# eunomia-bpf/bpf-developer-tutorial

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/eunomia-bpf-bpf-developer-tutorial).**

4,145 stars · 586 forks · C · MIT

## Links

- GitHub: https://github.com/eunomia-bpf/bpf-developer-tutorial
- Homepage: https://eunomia.dev/tutorials/
- awesome-repositories: https://awesome-repositories.com/repository/eunomia-bpf-bpf-developer-tutorial.md

## Topics

`bpf` `ebpf` `examples` `libbpf` `tutorial` `xdp`

## Description

This project is an educational resource providing a comprehensive development tutorial for writing and loading eBPF programs using C, Go, and Rust within the Linux kernel. It serves as a technical guide for developing custom logic to execute directly in the kernel.

The materials cover specialized domains including kernel observability and tracing, security implementation for intrusion detection, and high-performance network engineering for packet filtering and load balancing. It also includes dedicated manuals for Linux kernel tracing and the use of kprobes, uprobes, and tracepoints.

The project encompasses a broad range of capability areas, such as kernel instrumentation, system monitoring and observability, network analysis, and security enforcement. It further extends into hardware-level debugging for GPUs and drivers, as well as low-level system manipulation and resource management.

## Tags

### Operating Systems & Systems Programming

- [eBPF Program Development](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/kernel-development/kernel-observability-programs/ebpf-program-development.md) — Provides a comprehensive tutorial on writing and loading eBPF programs using C, Go, and Rust.
- [Learning Resources](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/kernel-development/kernel-observability-programs/ebpf-program-development/learning-resources.md) — Provides a comprehensive development tutorial for writing and loading eBPF programs using C, Go, and Rust.
- [Architecture-Agnostic Bytecode Execution](https://awesome-repositories.com/f/operating-systems-systems-programming/architecture-agnostic-bytecode-execution.md) — Translates a standardized instruction set into machine code for architecture-agnostic performance within the kernel.
- [CPU Execution Analysis](https://awesome-repositories.com/f/operating-systems-systems-programming/cpu-execution-analysis.md) — Samples processor execution and stack traces to identify CPU bottlenecks and function-level hotspots. ([source](https://eunomia.dev/tutorials/12-profile/))
- [CPU Schedulers](https://awesome-repositories.com/f/operating-systems-systems-programming/cpu-schedulers.md) — Implements custom CPU scheduling algorithms and task dispatching logic directly within the kernel. ([source](https://eunomia.dev/tutorials/44-scx-simple/))
- [Completely Fair Schedulers](https://awesome-repositories.com/f/operating-systems-systems-programming/cpu-schedulers/completely-fair-schedulers.md) — Tracks task execution time relative to weights to ensure fair resource distribution in the kernel. ([source](https://eunomia.dev/tutorials/44-scx-simple/))
- [Function Duration Measurement](https://awesome-repositories.com/f/operating-systems-systems-programming/function-duration-measurement.md) — Calculates function execution time distributions using nanosecond timestamps at function entry and exit. ([source](https://eunomia.dev/tutorials/33-funclatency/))
- [GPU Driver Debugging](https://awesome-repositories.com/f/operating-systems-systems-programming/gpu-driver-debugging.md) — Traces proprietary drivers and GPU pipelines to analyze memory allocation, scheduling, and interrupts.
- [Bytecode Safety Verification](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-bytecode-execution/bytecode-safety-verification.md) — Validates bytecode properties and memory access before execution to ensure kernel stability and prevent crashes.
- [Learning Resources](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/ebpf-tooling/ebpf-networking-concepts/learning-resources.md) — Offers a dedicated course on implementing packet filtering, load balancing, and traffic redirection using eBPF.
- [Kernel Function Instrumentation](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-function-instrumentation.md) — Demonstrates attaching custom logic to static kernel instrumentation points to monitor system events. ([source](https://github.com/eunomia-bpf/bpf-developer-tutorial/blob/main/src/1-helloworld/README.md))
- [eBPF Context Memory Copiers](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-memory-access/ebpf-context-memory-copiers.md) — Implements safe memory copying from kernel structures into eBPF context to prevent system crashes. ([source](https://eunomia.dev/tutorials/2-kprobe-unlink/))
- [Kernel State Maps](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-state-maps.md) — Utilizes shared hash maps and arrays to store and retrieve persistent state across program executions.
- [Unprivileged Kernel Instrumentation](https://awesome-repositories.com/f/operating-systems-systems-programming/unprivileged-kernel-instrumentation.md) — Executes kernel monitoring logic using probes and tracepoints from an unprivileged userspace context. ([source](https://eunomia.dev/tutorials/18-further-reading/ebpf-security/))
