An introduction to the BPF Compiler Collection

In the previous article of this series, I discussed how to use eBPF to safely run code supplied by user space inside of the kernel. Yet one of eBPF's biggest challenges for newcomers is that writing programs requires compiling and linking to the eBPF library from the kernel source. Kernel developers might always have a copy of the kernel source within reach, but that's not so for engineers working on production or customer machines. Addressing this limitation is one of the reasons that the BPF Compiler Collection was created. The project consists of a toolchain for writing, compiling, and loading eBPF programs, along with example programs and battle-hardened tools for debugging and diagnosing performance issues.

在本系列的上一篇文章中，我讨论了如何使用 eBPF 在内核中安全地运行由用户空间提供的代码。然而，对于初学者来说，eBPF 最大的挑战之一是编写程序需要从内核源码中编译并链接 eBPF 库。内核开发人员可能随时都能拿到内核源码，但对于在生产环境或客户机器上工作的工程师来说却并非如此。为了解决这一限制，BPF Compiler Collection（BCC）应运而生。该项目包括一个用于编写、编译和加载 eBPF 程序的工具链，以及示例程序和经过实战考验的调试与性能诊断工具。

Since its release in April 2015, many developers have worked on BCC, and the 113 contributors have produced an impressive collection of over 100 examples and ready-to-use tracing tools. For example, scripts that use User Statically-Defined Tracing (USDT) probes (a mechanism from DTrace to place tracepoints in user-space code) are provided for tracing garbage collection events, method calls and system calls, and thread creation and destruction in high-level languages. Many popular applications, particularly databases, also have USDT probes that can be enabled with configuration switches like --enable-dtrace. These probes are inserted into user applications, as the name implies, statically at compile-time. I'll be dedicating an entire LWN article to covering USDT probes in the near future.

自 2015 年 4 月发布以来，许多开发者参与了 BCC 的开发，113 位贡献者共同打造了一个令人印象深刻的集合，其中包含 100 多个示例和可直接使用的跟踪工具。例如，BCC 提供了利用用户静态定义跟踪（User Statically-Defined Tracing，USDT）探针的脚本（USDT 是一种来自 DTrace 的机制，用于在用户空间代码中放置跟踪点），可用于跟踪垃圾回收事件、方法调用和系统调用，以及在高级语言中线程的创建与销毁。许多流行应用，尤其是数据库，也内置了 USDT 探针，可以通过类似 --enable-dtrace 的配置开关启用。这些探针顾名思义是在编译时静态插入到用户应用程序中的。我将在不久的将来专门撰写一篇 LWN 文章来介绍 USDT 探针。

The project documentation shows how to use the existing scripts and tools to conduct a thorough performance investigation without writing a line of code, and a handy tutorial is provided in the BCC repository. Another useful guide to some of the BCC tools was written by Brendan Gregg, who has the second highest number of patches to bcc/tools (Sasha Goldshtein holds the number one spot as of this writing).

该项目的文档展示了如何使用现有的脚本和工具，在不写一行代码的情况下进行全面的性能调查，同时 BCC 仓库中还提供了一个方便的教程。另一份对部分 BCC 工具的实用指南由 Brendan Gregg 编写，他在 bcc/tools 中提交的补丁数量排名第二（截至目前，排名第一的是 Sasha Go