BPF: A New Type of Software

http://www.brendangregg.com/blog/2019-12-02/bpf-a-new-type-of-software.html

by andrenth • 7 years ago

603 184 7 years ago

jeswin• 7 years ago

Great video. Good content, delivery and impressive lighting and video production work.

GrayShade2• 7 years ago

Brendan has a lot of great content that gets posted here regularly: http://www.brendangregg.com/ (I'm still trying find the time to get through it though).

There's also https://github.com/iovisor/bcc#tools as an easy way to get started using BPF.

swinglock• 7 years ago

Brendans sharing is amazing, I have and am learning so much from it, as well as having referred others to it when they have a performance issue but missing the troubleshooting tools.

ajor• 7 years ago

I'd also recommend looking at bpftrace[1], which provides a simple DSL specifically for writing BPF programs and attaching them to events. (Disclaimer: I started the project)

[1] https://github.com/iovisor/bpftrace/blob/master/docs/tutoria...

thinkmassive• 7 years ago

He also has a book coming out this month, BPF Performance Tools http://www.brendangregg.com/bpf-performance-tools-book.html

chmaynard• 7 years ago

Strange that Brendan Gregg's blog is not available via an RSS feed. An oversight?

yetihehe• 7 years ago

Looks nice, microservices going into super-micro territory, where they are just simple small code snippets. Possible problems - many people will learn the hard way that logging or printing every packet which comes through your interfaces for further analysis will bring down your system. From the start there should be some simple way to rate-limit those bpf programs, like "if this exceeds some limits or bogs down system for more than X milliseconds, disable and give error".

fiedzia• 7 years ago

if this exceeds some limits or bogs down system for more than X milliseconds, disable and give error

That's exactly what kernel will do

kbumsik3• 7 years ago

"if this exceeds some limits or bogs down system for more than X milliseconds, disable and give error".

AFAIK indefinite loops in a BPF are not allowed: The kernel eBPF verifier will reject to load such programs. So the execution time of BPF programs will not be variable time and will be predictive.

I'm not sure if users need to care about the cases of long execution times when no loops are allowed.

andbberger• 7 years ago

How is that possible?? If true, that would imply BPF programs are not Turing complete.

pjmlp• 7 years ago

Android also uses it a lot.

https://source.android.com/devices/architecture/kernel/bpf

https://android.googlesource.com/platform/external/adeb/+/ma...

https://linuxplumbersconf.org/event/4/contributions/411/atta...

https://blog.linuxplumbersconf.org/2017/ocw/system/presentat...

winternett• 7 years ago

Is this why Google is possibly de-prioritizing non-AMP sites on it's search index, making non-AMP sites load slowly on Google Chrome, Lobbying against Net Neutrality, and doing many other things like implementing flagging for sites in Chrome that aren't encrypted?

If that was ever a possibility then it would explain a lot... But that's none of my business...

Not making any officially accusatory statements here though mind you. ಠ_ಠ

Iv2• 7 years ago

So from my understanding, that's a kind of "secure" (I'd like to know more about the security model tbh) module that runs with kernel privilege with no scheduling (so it runs until completion). These are supposed to be short and I am assuming, can't call libs and can't allocate memory (outside a predefined stack I would guess?)

Aren't they very similar to interrupts? What is the difference there? The kernel API?

GrayShade2• 7 years ago

My understanding is that they're program fragments that can be attached to kernel code and are generally used for debugging and observability. It's using a virtual machine that's designed to sandbox these, and they're limited in power so that a buggy filter can't hang the kernel.

This is different form hardware interrupts because they don't run in response to hardware events, and they don't have side effects. There is a similarity in that you want the filters to run quickly, though.

wisty• 7 years ago

IIR I think it's a VM(?) that has certain limits, and because of those limits it's OK to run it in kernel-space. IIRC it's not Turning complete, and has a fixed run time. So Linux can just say "OK run this now" and not worry about scheduling. It's like putting a green thread in the kernel but to do this safely you need very strict restrictions (finite memory it can access, finite number of steps, etc).