- [Userspace Bytecode Interpretation](https://awesome-repositories.com/f/operating-systems-systems-programming/userspace-bytecode-interpretation.md) — Runs eBPF programs within a userspace process using interpreters or JIT compilers for testing. ([source](https://eunomia.dev/tutorials/36-userspace-ebpf/))
- [Userspace Application Tracing](https://awesome-repositories.com/f/operating-systems-systems-programming/userspace-kernels/userspace-application-tracing.md) — Captures function calls and application state in user-space using a combination of uprobes and USDT. ([source](https://eunomia.dev/tutorials/))
- [Userspace Memory Verification](https://awesome-repositories.com/f/operating-systems-systems-programming/userspace-memory-verification.md) — Validates that kernel programs correctly access userspace data structures using type information. ([source](https://eunomia.dev/tutorials/38-btf-uprobe/test-verify/))
- [BPF Filesystem Mount Delegations](https://awesome-repositories.com/f/operating-systems-systems-programming/bpf-program-introspection/bpf-filesystem-mount-delegations.md) — Controls available BPF commands and map types via a bitmask-based delegation policy. ([source](https://eunomia.dev/tutorials/features/bpf_token/))
- [Device Access Controls](https://awesome-repositories.com/f/operating-systems-systems-programming/device-access-controls.md) — Restricts hardware access by monitoring and intercepting device open, read, and write requests. ([source](https://eunomia.dev/tutorials/cgroup/))
- [Hardware Trace Correlation](https://awesome-repositories.com/f/operating-systems-systems-programming/hardware-trace-correlation.md) — Synchronizes processor stack traces and graphics activity records using shared timestamps for a unified view. ([source](https://eunomia.dev/tutorials/xpu/flamegraph/))
- [I/O Trace Analysis](https://awesome-repositories.com/f/operating-systems-systems-programming/i-o-trace-analysis.md) — Includes tutorials on monitoring block-level storage operations to track the size and frequency of I/O requests. ([source](https://eunomia.dev/tutorials/bpftrace-tutorial/))
- [In-Kernel Storage Logic](https://awesome-repositories.com/f/operating-systems-systems-programming/in-kernel-storage-logic.md) — Executes storage logic and index lookups directly within kernel drivers to reduce system stack overhead. ([source](https://eunomia.dev/tutorials/18-further-reading/))
- [eBPF Lifecycle Management](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/ebpf-tooling/ebpf-lifecycle-management.md) — Manages the lifecycle of eBPF programs across a cluster using a privileged daemon for loading and unloading. ([source](https://eunomia.dev/tutorials/28-detach/))
- [Object Persistence](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/ebpf-tooling/ebpf-object-loading/object-persistence.md) — Allows pinning eBPF programs and maps to the filesystem to maintain persistence independently of the loader. ([source](https://eunomia.dev/tutorials/28-detach/))
- [eBPF Program Loading Delegations](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/ebpf-tooling/ebpf-program-loading-delegations.md) — Uses scoped delegation tokens to load eBPF programs without requiring full administrative privileges. ([source](https://eunomia.dev/tutorials/))
- [Execution Ordering](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/kernel-development/kernel-observability-programs/ebpf-program-deployment/execution-ordering.md) — Defines the sequence and execution order of multiple eBPF programs along a network data path. ([source](https://eunomia.dev/tutorials/50-tcx/))
- [Userspace Program Orchestration](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/kernel-development/kernel-observability-programs/ebpf-program-deployment/userspace-program-orchestration.md) — Controls kernel program execution and configures global variables from userspace to manage event notifications. ([source](https://eunomia.dev/tutorials/24-hide/))
- [Arena-Based Memory Management](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/process-and-memory-management/memory-management/allocation-strategies/arena-based-memory-management.md) — Implements arena-based memory management using reference counting to optimize kernel performance. ([source](https://eunomia.dev/tutorials/features/bpf_arena/))
- [Variable-Length Memory Validation](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/process-and-memory-management/memory-management/allocation-strategies/dynamic-memory-allocation/custom-memory-allocators/off-heap-image-allocators/off-heap-memory-managers/indirect-memory-handles/variable-length-memory-validation.md) — Provides techniques for processing memory regions of dynamic sizes using handles to ensure safe bounds access. ([source](https://eunomia.dev/tutorials/features/dynptr/))
- [Heap Allocation Call Stack Recorders](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/process-and-memory-management/memory-management/allocation-strategies/dynamic-memory-allocation/memory-allocation-tracers/heap-allocation-tracers/heap-allocation-call-stack-recorders.md) — Demonstrates recording full call stacks during allocation events to pinpoint memory leaks in the kernel. ([source](https://eunomia.dev/tutorials/16-memleak/))
