[Starlingx-discuss] System observability with BPF on StarlingX
Hi, I think it would be exciting if we can use BPF for tracing, debugging, and performance tuning on StarlingX. I noticed that CONFIG_BPF is enabled on the lates 5.10 kernel, but CONFIG_BPF_EVENTS and CONFIG_KPROBES are disabled. So, we cannot use BPF's functionality to the fullest extent. Is this intentional? I assume it might be some security reasons... Thanks, Shigeru
On 2021-09-30 8:33 a.m., Shigeru Yoshida wrote:
Hi,
I think it would be exciting if we can use BPF for tracing, debugging, and performance tuning on StarlingX.
I noticed that CONFIG_BPF is enabled on the lates 5.10 kernel, but CONFIG_BPF_EVENTS and CONFIG_KPROBES are disabled. So, we cannot use BPF's functionality to the fullest extent.
Is this intentional? I assume it might be some security reasons...
There are definitely concerns about security related to BPF. If you follow lkml and the work done on stable kernel releases you will certainly find that BPF bug and CVE fixes are more numerous than many/most other subsystems. A full and thoughtful discussions would have to weigh these concerns against the benefits (which as you indicate, there are many) before making a call on this. However, the main issue is that there is an incompatibility between some aspects of BPF and the preempt_rt patchset (which is used with the kernel-rt kernel variant of STX). You can read about this incompatibility here https://lwn.net/Articles/802884/ and the email exchange which the article links to. At this point in time there does not exist a resolution to this issue. The STX community could decide to proceed with using all of BPF when using the kernel-std, but this would create a capability matrix and possibly confusion as to why some tooling is available only under certain circumstances. Certainly the work of folks like Brendan Gregg and others have demonstrated the benefits of such tooling, so please continue to work with others in the STX community to advance your goals, I just thought I would share the above with you so you could be aware of why these kconfigs are currently selected in the 5.10 kernel. Regards, Mark Asselstine
Thanks, Shigeru
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
Hi Mark, Thanks for the valuable information. I understand the background of the current kernel configuration. Thanks, Shigeru On 2021/10/06 23:58, Mark Asselstine wrote:
On 2021-09-30 8:33 a.m., Shigeru Yoshida wrote:
Hi,
I think it would be exciting if we can use BPF for tracing, debugging, and performance tuning on StarlingX.
I noticed that CONFIG_BPF is enabled on the lates 5.10 kernel, but CONFIG_BPF_EVENTS and CONFIG_KPROBES are disabled. So, we cannot use BPF's functionality to the fullest extent.
Is this intentional? I assume it might be some security reasons...
There are definitely concerns about security related to BPF. If you follow lkml and the work done on stable kernel releases you will certainly find that BPF bug and CVE fixes are more numerous than many/most other subsystems. A full and thoughtful discussions would have to weigh these concerns against the benefits (which as you indicate, there are many) before making a call on this.
However, the main issue is that there is an incompatibility between some aspects of BPF and the preempt_rt patchset (which is used with the kernel-rt kernel variant of STX). You can read about this incompatibility here https://lwn.net/Articles/802884/ and the email exchange which the article links to. At this point in time there does not exist a resolution to this issue.
The STX community could decide to proceed with using all of BPF when using the kernel-std, but this would create a capability matrix and possibly confusion as to why some tooling is available only under certain circumstances.
Certainly the work of folks like Brendan Gregg and others have demonstrated the benefits of such tooling, so please continue to work with others in the STX community to advance your goals, I just thought I would share the above with you so you could be aware of why these kconfigs are currently selected in the 5.10 kernel.
Regards, Mark Asselstine
Thanks, Shigeru
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
participants (2)
-
Mark Asselstine
-
Shigeru Yoshida