Skip to content

Reference

Look-up facts for the eunomia-bpf bpf-developer-tutorial: the full lesson index with kernel baselines and CI status, the toolchain and package requirements, the program types and SEC() names the lessons use, kernel config options, and the privilege and dual-use tables. For why things work this way, see Explanation. For step-by-step tasks, see How-to Guides.

Provenance

The lesson index below is transcribed from the upstream generated matrix src/compatibility.md (produced by scripts/generate_compatibility.py from each lesson's .config file) and the repository README.md, both read on 2026-09-25 at upstream commit dated 2026-09-05. Upstream warns that "Not in CI" does not imply a manual test, and that distribution kernels may disable a listed option, so a version number alone does not guarantee compatibility.

Repository Facts

Fact Value (as of 2026-09-25)
Repository eunomia-bpf/bpf-developer-tutorial (Gitee mirror: gitee.com/yunwei37/bpf-developer-tutorial)
Website eunomia.dev/tutorials (synced from the repo by the trigger-sync.yml workflow)
License MIT, "Copyright (c) 2022 eunomia-bpf"
Releases None. Rolling main branch, ~323 commits
Latest commit 2026-09-05 ("keep GnuTLS and NSS probing enabled by default in sslsniff", #227)
Tutorials in the compatibility matrix 65: numbered lessons 0-54 (55), 6 features/*, 3 xpu/*, 1 cgroup
Listed in README table of contents 64 (lesson 32 wall-clock profiler exists and is CI-built but is missing from the README index)
Languages English README.md + Chinese README.zh.md per lesson
Newest lessons 51-54 added 2026-07-20 (TCP quarantine, fsession latency, BPF qdisc egress pacer, exec image inspector)
Agent tooling in repo CLAUDE.md, .agents/skills, .claude/ and a tutorial topic registry (added July 2026)

Lesson Index

All 65 tutorials, in matrix order. "Section" is the README table-of-contents group. "Min kernel" is the declared minimum from the lesson's .config.

