bpftrace internals
summary
Explains exactly how bpftrace compiles scripts into eBPF: map accesses become lookups + updates or per-CPU increments, helpers translate to register calls, and printf writes an ID + payload into the perf ring buffer (so heavy printing drops data). Shows that using @ = count() or per-CPU maps avoids races and drops runtime from ~266s to ~78s vs a global data fast path that benchmarks to ~4s for the simple case. Adds BTF support to read kernel types, and shows trampolines yield ~5x less overhead than kprobes.
AI-written summary · about
chapters (15)
- 0:00Start
- 1:19How Bpf Trace Works
- 4:24Context of the Probe
- 7:12Pseudocode
- 12:17Global Data
- 15:27Access Probe Arguments
- 16:55Trace Point Data
- 19:34Printf
- 26:10Histograms
- 30:29Histograms Begin and End Functions
- 32:28Recent Features
- 38:58K Log Start Tool
- 39:40New Functions
- 41:12Escapee Output
- 42:09Is the Thread Id Part of the Data That You Can Get in a Trace Function
related talks
28mbpftrace: what is it, what's new, and where is it going
25mKernel tracing with BPF
35mPerformance Insights into eBPF Step by Step
32mBPF: Introduction, Programming Tips and Tricks
21mPerformance Wins with BPF: Getting Started
32meBPF: BPF kernel infrastructure
30mPerformance insights into eBPF step by step
34mWhat's new in the BPF world?