linux-kernel - BPF runtime for systemtap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <72b69807-4cd7-afab-0acd-51af8c76469e@redhat.com>
Date:	Tue, 14 Jun 2016 13:06:20 -0700
From:	Richard Henderson <rth@...hat.com>
To:	systemtap@...rceware.org
Cc:	iovisor-dev@...ts.iovisor.org,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: BPF runtime for systemtap

I'm pleased to be able to announce an initial implementation of an (e)bpf 
backend for systemtap.  For the subset of systemtap probes that can use 
kprobes, we can use a bpf filter instead of loading a kernel module.

As this implementation is young, there are a number of limitations.  Neither 
string nor stats types are supported.  Both require enhancements to the set of 
builtin functions supported in kernel.  The stap bpf loader still needs 
improvement with respect to its use of the event subsystem.

We're using the same intermediate file format that is supported by the llvm bpf 
backend.  I have some improvements to submit for the llvm bpf backend as well.

The code can be reviewed at

   git://sourceware.org/git/systemtap.git rth/bpf

r~