With the presented tools BTF and CO-RE, BPF gets more portable, not requiring the whole build chain with LLVM, Clang, and kernel header dependencies. In this blog post, Brendan Gregg explains how it works and what it means for BPF performance tools.

BPF originally stood for Berkeley Packet Filter, but has been extended in Linux to become a generic kernel execution engine, capable of running a new type of user-defined and kernel-mode applications.

This is the official site for the book BPF Performance Tools: Linux System and Application Observability, published by Addison Wesley (2019)