diff --git a/README.md b/README.md index 907c972..69fced6 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,9 @@ ## Prerequisites - `bpftop` requires `sudo` privileges to run. +- The Linux kernel version must be 5.8 or later. - The binary is dynamically linked to `libz` and `libelf`, so these libraries must be present on the systems where you intend to run `bpftop`. +## How it works - +`bpftop` uses the [BPF_ENABLE_STATS](https://elixir.bootlin.com/linux/v6.6.16/source/include/uapi/linux/bpf.h#L792) BPF syscall command to enable global eBPF runtime statistics gathering, which is disabled by default to reduce performance overhead. It collects these statistics every second, calculating the average runtime, events per second, and estimated CPU utilization for each eBPF program within that sample period. This information is displayed in a top-like tabular format. Once `bpftop` terminates, it disables the statistics-gathering function by deleting the file descriptor returned by `BPF_ENABLE_STATS`. \ No newline at end of file