Skip to content

Tutorial compatibility matrix

This table is generated from each tutorial's .config metadata. Minimum kernel means the oldest kernel that the tutorial currently declares support for. Basis says whether that value comes from the tutorial documentation, the first version of a required feature, or the repository's declared baseline. Not in CI does not imply that a manual test was performed. Distribution kernels may disable a listed option, so a version number alone does not guarantee compatibility.

TutorialMinimum kernelBasisArchitecturesBTFCore kernel configHardwareRootTest status
eBPF Tutorial by Example 0: Introduction to Core Concepts and ToolsN/AN/AAllNot requiredNoneNoneNot requiredDocs only
eBPF Tutorial by Example 1: Hello World, Framework and Development4.8Tutorial docsx86_64, arm64Not requiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_FTRACE_SYSCALLS=yNoneRequiredCI runtime
eBPF Tutorial by Example 2: Monitoring unlink System Calls with kprobe5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_KPROBE_EVENTS=yNoneRequiredCI runtime
eBPF Tutorial by Example 3: Monitoring unlink System Calls with fentryx86_64:5.5, arm64:6.0Tutorial docsx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_BPF_JIT=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE=yNoneRequiredCI runtime
eBPF Tutorial by Example 4: Capturing Opening Files and Filter with Global Variables4.8Repository baselinex86_64, arm64Not requiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_FTRACE_SYSCALLS=yNoneRequiredCI runtime
eBPF Tutorial by Example 5: Capturing readline Function Calls with Uprobe5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_UPROBE_EVENTS=yNoneRequiredCI runtime
eBPF Tutorial by Example 6: Capturing Signal Sending and Store State with Hash Maps5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=yNoneRequiredCI runtime
eBPF Tutorial by Example 7: Capturing Process Execution, Output with perf event array5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=y, CONFIG_PERF_EVENTS=yNoneRequiredCI runtime
eBPF Tutorial by Example 8: Monitoring Process Exit Events, Output with Ring Buffer5.8Tutorial docsx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_TRACEPOINTS=yNoneRequiredCI runtime
eBPF Tutorial by Example 9: Capturing Scheduling Latency and Recording as Histogram5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_TRACEPOINTS=yNoneRequiredCI runtime
eBPF Tutorial by Example 10: Capturing Interrupts with hardirqs or softirqs5.5Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_CGROUPS=y, CONFIG_CGROUP_BPF=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE=yNoneRequiredCI runtime
eBPF Tutorial by Example 11: Develop User-Space Programs with libbpf and Trace exec() and exit()5.8Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_TRACEPOINTS=yNoneRequiredCI runtime
eBPF Tutorial by Example 12: Using eBPF Program Profile for Performance Analysis5.8Required featurex86_64, arm64OptionalCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_PERF_EVENTS=yNoneRequiredCI build
eBPF Tutorial by Example 13: Statistics of TCP Connection Delay with libbpf5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_KPROBE_EVENTS=yNoneRequiredCI runtime
eBPF Tutorial by Example 14: Recording TCP Connection Status and TCP RTT5.5Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE=y, CONFIG_TRACEPOINTS=yNoneRequiredCI runtime
eBPF Tutorial by Example 15: Capturing User-Space Java GC Duration Using USDT5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_UPROBE_EVENTS=yNoneRequiredCI build
eBPF Tutorial by Example 16: Monitoring Memory Leaks5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_TRACEPOINTS=y, CONFIG_UPROBE_EVENTS=yNoneRequiredCI runtime
eBPF Tutorial by Example 17: Count Random/Sequential Disk I/O5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_TRACEPOINTS=yBlock deviceRequiredCI runtime
More Reference Materials: papers, projectsN/AN/AAllNot requiredNoneNoneNot requiredDocs only
eBPF Tutorial by Example 19: Security Detection and Defense using LSM5.7Tutorial docsx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_LSM=y, CONFIG_DEBUG_INFO_BTF=yNoneRequiredNot in CI
