This table is generated from each tutorial's .config metadata. Minimum kernel means the oldest kernel that the tutorial currently declares support for. Basis says whether that value comes from the tutorial documentation, the first version of a required feature, or the repository's declared baseline. Not in CI does not imply that a manual test was performed. Distribution kernels may disable a listed option, so a version number alone does not guarantee compatibility.
| Tutorial | Minimum kernel | Basis | Architectures | BTF | Core kernel config | Hardware | Root | Test status |
|---|---|---|---|---|---|---|---|---|
| eBPF Tutorial by Example 0: Introduction to Core Concepts and Tools | N/A | N/A | All | Not required | None | None | Not required | Docs only |
| eBPF Tutorial by Example 1: Hello World, Framework and Development | 4.8 | Tutorial docs | x86_64, arm64 | Not required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_FTRACE_SYSCALLS=y | None | Required | CI runtime |
| eBPF Tutorial by Example 2: Monitoring unlink System Calls with kprobe | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_KPROBE_EVENTS=y | None | Required | CI runtime |
| eBPF Tutorial by Example 3: Monitoring unlink System Calls with fentry | x86_64:5.5, arm64:6.0 | Tutorial docs | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_BPF_JIT=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE=y | None | Required | CI runtime |
| eBPF Tutorial by Example 4: Capturing Opening Files and Filter with Global Variables | 4.8 | Repository baseline | x86_64, arm64 | Not required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_FTRACE_SYSCALLS=y | None | Required | CI runtime |
| eBPF Tutorial by Example 5: Capturing readline Function Calls with Uprobe | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_UPROBE_EVENTS=y | None | Required | CI runtime |
| eBPF Tutorial by Example 6: Capturing Signal Sending and Store State with Hash Maps | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=y | None | Required | CI runtime |
| eBPF Tutorial by Example 7: Capturing Process Execution, Output with perf event array | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=y, CONFIG_PERF_EVENTS=y | None | Required | CI runtime |
| eBPF Tutorial by Example 8: Monitoring Process Exit Events, Output with Ring Buffer | 5.8 | Tutorial docs | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_TRACEPOINTS=y | None | Required | CI runtime |
| eBPF Tutorial by Example 9: Capturing Scheduling Latency and Recording as Histogram | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_TRACEPOINTS=y | None | Required | CI runtime |
| eBPF Tutorial by Example 10: Capturing Interrupts with hardirqs or softirqs | 5.5 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_CGROUPS=y, CONFIG_CGROUP_BPF=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE=y | None | Required | CI runtime |
| eBPF Tutorial by Example 11: Develop User-Space Programs with libbpf and Trace exec() and exit() | 5.8 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_TRACEPOINTS=y | None | Required | CI runtime |
| eBPF Tutorial by Example 12: Using eBPF Program Profile for Performance Analysis | 5.8 | Required feature | x86_64, arm64 | Optional | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_PERF_EVENTS=y | None | Required | CI build |
| eBPF Tutorial by Example 13: Statistics of TCP Connection Delay with libbpf | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_KPROBE_EVENTS=y | None | Required | CI runtime |
| eBPF Tutorial by Example 14: Recording TCP Connection Status and TCP RTT | 5.5 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE=y, CONFIG_TRACEPOINTS=y | None | Required | CI runtime |
| eBPF Tutorial by Example 15: Capturing User-Space Java GC Duration Using USDT | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_UPROBE_EVENTS=y | None | Required | CI build |
| eBPF Tutorial by Example 16: Monitoring Memory Leaks | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_TRACEPOINTS=y, CONFIG_UPROBE_EVENTS=y | None | Required | CI runtime |
| eBPF Tutorial by Example 17: Count Random/Sequential Disk I/O | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_TRACEPOINTS=y | Block device | Required | CI runtime |
| More Reference Materials： papers, projects | N/A | N/A | All | Not required | None | None | Not required | Docs only |
| eBPF Tutorial by Example 19: Security Detection and Defense using LSM | 5.7 | Tutorial docs | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_LSM=y, CONFIG_DEBUG_INFO_BTF=y | None | Required | Not in CI |
| eBPF Tutorial by Example 20: tc Traffic Control | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_NET_CLS_BPF=y|m, CONFIG_NET_SCHED=y | Network interface | Required | CI runtime |
| eBPF Tutorial by Example 21: Programmable Packet Processing with XDP | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y | Network interface | Required | Not in CI |
| eBPF Tutorial by Example: Using eBPF Programs on Android | 5.15 | Tutorial docs | x86_64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=y | Android device or emulator | Required | Not in CI |
| L7 Tracing with eBPF: HTTP and Beyond via Socket Filters and Syscall Tracepoints | 5.17 | Tutorial docs | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=y | None | Required | CI runtime |
| eBPF Practical Tutorial: Hiding Process or File Information | 5.8 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=y | None | Required | CI build |
| Using bpf_send_signal to Terminate Malicious Processes in eBPF | 5.8 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=y | None | Required | CI runtime |
| eBPF Tutorial: Privilege Escalation via File Content Manipulation | 5.8 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=y | None | Required | CI build |
| eBPF Tutorial: Transparent Text Replacement in File Reads | 5.17 | Tutorial docs | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=y | None | Required | CI build |
| Running eBPF After Application Exits: The Lifecycle of eBPF Programs | 5.8 | Required feature | x86_64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE=y | None | Required | CI build |
| eBPF Development Practices: Accelerating Network Request Forwarding with Sockops | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_CGROUPS=y, CONFIG_CGROUP_BPF=y, CONFIG_DEBUG_INFO_BTF=y | Network interface | Required | CI build |
| eBPF Practical Tutorial: Capturing SSL/TLS Plain Text Data Using uprobe | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_UPROBE_EVENTS=y | None | Required | CI runtime |
| eBPF Practical Tutorial: Using eBPF to Trace Go Routine States | 5.2 | Required feature | x86_64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_UPROBE_EVENTS=y | None | Required | CI build |
| eBPF Tutorial by Example 32: Wall Clock Profiling with Combined On-CPU and Off-CPU Analysis | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_PERF_EVENTS=y | None | Required | CI build |
| Measuring Function Latency with eBPF | 4.8 | Repository baseline | x86_64, arm64 | Optional | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_KPROBE_EVENTS=y, CONFIG_UPROBE_EVENTS=y | None | Required | CI build |
| eBPF Development Practice: Modifying System Call Arguments with eBPF | 5.8 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=y | None | Required | CI runtime |
| eBPF Development Practices: Asynchronously Send to Kernel with User Ring Buffer | 6.1 | Tutorial docs | x86_64, arm64 | Optional | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_FTRACE_SYSCALLS=y | None | Required | CI runtime |
| Userspace eBPF Runtimes: Overview and Applications | N/A | N/A | All | Not required | None | None | Not required | Docs only |
| eBPF Practice: Tracing User Space Rust Applications with Uprobe | 4.8 | Repository baseline | x86_64, arm64 | Not required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_UPROBE_EVENTS=y | None | Required | CI runtime |
| Expanding eBPF Compile Once, Run Everywhere(CO-RE) to Userspace Compatibility | 5.2 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_UPROBE_EVENTS=y | None | Required | CI build |
| Using eBPF to Trace Nginx Requests | 4.8 | Repository baseline | x86_64, arm64 | Not required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_UPROBE_EVENTS=y | None | Required | Not in CI |
| Using eBPF to Trace MySQL Queries | 4.8 | Repository baseline | x86_64, arm64 | Not required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_UPROBE_EVENTS=y | None | Required | Not in CI |
| eBPF Tutorial by Example: Capturing TCP Information with XDP | 5.8 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y | Network interface | Required | CI build |
| eBPF Developer Tutorial: XDP Load Balancer | 4.8 | Required feature | x86_64, arm64 | Optional | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y | Network interface | Required | CI build |
| Extending eBPF Beyond Its Limits: Custom kfuncs in Kernel Modules | 6.11 | Tutorial docs | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_DEBUG_INFO_BTF_MODULES=y, CONFIG_KPROBE_EVENTS=y, CONFIG_MODULES=y | None | Required | CI build |