- [Argument Modification](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/system-calls/system-call-interceptors/argument-modification.md) — Overwrites user space memory during system calls to redirect file access and change kernel request behavior. ([source](https://eunomia.dev/tutorials/34-syscall/))
- [Kernel Object Manipulations](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/system-calls/system-call-interceptors/kernel-object-manipulations.md) — Alters system call arguments or hides process information by manipulating data flowing through the kernel. ([source](https://eunomia.dev/tutorials/))
- [Asynchronous Kernel Data Streaming](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-data-extraction/asynchronous-kernel-data-streaming.md) — Transfers captured kernel data to applications asynchronously using high-performance memory buffers. ([source](https://eunomia.dev/tutorials/30-sslsniff/))
- [Interrupt Execution Analysis](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-execution-context-layering/interrupt-handlers/interrupt-execution-analysis.md) — Measures the timing, distribution, and performance of hardware and software interrupt handlers within the kernel. ([source](https://eunomia.dev/tutorials/10-hardirqs/))
- [Kernel Extensions](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-extensions.md) — Adds custom kernel behavior through specialized functions and schedulers without modifying core source code. ([source](https://eunomia.dev/tutorials/))
- [Custom Kfunc Extensions](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-extensions/custom-kfunc-extensions.md) — Provides guidance on defining new kernel functions within modules to implement specialized operations and optimizations. ([source](https://eunomia.dev/tutorials/43-kfuncs/))
- [Kernel Object Iteration](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-object-iteration.md) — Traverses internal kernel data structures via iterators to filter and format data for userspace export. ([source](https://eunomia.dev/tutorials/features/bpf_iters/))
- [Dynamic Subsystem Updating](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-space-logic-implementation/dynamic-subsystem-updating.md) — Implements the replacement of kernel function pointers with eBPF programs to update logic without requiring system reboots. ([source](https://eunomia.dev/tutorials/features/struct_ops/))
- [Kernel Structure Tracing](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-structure-tracing.md) — Allows dereferencing and inspecting internal kernel data structures using raw pointers and type information. ([source](https://eunomia.dev/tutorials/bpftrace-tutorial/))
- [User-Space Argument Extraction](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-to-userspace-data-transfer/user-space-argument-extraction.md) — Extracts arguments and return values from user-space functions using kernel-level probes. ([source](https://eunomia.dev/tutorials/5-uprobe-bashreadline/))
- [Library Function Hooking](https://awesome-repositories.com/f/operating-systems-systems-programming/library-function-hooking.md) — Intercepts function calls within shared libraries via uprobes to aggregate data without restarting processes. ([source](https://eunomia.dev/tutorials/36-userspace-ebpf/))
- [Perf Event Array Streaming](https://awesome-repositories.com/f/operating-systems-systems-programming/perf-event-array-streaming.md) — Streams kernel events to userspace applications via perf event arrays and ring buffers. ([source](https://eunomia.dev/tutorials/))
- [Process Execution Capture](https://awesome-repositories.com/f/operating-systems-systems-programming/process-execution-capture.md) — Records process and user identifiers by intercepting system calls responsible for process execution. ([source](https://eunomia.dev/tutorials/7-execsnoop/))
- [Shared Memory Management](https://awesome-repositories.com/f/operating-systems-systems-programming/shared-memory-management.md) — Implements zero-copy shared memory regions and complex data structures using dynamic pointers. ([source](https://eunomia.dev/tutorials/))
- [Traffic Control Interfaces](https://awesome-repositories.com/f/operating-systems-systems-programming/traffic-control-interfaces.md) — Provides utilities for manipulating kernel-level networking rules and traffic control settings using link-based semantics. ([source](https://eunomia.dev/tutorials/50-tcx/))
- [User-Kernel Control Flow Correlation](https://awesome-repositories.com/f/operating-systems-systems-programming/user-kernel-control-flow-correlation.md) — Links high-level user API calls to corresponding low-level kernel ioctl implementations to reveal full control flow. ([source](https://eunomia.dev/tutorials/xpu/npu-kernel-driver/))
- [Userspace to Kernel Data Transfer](https://awesome-repositories.com/f/operating-systems-systems-programming/userspace-to-kernel-data-transfer.md) — Passes messages from user space to kernel mode using a single-producer consumer model. ([source](https://eunomia.dev/tutorials/35-user-ringbuf/))

