0

It seems like the debugging tools and the way instrumetnation is done should be quite general. Is it possible to have all the benefits of safe JIT'ed code in your program for, basically, the same purpose: performance monitoring and doing hot patches / configuration changes?

wvxvw
  • 8,089
  • 10
  • 32
  • 61
  • You can jump from one BPF program into another one (but not come back), those are _tail calls_. At the moment (mid-2019) you cannot call, from BPF, functions defined in another BPF programs loaded on the system, if this is your question. But there are plan for adding that in the future. Unless I misunderstood and you meant something else? – Qeole Jul 20 '19 at 16:05
  • @Qeole well, what I meant is: BPF is, essentially, an embedded language with its own VM. It is useful for debugging the kernel because it has some instrumentation in place. But, would it be possible to embed the same language and the VM in another application and have it expose the same API to, say `bpftrace`, so that you could use this tool to also query this application, just like you would do with kernel. – wvxvw Jul 20 '19 at 16:22
  • 1
    Embedding an eBPF VM in user space itself surely can be done, search for uBPF/rbpf. But that's just for the eBPF bits, not for the tracing part. eBPF on Linux (and bpftrace) can be used to trace user space applications though, if you hook programs to _uprobes_ (_user probes_) or _USDT_ (~user space tracepoints). See maybe [this section](https://github.com/iovisor/bpftrace/blob/master/docs/reference_guide.md#7-usdt-static-tracing-user-level) from bpftrace documentation? – Qeole Jul 20 '19 at 16:56
  • @Qeole thanks. That's useful. Will have to read up on it. – wvxvw Jul 21 '19 at 13:34

0 Answers0