Lecture: BPF

Read the BPF and XDP Reference Guide

The following questions are optional.

Question

Recall the RISC-V instructions auipc and jalr from the base ISA manual. They are often used as a pair to form a 32-bit PC-relative jump:

auipc t1,imm20
jalr  ra,imm12(t1)

Can you use the pair with some imm20/imm12 values to jump to offset 0x7ffffffc (2³¹ - 4) on 64-bit RISC-V? Briefly explain why or why not.

Question

Consider the BPF JIT for 64-bit RISC-V for the BPF_ALU | BPF_ADD | BPF_X instruction (32-bit reg-reg add: DST = (u64)((u32)DST + (u32)SRC)). Is emit_zext_32 at line 471 needed? Briefly explain why or why not.

overview

goal
- downloading user code into the kernel for extensibility
- compare to alternatives: upcall to user space, kernel module
  - performance
  - security
  - deployment
history
- “packet filter”: Xerox Alto, 1970s
- BPF, 1993
- (extended) BPF in the Linux kernel, since 2014
workflow
- application developers
  - write a BPF program in bytecode directly
  - or, write a C program and compile it to BPF bytecode (see examples)
- submit it to the kernel (e.g., the bpf syscall)
- the kernel invokes the BPF verifier for sanity check
  - example checks
    - no division by zero
    - no out-of-bounds memory access
    - no unbounded loops
  - trade-offs
    - reject legit programs (false positive) vs. complexity: safe but inconvenient (e.g., a verifier that rejects all BPF programs)
    - accept erroneous programs (false negative): bugs, often have serious security implications (e.g., CVE-2020-8835)
- execution: attach BPF program to hook points in the kernel
  - option 1: run the BPF interpreter: simple & slow, but disabled nowadays by default due to the concerns about the Spectre attacks
  - option 2: run a just-in-time (JIT) compiler to translate BPF programs to machine code and attach machine code instead

JIT compilation

BPF JIT for RISC-V
- goal: implement BPF instructions using RISC-V instructions
- be careful about the semantic gap