Directory Title Section Min kernel Architectures Hardware Test status
0-introduce Introduction to Core Concepts and Tools Getting started N/A All - Docs only
1-helloworld Hello World, Framework and Development Getting started 4.8 x86_64, arm64 - CI runtime
2-kprobe-unlink Monitoring unlink System Calls with kprobe Getting started 5.2 x86_64, arm64 - CI runtime
3-fentry-unlink Monitoring unlink System Calls with fentry Getting started x86_64:5.5, arm64:6.0 x86_64, arm64 - CI runtime
4-opensnoop Capturing Opening Files and Filter with Global Variables Getting started 4.8 x86_64, arm64 - CI runtime
5-uprobe-bashreadline Capturing readline Function Calls with Uprobe Getting started 5.2 x86_64, arm64 - CI runtime
6-sigsnoop Capturing Signal Sending and Store State with Hash Maps Getting started 5.2 x86_64, arm64 - CI runtime
7-execsnoop Capturing Process Execution, Output with perf event array Getting started 5.2 x86_64, arm64 - CI runtime
8-exitsnoop Monitoring Process Exit Events, Output with Ring Buffer Getting started 5.8 x86_64, arm64 - CI runtime
9-runqlat Capturing Scheduling Latency and Recording as Histogram Getting started 5.2 x86_64, arm64 - CI runtime
10-hardirqs Capturing Interrupts with hardirqs or softirqs Getting started 5.5 x86_64, arm64 - CI runtime
11-bootstrap Develop User-Space Programs with libbpf and Trace exec() and exit() Advanced 5.8 x86_64, arm64 - CI runtime
12-profile Using eBPF Program Profile for Performance Analysis Advanced 5.8 x86_64, arm64 - CI build
13-tcpconnlat Statistics of TCP Connection Delay with libbpf Advanced 5.2 x86_64, arm64 - CI runtime
14-tcpstates Recording TCP Connection Status and TCP RTT Advanced 5.5 x86_64, arm64 - CI runtime
15-javagc Capturing User-Space Java GC Duration Using USDT Advanced 5.2 x86_64, arm64 - CI build
16-memleak Monitoring Memory Leaks Advanced 5.2 x86_64, arm64 - CI runtime
17-biopattern Count Random/Sequential Disk I/O Advanced 5.2 x86_64, arm64 Block device CI runtime
18-further-reading More Reference Materials： papers, projects Advanced N/A All - Docs only
19-lsm-connect Security Detection and Defense using LSM Advanced 5.7 x86_64, arm64 - Not in CI
20-tc tc Traffic Control Advanced 5.2 x86_64, arm64 Network interface CI runtime
21-xdp Programmable Packet Processing with XDP Advanced 5.2 x86_64, arm64 Network interface Not in CI
22-android Using eBPF Programs on Android Android 5.15 x86_64 Android device or emulator Not in CI
23-http L7 Tracing with eBPF: HTTP and Beyond via Socket Filters and Syscall Tracepoints Networking 5.17 x86_64, arm64 - CI runtime
24-hide Hiding Process or File Information Security 5.8 x86_64, arm64 - CI build
25-signal Using bpf_send_signal to Terminate Malicious Processes in eBPF Security 5.8 x86_64, arm64 - CI runtime
26-sudo Privilege Escalation via File Content Manipulation Security 5.8 x86_64, arm64 - CI build
27-replace Transparent Text Replacement in File Reads Security 5.17 x86_64, arm64 - CI build
28-detach Running eBPF After Application Exits: The Lifecycle of eBPF Programs Security 5.8 x86_64 - CI build
29-sockops Accelerating Network Request Forwarding with Sockops Networking 5.2 x86_64, arm64 Network interface CI build
30-sslsniff Capturing SSL/TLS Plain Text Data Using uprobe Tracing 5.2 x86_64, arm64 - CI runtime
31-goroutine Using eBPF to Trace Go Routine States Tracing 5.2 x86_64 - CI build
32-wallclock-profiler Wall Clock Profiling with Combined On-CPU and Off-CPU Analysis Not in README index 5.2 x86_64, arm64 - CI build
33-funclatency Measuring Function Latency with eBPF Tracing 4.8 x86_64, arm64 - CI build
34-syscall Modifying System Call Arguments with eBPF Security 5.8 x86_64, arm64 - CI runtime
35-user-ringbuf Asynchronously Send to Kernel with User Ring Buffer Features 6.1 x86_64, arm64 - CI runtime
36-userspace-ebpf Userspace eBPF Runtimes: Overview and Applications Features N/A All - Docs only
37-uprobe-rust Tracing User Space Rust Applications with Uprobe Tracing 4.8 x86_64, arm64 - CI runtime
38-btf-uprobe Expanding eBPF Compile Once, Run Everywhere(CO-RE) to Userspace Compatibility Features 5.2 x86_64, arm64 - CI build
39-nginx Using eBPF to Trace Nginx Requests Tracing 4.8 x86_64, arm64 - Not in CI
40-mysql Using eBPF to Trace MySQL Queries Tracing 4.8 x86_64, arm64 - Not in CI
41-xdp-tcpdump Capturing TCP Information with XDP Networking 5.8 x86_64, arm64 Network interface CI build
42-xdp-loadbalancer XDP Load Balancer Networking 4.8 x86_64, arm64 Network interface CI build
43-kfuncs Extending eBPF Beyond Its Limits: Custom kfuncs in Kernel Modules Features 6.11 x86_64, arm64 - CI build
44-scx-simple Introduction to the BPF Scheduler Scheduler 6.12 x86_64, arm64 - CI build
45-scx-nest Implementing the scx_nest Scheduler Scheduler 6.12 x86_64, arm64 - CI build
46-xdp-test Building a High-Performance XDP Packet Generator Networking 5.18 x86_64, arm64 Network interface CI build
47-cuda-events Tracing CUDA GPU Operations GPU 5.8 x86_64 NVIDIA CUDA GPU CI build
48-energy Energy Monitoring for Process-Level Power Analysis Tracing 5.8 x86_64, arm64 - CI build
49-hid Fixing Broken HID Devices Without Kernel Patches Other 6.3 x86_64, arm64 - CI build
50-tcx Composable Traffic Control with TCX Links Networking 6.6 x86_64, arm64 Network interface CI build
51-tcp-quarantine Precisely Isolating Established TCP Connections Security 6.5 x86_64 - CI runtime
52-fsession-latency Tracing Slow vfs_read Calls with fsession Tracing 7.0 x86_64 - CI build
53-egress-pacer Building an Egress Pacer with BPF Qdisc Networking 6.16 x86_64 Network interface CI build
54-exec-image-inspector Inspecting the Executable Image After exec Security 6.19 x86_64 - CI build
cgroup cgroup-based Policy Control Other 5.8 x86_64, arm64 - CI build
features/bpf_arena BPF Arena for Zero-Copy Shared Memory Features 6.9 x86_64, arm64 - CI build
features/bpf_iters BPF Iterators for Kernel Data Export Features 5.8 x86_64, arm64 - CI build
features/bpf_token BPF Token for Delegated Privilege and Secure Program Loading Features 6.9 x86_64, arm64 - CI build
features/bpf_wq BPF Workqueues for Asynchronous Sleepable Tasks Features 6.10 x86_64, arm64 - CI build
features/dynptr BPF Dynamic Pointers for Variable-Length Data Features 6.4 x86_64, arm64 Network interface CI build
features/struct_ops Extending Kernel Subsystems with BPF struct_ops Features Unknown x86_64, arm64 - CI build
xpu/flamegraph Building a GPU Flamegraph Profiler with CUPTI GPU 5.8 x86_64 NVIDIA CUDA GPU Not in CI
xpu/gpu-kernel-driver Monitoring GPU Driver Activity with Kernel Tracepoints GPU 4.8 x86_64 GPU Not in CI
xpu/npu-kernel-driver Tracing Intel NPU Kernel Driver Operations GPU 6.2 x86_64 Intel NPU Not in CI

