BPF Tracing Multi-Link Supporting

Explore advanced BPF tracing optimization techniques in this 29-minute conference talk from the Linux Plumbers Conference. Learn how to overcome the inefficiencies of current per-function BPF program design that creates independent instances for each traced kernel function, leading to memory waste and slow attachment processes in large-scale scenarios. Discover the innovative tracing multi-link feature inspired by kprobe multi-link design, which enables efficient binding of a single BPF program to multiple target functions. Understand the implementation of BPF global trampolines that replace hardcoded program addresses with a dynamic function metadata hash table using rhashtable, storing BPF programs, cookies, and function parameters. Examine how this real-time metadata querying system, built with naked functions and C code, dramatically improves performance by reducing loading times from tens of minutes to under one second when tracing up to 50,000 kernel functions. Gain insights into practical applications for monitoring hundreds or thousands of kernel functions simultaneously while minimizing resource consumption and maximizing tracing efficiency.