Posts

Building BPF applications with libbpf-bootstrap

Get started with your own BPF application quickly and painlessly with libbpf-bootstrap scaffolding, which takes care of all the mundane setup steps and lets you dive right into BPF fun and minimize the necessary boilerplate. We'll take a look at what libbpf-bootstrap provides and how everything is tied together.

Get started with your own BPF application quickly and painlessly with libbpf-bootstrap scaffolding, which takes care of all the mundane setup steps and lets you dive right into BPF fun and minimize the necessary boilerplate. We'll take a look at what libbpf-bootstrap provides and how everything is tied together.

Read More

Categories: BPF

Tags: bpf

BPF ring buffer

BPF ring buffer (ringbuf) and how it is similar and different from BPF perf buffer. BPF ringbuf's APIs, performance and usability advantages. With examples of source code.

There is now a new BPF data structure available: BPF ring buffer. It solves memory efficiency and event re-ordering problems of the BPF perf buffer (a de facto standard today for sending data from kernel to user-space) while meeting or beating its performance. It provides both perfbuf-compatible for easy migration, but also has the new reserve/commit API with better usability. Also, both synthetic and real-world benchmarks show that in almost all cases so think about making it a default choice for sending data from the BPF program to user-space.

Read More

Categories: BPF

Tags: bpf

BPF CO-RE (Compile Once – Run Everywhere)

Why most BPF applications have to be portable across multiple Linux kernels and how BPF CO-RE (Compile Once – Run Everywhere) technology makes that possible and easy.

What does it mean for a BPF application to be portable? And why it's actually hard to achieve that without BPF Compile Once — Run Everywhere (CO-RE)? In this post we'll see what are the challenges of writing BPF programs that can work across multiple kernel versions and how BPF CO-RE is helping to address this problem.

Read More

Categories: BPF

BTF deduplication and Linux kernel BTF

Description of BTF deduplication algorithm, which enables compact BTF type information in Linux kernel. It enabled BPF CO-RE (Compile Once – Run Everywhere), building modern portable BPF applications and many modern and powerful BPF features in Linux kernel.

This is a slightly updated (in 2020) version of the post first published at Facebook's BPF blog back in 2018. BTF deduplication is what got me started with BPF and Linux kernel development, so I'm re-publishing it here retroactively for a more complete story of my involvement with BPF. Please also check out updated "What's next" section for a short summary on what happened in BPF world after BTF dedup was developed.

Read More

Categories: BPF