High-throughput BPF map manipulations with uprobes

1. A method for manipulating a Berkeley Packet Filter (BPF) map, the method comprising:

running a user program in a user space of a computing environment, the user program including a trigger function corresponding to a kernel BPF probe;

triggering the kernel BPF probe by reaching a memory address of the trigger function in the user space;

providing, via the kernel BPF probe, one or more operation parameters to a BPF map agent in a kernel space of the computing environment; and

performing, via the BPF map agent, one or more operations to manipulate a BPF map in the kernel space based on the one or more operation parameters.

2. The method of claim 1 , wherein triggering the kernel BPF probe corresponds to a single transition from the user space to the kernel space.

3. The method of claim 1 , wherein performing the one or more operations to manipulate the BPF map includes reading from one or more locations of the BPF map and/or writing to one or more locations of the BPF map.

4. The method of claim 3 , wherein writing to one or more locations of the BPF map includes clearing the one or more locations of the BPF map.

5. The method of claim 3 , wherein reading from one or more locations of the BPF map includes providing data values from the BPF map to a buffer accessible from the user space.

6. The method of claim 5 , wherein the data values include values computed based on data values stored in the BPF map.

7. The method of claim 1 , wherein providing the one or more operation parameters to the BPF map agent includes providing a command parameter identifying the one or more operations to be performed by the BPF map agent, a pointer parameter identifying a memory location containing operation data for the one or more operations to be performed by the BPF map agent, and a size parameter identifying a size of the operation data in the memory location identified by the pointer parameter.

8. The method of claim 7 , wherein the operation data for the one or more operations to be performed by the BPF map agent includes at least one of BPF map locations and data values for the one or more operations.

9. The method of claim 1 , further comprising:

determining the memory address of the trigger function; and

assigning the memory address of the trigger function to the kernel BPF probe in the user space.

10. The method of claim 1 , further comprising:

interrupting the user program in the user space in response to triggering the kernel BPF probe; and

resuming the user program in the user space in response to a determination that the one or more operations to manipulate the BPF map have been completed.

11. A system comprising:

at least one memory storing computer-executable instructions; and

at least one processor for executing the computer-executable instructions stored in the memory, wherein the instructions, when executed, instruct the at least one processor to:

run a user program in a user space of a computing environment, the user program including a trigger function corresponding to a kernel Berkeley Packet Filter (BPF) probe;

trigger the kernel BPF probe by reaching a memory address of the trigger function;

provide, via the kernel BPF probe, one or more operation parameters to a BPF map agent in a kernel space of the computing environment; and

perform, via the BPF map agent, one or more operations to manipulate a BPF map in the kernel space based on the one or more operation parameters.

12. The system of claim 11 , wherein triggering the kernel BPF probe corresponds to a single transition from the user space to the kernel space.

13. The system of claim 11 , wherein performing the one or more operations to manipulate the BPF map includes reading from one or more locations of the BPF map and/or writing to one or more locations of the BPF map.

14. The system of claim 13 , wherein writing to one or more locations of the BPF map includes clearing the one or more locations of the BPF map.

15. The system of claim 13 , wherein reading from one or more locations of the BPF map includes providing data values from the BPF map to a buffer accessible from the user space.

16. The system of claim 15 , wherein the data values include values computed based on data values stored in the BPF map.

17. The system of claim 11 , wherein providing the one or more operation parameters to the BPF map agent includes providing a command parameter identifying the one or more operations to be performed by the BPF map agent, a pointer parameter identifying a memory location containing operation data for the one or more operations to be performed by the BPF map agent, and a size parameter identifying a size of the operation data in the memory location identified by the pointer parameter.

18. The system of claim 17 , wherein the operation data for the one or more operations to be performed by the BPF map agent includes at least one of BPF map locations and data values for the one or more operations.

19. The system of claim 11 , wherein the instructions, when executed, further instruct the at least one processor to:

interrupt the user program in the user space in response to triggering the kernel BPF probe; and

resume the user program in the user space in response to a determination that the one or more operations to manipulate the BPF map have been completed.

20. The system of claim 11 , wherein the user space corresponds to a first portion of the at least one memory and the kernel space corresponds to a second portion of the at least one memory.