Her implementation of a rudimentary load balancer (in C) demonstrates eBPF in practice:
A Beginner's Guide to eBPF
41–50 of 78 posts
Re: A Beginner's Guide to eBPF
#42As I understand it, eBPF is primarily an observation tool and thus is quite limited in the modifications it can make to kernel memory. Does it have any generic way to make arbitrary modifications to kernel memory? Obviously this would invalidate any verification guarantees, but I would expect this to be very minor modifications in practice. For example, if I wanted to hook a page fault handler to change the behaviour…
[deleted]
Re: A Beginner's Guide to eBPF
#43Re: A Beginner's Guide to eBPF
#44As I understand it, eBPF is primarily an observation tool and thus is quite limited in the modifications it can make to kernel memory. Does it have any generic way to make arbitrary modifications to kernel memory? Obviously this would invalidate any verification guarantees, but I would expect this to be very minor modifications in practice. For example, if I wanted to hook a page fault handler to change the behaviour…
What you can do is quite limited. You're restricted to some preset eBPF program types, and each program type has a restricted set of operations it can perform (eBPF helper methods). So arbitrary modifications, absolutely not without adding a helper method and/or program type for this purpose. More program types and helper methods are being added all the time but overall it's pretty limited in use cases and operations.
If you want full control then kernel module is the way to go, but this doesn't have the same security and stability guarantees.
Re: A Beginner's Guide to eBPF
#45Earlier quoted context omitted.
You can just type "What is eBPF" into Google, and the first hit will decisively answer this question for you.
You can work around pretty much any issue like this, but you shouldn't have to. A beginner's guide should define the concept.
I find this same issue with many things posted here. Even businesses marketing their product. My favourite is when they give you an abstraction salad instead of explaining something.
I clicked the first link so I got the gist but how many other people just give up and disengage with their post? Or click the link then just close the tab without reading further.
Re: A Beginner's Guide to eBPF
#46This may prove useful: > eBPF (often aliased BPF)[2][5] is a technology that can run sandboxed programs in a privileged context such as the operating system kernel.[6] It is used to safely and efficiently extend the capabilities of the kernel at runtime without requiring to change kernel source code or load kernel modules.[7] Safety is provided through an in-kernel verifier which performs static code analysis and rej…
A paragraph like this one should be the first thing in the Readme.
Re: A Beginner's Guide to eBPF
#47The parody here is so perfect, they even created the technology they don't bother to define.
Re: A Beginner's Guide to eBPF
#48This may prove useful: > eBPF (often aliased BPF)[2][5] is a technology that can run sandboxed programs in a privileged context such as the operating system kernel.[6] It is used to safely and efficiently extend the capabilities of the kernel at runtime without requiring to change kernel source code or load kernel modules.[7] Safety is provided through an in-kernel verifier which performs static code analysis and rej…
Haven't sandboxed programs in a privileged context been the root cause of me seeing BSOD so often in the late 90ties?
I'm only aware of drivers, which were not sandboxed due to the nature of drivers (at least in late 90ties there was pobably not much of abstraction on that level, kernel features, hardware features available?)
Re: A Beginner's Guide to eBPF
#49I’m new to Linux kernel programming & eBPF (just started last week) and I’m having major troubles with eBPF verifier. I honestly feel like it would be easier for me to write a kernel module than eBPF code. I do wonder if this is the case for many people. It seems verifier is a bit unpredictable and makes eBPF programming quite painful.
Reading more about that… How does the verifier detect infinite loops anyway? Halting problem and all. It must use some rather crude heuristics, no?
You need to slightly modify your code. Rather than:
while (condition) { … }
Do: #define MAX 1000 for n = 0; n Unroll all loops, don’t allow any backward jumps and limit to (say) 1m instructions.
Re: A Beginner's Guide to eBPF
#50Something’s off here. I’m reasonably well read and literate on computer topics, I’ve worked in cyber security for over 5 years now, and extremely open-minded to new ideas — this reads at best like derivative marketing jargon and little in the way of technical.
eBPF is an extremely big deal in computer and network security, so, I assure you, this isn't "derivative marketing jargon", and it is very technical.
Well that is wild and kinda cool. I don’t often find things that are so foreign to me they appear fake! I’ll have to poke around a little more, thanks for the correction.