lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 15 Aug 2014 12:02:51 -0700
From:	Andy Lutomirski <>
To:	Alexei Starovoitov <>
Cc:	Daniel Borkmann <>,
	"H. Peter Anvin" <>,
	Andrew Morton <>,
	Linux API <>,
	Chema Gonzalez <>,
	Eric Dumazet <>,
	"David S. Miller" <>,
	Brendan Gregg <>,
	Linus Torvalds <>,
	Steven Rostedt <>,
	LKML <>,
	Peter Zijlstra <>,
	Kees Cook <>,
	Network Development <>,
	Ingo Molnar <>
Subject: Re: [PATCH RFC v4 net-next 17/26] tracing: allow eBPF programs to be
 attached to events

On Fri, Aug 15, 2014 at 11:56 AM, Alexei Starovoitov <> wrote:
> On Fri, Aug 15, 2014 at 11:50 AM, Andy Lutomirski <> wrote:
>> On Aug 15, 2014 10:36 AM, "Alexei Starovoitov" <> wrote:
>>> On Fri, Aug 15, 2014 at 10:20 AM, Andy Lutomirski <> wrote:
>>> > The downside of this approach is that compat support might be
>>> > difficult or impossible.
>>> Would do you mean by compat? 32-bit programs on 64-bit kernels?
>>> There is no such concept for eBPF. All eBPF programs are always
>>> operating on 64-bit registers.
>> Doesn't the eBPF program need to know sizeof(long) to read these
>> fields correctly?  Or am I misunderstanding what the code does?
> correct. eBPF program would be using 8-byte read on 64-bit kernel
> and 4-byte read on 32-bit kernel. Same with access to ptrace fields
> and pretty much all other fields in the kernel. The program will be
> different on different kernels.
> Say, this bpf_context struct doesn't exist at all. The programs would
> still need to be different to walk in-kernel data structures...

Hmm.  I guess this isn't so bad.

What's the actual difficulty with using u64?  ISTM that, if the clang
front-end can't deal with u64, there's a bigger problem.  Or is it
something else I don't understand.

To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists