BPF as a safer kernel programming environment

Posted Sep 26, 2022 18:14 UTC (Mon) by Cyberax (✭ supporter ✭, #52523)
In reply to: BPF as a safer kernel programming environment by kid_meier
Parent article: BPF as a safer kernel programming environment

WASM is designed from ground up to be safe, as it's used in browsers (which is probably the most aggressive computing medium imaginable). eBPF verifier is far less robust.

BPF as a safer kernel programming environment

Posted Sep 28, 2022 11:13 UTC (Wed) by foom (subscriber, #14868) [Link] (2 responses)

BPF verifier does have the notable feature (or misfeature) of being able to prove that the program will successfully complete in a bounded execution time.

Wasm doesn't do that. A wasm program is allowed to loop forever, or to abort.

BPF as a safer kernel programming environment

Posted Sep 28, 2022 16:36 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link] (1 responses)

> BPF verifier does have the notable feature (or misfeature) of being able to prove that the program will successfully complete in a bounded execution time.

WASM programs can be suspended after a given number of instructions ("fuel"), at least if you're using the "wasmtime" runtime. This is essentially the same functionality. Moreover the "fuel" limits can be configured during the runtime so you can easily have different settings for different types of instrumentation.

> Wasm doesn't do that. A wasm program is allowed to loop forever, or to abort.

The only thing you really need to add to WASM is the "default value" that would be returned on termination or fuel exhaustion.

BPF as a safer kernel programming environment

Posted Oct 6, 2022 21:53 UTC (Thu) by njs (subscriber, #40338) [Link]

I think the issue is that if your program is mutating kernel structures, then it may not be safe to kill it mid-stream -- you need some strategy for safely unwinding from an arbitrary point in execution. This seems like a pretty reasonable thing to me, but I guess so far eBPF has decided to make the tradeoff of investing in the verifier infrastructure instead of unwinding infrastructure.