BPFd: Running BCC tools remotely across systems and architectures

Posted Jan 24, 2018 17:52 UTC (Wed) by karim (subscriber, #114)
Parent article: BPFd: Running BCC tools remotely across systems and architectures

This is very cool. Happy to see efforts being done to get BPF running cross-platform. Architecture "independence" is one of the features that I liked of the ktap proposal (https://github.com/ktap/ktap).

I glanced over the code quickly looking for logging and only found this "/* TODO: logging disabled for now, add mechanism in future */". Any plans on leaving traces in /data of the BPF operations conducted remotely? This might have some value. Also, any chance of having local cache or already compiled scripts that could be run locally on the target? I can see the value of being able to leverage existing script sets locally while the device has already shipped and is no longer connected to a development system.

BPFd: Running BCC tools remotely across systems and architectures

Posted Jan 26, 2018 1:22 UTC (Fri) by _joel_ (subscriber, #112763) [Link]

Thanks Karim!

> I glanced over the code quickly looking for logging and only found this
> "/* TODO: logging disabled for now, add mechanism in future */".
> Any plans on leaving traces in /data of the BPF operations conducted remotely?

Yes, this is something that we should do.

> Also, any chance of having local cache or already compiled scripts that could
> be run locally on the target? I can see the value of being able to leverage
> existing script sets locally while the device has already shipped and is no
> longer connected to a development system.

Yes, that could be done by enabling debugging (BCC_REMOTE_DEBUG) on the BCC side and getting the commands. Then inputting the commands to BPFd on the target. The issue though then is the presentation layer. Without BCC running on the host side, you can't interpret the maps and output data unless the target was running BCC itself. But yes, one could perform the loader functionality of eBPF just by purely using BPFd without any need for BCC (I mentioned this with an example in the article)