Bpftime: Userspace eBPF runtime for fast Uprobe and Syscall hook and Plugins

Re:Bpftime: Userspace eBPF runtime for fast Uprobe and Sysca... by rendaw on Wednesday November 15, 2023 @01:12AM (#38273824)

This looks really cool. Like all eBPF though, what sort of eBPF verification is it doing and is it possible to do the verification in CI?

With eBPF the common gotcha is you can compile totally invalid eBPF code, with no compile errors, only to find out at go time (and only to be able to find out at go time).

[ Parent | on HN ]

Re:Bpftime: Userspace eBPF runtime for fast Uprobe and Sysca... by yunwei37 on Wednesday November 15, 2023 @02:19AM (#38274137)

Thanks!

This project can use a standalone eBPF verifier in this project: https://github.com/vbpf/ebpf-verifier

It can also use kernel verifier to verify the programs, then “offload”the BPF byte code from kernel, and runs it in userspace.

[ Parent | on HN ]

Re:Bpftime: Userspace eBPF runtime for fast Uprobe and Sysca... by brancz on Wednesday November 15, 2023 @02:41AM (#38274252)

I happen to work on a system-wide profiler[1] that is eBPF-based, and what we do is load our bpf programs on various kernels using qemu. This is important as the jit and verfier change significantly across kernel versions and we want to make sure we maintain compatibility.

[1] https://github.com/parca-dev/parca-agent

[ Parent | on HN ]