Test Status Distribution

Counted from the 65 matrix rows on 2026-09-25:

Status Meaning (upstream definition) Count
CI runtime Built and executed in CI 23
CI build Only the build is checked 31
Not in CI No CI evidence 8
Docs only Documentation, nothing to run 3

Kernel Baseline Spread

Minimum kernel Lessons
4.8 (repository baseline or docs) 1, 4, 33, 37, 39, 40, 42, xpu/gpu-kernel-driver
5.2-5.8 most tracing, security and early networking lessons
5.5 x86_64 / 6.0 arm64 3 (fentry)
6.1 35 (user ring buffer)
6.3 49 (HID-BPF)
6.4-6.11 features/dynptr 6.4, 51 6.5, 50 6.6, bpf_arena and bpf_token 6.9, bpf_wq 6.10, 43 6.11
6.12 44, 45 (sched_ext)
6.16 53 (BPF qdisc)
6.19 54 (BPF task work + file dynptr)
7.0 52 (fsession)
Unknown features/struct_ops (matrix basis "Unverified")

Toolchain Requirements

Component Where it is used Version / source
clang + llvm All lessons (BPF target compiler) Distro packages. CI installs Ubuntu 24.04 clang and llvm (no pinned version)
libelf, zlib libbpf-based lessons (11 onward) libelf1 libelf-dev zlib1g-dev (Debian/Ubuntu), elfutils-libelf elfutils-libelf-devel zlib-devel (Fedora)
libbpf libbpf user-space loaders Vendored via the src/third_party/bpftool submodule. Lesson 52 states libbpf 1.7.0 (released 2026-03)
bpftool Skeleton generation (.skel.h), vmlinux.h Submodule libbpf/bpftool. Lesson 52 states bpftool v7.7.0
blazesym Symbolization in profilers (12, 32) Submodule libbpf/blazesym
vmlinux headers CO-RE type info Pre-generated in src/third_party for x86, arm, arm64, riscv, powerpc and loongarch (per repo CLAUDE.md)
Rust + Cargo Lessons 12 (libbpf-rs + blazesym) and 37 CI modernized for Rust 1.97 (commit #210, 2026-07-14)
Go Lesson 31 target programs, cilium/ebpf starter template TBD — no version stated in the lessons read
ecc / ecli eunomia-bpf lessons 1-10 eunomia-bpf releases, latest v1.0.38 (2026-03-08). ecc needs clang, llvm and libclang installed
pahole (dwarves) BTF generation Installed by CI alongside linux-headers-generic-hwe-24.04
Kernel source tree Lesson 44 builds scx_simple from tools/sched_ext/ Linux 6.12+

CI environment

.github/workflows/test-libbpf.yml runs on ubuntu-24.04 on every push, pull request and weekly (cron: '0 0 * * 0'). It installs libelf1 libelf-dev zlib1g-dev make git clang llvm pkg-config build-essential dwarves linux-headers-generic-hwe-24.04, then runs make -C src/<lesson> per lesson and, for "CI runtime" lessons, sudo timeout -s 2 3 <binary>.

eunomia-bpf ecli Commands

Command Purpose
ecli run <path-or-url> Load and run a package.json or Wasm module, locally or from an OCI registry
ecli pull Fetch a precompiled program image from an OCI registry
ecli push Publish a program image to an OCI registry
ecli client / ecli-server Removed from main in March 2026; last implementation kept on the archive/ecli-remote-http branch

Program Types and Attach Points

SEC() names below are taken from the lesson READMEs (2026-09-25).

Hook class Example SEC() names Lessons
Tracepoints tp/syscalls/sys_enter_write, tracepoint/syscalls/sys_enter_execve, tp/sched/sched_process_exit 1, 7, 8, 11, 35
Raw tracepoints raw_tp/sched_switch, raw_tp/sched_wakeup 9
kprobe / kretprobe kprobe/do_unlinkat, kretprobe/do_unlinkat 2, 13, 33
fentry / fexit fentry/do_unlinkat, fexit/do_unlinkat 3
fsession (entry + return in one program) fsession/vfs_read 52
uprobe / uretprobe uretprobe//bin/bash:readline 5, 16, 30, 37, 39, 40, 47
USDT usdt 15
BPF LSM lsm/socket_connect, lsm/bprm_committed_creds 19, 54
Socket filter socket 23
sockops / sk_msg sockops, sk_msg 29
tc (classic) tc 20
TCX links tcx/ingress, tcx/egress 50
XDP xdp 21, 41, 42, 46
cgroup hooks cgroup/connect4, cgroup/dev, cgroup/sysctl cgroup
Iterators iter/task, iter/task_file features/bpf_iters
struct_ops struct_ops/egress_pacer_enqueue, struct_ops/hid_device_event, SCX_OPS_DEFINE(...) 44, 45, 49, 53, features/struct_ops

