eBPF Programs Can Attach To KProbes In Linux 4.1

The (e)BPF in-kernel virtual machine that's been extended to do more than just packet filtering is becoming more useful with the Linux 4.1 development kernel.

Ingo Molnar sent in the perf subsystem updates for Linux 4.1 on Tuesday and one of the biggest changes is the ability to attach eBPF programs to KProbes. This means that there's support for user-defined, sandboxed instrumentation running on a live kernel that at the same time can't cause the kernel any harm.

Other perf changes for Linux 4.1 is per-event clockid support, cluster-wide profiling, JIT profiling events, x86 Intel Processor Trace support, x86 Intel Cache QoS Monitoring support, and x86 Intel Haswell LBR call stack support. The x86 Intel Processor Trace support sounds interesting and is just available on Broadwell processors and newer.

More details on the perf feature updates via Ingo's pull request.