bpftime - Fast Uprobes with User Space BPF Runtime

Explore a groundbreaking approach to eBPF performance optimization in this Linux Plumbers Conference talk. Delve into bpftime, a prototype userspace eBPF runtime that offers significant speed improvements for uprobes and syscall hooks. Learn how this innovation bypasses context switch delays, enhances configurability without root access, and reduces the kernel attack surface. Discover the power of binary rewriting in enabling efficient function tracing and syscall manipulation. Gain insights into interprocess eBPF Maps implementation in shared userspace memory, compatibility with existing eBPF toolchains, and support for CO-RE via BTF. Understand how bpftime can be injected into running processes without restarts or recompilation, revolutionizing eBPF deployment and usage.

bpftime: Fast uprobes with user space BPF runtime - Yusheng Zheng