### Education & Learning Resources

- [Kernel Tracing Manuals](https://awesome-repositories.com/f/education-learning-resources/kernel-tracing-manuals.md) — Includes a detailed manual for implementing kprobes, uprobes, and tracepoints to capture real-time system events.
- [Security Implementation Guides](https://awesome-repositories.com/f/education-learning-resources/security-implementation-guides.md) — Provides a handbook for developing security policies and intrusion detection via system call interception.

### Networking & Communication

- [Kernel Event Hooks](https://awesome-repositories.com/f/networking-communication/kernel-event-hooks.md) — Provides interfaces for binding programs to kprobes and tracepoints to execute logic during specific system events.
- [Load Balancing](https://awesome-repositories.com/f/networking-communication/load-balancing.md) — Distributes incoming network traffic across backend servers by processing packets at the driver level. ([source](https://eunomia.dev/tutorials/21-xdp/))
- [Network Traffic Engineering](https://awesome-repositories.com/f/networking-communication/network-traffic-routing/network-traffic-engineering.md) — Offers tutorials on implementing high-performance packet filtering, load balancing, and traffic redirection in the kernel.
- [Safe Packet Header Parsers](https://awesome-repositories.com/f/networking-communication/packet-capture-drivers/raw-packet-inspection/safe-packet-header-parsers.md) — Implements bounds-checked parsing of Ethernet and IP headers from raw packet data using safe pointer arithmetic. ([source](https://eunomia.dev/tutorials/features/dynptr/))
- [XDP Packet Processing](https://awesome-repositories.com/f/networking-communication/packet-engines/packet-processing-frameworks/xdp-packet-processing.md) — Implements high-performance packet processing and load balancing at the network interface driver level using XDP. ([source](https://eunomia.dev/tutorials/))
- [eBPF Socket Filters](https://awesome-repositories.com/f/networking-communication/socket-networking/ebpf-socket-filters.md) — Implements eBPF programs attached to network sockets to restrict or prioritize traffic based on custom logic. ([source](https://eunomia.dev/tutorials/23-http/))
- [Socket Redirections](https://awesome-repositories.com/f/networking-communication/socket-networking/ebpf-socket-filters/socket-redirections.md) — Enables forwarding of network packets directly between sockets using rule maps to bypass the standard kernel network stack. ([source](https://eunomia.dev/tutorials/29-sockops/))
- [Traffic Distribution](https://awesome-repositories.com/f/networking-communication/traffic-shaping/scaling/traffic-distribution.md) — Routes incoming packets to multiple backend servers by hashing source IP and port addresses. ([source](https://eunomia.dev/tutorials/42-xdp-loadbalancer/))
- [In-Kernel Event Filtering](https://awesome-repositories.com/f/networking-communication/kernel-event-hooks/in-kernel-event-filtering.md) — Implements in-kernel event filtering using global variables passed from user-space to reduce data noise. ([source](https://eunomia.dev/tutorials/4-opensnoop/))
- [Packet Capture Implementations](https://awesome-repositories.com/f/networking-communication/network-packet-parsers/packet-capture-implementations.md) — Implements kernel-level interception and recording of raw TCP packet header information. ([source](https://eunomia.dev/tutorials/41-xdp-tcpdump/))
- [Hardware-Accelerated Packet Forwarding](https://awesome-repositories.com/f/networking-communication/packet-engines/packet-processing-frameworks/hardware-accelerated-packet-forwarding.md) — Translates bytecode into parallelized instructions for execution on hardware-based FPGA network cards. ([source](https://eunomia.dev/tutorials/18-further-reading/))
- [Malformed Packet Injection](https://awesome-repositories.com/f/networking-communication/packet-injection-engines/malformed-packet-injection.md) — Transmits arbitrary ethernet frames and malformed packets to verify system handling and stability. ([source](https://eunomia.dev/tutorials/46-xdp-test/))
- [Round-Trip Time Measurement](https://awesome-repositories.com/f/networking-communication/peer-connection-monitoring/round-trip-time-measurement.md) — Measures network round-trip time and aggregates latency data into histograms for connection analysis. ([source](https://eunomia.dev/tutorials/14-tcpstates/))
- [Per-Connection Latency Measurements](https://awesome-repositories.com/f/networking-communication/round-trip-time-measurements/per-connection-latency-measurements.md) — Calculates round-trip time for individual TCP connections by tracing network stack events. ([source](https://eunomia.dev/tutorials/13-tcpconnlat/))
- [Socket Lifecycle Monitoring](https://awesome-repositories.com/f/networking-communication/socket-event-handling/socket-lifecycle-monitoring.md) — Monitors and restricts how applications handle connections by hooking socket-level events. ([source](https://eunomia.dev/tutorials/cgroup/))
- [TCP Connection Status Monitoring](https://awesome-repositories.com/f/networking-communication/tcp-connection-lifecycles/tcp-client-connections/webassembly-tcp-connections/tcp-transport-connections/tcp-connection-status-monitoring.md) — Observes and tracks TCP state transitions using version-aware kernel programs. ([source](https://eunomia.dev/tutorials/14-tcpstates/))
- [eBPF Traffic Analyzers](https://awesome-repositories.com/f/networking-communication/traffic-interception-tools/ebpf-interceptors/ebpf-traffic-analyzers.md) — Analyzes connection states and HTTP traffic by attaching eBPF and XDP programs to network interfaces. ([source](https://eunomia.dev/tutorials/))
- [Userspace Packet Processing](https://awesome-repositories.com/f/networking-communication/userspace-packet-processing.md) — Integrates network traffic filtering logic within userspace data planes using kernel-assisted eBPF programs. ([source](https://eunomia.dev/tutorials/36-userspace-ebpf/))

