linux-kernel - Re: [PATCH 0/5] bpf: Add user-space-publisher ringbuffer map type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+khW7iBeAW9tzuZqVaafcAFQZhNwjdEBwE8C-zAaq8gkyujFQ@mail.gmail.com>
Date:   Mon, 15 Aug 2022 14:13:13 -0700
From:   Hao Luo <haoluo@...gle.com>
To:     David Vernet <void@...ifault.com>
Cc:     bpf@...r.kernel.org, ast@...nel.org, daniel@...earbox.net,
        andrii@...nel.org, john.fastabend@...il.com, martin.lau@...ux.dev,
        song@...nel.org, yhs@...com, kpsingh@...nel.org, sdf@...gle.com,
        jolsa@...nel.org, tj@...nel.org, joannelkoong@...il.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 0/5] bpf: Add user-space-publisher ringbuffer map type

On Tue, Aug 9, 2022 at 6:15 PM David Vernet <void@...ifault.com> wrote:
>
> Hi Hao,
>
> On Mon, Aug 08, 2022 at 11:57:53AM -0700, Hao Luo wrote:
> > > Note that one thing that is not included in this patch-set is the ability
> > > to kick the kernel from user-space to have it drain messages. The selftests
> > > included in this patch-set currently just use progs with syscall hooks to
> > > "kick" the kernel and have it drain samples from a user-producer
> > > ringbuffer, but being able to kick the kernel using some other mechanism
> > > that doesn't rely on such hooks would be very useful as well. I'm planning
> > > on adding this in a future patch-set.
> > >
> >
> > This could be done using iters. Basically, you can perform draining in
> > bpf_iter programs and export iter links as bpffs files. Then to kick
> > the kernel, you simply just read() the file.
>
> Thanks for pointing this out. I agree that iters could be used this way to
> kick the kernel, and perhaps that would be a sufficient solution. My
> thinking, however, was that it would be useful to provide some APIs that
> are a bit more ergonomic, and specifically meant to enable kicking
> arbitrary "pre-attached" callbacks in a BPF prog, possibly along with some
> payload from userspace.

David, very sorry about the late reply. Thank you for sharing your
thoughts. I am looking at your v2 and understand you need a way to
trigger the kernel to consume samples in the ringbuf, which seems a
reasonable motivation to me.

>
> Iters allow userspace to kick the kernel, but IMO they're meant to enable
> data extraction from the kernel, and dumping kernel data into user-space.

Not necessarily extracting data and dumping data. It could be used to
do operations on a set of objects, the operation could be
notification. Iterating and notifying are orthogonal IMHO.

> What I'm proposing is a more generalizable way of driving logic in the
> kernel from user-space.
> Does that make sense? Looking forward to hearing your thoughts.

Yes, sort of. I see the difference between iter and the proposed
interface. But I am not clear about the motivation of a new APis for
kicking callbacks from userspace. I guess maybe it will become clear,
when you publish a concerte RFC of that interface and integrates with
your userspace publisher.

Hao