  In kernel-centric operations, the uprobe component of eBPF frequently
encounters performance bottlenecks, largely attributed to the overheads borne
by context switches. Transitioning eBPF operations to user space bypasses these
hindrances, thereby optimizing performance. This also enhances configurability
and obviates the necessity for root access or privileges for kernel eBPF,
subsequently minimizing the kernel attack surface. This paper introduces
bpftime, a novel user-space eBPF runtime, which leverages binary rewriting to
implement uprobe and syscall hook capabilities. Through bpftime, userspace
uprobes achieve a 10x speed enhancement compared to their kernel counterparts
without requiring dual context switches. Additionally, this runtime facilitates
the programmatic hooking of syscalls within a process, both safely and
efficiently. Bpftime can be seamlessly attached to any running process,
limiting the need for either a restart or manual recompilation. Our
implementation also extends to interprocess eBPF Maps within shared memory,
catering to summary aggregation or control plane communication requirements.
Compatibility with existing eBPF toolchains such as clang and libbpf is
maintained, not only simplifying the development of user-space eBPF without
necessitating any modifications but also supporting CO-RE through BTF. Through
bpftime, we not only enhance uprobe performance but also extend the versatility
and user-friendliness of eBPF runtime in user space, paving the way for more
efficient and secure kernel operations.
