rlane / ubpf

Userspace eBPF VM (main repo is https://github.com/iovisor/ubpf)

uBPF

Userspace eBPF VM

About

This project aims to create an Apache-licensed library for executing eBPF programs. The primary implementation of eBPF lives in the Linux kernel, but due to its GPL license it can't be used in many projects.

Linux documentation for the eBPF instruction set

Instruction set reference

This project includes an eBPF assembler, disassembler, interpreter, and JIT compiler for x86-64.

Building

Run make -C vm to build the VM. This produces a static library libubpf.a and a simple executable used by the testsuite. After building the library you can install using make -C vm install via either root or sudo.

Running the tests

To run the tests, you first need to build the vm code then use nosetests to execute the tests. Note: The tests have some dependencies that need to be present. See the .travis.yml for details.

Before running the test (assuming Debian derived distro)

sudo apt-get update
sudo apt-get -y install python python-pip python-setuptools python-wheel python-nose
python2 -m pip install --upgrade "pip<21.0"
python2 -m pip install -r requirements.txt
python2 -m pip install cpp-coveralls

Running the test

make -C vm COVERAGE=1
nosetests -v   # run tests

After running the test

coveralls --gcov-options '\-lp' -i $PWD/vm/ubpf_vm.c -i $PWD/vm/ubpf_jit_x86_64.c -i $PWD/vm/ubpf_loader.c

Compiling C to eBPF

You'll need Clang 3.7.

clang-3.7 -O2 -target bpf -c prog.c -o prog.o

You can then pass the contents of prog.o to ubpf_load_elf, or to the stdin of the vm/test binary.

Contributing

Please fork the project on GitHub and open a pull request. You can run all the tests with nosetests.

License

Copyright 2015, Big Switch Networks, Inc. Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0>.

ubpf's Issues

Micro-optimizations to interpreter performance

This is based on just a cursory look to the code so please feel free to reject this if you feel so.

The current interpreter seems to be using a switch-case dispatch mechanism. You can improve the performance a little by using better mechanisms like direct or in-line threaded dispatch as described here. It however needs compiler support for labels as values usage so you can probably use the switch-case as a fallback as well.

The kernel's eBPF interpreter is using that already and I took it for my experiments :)

Functions with char * arguments

I don't know if that is a limitation of the eBPF instruction set or a limitation of the ubpf virtual machine but seems that is not possible to load programs that use external functions that have arguments type char *. Clang can compile the programs correctly but when loaded the ubp_load_elf functions exits with the error: Fialed to load code: bad relocation type.

If it is not a limitation of the eBPF instruction set I could try to look into it.

Performance estimations

Hello!

Huge Thanks for your brilliant job! That's what I want ;) I would like to ask you about some performance estimations. Do you have they?