### Programming Languages & Runtimes

- [eBPF Bytecode Compilers](https://awesome-repositories.com/f/programming-languages-runtimes/rust-based-compilers/ebpf-bytecode-compilers.md) — Transforms source code into eBPF bytecode files and packs them for kernel loading. ([source](https://github.com/eunomia-bpf/bpf-developer-tutorial/blob/main/src/1-helloworld/README.md))
- [Bytecode Loading Toolchains](https://awesome-repositories.com/f/programming-languages-runtimes/rust-based-compilers/ebpf-bytecode-compilers/bytecode-loading-toolchains.md) — Provides specialized toolchains to compile custom logic into bytecode and load it into the kernel. ([source](https://eunomia.dev/tutorials/0-introduce/))
- [BPF Program Chaining](https://awesome-repositories.com/f/programming-languages-runtimes/tail-call-optimizations/bpf-program-chaining.md) — Controls packet flow through a sequence of eBPF programs using tail-call chaining and specific return codes. ([source](https://eunomia.dev/tutorials/50-tcx/))

### Security & Cryptography

- [Network Traffic Filtering](https://awesome-repositories.com/f/security-cryptography/network-traffic-filtering.md) — Provides capabilities for inspecting and modifying packet data at traffic control points to implement firewall-style filtering. ([source](https://eunomia.dev/tutorials/20-tc/))
- [Runtime Security Enforcement](https://awesome-repositories.com/f/security-cryptography/runtime-security-enforcement.md) — Teaches real-time blocking and alerting of security-significant system events and malicious network traffic.
- [Stateful Filtering](https://awesome-repositories.com/f/security-cryptography/granular-access-controls/resource-level-access-controls/system-call-access-controllers/stateful-filtering.md) — Enforces security policies by maintaining filter state across multiple system call interpositions. ([source](https://eunomia.dev/tutorials/18-further-reading/))
- [Handshake Latency Analysis](https://awesome-repositories.com/f/security-cryptography/https-performance-optimizations/handshake-latency-analysis.md) — Analyzes encryption establishment time by tracking the start and end of secure connection handshakes. ([source](https://eunomia.dev/tutorials/30-sslsniff/))
- [Security Policy Enforcers](https://awesome-repositories.com/f/security-cryptography/infrastructure-policy-enforcement/security-policy-enforcers.md) — Implements access control and threat detection using security hooks and delegated privileges within the kernel. ([source](https://eunomia.dev/tutorials/))
- [IP Blocking Middleware](https://awesome-repositories.com/f/security-cryptography/malicious-traffic-blocking/ip-blocking-middleware.md) — Intercepts connection requests to block network traffic to specific forbidden IP addresses. ([source](https://eunomia.dev/tutorials/19-lsm-connect/))
- [ML-Based Detection](https://awesome-repositories.com/f/security-cryptography/network-intrusion-detection/ml-based-detection.md) — Runs machine learning models directly in the kernel to classify and detect malicious network flows. ([source](https://eunomia.dev/tutorials/18-further-reading/))

### Software Engineering & Architecture

- [Kernel Task](https://awesome-repositories.com/f/software-engineering-architecture/background-thread-dispatchers/dispatch-queues/kernel-task.md) — Buffers tasks in kernel-space queues to coordinate CPU workload assignment. ([source](https://eunomia.dev/tutorials/44-scx-simple/))
- [Goroutine Execution Tracing](https://awesome-repositories.com/f/software-engineering-architecture/task-scheduling/asynchronous-schedulers/asynchronous-thread-schedulers/goroutine-scheduling-models/goroutine-execution-tracing.md) — Intercepts goroutine state transitions in Go programs using user-level probes to reveal concurrency issues. ([source](https://eunomia.dev/tutorials/31-goroutine/))