You can thus get speed-ups because there's no API, memory management, even scheduling.

Iv2• 7 years ago

Got it, thanks! I did not realize it runs in a VM, ok, that indeed makes sense to call it a different kind of application.

maxdamantus3• 7 years ago

I think it's more to do with avoiding overheads typically associated with system calls (presumably involving some interrupt and disabling/enabling/changing paging behaviour).

Here's an example of a syscall-heavy command on my system:

  $ time dd if=/dev/zero bs=1 count=10M of=/dev/null
  10485760+0 records in
  10485760+0 records out
  10485760 bytes (10 MB, 10 MiB) copied, 7.09089 s, 1.5 MB/s
 
  real    0m7.092s
  user    0m2.123s
  sys     0m4.968s

3 million system calls per second seems quite slow on a 3.2 GHz CPU when all it should really be doing is dereferencing a couple of pointers until it finds some functions that simply write a zero byte to a buffer (the "/dev/zero" descriptor handler) and ignore bytes from a buffer (the "/dev/null" descriptor handler).

If you have a safe bytecode format for representing operations that are performed in a loop, the kernel can just perform those operations without having to switch back and forth to userspace.

megous• 7 years ago

Re-try with mitigations=off

joosters• 7 years ago

How much of that time is really spent in the system call interface?

You've got 4.968s of system time there (i.e. broadly the time spent in kernel code) and 2.123s of user time. Given that the user-space program is effectively a tight loop around read() and write() calls, we can assume that almost all of those 2 seconds are spent going through the syscall plumbing.

Now, there's going to also be some of the kernel-side time spent in the syscall plumbing too, but there's also a lot of I/O, buffer and filesystem layer code executing there. All of which will be in use with a BPF program too. So it's unclear how much of the effective time can be shaved off.

barrkel• 7 years ago

Have you forgotten about Meltdown, Spectre, and all the other cache attacks?

etaioinshrdlu2• 7 years ago

It reminds me a wee bit of stuff that has happened in browsers. NaCl was a way to run untrusted native code by scanning it for unsafe operations.

BPF seems to have a similar aim in a sense: run less-trustworthy code in an unrestricted environment, but don't use CPU hardware based access control (and therefore context switching) to limit it, rather, make the code more sandboxed in software to prevent the need for context switches.

rusk4• 7 years ago

I wonder is this something that Futhark [0] could be used for?

[0] https://futhark-lang.org/

EDIT pleased to discover that the native `bpftrace` language is based on awk!

baybal2• 7 years ago

Question from me, why reinvent the bicycle and not just write proper kernel modules in C?

varelaz• 7 years ago

Well, if you have seen the video, probably you wouldn't ask this. Kernel modules can do everything that can BPF do, but BPF could be easier to write, more isolated and less error prone.

sanxiyn4• 7 years ago

You need root to load kernel modules. While this isn't possible yet, the intention is to allow loading BPF programs without privilege.

rhinoceraptor3• 7 years ago

BPF is completely production safe. So there is no way for a BPF program to crash the kernel, introduce significant performance latency, or have any side effects on the kernel/user space. Obviously, kernel modules have none of those properties.

Also, BPF has been around for almost 30 years, and you're likely using it. tcpdump is basically just a BPF bytecode frontend, for example.

manyworlds12• 7 years ago

You can maintain production safety by using a BPF->kernel module compiler.

This additionally removes the need to have the bpf compiler in the kernel, reducing both core size and vulnerability surface area.

No reason BPF must imply JIT

StreamBright• 7 years ago

I guess you are missing the point by 100000 miles. The whole point of BPF is the avoid writing a C kernel module and pull in the entire problem domain of C programs running in Ring0. this was called out explicitly in the video.

manyworlds12• 7 years ago

He’s not off the mark completely, you can maintain production safety by using a BPF->kernel module compiler. Unnecessary to have an entire JIT infrastructure in the kernel just to get the safety benefits of BPF.

jokoon• 7 years ago

I have a hard time understanding what you would use it for. I could understand a use-case, but I fail to understand why it would be that much useful.

