Bpftime: Userspace eBPF runtime for fast Uprobe and Syscall hook and Plugins
1–10 of 13 posts
Re: Bpftime: Userspace eBPF runtime for fast Uprobe and Syscall hook and Plugins
#2A full version of the preliminary descriptions and results can be found here http://arxiv.org/abs/2311.07923. Thanks for the advise for cross boundary communication brought on the LPC, we will integrate!
Re: Bpftime: Userspace eBPF runtime for fast Uprobe and Syscall hook and Plugins
#3Sounds a lot like DTrace user defined probe tracing.
Re: Bpftime: Userspace eBPF runtime for fast Uprobe and Syscall hook and Plugins
#4This looks really cool. Like all eBPF though, what sort of eBPF verification is it doing and is it possible to do the verification in CI?
With eBPF the common gotcha is you can compile totally invalid eBPF code, with no compile errors, only to find out at go time (and only to be able to find out at go time).
Re: Bpftime: Userspace eBPF runtime for fast Uprobe and Syscall hook and Plugins
#5Sounds a lot like DTrace user defined probe tracing.
Uprobes has—I believe—DTrace USDT-like functionality. This seems interesting and different: sending the tracing facility into the traced/victim process. Whereas DTrace and ePBF typically trap into the kernel to execute and event, this approach allows for potentially much less overhead.
How important is enabled probe effect? Of that I’m less sure.
Re: Bpftime: Userspace eBPF runtime for fast Uprobe and Syscall hook and Plugins
#6This looks really cool. Like all eBPF though, what sort of eBPF verification is it doing and is it possible to do the verification in CI? With eBPF the common gotcha is you can compile totally invalid eBPF code, with no compile errors, only to find out at go time (and only to be able to find out at go time).
Thanks!
This project can use a standalone eBPF verifier in this project: https://github.com/vbpf/ebpf-verifier
It can also use kernel verifier to verify the programs, then “offload”the BPF byte code from kernel, and runs it in userspace.
Re: Bpftime: Userspace eBPF runtime for fast Uprobe and Syscall hook and Plugins
#7We talked about it in LPC 23 today, and the slides: https://lpc.events/event/17/contributions/1639
Stream: https://youtube.com/watch?v=zDNZY0HQOMw&t=1765s
The draft paper: https://arxiv.org/abs/2311.07923
Re: Bpftime: Userspace eBPF runtime for fast Uprobe and Syscall hook and Plugins
#8This looks really cool. Like all eBPF though, what sort of eBPF verification is it doing and is it possible to do the verification in CI? With eBPF the common gotcha is you can compile totally invalid eBPF code, with no compile errors, only to find out at go time (and only to be able to find out at go time).
I happen to work on a system-wide profiler[1] that is eBPF-based, and what we do is load our bpf programs on various kernels[2] using qemu. This is important as the jit and verifier change significantly across kernel versions and we want to make sure we maintain compatibility.
[1] https://github.com/parca-dev/parca-agent
[2] https://github.com/parca-dev/parca-agent/blob/54434c02773a8a...
Re: Bpftime: Userspace eBPF runtime for fast Uprobe and Syscall hook and Plugins
#9We talked about it in LPC 23 today, and the slides: https://lpc.events/event/17/contributions/1639 Stream: https://youtube.com/watch?v=zDNZY0HQOMw&t=1765s The draft paper: https://arxiv.org/abs/2311.07923
Thanks for the additional details :) I found bpftime through a social share [0], where it is shown to run bpftrace without root permissions [1], and added it to my newsletter into my eBPF learning series [2].
[0] https://twitter.com/yunwei37/status/1717990094810862045
[1] https://github.com/eunomia-bpf/bpftime/blob/master/example/b...
[2] https://opsindev.news/archive/2023-11-14/#the-inner-dev-lear...
Re: Bpftime: Userspace eBPF runtime for fast Uprobe and Syscall hook and Plugins
#10Sounds a lot like DTrace user defined probe tracing.
Uprobes has—I believe—DTrace USDT-like functionality. This seems interesting and different: sending the tracing facility into the traced/victim process. Whereas DTrace and ePBF typically trap into the kernel to execute and event, this approach allows for potentially much less overhead. How important is enabled probe effect? Of that I’m less sure.
Oh, thanks, yes, that does sound interesting. I gave it too cursory a look earlier, ay!