[Paper Review] bpftime: userspace eBPF Runtime for Uprobe, Syscall and Kernel-User Interactions

Yusheng Zheng, Tong Yu+4 more|arXiv (Cornell University)|Nov 14, 2023

Security and Verification in Computing4 citations

TL;DR

bpftime is a high-performance, user-space eBPF runtime that uses binary rewriting to enable programmatic uprobe and syscall hooking without kernel context switches, achieving over 10x speedup over kernel eBPF. It supports seamless runtime injection into existing processes, maintains compatibility with clang/libbpf, and enables shared-memory eBPF maps for inter-process communication.

ABSTRACT

In kernel-centric operations, the uprobe component of eBPF frequently encounters performance bottlenecks, largely attributed to the overheads borne by context switches. Transitioning eBPF operations to user space bypasses these hindrances, thereby optimizing performance. This also enhances configurability and obviates the necessity for root access or privileges for kernel eBPF, subsequently minimizing the kernel attack surface. This paper introduces bpftime, a novel user-space eBPF runtime, which leverages binary rewriting to implement uprobe and syscall hook capabilities. Through bpftime, userspace uprobes achieve a 10x speed enhancement compared to their kernel counterparts without requiring dual context switches. Additionally, this runtime facilitates the programmatic hooking of syscalls within a process, both safely and efficiently. Bpftime can be seamlessly attached to any running process, limiting the need for either a restart or manual recompilation. Our implementation also extends to interprocess eBPF Maps within shared memory, catering to summary aggregation or control plane communication requirements. Compatibility with existing eBPF toolchains such as clang and libbpf is maintained, not only simplifying the development of user-space eBPF without necessitating any modifications but also supporting CO-RE through BTF. Through bpftime, we not only enhance uprobe performance but also extend the versatility and user-friendliness of eBPF runtime in user space, paving the way for more efficient and secure kernel operations.

Motivation & Objective

• Address performance bottlenecks in kernel-based eBPF uprobe execution caused by context switches.
• Reduce the kernel attack surface by moving eBPF execution to userspace, eliminating the need for root privileges.
• Enable dynamic, runtime attachment of eBPF programs to existing processes without restarts or recompilation.
• Support programmatic syscall tracing and shared-memory eBPF maps for inter-process communication and data aggregation.
• Ensure full compatibility with existing eBPF toolchains (clang, libbpf) and CO-RE via BTF, enabling unmodified migration from kernel eBPF.

Proposed method

• Leverages LLVM's JIT/AOT compilation to deliver high-performance execution of eBPF programs in userspace.
• Employs binary rewriting at runtime to instrument target processes for uprobe and syscall hooking without source code or recompilation.
• Uses a custom binary rewriting engine to insert eBPF trampolines at function entry and exit points, enabling efficient userspace uprobe semantics.
• Introduces shared-memory eBPF maps to allow communication between userspace eBPF programs and between userspace and kernel eBPF programs.
• Supports seamless injection of eBPF programs into running processes via a dynamic attach mechanism that avoids process restarts.
• Maintains compatibility with kernel eBPF maps and BTF (BPF Type Format) to enable CO-RE and interoperability with kernel eBPF programs.

Experimental results

Research questions

• RQ1 Can a userspace eBPF runtime achieve significantly lower overhead than kernel-based uprobe execution by eliminating context switches?
• RQ2 Can programmatic syscall hooking be efficiently and safely implemented in userspace eBPF without kernel involvement?
• RQ3 Is it feasible to support runtime injection of eBPF programs into existing processes without recompilation or restarts?
• RQ4 To what extent can a userspace eBPF runtime maintain compatibility with existing eBPF toolchains like clang and libbpf?
• RQ5 Can shared-memory eBPF maps enable efficient inter-process communication and coordination in a userspace eBPF environment?

Key findings

• bpftime achieves over 10x performance improvement in uprobe execution compared to kernel-based eBPF, primarily by eliminating context switch overhead.
• The runtime enables programmatic syscall tracing and uprobe attachment in userspace with no need for process restarts or recompilation.
• eBPF programs from the bcc toolset, including uprobe and syscall tracing examples, run unmodified on bpftime, demonstrating full compatibility.
• Shared-memory eBPF maps are successfully used to enable inter-process communication and data aggregation, supporting use cases like control plane coordination.
• bpftime supports seamless integration with kernel eBPF programs through shared maps and can be loaded from kernel eBPF, enabling hybrid execution models.
• The security posture of bpftime is improved over kernel eBPF, as it reduces the kernel attack surface and operates in a sandboxed, userspace environment.