| eBPF Tutorial: Introduction to the BPF Scheduler | 6.12 | Tutorial docs | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_SCHED_CLASS_EXT=y | None | Required | CI build |
eBPF Tutorial by Example: Implementing the scx_nest Scheduler |
6.12 | Tutorial docs | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_SCHED_CLASS_EXT=y | None | Required | CI build |
| eBPF Tutorial by Example: Building a High-Performance XDP Packet Generator | 5.18 | Tutorial docs | x86_64, arm64 | Optional | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_XDP_SOCKETS=y | Network interface | Required | CI build |
| eBPF Tutorial: Tracing CUDA GPU Operations | 5.8 | Required feature | x86_64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_UPROBE_EVENTS=y | NVIDIA CUDA GPU | Required | CI build |
| eBPF Tutorial: Energy Monitoring for Process-Level Power Analysis | 5.8 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_TRACEPOINTS=y | None | Required | CI build |
| eBPF Tutorial: Fixing Broken HID Devices Without Kernel Patches | 6.3 | Tutorial docs | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_HID_BPF=y, CONFIG_UHID=y|m | None | Required | CI build |
| eBPF Tutorial by Example 50: Composable Traffic Control with TCX Links | 6.6 | Tutorial docs | x86_64, arm64 | Optional | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_NET_XGRESS=y | Network interface | Required | CI build |
| eBPF Tutorial: cgroup-based Policy Control | 5.8 | Required feature | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_CGROUPS=y, CONFIG_CGROUP_BPF=y, CONFIG_CGROUP_DEVICE=y, CONFIG_DEBUG_INFO_BTF=y | None | Required | CI build |
| eBPF Tutorial by Example: BPF Arena for Zero-Copy Shared Memory | 6.9 | Tutorial docs | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_JIT=y, CONFIG_DEBUG_INFO_BTF=y | None | Required | CI build |
| eBPF Tutorial: BPF Iterators for Kernel Data Export | 5.8 | Tutorial docs | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y | None | Required | CI build |
| eBPF Tutorial by Example: BPF Token for Delegated Privilege and Secure Program Loading | 6.9 | Tutorial docs | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_USER_NS=y | None | Required | CI build |
| eBPF Tutorial: BPF Workqueues for Asynchronous Sleepable Tasks | 6.10 | Tutorial docs | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_BPF_JIT=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE=y | None | Required | CI build |
| eBPF Tutorial by Example: BPF Dynamic Pointers for Variable-Length Data | 6.4 | Tutorial docs | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_NET_CLS_BPF=y|m, CONFIG_NET_SCHED=y | Network interface | Required | CI build |
| eBPF Tutorial: Extending Kernel Subsystems with BPF struct_ops | Unknown | Unverified | x86_64, arm64 | Required | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_JIT=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_DEBUG_INFO_BTF_MODULES=y, CONFIG_MODULES=y | None | Required | CI build |
| eBPF by Example: Building a GPU Flamegraph Profiler with CUPTI | 5.8 | Required feature | x86_64 | Optional | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_PERF_EVENTS=y, CONFIG_UPROBE_EVENTS=y | NVIDIA CUDA GPU | Required | Not in CI |
| eBPF Tutorial by Example: Monitoring GPU Driver Activity with Kernel Tracepoints | 4.8 | Repository baseline | x86_64 | Optional | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y | GPU | Required | Not in CI |
| eBPF Tutorial by Example: Tracing Intel NPU Kernel Driver Operations | 6.2 | Tutorial docs | x86_64 | Optional | CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DRM_ACCEL=y, CONFIG_DRM_ACCEL_IVPU=y|m, CONFIG_TRACEPOINTS=y | Intel NPU | Required | Not in CI |
kernel_minandkernel_min_basis: the declared minimum kernel and its evidence basis; usearchitecture:versionwhen architectures differ.architectures: architectures the tutorial currently declares support for.btfandkernel_config: the BTF requirement and core kernel options common to the implementation paths; see the tutorial for vendor- or hook-specific conditions.y|mmeans built in or loaded as a module.hardware: specialized hardware or environment required to run the tutorial;nonemeans no specialized hardware.root: whether running the tutorial requires root privileges.test_status:ci-runtimeexecutes in CI,ci-buildchecks only the build,not-in-cimeans there is no CI evidence, anddocs-onlyis documentation only.
Field definitions and allowed values are validated by scripts/generate_compatibility.py. When a tutorial requirement changes, update its .config and rerun the generator.