I have a sense it allows much better performance for horizontal scaling, but I'm not sure...

rusk4• 7 years ago

Real-time, low latency, network-based applications.

At the pace of network events, CPU is still very fast by perhaps at least order of magnitude. However, latency introduced by system calls is significant.

This allows you to run certain classes of application in kernel space with these overheads largely mitigated.

Principally it's monitoring and "observability" applications, but apparently it's much more flexible now than it has been historically ...

z3t4• 7 years ago

Wouldn't virtualization kill the perf benefit, or is this supposed to run "on the metal"?

ignoramous• 7 years ago

Principally it's monitoring and "observability" applications, but apparently it's much more flexible now than it has been historically ...

Yep: Here's a bredangregg presentation on the topic: https://www.youtube-nocookie.com/embed/7pmXdG8-7WU

jancsika3• 7 years ago

To get the realtime benefits I'd have to run everything that requires realtime scheduling as an eBPF program, right?

I mean, suppose I want to make an eBPF program to pipe audio input into my very fancy DSP algo. Awesome. But now I've limited the remainder of my signal chain to remain in eBPF land, haven't I? The moment I throw the signal to Supercollider, Pd, some Jack client, etc., I'm back to being a mere userland mortal and taking the performance hit that entails. (Unless I sample that data coming into userland at a lower rate, but that severely limits the use cases for such a design.)

Judging by some of the screenshots I've seen Linux audio users seem to want to mix their samples through every single audio program they can get their hands on. So at least in this domain I have a hard time seeing how eBPF could practically help realtime scheduling.

Edit: clarification

dbancajas• 7 years ago

Could you allocate a memory dynamically inside your BPF program?

the8472• 7 years ago

However, latency introduced by system calls is significant.

io_uring was introduced to attack this too and essentially is an async, queue-based, batched syscall interface eliminating a lot of that latency overhead. With polling mode you only have to do a syscall when both the application and the kernel are out of work.

waste_monk• 7 years ago

Real-time, low latency, network-based applications.

I thought these kinds of applications generally (try to) avoid the kernel entirely e.g. high frequency trading algorithms running on FPGAs.

Maybe using it to get data on/off of the FPGA for charting / updates / etc.

arminiusreturns2• 7 years ago

The main use case for me as a linux admin is two fold. One, to augment iptables/nftables for increased speed and observability gains in them. It's possible to do BPF only netfilter (some firewall/IDS tools are likely to use it heavily) but I think it works better just helping the other tools, and you can lookup some benchmarks that show it.

Two, as a better tool for general observability and problem tracing. For example, I recently listened to a Usenix (LISA19) talk by Brendan Gregg (author of this blog) about linux systems perf at Netflix where he talks about how much strace can impact performance and he posits the future replacement for it will be 'perf trace' which uses ring buffer and BPF. [1]

1[] https://youtu.be/fhBHvsi0Ql0?t=1300

zippie• 7 years ago

Not sure if you were hinting at it already, just in case, you may be interested in the ongoing work with bpfilter [0] which uses ebpf underneath existing xfilter rule interfaces.

[0] https://lwn.net/Articles/747551/

gnufx2• 7 years ago

Look at all the examples Gregg provides.

jakeogh• 7 years ago

One could replace JS with something that halts.

convolvatron• 7 years ago

imagine how this might be useful in a distributed context.

rather than specify a limited set of api entry points (like segment gates) that you try to make safe....you can provide general security and resource guarantees and let the consumer do what they need. so that's cute, but imagine the round trip reduction (nfsv4 does this to a very limited extent) and increased generality.

what if your btree traversal could be safely run on the storage server.

brendangregg• 7 years ago

Cilium's container networking and security product [0]; Facebook's Katran [1]; Netflix's flowsrus (not public yet, but see my tcplife tool in BCC[2]). That's just the beginning. It's not just for performance, it's also security, as while BPF programs run in kernel-mode they have a limited and secured API for interacting with the system (BPF helpers).

