Re: [Ksummit-discuss] [MAINTAINERS SUMMIT] How far to go with eBPF

On Sat 18-06-22 09:43:32, NeilBrown wrote:
> On Fri, 17 Jun 2022, Jan Kara wrote:
> > On Fri 17-06-22 09:53:52, Jiri Kosina wrote:
> > > On Thu, 16 Jun 2022, James Bottomley wrote:
> > > 
> > > > > If you want a "stable ebpf program" then you submit it upstream and
> > > > > we can make sure that it works with any internal API changes, the
> > > > > same way we do for modules. Those with out-of-tree modules will have
> > > > > the technical debt of changing every time a new kernel release is
> > > > > out, and so should out-of-tree bpf programs.
> > > > 
> > > > Assuming eBPF takes off, that would have some poor maintainer managing
> > > > the whole of the compatibility changes for the entire eBPF ecosystem
> > > > ... I really don't think that's scalable.
> > > 
> > > I nevertheless still see this as the best and only option we have; that 
> > > is, have an infrastructure in the kernel tree for maintaining eBPF 
> > > programs, somehow sorted per subsystem so that it mirrors the standard 
> > > maintainership / subsystem structure proper, and have the maintainers 
> > > responsible for keeping the eBPF programs related to their subsystem in 
> > > sync with the internal changes happening in the subsystem.
> > > 
> > > At the end of the day, it will be the subsystem maintainers themsleves 
> > > accepting the program into the tree in the first place, so it's not like 
> > > they are receiving responsibility for something they never wanted in the 
> > > first place. So we'll probably end up with subsystems with many eBPF 
> > > programs, and also subsystems with zero. Similarly to tracepoints.
> > > 
> > > I.e. pretty much the 'perf' model, but on much wider scale (as eBPF can 
> > > hook to just about anything).
> > > 
> > > Any other option seems to lead to having eBPF programs sprinkled all over 
> > > the internet that depend on particular kernel version / API, leading to 
> > > nothing else than unhappy users, because "I downloaded it, it didn't work, 
> > > Linux sucks".
> > 
> > OK, but if we keep eBPF programs this closely coupled to the kernel, then
> > what is the advantage of using eBPF, say for HID as was discussed earlier
> > in this thread, compared to just making sure HID has appropriate hooks and
> > the handling of the device quirks is done in normal C code (kernel module)
> > attached to these hooks?
> > 
> > Because frankly for me the main value of eBPF over patching and recompiling
> > the kernel is that I can tweak the eBPF code exactly to my needs and load
> > it to the kernel without needing to reboot, over time it is less work than
> > maintaining a source code patch out of tree, and usually it is a hacky
> > tweak I use for some debugging so merging it upstream does not make sense.
> > 
> 
> How is "load without needing to reboot" different from loading a module.
> And if the code you need to tweak with eBPF isn't in a module, then how
> it is different from live-patching ?

Well, typically I want to print some values when entering a function or
gather some stats while kernel is running. I could modify the kernel to do
this and as you say for a module (if it can be unused), I could even start
running the new code without reboot. And yes, live-patching could work for
the non-modular bits in princible but it is a matter of convenience -
live-patching is by far not as easy to use as eBPF for my purposes as eBPF
trivially hooks to trace points, has data structures to coalescing data
before passing it to userspace etc. But I'm getting offtopic here I'm
afraid.

> And how is "less work than maintaining a source code patch out of tree"
> different to asking for a stable abi?

To be clear I'm of the opinion we need to avoid tying us with stable ABI
requirements by eBPF. But my experience shows that eBPF programs attaching
to tracepoints / functions require less tweaking from version to version
than source code patches which happen to not apply for all sorts of
unrelated reasons. So it is not that eBPF programs would not require
tweaking from time to time but simply the way how kernel extension happens
with eBPF tends to result in less pointless conflicts.

> It seems like eBPF might be just a back-door for a stable abi, which
> seems easier because the compiler lives in the kernel which allows us to
> distribute arch-independent modules.

I don't think so. eBPF is used for multiple different purposes. So far its
uses were such that it was understood that eBPF programs will break from
time to time and need update for a newer kernel. As the use of eBPF is
expanding there's a real risk we develop eBPF programs breaking which
would be difficult to deal with for users and that's where problems start.
And AFAIU Jiri's topic proposal which started this thread is exactly trying
to get the discussion going how to avoid such situation.

								Honza
-- 
Jan Kara <[email protected]>
SUSE Labs, CR
_______________________________________________
Ksummit-discuss mailing list
[email protected]
https://lists.linuxfoundation.org/mailman/listinfo/ksummit-discuss