eBPF Tutorial by Example 20: tc Traffic Control5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_NET_CLS_BPF=y|m, CONFIG_NET_SCHED=yNetwork interfaceRequiredCI runtime
eBPF Tutorial by Example 21: Programmable Packet Processing with XDP5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=yNetwork interfaceRequiredNot in CI
eBPF Tutorial by Example: Using eBPF Programs on Android5.15Tutorial docsx86_64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=yAndroid device or emulatorRequiredNot in CI
L7 Tracing with eBPF: HTTP and Beyond via Socket Filters and Syscall Tracepoints5.17Tutorial docsx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=yNoneRequiredCI runtime
eBPF Practical Tutorial: Hiding Process or File Information5.8Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=yNoneRequiredCI build
Using bpf_send_signal to Terminate Malicious Processes in eBPF5.8Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=yNoneRequiredCI runtime
eBPF Tutorial: Privilege Escalation via File Content Manipulation5.8Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=yNoneRequiredCI build
eBPF Tutorial: Transparent Text Replacement in File Reads5.17Tutorial docsx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=yNoneRequiredCI build
Running eBPF After Application Exits: The Lifecycle of eBPF Programs5.8Required featurex86_64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE=yNoneRequiredCI build
eBPF Development Practices: Accelerating Network Request Forwarding with Sockops5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_CGROUPS=y, CONFIG_CGROUP_BPF=y, CONFIG_DEBUG_INFO_BTF=yNetwork interfaceRequiredCI build
eBPF Practical Tutorial: Capturing SSL/TLS Plain Text Data Using uprobe5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_UPROBE_EVENTS=yNoneRequiredCI runtime
eBPF Practical Tutorial: Using eBPF to Trace Go Routine States5.2Required featurex86_64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_UPROBE_EVENTS=yNoneRequiredCI build
eBPF Tutorial by Example 32: Wall Clock Profiling with Combined On-CPU and Off-CPU Analysis5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_PERF_EVENTS=yNoneRequiredCI build
Measuring Function Latency with eBPF4.8Repository baselinex86_64, arm64OptionalCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_KPROBE_EVENTS=y, CONFIG_UPROBE_EVENTS=yNoneRequiredCI build
eBPF Development Practice: Modifying System Call Arguments with eBPF5.8Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE_SYSCALLS=yNoneRequiredCI runtime
eBPF Development Practices: Asynchronously Send to Kernel with User Ring Buffer6.1Tutorial docsx86_64, arm64OptionalCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_FTRACE_SYSCALLS=yNoneRequiredCI runtime
Userspace eBPF Runtimes: Overview and ApplicationsN/AN/AAllNot requiredNoneNoneNot requiredDocs only
eBPF Practice: Tracing User Space Rust Applications with Uprobe4.8Repository baselinex86_64, arm64Not requiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_UPROBE_EVENTS=yNoneRequiredCI runtime
Expanding eBPF Compile Once, Run Everywhere(CO-RE) to Userspace Compatibility5.2Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_UPROBE_EVENTS=yNoneRequiredCI build
Using eBPF to Trace Nginx Requests4.8Repository baselinex86_64, arm64Not requiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_UPROBE_EVENTS=yNoneRequiredNot in CI
Using eBPF to Trace MySQL Queries4.8Repository baselinex86_64, arm64Not requiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_UPROBE_EVENTS=yNoneRequiredNot in CI
eBPF Tutorial by Example: Capturing TCP Information with XDP5.8Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=yNetwork interfaceRequiredCI build
eBPF Developer Tutorial: XDP Load Balancer4.8Required featurex86_64, arm64OptionalCONFIG_BPF=y, CONFIG_BPF_SYSCALL=yNetwork interfaceRequiredCI build
Extending eBPF Beyond Its Limits: Custom kfuncs in Kernel Modules6.11Tutorial docsx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_DEBUG_INFO_BTF_MODULES=y, CONFIG_KPROBE_EVENTS=y, CONFIG_MODULES=yNoneRequiredCI build
eBPF Tutorial: Introduction to the BPF Scheduler6.12Tutorial docsx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_SCHED_CLASS_EXT=yNoneRequiredCI build