Since extended BPF is in the Linux kernel (and will be in other kernels in the future), everyone is getting it, and we'll see more use cases over time. In some ways it's like the birth of JavaScript for the browser, and all the new applications it made possible. But it goes further than that: we could still analyze and debug JavaScript applications using traditional tools. But BPF programs are neither process-space or kernel routines, and are outside the view of everything. No visibility in ps(1), top(1), or lsmod(8). We're having to create new tools to even see what's running on the CPUs. Every performance monitoring product that shows a process table with CPU consumption will now need a BPF program table as well.

[0] https://cilium.io/ [1] https://github.com/facebookincubator/katran [2] http://www.brendangregg.com/blog/2016-11-30/linux-bcc-tcplif...

ComSubVie• 7 years ago

Haven't used it till now (except maybe via nft?).

What I'm not sure is: who is preventing BPF to be used as rootkits? Since they are run inside the kernel and cannot be inspected (?) can they be used to hide malicious activity?

tsukurimashou• 7 years ago

I was wondering about that as well

rhinoceraptor3• 7 years ago

You can see which bpf programs are loaded in the kernel via the bpf() syscall.

Theoretically it could be used for a rootkit, but the programs needed to loaded as root, and they can't have side effects. BPF has also been around for a long time, and it's in basically all of the nix operating systems.

sanxiyn4• 7 years ago

Generally agreed, but Linux BPF is considerably more powerful than traditional Unix BPF, so I wouldn't depend on "it has been around for a long time" for safety.

I would like to see some academic research on Linux BPF verifier. If you are a graduate student working on formal methods looking for a topic, this is a hint.

NyxWulf• 7 years ago

In addition to the compiler there is a verifier that imposes some strict limits on programs. One example is it must prove the program will halt. It would be foolish to say there couldn't be a vector there, but they have done really strong work in protecting against that type of attack.

steve1977• 7 years ago

I still have to watch the presentation and/or read the book, but at first glance this looks like a nasty kludge. I hope I'm wrong.

wbl• 7 years ago

I wonder what Netflix does on their FreeBSD machines.

phkamp• 7 years ago

The Lost Generation discovers IBM Mainframe Channel Programs?

Want to bet if they are going to make all the same mistakes themselves, or if they are willing to learn from history?

peteradio• 7 years ago

Enlighten us grey one.

leetrout2• 7 years ago

All snark aside, is there potential benefit to Varnish Cache with this becoming widely adopted? Things that could only be accomplished at lower layers like this implies access to?

EsssM7QVMehFPAs2• 7 years ago

Since there is already highly efficient event driven I/O and a context switch is bound to happen for applications that require major business logic in user space, I doubt there will be huge benefits for large server applications.

Maybe simplified versions work with this paradigm with significant performance gains, but I doubt that you could simply plug Varnish or nginx in and see much of an improvement.

There is still quite a complexity gap between e.g. interpreting firewall filter rules and a full blown web reverse proxy..

eigenvalue• 7 years ago

Seems like they only resemble Channel Programs in spirit since they don't use any specialized hardware. If it all runs on commodity hardware and is completely generic/customizable in software then it seems a lot more useful and economical than anything for a mainframe.

monocasa13• 7 years ago

Which mistakes? Like, I've def got a few in mind, but I'd like to hear your perspective.

HIP_HOP• 7 years ago

Can someone write an ELI5 of BPF, please?

leetrout2• 7 years ago

Take a look through https://qmonnet.github.io/whirl-offload/2016/09/01/dive-into...

fizwhiz• 7 years ago

Good god those linked articles ought to keep anyone busy for months

ClumsyPilot2• 7 years ago

This looks very similar to webassembly work going on right now, both use a secure VM, and both run in kernel space.