### System Administration & Monitoring

- [eBPF-Based Tracing](https://awesome-repositories.com/f/system-administration-monitoring/diagnostic-tools/diagnostics/execution-tracers/kernel-tracing-frameworks/ebpf-based-tracing.md) — Uses eBPF-based tracing to capture predefined static tracepoints (USDT) in user-space programs. ([source](https://eunomia.dev/tutorials/15-javagc/))
- [System Call Tracing](https://awesome-repositories.com/f/system-administration-monitoring/diagnostic-tools/diagnostics/execution-tracers/kernel-tracing-frameworks/system-call-tracing.md) — Intercepts kernel system calls to track arguments and return values via a trace pipe. ([source](https://eunomia.dev/tutorials/6-sigsnoop/))
- [Kernel Event Observability](https://awesome-repositories.com/f/system-administration-monitoring/kernel-event-observability.md) — Provides comprehensive guides on monitoring system events by attaching eBPF programs to kernel hooks.
- [Learning Resources](https://awesome-repositories.com/f/system-administration-monitoring/kernel-event-observability/learning-resources.md) — Ships a comprehensive guide for monitoring system calls and hardware events to analyze kernel behavior.
- [Dynamic User-Space Probes](https://awesome-repositories.com/f/system-administration-monitoring/logging-and-telemetry/dynamic-binary-instrumentation/dynamic-kernel-probes/dynamic-user-space-probes.md) — Attaches dynamic probes to compiled binaries to monitor function calls without modifying source code.
- [Function IO Tracing](https://awesome-repositories.com/f/system-administration-monitoring/user-space-function-tracing/function-io-tracing.md) — Demonstrates logging function input arguments and recording task durations by attaching probes to kernel functions. ([source](https://eunomia.dev/tutorials/39-nginx/))
- [Task Execution Monitoring](https://awesome-repositories.com/f/system-administration-monitoring/activity-monitors/task-execution-monitoring.md) — Tracks the execution of the exec family of functions to monitor process spawning and execution flow. ([source](https://eunomia.dev/tutorials/22-android/))
- [Device-Specific Event Filtering](https://awesome-repositories.com/f/system-administration-monitoring/device-specific-event-filtering.md) — Implements the ability to restrict I/O statistics tracking to specific hardware device identifiers. ([source](https://eunomia.dev/tutorials/17-biopattern/))
- [Driver Operation Tracing](https://awesome-repositories.com/f/system-administration-monitoring/diagnostic-tools/diagnostics/execution-tracers/kernel-tracing-frameworks/kernel-execution-path-tracing/driver-operation-tracing.md) — Implements probes for kernel module functions to monitor execution flow and identify performance hot paths in drivers. ([source](https://eunomia.dev/tutorials/xpu/npu-kernel-driver/))
- [Kernel Function Call Monitoring](https://awesome-repositories.com/f/system-administration-monitoring/diagnostic-tools/diagnostics/execution-tracers/kernel-tracing-frameworks/kernel-execution-profilers/kernel-function-call-monitoring.md) — Intercepts kernel function entry and exit points to capture arguments for auditing and tracing purposes. ([source](https://eunomia.dev/tutorials/2-kprobe-unlink/))
- [Latency Distribution Histograms](https://awesome-repositories.com/f/system-administration-monitoring/event-monitoring-systems/kernel-event-tracers/event-distribution-histograms/latency-distribution-histograms.md) — Provides histogram-based visualization of process scheduling delays to analyze latency distributions. ([source](https://eunomia.dev/tutorials/9-runqlat/))
- [Graphics API Tracing](https://awesome-repositories.com/f/system-administration-monitoring/graphics-hardware-monitors/graphics-call-profilers/graphics-api-tracing.md) — Records sequences of graphics commands by intercepting runtime calls via shared library injection. ([source](https://eunomia.dev/tutorials/xpu/flamegraph/))
- [Kernel Ring Buffer Streams](https://awesome-repositories.com/f/system-administration-monitoring/log-streaming/kernel-ring-buffer-streams.md) — Transfers captured kernel data to user-space asynchronously using high-performance memory ring buffers.
- [Probe Discovery Utilities](https://awesome-repositories.com/f/system-administration-monitoring/logging-and-telemetry/dynamic-binary-instrumentation/dynamic-kernel-probes/probe-discovery-utilities.md) — Provides utilities for discovering available kernel and user-space instrumentation points using wildcard searches. ([source](https://eunomia.dev/tutorials/bpftrace-tutorial/))
