BPF Internals, From bpftrace to Machine Code
At USENIX LISA2021, Brendan Gregg delivered a 40-minute deep dive into the internals of BPF on Linux, with a specific focus on observability tracing tools. Rather than rehashing existing online references, the talk breaks down how a bpftrace instrumentation request travels from user space down to the final machine code. The central message is that the entire pipeline is composed of small, understandable components.
Following the Path of an Instrumentation
The session traces the complete lifecycle of a tracing command. It starts with the user-facing bpftrace tool, moves through the kernel's BPF system call interface, and culminates in the generated instructions that the CPU executes. By dissecting each stage, the talk demonstrates that the seemingly complex BPF stack is, in practice, an accessible chain of clearly defined steps.
Those who miss the live event can catch the full video on YouTube, with the slide deck available both on the web and as a PDF. The presentation also builds on the material covered in Gregg's BPF Performance Tools book (Addison-Wesley 2020).
Keeping Pace With a Moving Target
BPF is a rapidly evolving subsystem, so staying current requires monitoring development. The primary sources of truth are the Linux kernel header files, particularly bpf.h, bpf_common.h, and filter.h, which define the user-space API and the available capabilities. For high-frequency updates, following the bpf-next mailing list is recommended; for a lower-frequency overview, the KernelNewbies Linux version summaries provide quarterly feature summaries.
The talk intentionally confines its scope to Linux. It does not cover the substantially different implementation that Microsoft has made public for running eBPF on Windows, which is a separate architecture entirely.
