linux-kernel - Re: [RFC][PATCH] tracepoint: Have tracepoints created with DECLARE_TRACE() have

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250423172721.54499dc4@gandalf.local.home>
Date: Wed, 23 Apr 2025 17:27:21 -0400
From: Steven Rostedt <rostedt@...dmis.org>
To: Andrii Nakryiko <andrii.nakryiko@...il.com>
Cc: LKML <linux-kernel@...r.kernel.org>, Linux Trace Kernel
 <linux-trace-kernel@...r.kernel.org>, Mathieu Desnoyers
 <mathieu.desnoyers@...icios.com>, Masami Hiramatsu <mhiramat@...nel.org>,
 Peter Zijlstra <peterz@...radead.org>, David Ahern <dsahern@...nel.org>,
 Juri Lelli <juri.lelli@...il.com>, Breno Leitao <leitao@...ian.org>,
 netdev@...r.kernel.org, Alexei Starovoitov <alexei.starovoitov@...il.com>,
 bpf@...r.kernel.org, Gabriele Monaco <gmonaco@...hat.com>
Subject: Re: [RFC][PATCH] tracepoint: Have tracepoints created with
 DECLARE_TRACE() have _tp suffix

On Wed, 23 Apr 2025 14:21:24 -0700
Andrii Nakryiko <andrii.nakryiko@...il.com> wrote:

> BPF by itself doesn't have any API to list tracepoints, so in that
> sense, no, BPF doesn't expose *the list* of those tracepoints. But the
> same can be said about kprobes or normal tracepoints. But it is
> allowed to attempt to attach to those tracepoints by just specifying
> their name as a string.
> 
> I guess I'm confused about what "accessing only from code within the
> kernel" means. In my mind BPF isn't really "code within the kernel",
> but we are getting into the philosophical area now :) I just wanted to
> point out that this is consumable/attachable with BPF just like any
> other tracepoint, so it's not just kernel/module code that can attach
> to them.

To continue the philosophical debate ;-) I'll argue that a BPF program runs
inside the kernel just like a module would. Hence, a BPF program is in
kernel space. In fact, from what I understand, that's the entire point of
BPF. To run in kernel space!

-- Steve