From Profiling to Kernel Patch: the Journey to an Ebpf Performance Fix

Amazing read, and actually a pretty good demo of their profiler, I'm adding it to my toolbox.

In hindsight, making the sync point be paid for all users was a mistake, and an opt-in flag would have been the better option. This is especially true because users that hit the issue kind of mis-used the eBPF map. I've found that most of the map types are good for the userspace -> kernel direction, but most of the times not the other way around.

In the example, sending timing samples to userspace should be performed with a ringbuf map. Alas, those did not exist in 2018, and the perf event array map type had its own drawbacks that pushed people (ab)using array maps. The only times the usual maps are fine for kernel -> userspace is for some non-streaming data (e.g. accumulated packet count in network programs); streaming should be left to ringbuf.