2 ms·
As someone who's really interested in eBPF (tiny in-kernel vm..tell me more) but has never looked deeper than a few LWN articles, what are the advantages of an
by dcow 9y ago
As someone who's really interested in eBPF (tiny in-kernel vm..tell me more) but has never looked deeper than a few LWN articles, what are the advantages of an eBPF approach to this problem? You could achieve the same thing with ptrace, right? I've heard performance is good. Is the main advantage that eBPF already has interesting hooks for you to build off of whereas you'd basically have to write a ruby debugger (or do something invasive) to achieve the same result traditionally?
edit: ptrace not pattach
- khuey 9y agoDo you mean ptrace? One of the advantages of eBPF is that it runs in the kernel so you don't need to context switch to another user space process. A number of syscalls are significantly cheaper than a user space context switch. The rr debugger[0], which needs to process all syscalls, uses an eBPF based filter to select certain simple syscalls for in-process handling and avoid context switching through ptrace. [0] http://rr-project.org/ http://rr-project.org/