bpftime
ebpf-verifier
| bpftime | ebpf-verifier | |
|---|---|---|
| 6 | 2 | |
| 631 | 345 | |
| 6.8% | 2.0% | |
| 9.2 | 8.5 | |
| 8 days ago | 4 days ago | |
| C++ | C++ | |
| MIT License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
bpftime
-
eBPF Tutorial by Example 16: Monitoring Memory Leaks
Uprobe in kernel mode eBPF runtime may also cause relatively large performance overhead. In this case, you can also consider using user mode eBPF runtime, such as bpftime. bpftime is a user mode eBPF runtime based on LLVM JIT/AOT. It can run eBPF programs in user mode and is compatible with kernel mode eBPF, avoiding context switching between kernel mode and user mode, thereby improving the execution efficiency of eBPF programs by 10 times.
-
bpftime: Extending eBPF from Kernel to Userspace
In this blog, we are excited to introduce a new open-source user-space eBPF runtime: https://github.com/eunomia-bpf/bpftime. bpftime further expands the capabilities of eBPF, allowing existing eBPF tools and applications, such as BCC tools, bpftrace, Deepflow, etc., to run in non-privileged user space without any code modifications, while using the same libraries and toolchains as kernel eBPF.
- The Secure Path Forward for eBPF runtime: Challenges and Innovations
-
Bpftime: Userspace eBPF runtime for fast Uprobe and Syscall hook and Plugins
Thanks for sharing your talk and insights! bpftrace is a wonderful tool, and the talk is great!
In fact, bpftime can already run bpftrace in userspace for uprobes, without any modification: https://github.com/eunomia-bpf/bpftime/tree/master/example/b...
(There might still need some bug fixes in some cases, eg. the signal handler to stop the bpf program...
ebpf-verifier
-
Bpftime: Userspace eBPF runtime for fast Uprobe and Syscall hook and Plugins
This project can use a standalone eBPF verifier in this project: https://github.com/vbpf/ebpf-verifier
It can also use kernel verifier to verify the programs, then “offload”the BPF byte code from kernel, and runs it in userspace.
-
eBPF Verification Is Untenable
No, not driver verifier. https://github.com/vbpf/ebpf-verifier
What are some alternatives?
chaotix - The chaotix operating system! (Previously known as Magma or Psychix)
ebpf - ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
wasm-micro-runtime - WebAssembly Micro Runtime (WAMR)
ebpf-for-windows - eBPF implementation that runs on top of Windows
bpf-developer-tutorial - eBPF Developer Tutorial: Learning eBPF Step by Step with Examples
xdp-tools - Utilities and example programs for use with XDP
AFLplusplus - The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!
ikos - Static analyzer for C/C++ based on the theory of Abstract Interpretation.
bpfman - An eBPF Manager for Linux and Kubernetes
libbpf - Automated upstream mirror for libbpf stand-alone build.
opentelemetry-go-instrumentation - OpenTelemetry Auto Instrumentation using eBPF
opensnitch - OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.