netdev - Capturing syscall arguments: `kprobe`, `kretprobe` or `tracepoint` or `raw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAMa4Cyh8EPOJUL6URov3Zh7cjo07j_zTfeS32p_ht0=4jRvCQg@mail.gmail.com>
Date:   Tue, 20 Aug 2019 16:26:31 +0600
From:   Tahsin Rahman <tahsin@...scode.com>
To:     netdev@...r.kernel.org
Subject: Capturing syscall arguments: `kprobe`, `kretprobe` or `tracepoint` or
 `raw_tracepoint` type programs

Hi,
I'm new to ebpf. I want to write an ebpf program that can trace the
syscall arguments and return values.
According to my research, I can do this using `kprobe`, `kretprobe` or
`tracepoint` or `raw_tracepoint` type of bpf programs.

- What factors should I consider when choosing one type of program over another?

- Is the main difference among them is performance benefits? I'd be
great help if one can point me to any documentations about the
performance difference among different types of ebpf programs.

- How can I benchmark these programs?

Thanks!