linux-kernel - Re: [RFC PATCH v3 06/37] bpf tools: Introduce 'bpf' library to tools

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 21 May 2015 08:24:03 +0800
From:	"Wangnan (F)" <wangnan0@...wei.com>
To:	Alexei Starovoitov <ast@...mgrid.com>, <paulus@...ba.org>,
	<a.p.zijlstra@...llo.nl>, <mingo@...hat.com>, <acme@...nel.org>,
	<namhyung@...nel.org>, <jolsa@...nel.org>, <dsahern@...il.com>,
	<daniel@...earbox.net>, <brendan.d.gregg@...il.com>,
	<masami.hiramatsu.pt@...achi.com>
CC:	<lizefan@...wei.com>, <linux-kernel@...r.kernel.org>,
	<pi3orama@....com>
Subject: Re: [RFC PATCH v3 06/37] bpf tools: Introduce 'bpf' library to tools



在 2015/5/20 13:24, Alexei Starovoitov 写道:
> On 5/19/15 8:48 PM, Wangnan (F) wrote:
>>
>>>> +
>>>> +# Version of eBPF elf file
>>>> +FILE_VERSION = 1
>>>
>>> what that comment suppose to mean?
>>
>> The format of eBPF objects can be improved in futher. A version number
>> here is the precaution of backward compatibility. However this patch
>> doesn't
>> utilize it.
>>
>> I'd like to append a 'format' section into eBPF object format to let
>> libbpf know
>> the version of the object. What do you think?
>
> I don't think it will help.
> Version number is quite inconvenient.
> perf_event_attr and bpf_attr are using 'size' instead, since the only
> way keep to backward compatibility is to force new additions to preserve
> old fields. The notion that 'new version number can start fresh' doesn't
> really work, because it means duplicated code. In this case, in libbpf.
> I don't think we want 'if (elf_version == X) parse sections this way'
> type of code. 


> iproute2 already reserved 'classifier' and 'action'
> names and I think 'kprobe' and 'socket' are good enough prefixes for
> BPF_PROG_TYPE_KPROBE and BPF_PROG_TYPE_SOCKET_FILTER programs as well.

Do you think we should classify kprobe/socket programs in libbpf layer 
instead of perf?

In my current implementation, type of a program is determined by perf by 
parsing names of
corresponding sections. Format of section names should be part of 
interface between perf
(and iproute2 and others) and eBPF programs. What libbpf should do is to 
fetch those
names and give them to caller, let caller decide the type of programs. 
Therefore, if
the program is written for perf, writer of program even don't need to 
think about
kprobe/socket program type since in perf currently we can only use 
kprobe program.

(Currently "config" section is special, but as you suggested I decide to 
drop it in next version.)

> So the prefix to indicate the program type is already settled.
> What comes after the prefix is tbd.
> I proposed 'kprobe/perform_write(void*, void*, long long)'
> style for vmlinux without debug info and
> 'kprobe/perform_write+122(file->f_mapping->a_ops, bytes, offset)'
> with debug. It looks flexible enough and can be extended with
> new features later.

Now section name has similary format as 'perf probe' because I think by 
doing this we can avoid
inventing a new syntax for eBPF programs. What do you think?

> I don't think 'config', 'format' sections are needed.
>

You won't see them in v4 :)

Thank you.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/