linux-kernel - Re: bpf+tracing next steps. Was: [PATCH v9 tip 3/9] tracing: attach BPF programs to kprobes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 23 Mar 2015 18:27:38 +0900
From:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
To:	Alexei Starovoitov <ast@...mgrid.com>
CC:	Ingo Molnar <mingo@...nel.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Namhyung Kim <namhyung@...nel.org>,
	Arnaldo Carvalho de Melo <acme@...radead.org>,
	Jiri Olsa <jolsa@...hat.com>,
	"David S. Miller" <davem@...emloft.net>,
	Daniel Borkmann <daniel@...earbox.net>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	linux-api@...r.kernel.org, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: bpf+tracing next steps. Was: [PATCH v9 tip 3/9] tracing: attach
 BPF programs to kprobes

(2015/03/23 13:57), Alexei Starovoitov wrote:
> On 3/22/15 7:17 PM, Masami Hiramatsu wrote:
>> (2015/03/23 3:03), Alexei Starovoitov wrote:
>>
>>> User space tools that will compile ktap/dtrace scripts into bpf might
>>> use build-id for their own purpose, but that's a different discussion.
>>
>> Agreed.
>> I'd like to discuss it since kprobe event interface may also have same
>> issue.
> 
> I'm not sure what 'issue' you're seeing. My understanding is that
> build-ids are used by perf to associate binaries with their debug info
> and by systemtap to make sure that probes actually match the kernel
> they were compiled for. In bpf case it probably will be perf way only.

Ah, I see. So perftools can check the build-id if needed, right?

> Are you interested in doing something with bpf ? ;)

Of course :)

> I know that Jovi is working on clang-based front-end, He Kuang is doing
> something fancy and I'm going to focus on 'tcp instrumentation' once
> bpf+kprobes is in. I think these efforts will help us make it
> concrete and will establish a path towards bpf+tracepoints
> (debug tracepoints or trace markers) and eventual integration with perf.
> Here is the wish-list (for kernel and userspace) inspired by Brendan:
> - access to pid, uid, tid, comm, etc
> - access to kernel stack trace
> - access to user-level stack trace
> - kernel debuginfo for walking kernel structs, and accessing kprobe
> entry args as variables

perf probe can provide this to bpf.

> - tracing of uprobes
> - tracing of user markers

I'm working on the perf-cache which will also support SDT (based on Hemant Kumar's work).

> - user debuginfo for user structs and args

Ditto.

> - easy to use language
> - library of scripting features
> - nice one-liner syntax
> 
> I think there is a lot of interest in bpf+tracing and would be good to
> align the efforts.

Agreed :)

Thanks!

-- 
Masami HIRAMATSU
Software Platform Research Dept. Linux Technology Research Center
Hitachi, Ltd., Yokohama Research Laboratory
E-mail: masami.hiramatsu.pt@...achi.com


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/