[Starlingx-discuss] System observability with BPF on StarlingX

[Mark Asselstine]

On 2021-09-30 8:33 a.m., Shigeru Yoshida wrote:
> Hi,
> 
> I think it would be exciting if we can use BPF for tracing, debugging,
> and performance tuning on StarlingX.
> 
> I noticed that CONFIG_BPF is enabled on the lates 5.10 kernel,
> but CONFIG_BPF_EVENTS and CONFIG_KPROBES are disabled.
> So, we cannot use BPF's functionality to the fullest extent.
> 
> Is this intentional?  I assume it might be some security reasons...

There are definitely concerns about security related to BPF. If you 
follow lkml and the work done on stable kernel releases you will 
certainly find that BPF bug and CVE fixes are more numerous than 
many/most other subsystems. A full and thoughtful discussions would have 
to weigh these concerns against the benefits (which as you indicate, 
there are many) before making a call on this.

However, the main issue is that there is an incompatibility between some 
aspects of BPF and the preempt_rt patchset (which is used with the 
kernel-rt kernel variant of STX). You can read about this 
incompatibility here https://lwn.net/Articles/802884/ and the email 
exchange which the article links to. At this point in time there does 
not exist a resolution to this issue.

The STX community could decide to proceed with using all of BPF when 
using the kernel-std, but this would create a capability matrix and 
possibly confusion as to why some tooling is available only under 
certain circumstances.

Certainly the work of folks like Brendan Gregg and others have 
demonstrated the benefits of such tooling, so please continue to work 
with others in the STX community to advance your goals, I just thought I 
would share the above with you so you could be aware of why these 
kconfigs are currently selected in the 5.10 kernel.

Regards,
Mark Asselstine


> 
> Thanks,
> Shigeru
> 
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss