BPF: A New Type of Software
brendangregg.com
BPF: A New Type of Software
1–10 of 192 posts
Re: BPF: A New Type of Software
#2Great video. Good content, delivery and impressive lighting and video production work.
Re: BPF: A New Type of Software
#3Brendan has a lot of great content that gets posted here regularly: http://www.brendangregg.com/ (I'm still trying find the time to get through it though).
There's also https://github.com/iovisor/bcc#tools as an easy way to get started using BPF.
Re: BPF: A New Type of Software
#4Looks nice, microservices going into super-micro territory, where they are just simple small code snippets. Possible problems - many people will learn the hard way that logging or printing every packet which comes through your interfaces for further analysis will bring down your system. From the start there should be some simple way to rate-limit those bpf programs, like "if this exceeds some limits or bogs down system for more than X milliseconds, disable and give error".
Re: BPF: A New Type of Software
#5Re: BPF: A New Type of Software
#6So from my understanding, that's a kind of "secure" (I'd like to know more about the security model tbh) module that runs with kernel privilege with no scheduling (so it runs until completion). These are supposed to be short and I am assuming, can't call libs and can't allocate memory (outside a predefined stack I would guess?)
Aren't they very similar to interrupts? What is the difference there? The kernel API?
Re: BPF: A New Type of Software
#7Brendan has a lot of great content that gets posted here regularly: http://www.brendangregg.com/ (I'm still trying find the time to get through it though). There's also https://github.com/iovisor/bcc#tools as an easy way to get started using BPF.
Brendans sharing is amazing, I have and am learning so much from it, as well as having referred others to it when they have a performance issue but missing the troubleshooting tools.
Re: BPF: A New Type of Software
#8Looks nice, microservices going into super-micro territory, where they are just simple small code snippets. Possible problems - many people will learn the hard way that logging or printing every packet which comes through your interfaces for further analysis will bring down your system. From the start there should be some simple way to rate-limit those bpf programs, like "if this exceeds some limits or bogs down syst…
> if this exceeds some limits or bogs down system for more than X milliseconds, disable and give error
That's exactly what kernel will do
Re: BPF: A New Type of Software
#9So from my understanding, that's a kind of "secure" (I'd like to know more about the security model tbh) module that runs with kernel privilege with no scheduling (so it runs until completion). These are supposed to be short and I am assuming, can't call libs and can't allocate memory (outside a predefined stack I would guess?) Aren't they very similar to interrupts? What is the difference there? The kernel API?
My understanding is that they're program fragments that can be attached to kernel code and are generally used for debugging and observability. It's using a virtual machine that's designed to sandbox these, and they're limited in power so that a buggy filter can't hang the kernel.
This is different form hardware interrupts because they don't run in response to hardware events, and they don't have side effects. There is a similarity in that you want the filters to run quickly, though.
Re: BPF: A New Type of Software
#10So from my understanding, that's a kind of "secure" (I'd like to know more about the security model tbh) module that runs with kernel privilege with no scheduling (so it runs until completion). These are supposed to be short and I am assuming, can't call libs and can't allocate memory (outside a predefined stack I would guess?) Aren't they very similar to interrupts? What is the difference there? The kernel API?
IIR I think it's a VM(?) that has certain limits, and because of those limits it's OK to run it in kernel-space. IIRC it's not Turning complete, and has a fixed run time. So Linux can just say "OK run this now" and not worry about scheduling. It's like putting a green thread in the kernel but to do this safely you need very strict restrictions (finite memory it can access, finite number of steps, etc).
You can thus get speed-ups because there's no API, memory management, even scheduling.