// the find
eunomia-bpf/bpftime
Userspace eBPF runtime for Observability, Network, GPU & General Extensions Framework
A userspace eBPF runtime that runs eBPF programs against uprobes, USDT, syscalls, and even GPU kernels without touching the actual kernel eBPF subsystem. It's aimed at people who want eBPF-style dynamic instrumentation on systems where kernel eBPF isn't available, isn't permitted, or is simply too slow for their use case — think observability/tracing tooling, not general app development.
The GPU attach path (converting eBPF to PTX and injecting into CUDA kernels) is a genuinely novel piece of work, not something you see in other uprobe tooling. It reuses existing clang/libbpf toolchains unmodified, so you write eBPF the normal way and it just runs elsewhere. The project backs its performance claims with an actual benchmark suite (bpf-benchmark) and an OSDI '25 paper rather than just marketing numbers in the README. The attach layer is modular enough (frida-based, syscall-intercept-based, trap-based uprobe implementations) that you can see the engineering tradeoffs explicitly in the repo structure.
The dependency surface is heavy — LLVM, Frida, and for GPU use the CUDA toolkit, plus a separate userspace verifier (PREVAIL) you have to trust since the kernel verifier isn't in the loop. Despite the 'cross-platform' framing, the core value prop (bypassing the kernel) is still fundamentally built and tested against Linux semantics, so portability claims are softer than the pitch suggests. The README admits upfront you lose access to kernel data structures like task_struct and some kfuncs, which rules out a chunk of real-world tracing use cases people reach for eBPF for in the first place. AF_XDP/DPDK and GPU support are both explicitly marked experimental, so the flashiest features are also the least production-ready parts.