linux-kernel - Re: [RFC PATCH v3 06/37] bpf tools: Introduce 'bpf' library to tools

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 19 May 2015 22:24:39 -0700
From:	Alexei Starovoitov <ast@...mgrid.com>
To:	"Wangnan (F)" <wangnan0@...wei.com>, paulus@...ba.org,
	a.p.zijlstra@...llo.nl, mingo@...hat.com, acme@...nel.org,
	namhyung@...nel.org, jolsa@...nel.org, dsahern@...il.com,
	daniel@...earbox.net, brendan.d.gregg@...il.com,
	masami.hiramatsu.pt@...achi.com
CC:	lizefan@...wei.com, linux-kernel@...r.kernel.org, pi3orama@....com
Subject: Re: [RFC PATCH v3 06/37] bpf tools: Introduce 'bpf' library to tools

On 5/19/15 8:48 PM, Wangnan (F) wrote:
>
>>> +
>>> +# Version of eBPF elf file
>>> +FILE_VERSION = 1
>>
>> what that comment suppose to mean?
>
> The format of eBPF objects can be improved in futher. A version number
> here is the precaution of backward compatibility. However this patch
> doesn't
> utilize it.
>
> I'd like to append a 'format' section into eBPF object format to let
> libbpf know
> the version of the object. What do you think?

I don't think it will help.
Version number is quite inconvenient.
perf_event_attr and bpf_attr are using 'size' instead, since the only
way keep to backward compatibility is to force new additions to preserve
old fields. The notion that 'new version number can start fresh' doesn't
really work, because it means duplicated code. In this case, in libbpf.
I don't think we want 'if (elf_version == X) parse sections this way'
type of code. iproute2 already reserved 'classifier' and 'action'
names and I think 'kprobe' and 'socket' are good enough prefixes for
BPF_PROG_TYPE_KPROBE and BPF_PROG_TYPE_SOCKET_FILTER programs as well.
So the prefix to indicate the program type is already settled.
What comes after the prefix is tbd.
I proposed 'kprobe/perform_write(void*, void*, long long)'
style for vmlinux without debug info and
'kprobe/perform_write+122(file->f_mapping->a_ops, bytes, offset)'
with debug. It looks flexible enough and can be extended with
new features later.
I don't think 'config', 'format' sections are needed.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/