bpfilter

The hostname is now recorded as custom context in the JSON output alongside gitrev, gitdate, and other run metadata. This makes it possible to correlate results with the machine that produced them, which matters when benchmarks are run on different hosts.

Rules with a log action currently emit one entry per matching packet with no throttling. To support rate-limited logging, BPF programs need mutable per-rule state that persists across invocations. Introduce bf_smap, a single-entry BPF_MAP_TYPE_ARRAY map per chain whose value is a flat array of bf_rule_state entries (one per rule). The map is looked up once in the program prologue and the base pointer stored in bf_runtime.state_map; per-rule access is then a constant offset, avoiding one bpf_map_lookup_elem call per rule at packet time. For each rule with log_rate_ns set, the generated code reads last_log_ts, calls bpf_ktime_get_ns(), and skips the log elfstub if the elapsed time falls short of the configured interval. R9 (callee-saved) holds the state entry pointer across the ktime call. Writes to last_log_ts are best-effort: no CAS, but a naturally aligned 8-byte store is atomic on x86-64, so no torn writes occur. Expose the rate in the DSL as 'log [] every {ns,us,ms,s}' and wire it to the new bf_rule.log_rate_ns field serialized alongside the existing rule fields.

Switch BF_MAP_TYPE_COUNTERS from BPF_MAP_TYPE_ARRAY to BPF_MAP_TYPE_PERCPU_ARRAY. Each CPU updates its own counter slot without contention, which eliminates the need for atomic operations in the BPF fast path (bpf_map_lookup_elem on a per-CPU map returns a direct pointer to the current CPU's value). Changes lib: Add to Switch the counters map to : allocate a per-CPU buffer, do one lookup, then sum all CPU slots into the returned Add : builds a per-CPU buffer with the value in CPU 0's slot and zeroes elsewhere, then calls with the full buffer : replace with — the old call passed a 16-byte buffer to a syscall that reads bytes, writing garbage from the stack into the new map tests: Update jq queries in 8 e2e tests: per-CPU dumps use (array per CPU) instead of , so counter reads change from to