In the setting eBPF is used today, most of the value of the verifier is that it's hard to accidentally crash your kernel with a bad eBPF program. That is comically untrue about an ordinary LKM.
And, of course, root -> ring0 is less of a problem with unprivileged user namespaces where you can make yourself "root", as we've seen in every eBPF bug PoC since distros started turning that on (and have since turned it off again, mostly)
Verifier bugs don't matter that much, for most Linux users, right now, because unprivileged accounts can't use eBPF.
Does the limited flexibility it provides really justify the added kernel space complexity? I can understand it for packet filtering but some of the other stuff it's used for like sandboxing just isn't convincing.
You may not use it much, but some people use it all day. I think FAANG engineers have said that they run tens (hundreds?) of these things on all servers, all the time. And that's excluding one-offs. And FAANG has full time kernel coders on staff, so they're also funding this complexity that they use.
But also yes, I've solved problems by using eBPF. Problems that are basically unsolvable by non-kernel-gurus without eBPF. I rarely need it. But when I need it, there's nothing else that does the trick.
In some cases, even for kernel gurus, it's a choice between eBPF or maintaining a custom kernel patch forever.
To add on this point: I successfully used SystemTap a few years ago to debug an issue i was having.
Before going further: keep in mind that my point of view (at the time) was the one of somebody working as a devops engineer, debugging some annoyances with containers (managed by Kubernetes) going OOM. I'm no kernel developer and I have a basic-good understanding of the C language based on first-years university course and geekyness/nerdyness. So in this context I'm a glorified hobbyist.
Learning SystemTap is easier in my opinion. I followed a tutorial by RedHat to get the hang of the manual parts but after that I remember being fairly easy:
1. Try to reproduce the issue you're having (fairly easy for me)
2. Skim the source code of the linux about the part that you think might be relevant (for me it was the oom killer)
3. Add probes in there, see if they fire when you reproduce the issue
4. Look back at the source code of the kernel and see what chain of data structures and fields you can follow to reach the piece of information you need
5. Improve your probes
6. If successful, you're done
7. Goto 4
I think it took like one or two days between following the tutorial and getting a working probe.
It was a pleasant couple of days.
The additional flexibility eBPF gets from this is amazing really. While dtrace is a more-targeted (and for its intended usecases, in some situations still superior to eBPF) but also less-general tool.
(citrus vs. stone fruit ...)
Would you mind giving some examples? I recently started learning about ebpf's from Liz Rice's book and is curious about what makes ebpf the correct choice in a particular scenario.
Literally "One not is none", aka "One is not none".
Checking out the Royal Spanish Academy, here's what they say about it:
https://www.rae.es/espanol-al-dia/doble-negacion-no-vino-nad...
> The so-called "double negation" is due to the obligatory negative agreement that must be established in Spanish, and other Romance languages, in certain circumstances (see New Grammar, § 48.3d), which results in the joint presence in the statement of the adverb no and other elements that also have a negative meaning.
> The concurrence of these two "negations" does not annul the negative meaning of the statement.
In any case, the meaning of the sentence above: "uno no es ninguno" in Spanish is clearly one is not zero, or one is not none, or one is different than none.
"Uno no es nada" could be "one is nothing", and "one is not nothing". It all depends on the frame of reference (in this case English), but for this sentence, the "one is not none" is correct IMO. I would never even do a second pass on that sentence, as a native Spanish speaker (appeal to authority, I know)
I believe that translates to "One is not none"
https://bughunters.google.com/blog/6303226026131456/a-deep-d...
https://spanish.stackexchange.com/questions/26777/how-does-d...
