eBPF Is Awesome
filipnikolovski.com
eBPF Is Awesome
1–10 of 46 posts
Re: eBPF Is Awesome
#2Spectre mitigations can make it go from awesome to useful.
The documentation is also pretty dire, but it's mostly implement-once remember-forever in my experience - it's all there but kernel samples are quite hard to read, and I'd rather not guess based on struct listings (e.g. variable length structs aren't particularly fun when you're fumbling around)
Re: eBPF Is Awesome
#3Most examples of BPF code are written in a mix of Python and C using BCC, the "BPF Compiler Collection", which essentially treats all of LLVM and clang as a library callable from Python code.
I can't get my head around using it that way, and have found it pretty straightforward to just write C programs, compiled with clang `-target bpf`. Until very recently, writing anything interesting this way required you to declare all functions inline, compile into a single ELF .o, and, of course, avoid most loops. But most of the kinds of things you'd write in BPF tend not to be especially loopy (you can factor most algorithmic code out into userland, communicating with BPF using maps).
A big issue for this kind of development is kernel compat; struct layouts can change from release to release, for instance. This isn't a problem for us at Fly, because we just run the same kernel everywhere, but it's a real problem if you're trying to ship a tool for other people's systems. But that's changing with CO-RE; recent kernels can export a simplified symbol table in a BPF-legible format called BTF, and the leader can perform relocations. Facebook has written a bunch of good stuff about this:
https://facebookmicrosites.github.io/bpf/blog/2020/02/20/bcc...
Re: eBPF Is Awesome
#4Most examples of BPF code are written in a mix of Python and C using BCC, the "BPF Compiler Collection", which essentially treats all of LLVM and clang as a library callable from Python code. I can't get my head around using it that way, and have found it pretty straightforward to just write C programs, compiled with clang `-target bpf`. Until very recently, writing anything interesting this way required you to decla…
What's worse is that I've run into Kernel bugs/panics a few times that made me hesitate recommended BPF for production systems. Hopefully those become less frequent as the ecosystem matures, but they were pretty scary!
Re: eBPF Is Awesome
#5That sounds extremely cool.
Sadly, I don't program in Linux, so I can't use it. :'(
Re: eBPF Is Awesome
#6That sounds extremely cool. Sadly, I don't program in Linux, so I can't use it. :'(
If you just want to learn and try it, you can always do it in a Linux VM.
My general development skill (in Linux or otherwise) has definitely improved since I became a Linux native. But that didn't happen overnight.
Re: eBPF Is Awesome
#7Most examples of BPF code are written in a mix of Python and C using BCC, the "BPF Compiler Collection", which essentially treats all of LLVM and clang as a library callable from Python code. I can't get my head around using it that way, and have found it pretty straightforward to just write C programs, compiled with clang `-target bpf`. Until very recently, writing anything interesting this way required you to decla…
I think dtrace has the same problem, i.e. it's pretty tightly coupled to the exact functions / trace points in the kernel. A different kernel can break a dtrace script, although I think their code changes a lot less than Linux does.
It seems somewhat unavoidable, if the goal is to introspect the kernel at a very intimate level ...
Re: eBPF Is Awesome
#8It seems worth mentioning that the code actually executing in the kernel, when it is running your eBPF, is native machine code, ahead-of-time compiled from the bytecode program you gave to the kernel.
Re: eBPF Is Awesome
#9That sounds extremely cool. Sadly, I don't program in Linux, so I can't use it. :'(
If you program on Windows you should check out Event Tracing for Windows(ETW). Similar to eBPF, ETW is a logging framework inside Windows kernal. Microsoft.Diagnostics.Tracing.TraceEvent[0] is a nice nuget package for logging and analyzing ETL files.
[0]https://github.com/microsoft/perfview/blob/master/documentat...
Re: eBPF Is Awesome
#10That sounds extremely cool. Sadly, I don't program in Linux, so I can't use it. :'(
You may try out generic eBPF outside of Linux: https://github.com/generic-ebpf/generic-ebpf