The bpftime project has been introduced, which develops a runtime and virtual machine for executing eBPF handler programs in user space. Bpftime allows the execution of eBPF tracing and intervention programs entirely in user space, utilizing capabilities such as uprobe and software interception of system calls. It is noted that by eliminating unnecessary context switches, bpftime achieves a tenfold reduction in overhead compared to the functionality of uprobe and uretprobe provided by the Linux kernel. Additionally, bpftime significantly simplifies debugging, can potentially be applied on systems without a Linux kernel, and does not require the elevated privileges needed to load an eBPF application into the kernel. The project code is written in C/C++ and is distributed under the MIT license.
The interception of system calls and integration of uprobe checks is implemented using a technique known as binary rewriting, where calls to system calls, entry points, and local functions are replaced with jumps to debugging handlers by modifying the machine code of the executing application, which is significantly more efficient than organizing interception using uprobe at the Linux kernel level.
It supports operations for replacing or altering functions, attaching handlers (hooks) and filters, redirecting, blocking, or modifying system call parameters, intercepting entry and exit points of functions, as well as inserting handlers at arbitrary offsets in the code. Bpftime can be attached to any running process in the system without the need for restarting or recompiling. Insertion of bpftime into processes can be done for running processes via ptrace, and for loaded ones through LD_PRELOAD.
Within bpftime, a runtime is being developed that allows for attaching eBPF programs to system call tracing points and uprobe. the virtual machine eBPF with JIT for isolated execution of eBPF programs at the user process level (AOT compilation is additionally supported); a background process for interacting with the kernel and ensuring compatibility with the kernel's uprobe subsystem (bpftime supports loading eBPF into user space from the kernel to enable collaboration with eBPF programs in the kernel, used, for example, for handling kprobes or implementing network filters).
The eBPF virtual machine is implemented as a plug-in library and provides an API similar to ubpf, allowing it to be used for integrating eBPF functionality into other projects. For aggregate data collection from multiple processes, the creation of shared eBPF maps stored in shared memory is supported. Alongside bpftime, standard eBPF handlers written for kernel use can be utilized, and standard tools based on clang and libbpf can be applied for compilation.
With bpftime in user space, tracing systems such as BCC, bpftrace, and Deepflow can be executed. For example, the use of the sslsniff script from the BCC framework for analyzing and saving encrypted traffic in nginx has been demonstrated. In tests, the performance of nginx when executing sslsniff in kernel space decreases by 58%, while moving the handler to user space results in only a 12.3% decrease.
Process tracing architecture using original eBPF in the kernel:
User space tracing architecture using bpftime:
Hybrid mode, in which bpftime works together with eBPF in the kernel, for example, for setting network filters or moving individual handlers to user space:
Future plans include: support for exception substitution (Fault Injection); hot patching to modify logic or fix bugs in binary builds; creating a module for Nginx that allows extensions through eBPF programs (e.g., for dynamic routing, caching, applying security policies, and load balancing); expanding the capabilities of the FUSE subsystem (e.g., creating eBPF programs as extensions to the file system for caching or access management).
Source: opennet.ru
