\n* [BPF辅助函数](docs/BPF辅助函数.md)\n* [kubeArmor](docs/kubeArmor.md)\n* [falco](docs/falco.md)\n* [tracee](docs/tracee.md)\n* [cilium](docs/cilium.md)\n* [datadog](docs/datadog.md)\n* [goebpf](docs/goebpf.md)\n    * [快速开始](docs/goebpf/快速开始.md)\n    * [Demo样例拆解](docs/goebpf/Demo样例拆解.md)\n* [libbpf](docs/libbpf.md)\n* [libbpf-bootstrap](docs/libbpf-bootstrap.md)\n    * [快速开始](docs/libbpf-bootstrap/快速开始.md)\n* [bcc](docs/bcc.md)\n    * [argdist](docs/bcc/argdist.md)\n    * [bashreadline](docs/bcc/bashreadline.md)\n    * [bindsnoop](docs/bcc/bindsnoop.md)\n    * [biolatency](docs/bcc/biolatency.md)\n    * [biolatpcts](docs/bcc/biolatpcts.md)\n    * [biosnoop](docs/bcc/biosnoop.md)\n    * [biotop](docs/bcc/biotop.md)\n    * [bitesize](docs/bcc/bitesize.md)\n    * [bpflist](docs/bcc/bpflist.md)\n    * [cachestat](docs/bcc/cachestat.md)\n    * [cachetop](docs/bcc/cachetop.md)\n    * [capable](docs/bcc/capable.md)\n    * [cobjnew](docs/bcc/cobjnew.md)\n    * [compactsnoop](docs/bcc/compactsnoop.md)\n    * [cpudist](docs/bcc/cpudist.md)\n    * [cpuunclaimed](docs/bcc/cpuunclaimed.md)\n    * [dbslower](docs/bcc/dbslower.md)\n    * [dbstat](docs/bcc/dbstat.md)\n    * [dcsnoop](docs/bcc/dcsnoop.md)\n    * [dcstat](docs/bcc/dcstat.md)\n    * [deadlock](docs/bcc/deadlock.md)\n    * [dirtop](docs/bcc/dirtop.md)\n    * [drsnoop](docs/bcc/drsnoop.md)\n    * [execsnoop](docs/bcc/execsnoop.md)\n    * [exitsnoop](docs/bcc/exitsnoop.md)\n    * [ext4dist](docs/bcc/ext4dist.md)\n    * [ext4slower](docs/bcc/ext4slower.md)\n    * [filelife](docs/bcc/filelife.md)\n    * [fileslower](docs/bcc/fileslower.md)\n    * [filetop](docs/bcc/filetop.md)\n    * [funccount](docs/bcc/funccount.md)\n    * [funcinterval](docs/bcc/funcinterval.md)\n    * [funclatency](docs/bcc/funclatency.md)\n    * [funcslower](docs/bcc/funcslower.md)\n    * [gethostlatency](docs/bcc/gethostlatency.md)\n    * [hardirqs](docs/bcc/hardirqs.md)\n    * [javacalls](docs/bcc/javacalls.md)\n    * [javaflow](docs/bcc/javaflow.md)\n    * [javagc](docs/bcc/javagc.md)\n    * [javaobjnew](docs/bcc/javaobjnew.md)\n    * [javastat](docs/bcc/javastat.md)\n    * [javathreads](docs/bcc/javathreads.md)\n    * [killsnoop](docs/bcc/killsnoop.md)\n    * [klockstat](docs/bcc/klockstat.md)\n    * [llcstat](docs/bcc/llcstat.md)\n    * [mdflush](docs/bcc/mdflush.md)\n    * [memleak](docs/bcc/memleak.md)\n    * [mountsnoop](docs/bcc/mountsnoop.md)\n    * [mysqld_qslower](docs/bcc/mysqld_qslower.md)\n    * [netqtop](docs/bcc/netqtop.md)\n    * [nfsdist](docs/bcc/nfsdist.md)\n    * [nfsslower](docs/bcc/nfsslower.md)\n    * [nodegc](docs/bcc/nodegc.md)\n    * [nodestat](docs/bcc/nodestat.md)\n    * [offcputime](docs/bcc/offcputime.md)\n    * [offwaketime](docs/bcc/offwaketime.md)\n    * [oomkill](docs/bcc/oomkill.md)\n    * [opensnoop](docs/bcc/opensnoop.md)\n    * [perlcalls](docs/bcc/perlcalls.md)\n    * [perlflow](docs/bcc/perlflow.md)\n    * [perlstat](docs/bcc/perlstat.md)\n    * [phpcalls](docs/bcc/phpcalls.md)\n    * [phpflow](docs/bcc/phpflow.md)\n    * [phpstat](docs/bcc/phpstat.md)\n    * [pidpersec](docs/bcc/pidpersec.md)\n    * [profile](docs/bcc/profile.md)\n    * [pythoncalls](docs/bcc/pythoncalls.md)\n    * [pythonflow](docs/bcc/pythonflow.md)\n    * [pythongc](docs/bcc/pythongc.md)\n    * [pythonstat](docs/bcc/pythonstat.md)\n    * [readahead](docs/bcc/readahead.md)\n    * [reset-trace](docs/bcc/reset-trace.md)\n    * [rubycalls](docs/bcc/rubycalls.md)\n    * [rubyflow](docs/bcc/rubyflow.md)\n    * [rubygc](docs/bcc/rubygc.md)\n    * [rubyobjnew](docs/bcc/rubyobjnew.md)\n    * [rubystat](docs/bcc/rubystat.md)\n    * [runqlat](docs/bcc/runqlat.md)\n    * [runqlen](docs/bcc/runqlen.md)\n    * [runqslower](docs/bcc/runqslower.md)\n    * [shmsnoop](docs/bcc/shmsnoop.md)\n    * [slabratetop](docs/bcc/slabratetop.md)\n    * [sofdsnoop](docs/bcc/sofdsnoop.md)\n    * [softirqs](docs/bcc/softirqs.md)\n    * [solisten](docs/bcc/solisten.md)\n    * [sslsniff](docs/bcc/sslsniff.md)\n    * [stackcount](docs/bcc/stackcount.md)\n    * [statsnoop](docs/bcc/statsnoop.md)\n    * [swapin](docs/bcc/swapin.md)\n    * [syncsnoop](docs/bcc/syncsnoop.md)\n    * [syscount](docs/bcc/syscount.md)\n    * [tclcalls](docs/bcc/tclcalls.md)\n    * [tclflow](docs/bcc/tclflow.md)\n    * [tclobjnew](docs/bcc/tclobjnew.md)\n    * [tclstat](docs/bcc/tclstat.md)\n    * [tcpaccept](docs/bcc/tcpaccept.md)\n    * [tcpconnect](docs/bcc/tcpconnect.md)\n    * [tcpconnlat](docs/bcc/tcpconnlat.md)\n    * [tcpdrop](docs/bcc/tcpdrop.md)\n    * [tcplife](docs/bcc/tcplife.md)\n    * [tcpretrans](docs/bcc/tcpretrans.md)\n    * [tcprtt](docs/bcc/tcprtt.md)\n    * [tcpstates](docs/bcc/tcpstates.md)\n    * [tcpsubnet](docs/bcc/tcpsubnet.md)\n    * [tcpsynbl](docs/bcc/tcpsynbl.md)\n    * [tcptop](docs/bcc/tcptop.md)\n    * [tcptracer](docs/bcc/tcptracer.md)\n    * [threadsnoop](docs/bcc/threadsnoop.md)\n    * [tplist](docs/bcc/tplist.md)\n    * [trace](docs/bcc/trace.md)\n    * [ttysnoop](docs/bcc/ttysnoop.md)\n    * [vfscount](docs/bcc/vfscount.md)\n    * [vfsstat](docs/bcc/vfsstat.md)\n    * [virtiostat](docs/bcc/virtiostat.md)\n    * [wakeuptime](docs/bcc/wakeuptime.md)\n    * [xfsdist](docs/bcc/xfsdist.md)\n    * [xfsslower](docs/bcc/xfsslower.md)\n* [公开课](docs/公开课.md)\n    * [eBPF学习路线分享与LMP项目介绍](docs/公开课/eBPF学习路线分享与LMP项目介绍.md)\n* [中国eBPF大会](docs/中国eBPF大会.md)\n  - [观测内核行为的若干示例](docs/中国eBPF大会/观测内核行为的若干示例.md)\n\n\n## 相关站点\n\n* \u003chttps://ebpf.io/\u003e\n* \u003chttps://github.com/iovisor/bcc\u003e\n* \u003chttps://github.com/cilium/cilium\u003e\n\n---\n\n![20220314_211340_10](image/20220314_211340_10.png)\n\n\n## 参考\n\n* \u003chttps://zhuanlan.zhihu.com/p/470680443\u003e\n\n\n---\n\n![20220321_095908_26](image/20220321_095908_26.png)\n\n![20220321_095948_70](image/20220321_095948_70.png)\n\n![20220314_211613_88](image/20220314_211613_88.png)\n\n![20220314_211747_11](image/20220314_211747_11.png)\n\n![20220314_211412_47](image/20220314_211412_47.png)\n\n![20220321_104048_85](image/20220321_104048_85.png)\n\n---\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyifengyou%2Febpf","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fyifengyou%2Febpf","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyifengyou%2Febpf/lists"}