Would webassembly be a more general purpose way of accomplishing something like this?

TickleSteve• 7 years ago

A BPF interpreter can literally be ~100 LoC. A WebAssembly VM on the other hand will likely be ~1million LoC (without checking).

One is suitable for embedding into a kernel, the other isn't.

sanxiyn4• 7 years ago

Where did you get ~1million number? https://github.com/bytecodealliance/wasm-micro-runtime is less than 100K LoC for example.

nicoburns2• 7 years ago

One is suitable for embedding into a kernel, the other isn't.

I'd be very surprised if the linux kernel doesn't eventually get web assembly support.

mwcampbell• 7 years ago

without checking

Then how can you possibly know? Do you just assume that because it has "Web" in the name, it must be insanely complicated?

ClumsyPilot2• 7 years ago

Thank you, I appreciate the perspective.

Perhaps WebAssembly kernel-space programming would still be viable for major trusted projects, like Kafka, where you literally dedicate the entire machine to that application.

sho_hn• 7 years ago

webassembly "runs in kernel space"?

rhencke• 7 years ago

Yes, though it's early days yet. See:

https://github.com/wasmerio/kernel-wasm

yehia2amer• 7 years ago

This is one of the moments that i read an article and say to myself: “Those stuff needs a smarter programmer than i am” I will try to watch the video, hopefully it is simpler to understand !

badfrog2• 7 years ago

I've thought that many times and always been wrong. At the end of the day, code is just code. After you take the time to understand the environment it's running in, it's not that much different than anything else you could write.

Creating BPF in the first place took a lot of cleverness. Figuring out how to fit it into a massive infrastructure at a place like Facebook took a lot of cleverness. But most of the people actually working on the implementations are just normal software engineers.

throwaway2048• 7 years ago

There is lots of code that is difficult to understand, for anyone.

What about code that proves a complex, many page mathematical theorem?

What about code that does complex and very math heavy things like GCM encryption modes, or statistical compression via prediction by partial matching and arithmetic coding?

Just reading the code isn't always enough, plenty of complicated code requires understanding of concepts far outside what you could hope to fit in a comment.

eddiezane• 7 years ago

My coworker gave a talk [0] two weeks ago at KubeCon on the eBPF datapath in regards to Cilium (a network implementation for Kubernetes). He touches on the journey though different kernel and system calls.

0: https://youtu.be/Kmm8Hl57WDU

Aissen• 7 years ago

gregkh said at Kernel Recipes this year that "we have a micro kernel and nobody noticed" while talking about eBPF.

monocasa13• 7 years ago

It's more an exokernel, but yeah.

kasabali• 7 years ago

I think he may have said that about "ELF modules" [1] specifically. Because plain BPF code runs in kernel mode and that wouldn't make it a micro kernel. I don't know if elf modules feature has been merged upstream.

1. https://lwn.net/Articles/749108/

anyzen• 7 years ago

Off topic: this is the same Brendan Gregg of flame charts fame [0][1]. It has solved my skin quite a few times when trying to figure out performance bottlenecks in Python apps (using pyflame[2] to capture data and FlameGraph[1] to convert it to displayable SVG).

[0] http://www.brendangregg.com/flamegraphs.html

[1] https://github.com/brendangregg/FlameGraph

[2] https://github.com/uber-archive/pyflame

emptysea• 7 years ago

Looks like `pyflame` was recently deprecated & archived.

I've had success using `py-spy` for debugging perf issues. Flamegraphs are much nicer to work with than cProfile's output.

https://github.com/benfred/py-spy

simtel20• 7 years ago

I just wrote up a quick survey of python profilers that hasn't been published yet, and along with py-spy, there is austin (https://github.com/P403n1x87/austin). The thing that I liked the most about austin is that it also samples the memory usage of the system so that you have the context of the world outside of the process being sampled, in case it is useful. That said, py-spy is easier to install (it can be installed via pip).

manyworlds12• 7 years ago

This is less about BPF vs native code, and more about the process model vs the event based model of application programming.

