Stream: https://youtube.com/watch?v=zDNZY0HQOMw&t=1765s
The draft paper: https://arxiv.org/abs/2311.07923
[0] https://twitter.com/yunwei37/status/1717990094810862045
[1] https://github.com/eunomia-bpf/bpftime/blob/master/example/b...
[2] https://opsindev.news/archive/2023-11-14/#the-inner-dev-lear...
It was always possible to do something like this, to inject the bpf code to run in-process and only export data occasionally just like the kernel side version - and the pieces already existed but no one had put all the pieces together, now someone has. Awesome!
Just need someone to implement this seamlessly into bpftrace :) That would be amazing!
If you want to understand why it's slow without this, I recently did a talk explaining the difference in tracing speed between strace and bpftrace (when tracing things in the kernel) that may help! In this case (which I didn't really cover), most function uprobes have to trap into the kernel and back twice (once on function entry and once on return, I explain why) - not as bad as the full strace example I explain in detail in the video - but still comparatively expensive.
https://www.youtube.com/watch?v=ZDTfcrp9pJI "bpftrace recipes: 5 real problems solved"
I re-ran this talk (mostly the same, a few minor updates) at the Riga Ubuntu Summit a couple of weeks ago but the videos aren't up yet. But the version above is mostly the same and was a pretty good recording :)
In fact, bpftime can already run bpftrace in userspace for uprobes, without any modification: https://github.com/eunomia-bpf/bpftime/tree/master/example/b...
(There might still need some bug fixes in some cases, e.g. the signal handler to stop the bpf program…
Maybe we can integrate the bpftime agent and attach mechanism in bpftrace, so it can be released together?
With eBPF the common gotcha is you can compile totally invalid eBPF code, with no compile errors, only to find out at go time (and only to be able to find out at go time).
[1] https://github.com/parca-dev/parca-agent
[2] https://github.com/parca-dev/parca-agent/blob/54434c02773a8a...
This project can use a standalone eBPF verifier in this project: https://github.com/vbpf/ebpf-verifier
It can also use kernel verifier to verify the programs, then “offload”the BPF byte code from kernel, and runs it in userspace.
How important is enabled probe effect? Of that I’m less sure.