linux-kernel - Re: Draft 3 of bpf(2) man page for review

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <55B01535.4080809@plumgrid.com>
Date:	Wed, 22 Jul 2015 15:12:05 -0700
From:	Alexei Starovoitov <ast@...mgrid.com>
To:	"Michael Kerrisk (man-pages)" <mtk.manpages@...il.com>,
	Daniel Borkmann <daniel@...earbox.net>
Cc:	linux-man <linux-man@...r.kernel.org>,
	linux-kernel@...r.kernel.org, Silvan Jegen <s.jegen@...il.com>,
	Walter Harms <wharms@....de>
Subject: Re: Draft 3 of bpf(2) man page for review

On 7/22/15 1:10 PM, Michael Kerrisk (man-pages) wrote:
>         BPF  maps  are  a generic data structure for storage of different
>         data types.  A  user  process  can  create  multiple  maps  (with
>         key/value-pairs  being  opaque bytes of data) and access them via
>         file descriptors.  Differnt eBPF programs  can  access  the  same
>         maps  in  parallel.  It's up to the user process and eBPF program
>         to decide what they store inside maps.

typo in 'Different'

>     eBPF program types
>         By picking prog_type, the program author selects a set of  helper
>         functions that can be called from the eBPF program and the corre‐
>         sponding format of struct bpf_context (which  is  the  data  blob
>         passed  into  the eBPF program as the first argument).  For exam‐
>         ple,     programs     loaded     with     a     prog_type      of
>         BPF_PROG_TYPE_SOCKET_FILTER  may  call  the bpf_map_lookup_elem()
>         helper, whereas some other program  types  may  not  be  able  to
>         employ  this helper.  The set of functions available to eBPF pro‐
>         grams of a given type may increase in the future.

overall it's all correct, but today bpf_map_lookup_elem() is allowed
for all program types. May be change that to:
"BPF_PROG_TYPE_KPROBE may call the bpf_probe_read() helper"
since only type_kprobe programs can call it.
type_sockets/type_sched_* cannot.

>                The bpf_context argument is a pointer to a struct sk_buff.
>                Programs cannot access the fields of sk_buff directly.

Probably drop last sentence and replace 'sk_buff' with '__sk_buff'
in the first? Or for the first version we can drop both sentences.

The rest looks great. Thank you much!

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/