- [Process Lifecycle Tracing](https://awesome-repositories.com/f/system-administration-monitoring/monitoring-and-observability/execution-tracing-analysis/execution-tracing/process-lifecycle-tracing.md) — Monitors the spawning and termination of processes to calculate resource statistics and durations. ([source](https://eunomia.dev/tutorials/11-bootstrap/))
- [Network Traffic Analysis](https://awesome-repositories.com/f/system-administration-monitoring/network-traffic-analysis.md) — Processes packets and monitors connection states to implement kernel-level load balancing and traffic control. ([source](https://cdn.jsdelivr.net/gh/eunomia-bpf/bpf-developer-tutorial@main/README.md))
- [Kernel Traffic Sketching](https://awesome-repositories.com/f/system-administration-monitoring/network-traffic-analysis/kernel-traffic-sketching.md) — Implements compact, probabilistic data structures in the kernel to summarize high-volume network traffic efficiently. ([source](https://eunomia.dev/tutorials/18-further-reading/))
- [Disk I/O Performance Analysis](https://awesome-repositories.com/f/system-administration-monitoring/performance-monitoring-tools/performance-tuning/disk-i-o-performance-analysis.md) — Provides analysis of disk I/O patterns by calculating the ratio of random to sequential requests via sector tracking. ([source](https://eunomia.dev/tutorials/17-biopattern/))
- [Process Resource Statistics](https://awesome-repositories.com/f/system-administration-monitoring/process-resource-statistics.md) — Gathers real-time metrics on CPU, memory, and resource consumption during the process termination phase. ([source](https://github.com/eunomia-bpf/bpf-developer-tutorial/blob/main/src/11-bootstrap/README.md))
- [Driver Interaction Monitoring](https://awesome-repositories.com/f/system-administration-monitoring/real-time-monitoring/hardware-health-monitors/driver-interaction-monitoring.md) — Monitors operations between the kernel and hardware drivers to debug device activity and energy consumption. ([source](https://eunomia.dev/tutorials/))
- [Scheduler Latency Analyzers](https://awesome-repositories.com/f/system-administration-monitoring/resource-scheduling/kernel-schedulers/scheduler-latency-analyzers.md) — Quantifies the time between a process becoming runnable and its actual execution on a CPU. ([source](https://eunomia.dev/tutorials/9-runqlat/))
- [Scheduler Performance Monitoring](https://awesome-repositories.com/f/system-administration-monitoring/scheduler-performance-monitoring.md) — Aggregates task queue statistics in userspace to monitor real-time kernel scheduling behavior. ([source](https://eunomia.dev/tutorials/44-scx-simple/))
- [SSL TLS Data Capture](https://awesome-repositories.com/f/system-administration-monitoring/ssl-tls-data-capture.md) — Implements interception of plaintext data from SSL/TLS libraries using probes for observability. ([source](https://eunomia.dev/tutorials/30-sslsniff/))
- [Process Duration Monitoring](https://awesome-repositories.com/f/system-administration-monitoring/time-duration-monitoring/process-duration-monitoring.md) — Calculates the total elapsed time from the start to the termination of operating system processes. ([source](https://github.com/eunomia-bpf/bpf-developer-tutorial/blob/main/src/11-bootstrap/README.md))
- [Execution Stack Samplers](https://awesome-repositories.com/f/system-administration-monitoring/trace-sampling/execution-stack-samplers.md) — Samples kernel and user-level stack traces at regular intervals to identify processor bottlenecks. ([source](https://eunomia.dev/tutorials/bpftrace-tutorial/))
- [Kernel Stack Trace Capture](https://awesome-repositories.com/f/system-administration-monitoring/trace-sampling/stack-trace-aggregators/kernel-stack-trace-capture.md) — Records full user-space call chains with nanosecond precision using kernel probes. ([source](https://eunomia.dev/tutorials/xpu/flamegraph/))
- [Flame Graph Generators](https://awesome-repositories.com/f/system-administration-monitoring/trace-visualization/flame-graph-generators.md) — Transforms kernel stack trace data into interactive flame graphs to visualize execution hotspots. ([source](https://eunomia.dev/tutorials/12-profile/))
- [Wall-Clock Flame Graphs](https://awesome-repositories.com/f/system-administration-monitoring/trace-visualization/flame-graph-generators/wall-clock-flame-graphs.md) — Generates normalized visualizations that merge processor samples and blocking time into wall-clock flame graphs. ([source](https://eunomia.dev/tutorials/32-wallclock-profiler/))

