netdev - Re: [PATCH] samples/bpf: make xdp_monitor use raw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEf4BzacEF0Ga921DCuYCVTxR4rFdOzmRt5o0T7HH-H38gEccg@mail.gmail.com>
Date:   Tue, 15 Oct 2019 21:05:18 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Jesper Dangaard Brouer <brouer@...hat.com>
Cc:     Eric Sage <eric@...e.org>, Networking <netdev@...r.kernel.org>,
        bpf <bpf@...r.kernel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        xdp-newbies@...r.kernel.org, brouer@...hat.org,
        Alexei Starovoitov <ast@...nel.org>,
        Jiri Olsa <jolsa@...hat.com>
Subject: Re: [PATCH] samples/bpf: make xdp_monitor use raw_tracepoints

On Mon, Oct 7, 2019 at 2:00 AM Jesper Dangaard Brouer <brouer@...hat.com> wrote:
>
>
> On Mon,  7 Oct 2019 04:57:26 +0000 Eric Sage <eric@...e.org> wrote:
>
> > raw_tracepoints are an eBPF alternative to standard tracepoints which
> > attach to a tracepoint without the perf layer being executed, making
> > them faster.
> >
> > Since xdp_monitor is supposed to have as little impact on the system as
> > possible it is switched to using them by append raw_ to the SEC names.
> >
> > There was also a small issues with 'samples/bpf/bpf_load' - it was
> > loading the raw_tracepoints with the tracing subsystem name still
> > attached, which the bpf syscall rejects with a No such file or directory
> > error. This is now fixed.
> >
> > Signed-off-by: Eric Sage <eric@...e.org>
> > ---
> >  samples/bpf/bpf_load.c         |  5 +++--
> >  samples/bpf/xdp_monitor_kern.c | 26 +++++++++++++-------------
> >  2 files changed, 16 insertions(+), 15 deletions(-)
>
> If there is an issue in the loader 'samples/bpf/bpf_load.c' then we
> should of-cause fix it, but you should be aware that we are in general
> trying to deprecate this loader, and we want to convert users over to
> libbpf.
>
> This patch seems like a good first step forward.  Longer term, I would
> like to see this converted into using libbpf.  The library are missing
> attach helpers for regular tracepoints, but for raw_tracepoints it does
> contain bpf_raw_tracepoint_open().

libbpf has both bpf_program__attach_tracepoint() and
bpf_program__attach_raw_tracepoint(), please use them, not lower-level
bpf_raw_tracepoint_open(). See selftests/bpf/prog_tests/attach_probe.c
for examples.

>
> You can see an example of how xdp_monitor have been converted into
> using libbpf and raw_tracepoints here (by Jiri Olsa):
>
>  https://github.com/xdp-project/xdp-tutorial/blob/master/tracing02-xdp-monitor/trace_prog_kern.c
>
>

[...]