Event based handling is inherently more efficient because it runs in the context of the caller, instead of requiring its own context like in process-based applications.

This is the main reason why file system code in the kernel is more efficient than file system servers running in a different process, eg via FUSE. No context switching

EsssM7QVMehFPAs2• 7 years ago

To be fair it should be considered that within the kernel space event driven architectures are already ubiquitous though. I/O, filesystem, you name it. Including powerful multiplexing and dispatch frameworks.

I'd rather see this as a way to ingest performance critical code pieces into the kernel space more easily, with virtualization and verification options providing safety within an otherwise dangerous/complicated domain.

I would not agree with the article that this kind of paradigm is new - neither inside not outside of kernel land.

youareawesome2• 7 years ago

Agree, it's not new, and I think GP's point is that event-driven is the norm for the kernel and why kernel-level interfaces are efficient.

What's new here is that this is being made available to user-level custom applications.

monocasa13• 7 years ago

Sort of, but misses some of the larger picture. The main reason that fs code is faster in the kernel is the direct access to kernel data structures. File system, virtual memory, and buffer cache are all three sides of the same coin. Once you divorce yourself from direct (even if sandboxed) read and writes of the underlying data structures, you impose a massive overhead.

manyworlds12• 7 years ago

Hmm I don’t think this is the case, at least not when comparing fuse to in-kernel file systems. Having access to native VM structures only helps to the extent that you can avoid copies, yet in fuse, only one extra copy takes place. I think having to switch tasks (and associated work: swapping mm, flushing tlb, ireting/syscalling, synchronization) is really what kills perf

smartmic• 7 years ago

I do not know much about kernels and OS architecture. But I am wondering how this relates to the idea of GNU Hurd. Wasn't its concept also about microkernel-based design?

monocasa13• 7 years ago

This is pretty different, Hurd ran all of this stuff in user space.

It's really close to exokernels though. XOK had three different, but similar VMs for running user code in kernel space. Like their version of futex was a filter program that got run to see if the program should be woke up.

hackworks• 7 years ago

eBPF can be viewed as a mechanism to safely run user code in kernel since it uses a DSL and a compiler before the byte code is executed in kernel. This opens up doors for running performance critical functionality in kernel without having to bundle it with the kernel or very tightly coupled with the kernel version.

Optimizing FUSE is an example: https://extfuse.github.io/

I expect custom security auditing software, reverse proxies, firewalls with rule engines implemented in eBPF in the coming future. This will avoid having to copy dates across kernel and user boundary and the switching overheads.

nikanj• 7 years ago

Bytecode + compiler was also how both Flash and Java Applets worked. Have we forgotten how secure those were?

meithecatte• 7 years ago

It's also how wasm works, and in some sense -- JavaScript. Somehow, these introduce much less security problems.

monocasa13• 7 years ago

Java implemented the sandbox as java code in the same VM as what it was sandboxing, then later attached reflection so you had a billion different ways to get references to those classes blocking your access and do brain surgery on them. Oof.

Flash was a lovecraftian horror novel of a code base that even Adobe didn't feel totally comfortable making changes in.

musicale2• 7 years ago

One difference with eBPF is that it limits the number of instructions you can execute (and also prohibits backward branches if I recall - "loops" must be unrolled) and that the semantics are restricted enough that it can be "proven" to be safe.

