What's new in the BPF world?
summary
Covers concrete kernel features now usable from BPF: kfuncs (example: a crash_kexec kfunc lets a BPF program trigger a controlled kernel crash for debugging), BPF memory allocator with per-CPU caches and high/low water marks for faster dynamic allocation, long-lived kernel pointers that can be typed and stored in maps for safe cross-program sharing, and multi-kprobe attachment (BPFTrace attaches ~426 probes; older attach took ~15s, new tracekeeper multi does it in <1s). Also: BPF loop helper (iterations+callback), BTF-backed iterators, libbpf/light skeletons and ongoing work on propack and program signing.
AI-written summary · about
chapters (4)
related talks
28mbpftrace: what is it, what's new, and where is it going
47mBPF: The Status of BTF, producers, consumers.
25mKernel tracing with BPF
32meBPF: BPF kernel infrastructure
38mLinux Kernel Tracing Using eBPF
30mCilium's BPF kernel datapath revamped
36mObservability and performance analysis with BPF
16mWhy Everyone Should Care About eBPF