eBPF Support #6
Description
Even though eBPF can allow us to intercept IO framework in a very fine-grained ways. For example, with eBPF, we can track the exact caliing and return time of the io_uring function in kernel space:
But since eBPF require sudo Permissions, now we would add it into the project.
Below are some materials that maybe helpful for the implementation of eBPF realted features:
- BPF ring buffer
- BPF ring buffer
- Unraveling eBPF Ring Buffers
- eBPF Tutorial by Example 8: Monitoring Process Exit Events, Print Output with Ring Buffer
- eBPF’s User Ring Buffer: Introducing BPF_MAP_TYPE_USER_RINGBUF
- Tracing System Calls Using eBPF - Part 2
- Hello eBPF: Ring buffers in libbpf (6)
- Beyond Observability: Modifying Syscall Behavior with eBPF — My Precious Secret Files
This feature might be implemented by using kernel-user space ring buffer (just like io_uring) + epoll.