eBPF Tutorial by Example: Implementing the scx_nest Scheduler6.12Tutorial docsx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_SCHED_CLASS_EXT=yNoneRequiredCI build
eBPF Tutorial by Example: Building a High-Performance XDP Packet Generator5.18Tutorial docsx86_64, arm64OptionalCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_XDP_SOCKETS=yNetwork interfaceRequiredCI build
eBPF Tutorial: Tracing CUDA GPU Operations5.8Required featurex86_64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_UPROBE_EVENTS=yNVIDIA CUDA GPURequiredCI build
eBPF Tutorial: Energy Monitoring for Process-Level Power Analysis5.8Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_TRACEPOINTS=yNoneRequiredCI build
eBPF Tutorial: Fixing Broken HID Devices Without Kernel Patches6.3Tutorial docsx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_HID_BPF=y, CONFIG_UHID=y|mNoneRequiredCI build
eBPF Tutorial by Example 50: Composable Traffic Control with TCX Links6.6Tutorial docsx86_64, arm64OptionalCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_NET_XGRESS=yNetwork interfaceRequiredCI build
eBPF Tutorial: cgroup-based Policy Control5.8Required featurex86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_CGROUPS=y, CONFIG_CGROUP_BPF=y, CONFIG_CGROUP_DEVICE=y, CONFIG_DEBUG_INFO_BTF=yNoneRequiredCI build
eBPF Tutorial by Example: BPF Arena for Zero-Copy Shared Memory6.9Tutorial docsx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_JIT=y, CONFIG_DEBUG_INFO_BTF=yNoneRequiredCI build
eBPF Tutorial: BPF Iterators for Kernel Data Export5.8Tutorial docsx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=yNoneRequiredCI build
eBPF Tutorial by Example: BPF Token for Delegated Privilege and Secure Program Loading6.9Tutorial docsx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_USER_NS=yNoneRequiredCI build
eBPF Tutorial: BPF Workqueues for Asynchronous Sleepable Tasks6.10Tutorial docsx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_BPF_JIT=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_FTRACE=yNoneRequiredCI build
eBPF Tutorial by Example: BPF Dynamic Pointers for Variable-Length Data6.4Tutorial docsx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_NET_CLS_BPF=y|m, CONFIG_NET_SCHED=yNetwork interfaceRequiredCI build
eBPF Tutorial: Extending Kernel Subsystems with BPF struct_opsUnknownUnverifiedx86_64, arm64RequiredCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_JIT=y, CONFIG_DEBUG_INFO_BTF=y, CONFIG_DEBUG_INFO_BTF_MODULES=y, CONFIG_MODULES=yNoneRequiredCI build
eBPF by Example: Building a GPU Flamegraph Profiler with CUPTI5.8Required featurex86_64OptionalCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_PERF_EVENTS=y, CONFIG_UPROBE_EVENTS=yNVIDIA CUDA GPURequiredNot in CI
eBPF Tutorial by Example: Monitoring GPU Driver Activity with Kernel Tracepoints4.8Repository baselinex86_64OptionalCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=yGPURequiredNot in CI
eBPF Tutorial by Example: Tracing Intel NPU Kernel Driver Operations6.2Tutorial docsx86_64OptionalCONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_EVENTS=y, CONFIG_DRM_ACCEL=y, CONFIG_DRM_ACCEL_IVPU=y|m, CONFIG_TRACEPOINTS=yIntel NPURequiredNot in CI

Metadata fields

  • kernel_min and kernel_min_basis: the declared minimum kernel and its evidence basis; use architecture:version when architectures differ.
  • architectures: architectures the tutorial currently declares support for.
  • btf and kernel_config: the BTF requirement and core kernel options common to the implementation paths; see the tutorial for vendor- or hook-specific conditions. y|m means built in or loaded as a module.
  • hardware: specialized hardware or environment required to run the tutorial; none means no specialized hardware.
  • root: whether running the tutorial requires root privileges.
  • test_status: ci-runtime executes in CI, ci-build checks only the build, not-in-ci means there is no CI evidence, and docs-only is documentation only.

Field definitions and allowed values are validated by scripts/generate_compatibility.py. When a tutorial requirement changes, update its .config and rerun the generator.