A Beginner's Guide to eBPF • Hacker News Board

Re: A Beginner's Guide to eBPF

#31

Post by PhilipRoman » Mon, May 08, 2023, 6:08 AM UTC

upghost wrote: post #12

Something’s off here. I’m reasonably well read and literate on computer topics, I’ve worked in cyber security for over 5 years now, and extremely open-minded to new ideas — this reads at best like derivative marketing jargon and little in the way of technical.

I've found kernel documentation under Documentation/bpf to be the best resource available. Clear, concise and no marketing-speak

As for this repository - the README triggered a false alarm in my bullshit sensors, but the code example is pretty nice.

Re: A Beginner's Guide to eBPF

#32

Post by 1propionyl » Mon, May 08, 2023, 6:23 AM UTC

diarrhea wrote: post #30

DethNinja wrote: post #15

I’m new to Linux kernel programming & eBPF (just started last week) and I’m having major troubles with eBPF verifier. I honestly feel like it would be easier for me to write a kernel module than eBPF code. I do wonder if this is the case for many people. It seems verifier is a bit unpredictable and makes eBPF programming quite painful.

Reading more about that… How does the verifier detect infinite loops anyway? Halting problem and all. It must use some rather crude heuristics, no?

It doesn't. Flip things around and you get something tractable, though incomplete.

Unsolvable problem: reject any loop that is provably infinite.

Solvable problem: reject any loop that isn't provably finite.

The trade off is that there will always be some loops that in fact always do terminate, but that the verifier can't prove do.

Re: A Beginner's Guide to eBPF

#33

Post by aptwebapps » Mon, May 08, 2023, 6:42 AM UTC

tptacek wrote: post #22

Dylan16807 wrote: post #4

Earlier quoted context omitted.

Is a joke going over my head here, because the first sentence links to a document titled "what is eBPF?"

You can just type "What is eBPF" into Google, and the first hit will decisively answer this question for you.

Although the fact that Google puts the Wikipedia BPF article in the sidebar might confuse you a little.

Re: A Beginner's Guide to eBPF

#34

Post by kqr » Mon, May 08, 2023, 6:43 AM UTC

Ever since Brendan Gregg started using eBPF for observability back in 2015 I've had the sense that eBPF is an extremely underrated tool of the future. I really would like to learn it, but beyond some improvised bpftrace scripting and the tools that come with bcc, I've not really had the need.

What custom usage do you have for it?

Re: A Beginner's Guide to eBPF

#35

Post by cinntaile » Mon, May 08, 2023, 6:48 AM UTC

tptacek wrote: post #22

Dylan16807 wrote: post #4

Earlier quoted context omitted.

Is a joke going over my head here, because the first sentence links to a document titled "what is eBPF?"

You can just type "What is eBPF" into Google, and the first hit will decisively answer this question for you.

You can work around pretty much any issue like this, but you shouldn't have to. A beginner's guide should define the concept.

Re: A Beginner's Guide to eBPF

#36

Post by anonymousDan » Mon, May 08, 2023, 7:09 AM UTC

israrkhan wrote: post #28

tptacek wrote: post #17

Earlier quoted context omitted.

It would be much easier to write a kernel module than an eBPF program. But the eBPF program is unlikely to panic your machine, and the kernel module is almost certain to.

Also In cloud environments, I would much rather trust an eBPF program, than a kernel module.

Why in cloud environments?

Re: A Beginner's Guide to eBPF

#37

Post by anonymousDan » Mon, May 08, 2023, 7:17 AM UTC

As I understand it, eBPF is primarily an observation tool and thus is quite limited in the modifications it can make to kernel memory. Does it have any generic way to make arbitrary modifications to kernel memory? Obviously this would invalidate any verification guarantees, but I would expect this to be very minor modifications in practice. For example, if I wanted to hook a page fault handler to change the behaviour without having to pay the cost of signal handlers.

Re: A Beginner's Guide to eBPF

#38

Post by kjuulh » Mon, May 08, 2023, 7:37 AM UTC

Just read the book, I like the way she did it, it starts out easy with what eBPF is, how it works, using short examples for both the low-level under the hood stuff, but also how to actually use it. It doesn't deviate much from this pattern, which is a good thing for such a relatively short book, and she gets to cover a lot of ground that way. It is still a "beginners" eBPF book, but sets the stage for further development through the references or alternative books.

I can highly recommend it if you're eBPF curious =D I guess my only gribe is that the latter parts of the book, is a bit product heavy, but done in the most tasteful manner it could probably have been done, i.e. using it as examples on how to use eBPF.

Re: A Beginner's Guide to eBPF

#39

Post by awesomegoat_com » Mon, May 08, 2023, 7:47 AM UTC

Paul-Craft wrote: post #10

This may prove useful: > eBPF (often aliased BPF)[2][5] is a technology that can run sandboxed programs in a privileged context such as the operating system kernel.[6] It is used to safely and efficiently extend the capabilities of the kernel at runtime without requiring to change kernel source code or load kernel modules.[7] Safety is provided through an in-kernel verifier which performs static code analysis and rej…

Haven't sandboxed programs in a privileged context been the root cause of me seeing BSOD so often in the late 90ties?

Re: A Beginner's Guide to eBPF

#40

Post by _def » Mon, May 08, 2023, 7:54 AM UTC

upghost wrote: post #12

Something’s off here. I’m reasonably well read and literate on computer topics, I’ve worked in cyber security for over 5 years now, and extremely open-minded to new ideas — this reads at best like derivative marketing jargon and little in the way of technical.

welcome to cloud engineering.