Do eBPF programming restrictions still apply?

[manuschillerdev]

Thanks for your great talk here at KubeCon!
eBPF has some programming restrictions that makes it safe for kernel use cases (eg no infinite loops).

if I got it correctly the eBPF module calls into a wasm module via a kfunc. Is this a blocking process? Could the wasm module potentially execute an infinite loop and circumvent the security restrictions for eBPF Modules?

[bonifaido]

Hi @manuschillerdev,

Thank you! And thanks for the question!

Yes, currently this is currently the case, and yes, they are also blocking. So as like kernel functions needs to be thoroughly reviewed before becoming exposed as kfuncs, authors of Wasm modules are also required to do so, however as the tooling around Webassembly continuously evolves I hope this will become more straightforward to check in the future.

On the other hand, the current Wasm runtime we use, which is Wasm3 has the notion of Gas, which is something related to deterministic execution, see: https://github.com/ewasm/design/blob/master/metering.md

I think we could piggyback on this functionality to overcome this, mot probably some code changes are needed in the current module to be able to use this properly, but it something that I'm eager to work on.

Also the inserted Wasm module has to be injected with metering, as the demo says here: https://github.com/wasm3/wasm3/blob/7890a2097569fde845881e0b352d813573e371f9/platforms/app/main.c#L28

[manuschillerdev]

super interesting! Thanks for taking the time for the detailed explanation!