You are correct however that allowing arbitrary eBPF code to be installed by untrusted users increases the attack surface. For example, we need to trust that the eBPF checker is correct, as well as the implementation of the eBPF operations. Moreover, even though eBPF may be safe I suspect it could potentially trigger or exploit bugs in internal kernel subsystems that might be harder or even impossible to trigger through the regular system call interface.

riyakhanna1983• 7 years ago

Another example is a sandboxing file system https://lwn.net/Articles/803890/

cpr• 7 years ago

firewalls with rule engines implemented in eBPF in the coming future

Wasn't this the original purpose of BPF?

irq-1• 7 years ago

I was thinking about something similar to extfuse, but for a remote filesystem. Here's some note scraps:

Server abilities can be changed by uploading JS functions/libs..
Want to search a file formats meta-data on the server? Upload JS to read the meta-data and index it, and provide the search options..
Servers should also use the best options for the tasks they provide: Grep to seach text -- and not Grep like functionality, but the optimized binary for the platform the server is running.
Locking, linking, ACLs, and binary access should all be changable by JS.

anderspitman• 7 years ago

This is an interesting idea. Sort of the inverse of a web app. Part of the problem with the cloud for large datasets (ie genomics) is getting the computation close enough to the data (the UI being the third leg of the stool). If you could upload small processing scripts (or ebpf/wasm) to the exact node where the data lives in real time, it might open up some novel techniques.

Kind of like current serverless tech but instead of running at the edge, you run on the storage node.

EDIT: removed statement about network speed vs ssd speed. Pretty sure I was way off.

throwaway894345• 7 years ago

According to https://news.ycombinator.com/item?id=18496054, these programs have to halt? How does this system guarantee that the programs halt? Does this mean eBPF is not Turing complete?

4ad• 7 years ago

Indeed, eBPF is not turing complete.

ttctciyf• 7 years ago

From the accompanying video (17:11)[1] it's not Turing complete "because the verifier rejects unbounded loops and so there is some things that are not possible. We do have bounded loops in BPF now."

1: https://youtu.be/7pmXdG8-7WU?t=1031

nwallin• 7 years ago

The language itself is Turing complete, but the kernel will refuse to run a program that it cannot prove will halt.

There are three categories of programs; programs you can trivially prove will halt, programs you can trivially prove won't halt, and programs where it's difficult or impossible to prove whether or not will halt. The third category is what we call the halting problem. Only the first category will be run by the kernel.

The nitty gritty is that the only jumps which are allowed to go backwards are the end of a loop with a fixed number of iterations. All other jumps must jump forward.

This sounds like it's really limiting, but in practice there's not a whole lot of useful stuff you're unable to do.

sansnomme• 7 years ago

Commonly known as total functional programming.

https://en.m.wikipedia.org/wiki/Total_functional_programming

sigstoat2• 7 years ago

if i like the guarantees that BPF gives the kernel, and want to embed it into my user-space software so that it can execute BPF programs received from other untrusted processes, are there any hints on where to start? the "BPF beginners" material i come across doesn't seem to discuss this use case.

base0x102• 7 years ago

This is currently not easy to do. First of all, the kernel BPF implementation is GPLv2, which means you cannot rip out the runtime and embed it in your userspace code unless you are able to distribute your userspace software as GPLv2 (This is AFAIK and IANAL). For software engineering and license compatibility reasons, you probably want to use a clean implementation of eBPF.

Two such implementations exist. uBPF has a simple implementation. This implementation is likely not feature complete, as it is not regularly updated and the kernel BPF validator keeps getting new features. DPDK also has an implementation of BPF. This appears to be actively developed, but it also comes with a lot of baggage from DPDK. It may be possible to fork for this purpose, but it appears to primarily used for running traditional network filters on incoming packets in userspace.

What you are looking for is a really interesting possibility but would require a significant software engineering effort.

If you relax the constraint that BPF runs in userspace, it is possible to insert userspace dynamic tracing points (USDT) into your code, which will call out to a BPF program in the kernel when executed.

sigstoat2• 7 years ago

First of all, the kernel BPF implementation is GPLv2, which means you cannot rip out the runtime and embed it in your userspace code unless you are able to distribute your userspace software as GPLv2

mmm right, should've thought of that.

