bpftime: Fast uprobes with user space BPF runtime
summary
bpftime is a userspace eBPF runtime that uses binary rewriting to inject into running processes without restart and claims bpftime prototype uprobes that are 10x faster than kernel uprobes by avoiding two context switches. It programs syscall hooks, supports clang/libbpf toolchains and CO-RE via BTF, and implements shared userspace maps (mmap’d interprocess eBPF Maps) for aggregation and control-plane communication. Benchmarks show large speedups and lower SSL interception overhead (kernel hook ~60% RPS drop vs userspace ~12%), with ongoing work on verifier, memory/latency tradeoffs, and kernel compatibility.
AI-written summary · about
chapters (9)
- 0:00Introduction to BPFtime
- 1:04Why user space BPF runtime
- 6:07Introducing BPFtime
- 10:07BPFtime usage examples
- 11:16How BPFtime works
- 16:20Performance benchmarks
- 17:46Use case evaluations
- 21:17Future improvements
- 24:32Summary and Q&A
related talks
31meBPF and Wasm: Unifying Userspace Extensions With Bpftime
29meBPF on the Rise - Getting Started
33meBPF: exploring use case of BPF kernel infrastructure
32meBPF: The Next Power Tool of SREs
01h 07meBPF: Fueling New Flame Graphs & more
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
29mBuzzing Across the Cloud Native Landscape with eBPF
16mWhy Everyone Should Care About eBPF