netdev - Re: [PATCH bpf-next v6 1/2] bpf: extend stackmap to save binary_build

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1f960b89-e8ef-7117-ac48-ec9a4159db84@iogearbox.net>
Date:   Wed, 14 Mar 2018 18:39:26 +0100
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Song Liu <songliubraving@...com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "ast@...nel.org" <ast@...nel.org>,
        "peterz@...radead.org" <peterz@...radead.org>
Cc:     Kernel Team <Kernel-team@...com>,
        "hannes@...xchg.org" <hannes@...xchg.org>,
        Teng Qin <qinteng@...com>
Subject: Re: [PATCH bpf-next v6 1/2] bpf: extend stackmap to save
 binary_build_id+offset instead of address

On 03/14/2018 06:36 PM, Song Liu wrote:
>> On Mar 14, 2018, at 10:23 AM, Song Liu <songliubraving@...com> wrote:
>>
>> Currently, bpf stackmap store address for each entry in the call trace.
>> To map these addresses to user space files, it is necessary to maintain
>> the mapping from these virtual address to symbols in the binary. Usually,
>> the user space profiler (such as perf) has to scan /proc/pid/maps at the
>> beginning of profiling, and monitor mmap2() calls afterwards. Given the
>> cost of maintaining the address map, this solution is not practical for
>> system wide profiling that is always on.
>>
>> This patch tries to solve this problem with a variation of stackmap. This
>> variation is enabled by flag BPF_F_STACK_BUILD_ID. Instead of storing
>> addresses, the variation stores ELF file build_id + offset.
>>
>> Build_id is
>> only meaningful for user stack. If a kernel stack is added to a stackmap
>> with BPF_F_STACK_BUILD_ID, it will automatically fallback to only store
>> ip (status == BPF_STACK_BUILD_ID_IP).
> 
> I forgot to delete the paragraph above. Please let me know if I should 
> resend (or it can be removed when you apply it).

We can fix it up when applying, no problem.

Thanks,
Daniel