What you are looking for is a really interesting possibility but would require a significant software engineering effort.

thanks for the info, i appreciate it, and it gives me a bit to chew on.

kizer• 7 years ago

I've wondered why operating systems, aside from hypervisors, are overwhelmingly the first abstraction - I know the obvious benefits, or rather necessities (processor sharing, security, file system, etc etc) - but in ultra-specialized perf-critical applications I'd have thought economic pressures would have materialized a greater variety of ad-hoc bare-metal software. I guess we're headed that way w/ the twilight of Moor'es law, FPGAs. Maybe I'm just ignorant of such implementations.

SahAssar• 7 years ago

Isn't that sorta what a unikernel is?

eyberg• 7 years ago

yep - and some of us are working on that

monocasa13• 7 years ago

You're not wrong. Alibaba is really leading the charge on FPGAs as servers in the data center.

It's complex though, because the tooling wrt logging, monitoring, debugging aren't as mature yet.

JackRabbitSlim• 7 years ago

BPF amuses me greatly; Real-Mode/Ring0 are dead! Long live Real-mode/Ring0!

Yes, yes. It's got some access control and security sugar sprinkled in but the idea of 'userland for everything!' is clearly wrong if eBPF moving stuff back into the kernel is "The biggest OS development in my career"

paggle• 7 years ago

Can someone explain in one simple paragraph what this is?

willisbueller2• 7 years ago

Sounds a lot like SPIN OS https://en.wikipedia.org/wiki/SPIN_(operating_system) They have to make do without type safety (in SPIN's case provided by modula-3), but it's really cool to see it tried. For those interested: SPIN and other hybrid kernels (like Exo) were created in the fall-out of "microkernels are bad" by attempting to allow a hybrid approach. Linux was created around the same time staying straight in the monolithic category (but since moving to be more hybrid).

smorrow2• 7 years ago

Out of the loop, why is Linux now "more hybrid"?

PaulDavisThe1st4• 7 years ago

kernel modules and BPF ....

boomboomsubban• 7 years ago

Many of the benefits of microkernels have been implemented in Linux over the past 25 years. Modules, FUSE, and live patching for example.

pm90• 7 years ago

Because it has a crap ton of drivers and shit in the kernel, which is the opposite of unikernel/microkernel approach where most of this functionality is implemented in userspace. See eg Minix

willisbueller2• 7 years ago

It provides some of the capabilities previously limited to microkernels in the past around the ability of an application domain to customize the kernel to fit its needs. You can see it in loadable kernel modules, user-space drivers which allow applications to control how they access hardware directly, and now loadable application code too which can run directly in the kernel. Hybrid hasn't been used to denote something that has a address space layout similar to a mkernel so much as it's being used to denote a monolithic operating system that has some capabilities previously only available in a mkernel.

kragen• 7 years ago

There are a bunch of places where non-Turing-complete scripting can be used to provide better interfaces between mutually-untrusting systems. Bitcoin Script, which is loopless like BPF, is another example. (I don't mean eBPF, which isn't loopless.) I've been thinking about using this approach in the Wercam windowing system for BubbleOS to get reliably low-latency feedback for user interface events, as Don Hopkins did with NeWS; https://gitlab.com/kragen/dercuano/blob/master/markdown/werc... explains how, and also delves a bit into the history of the approach. Other possible uses include active networking (by including a routing program in your packet headers), specifying pub-sub subscriptions, and specifying database queries.

etaioinshrdlu2• 7 years ago

Very interesting. The BPF programs are often written in C and compiled using a BPF backed to llvm using this project: https://github.com/iovisor/bcc

This should be useful any time you need a high performance, high security way to instrument or extend a C based program during run time! Not just in kernels.

musicale2• 7 years ago

I'm a big fan of eBPF (and Brendan Gregg), but it's not really a new type of software - the original BPF (1993) has been around for a while, not to mention other user-extensible kernel architectures such as ring-based kernels and microkernels (1960s-) and exokernels (1994).

eBPF reminds me a lot of exokernel type systems.

BPF: A New Type of Software

Related Stories