### Part of an Awesome List

- [Scheduler Performance Metrics](https://awesome-repositories.com/f/awesome-lists/productivity/time-and-scheduling/scheduler-performance-metrics.md) — Collects periodic statistics on CPU core states to evaluate the effectiveness of the kernel scheduler. ([source](https://eunomia.dev/tutorials/45-scx-nest/))

### Data & Databases

- [Zero-Copy Memory Mappings](https://awesome-repositories.com/f/data-databases/data-engineering-infrastructure/data-persistence-storage/data-storage-architectures/zero-copy-memory-mappings.md) — Creates sparse memory regions shared between kernel and userspace to eliminate expensive system calls. ([source](https://eunomia.dev/tutorials/features/bpf_arena/))
- [Kernel-Level Complex Data Structures](https://awesome-repositories.com/f/data-databases/in-memory-data-stores/complex-data-structure-stores/kernel-level-complex-data-structures.md) — Enables the construction of advanced data structures like linked lists and graphs using raw pointers in kernel memory. ([source](https://eunomia.dev/tutorials/features/bpf_arena/))
- [Interrupt-Driven Caching](https://awesome-repositories.com/f/data-databases/performance-caching-systems/page-caching-controls/kernel-page-cache-file-caching/interrupt-driven-caching.md) — Serves requests from a cache during hardware interrupts to increase network packet throughput. ([source](https://eunomia.dev/tutorials/18-further-reading/))
- [Kernel-Userspace Shared Memory](https://awesome-repositories.com/f/data-databases/shared-memory-transports/kernel-userspace-shared-memory.md) — Creates sparse memory regions shared between kernel and userspace to avoid expensive system calls.

### Development Tools & Productivity

- [eBPF-Based CPU Profilers](https://awesome-repositories.com/f/development-tools-productivity/debugging-profiling-testing/debugging-diagnostics/performance-resource-profilers/cpu-profilers/continuous-profilers/ebpf-based-cpu-profilers.md) — Samples kernel and user-space stack traces at regular intervals to identify execution hotspots. ([source](https://eunomia.dev/tutorials/32-wallclock-profiler/))
- [In-Kernel Event Aggregations](https://awesome-repositories.com/f/development-tools-productivity/debugging-profiling-testing/debugging-diagnostics/performance-resource-profilers/cpu-profilers/data-summarizations/in-kernel-event-aggregations.md) — Implements the aggregation of occurrences into kernel maps and histograms for efficient performance analysis. ([source](https://eunomia.dev/tutorials/bpftrace-tutorial/))
- [Flamegraph Generators](https://awesome-repositories.com/f/development-tools-productivity/debugging-profiling-testing/debugging-diagnostics/performance-resource-profilers/cpu-profilers/flamegraph-generators.md) — Formats combined processor and graphics trace data into folded stack files for flamegraph visualization. ([source](https://eunomia.dev/tutorials/xpu/flamegraph/))
- [Off-CPU Latency Analyzers](https://awesome-repositories.com/f/development-tools-productivity/debugging-profiling-testing/debugging-diagnostics/performance-resource-profilers/cpu-profilers/off-cpu-latency-analyzers.md) — Measures thread wait times between scheduler events to identify blocking bottlenecks. ([source](https://eunomia.dev/tutorials/32-wallclock-profiler/))

### DevOps & Infrastructure

- [Kernel Event Correlation](https://awesome-repositories.com/f/devops-infrastructure/infrastructure-operations/infrastructure-event-correlation-tools/security-event-correlation/forensic-event-correlation/event-correlation-and-sequencing/kernel-event-correlation.md) — Links data across separate kernel entry and exit events by maintaining state in hash maps. ([source](https://eunomia.dev/tutorials/6-sigsnoop/))
- [CPU Scheduling Event Recorders](https://awesome-repositories.com/f/devops-infrastructure/task-scheduling-policies/cpu-scheduling-policies/cpu-scheduling-event-recorders.md) — Captures fine-grained kernel scheduling events such as context switches and runnable transitions for analysis. ([source](https://eunomia.dev/tutorials/bpftrace-tutorial/))

### Testing & Quality Assurance

- [Memory Leak Detection](https://awesome-repositories.com/f/testing-quality-assurance/debugging-diagnostics/memory-leak-detection.md) — Tracks allocation and deallocation events in the kernel to identify memory blocks that are not freed. ([source](https://eunomia.dev/tutorials/16-memleak/))
- [Isolated Program Testing](https://awesome-repositories.com/f/testing-quality-assurance/general-testing-utilities/test-isolation/isolated-program-testing.md) — Validates BPF program logic using synthetic inputs without sending actual network traffic. ([source](https://eunomia.dev/tutorials/46-xdp-test/))
- [Synthetic Traffic Generators](https://awesome-repositories.com/f/testing-quality-assurance/synthetic-traffic-generators.md) — Injects synthetic packets directly into the kernel fast path to benchmark network stack stability. ([source](https://eunomia.dev/tutorials/46-xdp-test/))