Kernel Config Options

Options the matrix lists as core requirements (a lesson needs a subset):

Option Needed for
CONFIG_BPF, CONFIG_BPF_SYSCALL Every runnable lesson
CONFIG_BPF_EVENTS Tracing program types
CONFIG_DEBUG_INFO_BTF CO-RE lessons (BTF "Required" in the matrix)
CONFIG_DEBUG_INFO_BTF_MODULES, CONFIG_MODULES 43 (kfuncs in modules), features/struct_ops
CONFIG_BPF_JIT 3, 51-54, bpf_arena, bpf_wq, struct_ops
CONFIG_FTRACE_SYSCALLS Syscall tracepoint lessons (1, 4, 6, 7, 22-27, 34, 35)
CONFIG_KPROBE_EVENTS, CONFIG_UPROBE_EVENTS kprobe and uprobe lessons
CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS 52 (fsession)
CONFIG_BPF_LSM, CONFIG_SECURITY 19, 54 (also needs bpf in the active LSM list)
CONFIG_NET_CLS_BPF, CONFIG_NET_SCHED 20, features/dynptr
CONFIG_NET_XGRESS 50 (TCX)
CONFIG_NET_SCH_BPF 53 (BPF qdisc)
CONFIG_XDP_SOCKETS 46
CONFIG_CGROUPS, CONFIG_CGROUP_BPF, CONFIG_CGROUP_DEVICE 10, 29, cgroup
CONFIG_SCHED_CLASS_EXT 44, 45
CONFIG_HID_BPF, CONFIG_UHID 49
CONFIG_USER_NS features/bpf_token
CONFIG_DRM_ACCEL, CONFIG_DRM_ACCEL_IVPU xpu/npu-kernel-driver

Privilege Model

Every runnable lesson is marked "Root: Required". On kernels 5.8+, fine-grained capabilities can replace full root for production-style loading:

Capability Grants Relevant to
CAP_BPF Program and map load, most bpf() operations Every lesson
CAP_PERFMON Tracing attach (kprobes, uprobes, tracepoints, perf events) Tracing lessons (for example 1-17, 30-40, 47-48, 52)
CAP_NET_ADMIN XDP, tc, TCX and qdisc attachment Networking lessons 20-21, 29, 41-42, 46, 50, 53
CAP_SYS_ADMIN Legacy catch-all on older kernels, some attach types Pre-5.8 kernels

features/bpf_token (6.9+) teaches BPF token, which delegates a restricted subset of these rights into a user namespace through a bpffs mount.

Dual-Use Lesson Warnings

A deliberate course arc teaches offense-shaped primitives so defenders understand attacker technique:

Lesson Technique demonstrated Handling caution
24-hide Hiding PIDs/files from user space Run only in an isolated VM
25-signal Terminating arbitrary PIDs from inside BPF (bpf_send_signal) Scope PID filters before loading
26-sudo Privilege escalation via file-content manipulation Textbook demonstration environment only
27-replace Transparent tampering of file reads Same
28-detach Programs that outlive their loader (pinned in bpffs) Clean up pins afterwards
30-sslsniff TLS plaintext capture via OpenSSL/GnuTLS/NSS uprobes Treat output as secrets
34-syscall Rewriting live syscall arguments Can corrupt unrelated processes without filters
51-tcp-quarantine Destroying established TCP connections (bpf_sock_destroy) Dry-run by default; use --apply only on lab networks
Project Role License
eunomia-bpf ecc compiler + ecli runner, JSON/Wasm packages, OCI distribution MIT
bpftime Userspace eBPF runtime (uprobe, syscall, GPU hooks), OSDI '25 paper MIT
wasm-bpf Write eBPF user space as Wasm modules MIT
libbpf Loader library the lessons build on; 1.7.0 released 2026-03 LGPL-2.1 OR BSD-2-Clause
bpftool Mirror of the kernel's bpftool; version tracks libbpf (v7.7 with libbpf 1.7) GPL-2.0 OR BSD-2-Clause
libbpf-bootstrap Scaffold with minimal, bootstrap and other examples; lesson 11 is derived from it BSD-3-Clause
Starter templates libbpf-starter-template, cilium-ebpf-starter-template, libbpf-rs-starter-template, eunomia-template See each repo

Sources