netdev - Re: [RFC PATCH bpf-next 0/3] bpf: add tracing for XDP programs using the BPF_PROG_TEST

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 28 Apr 2020 09:19:47 -0300
From:   Arnaldo Carvalho de Melo <arnaldo.melo@...il.com>
To:     Eelco Chaudron <echaudro@...hat.com>
Cc:     Alexei Starovoitov <alexei.starovoitov@...il.com>,
        Yonghong Song <yhs@...com>, bpf <bpf@...r.kernel.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        "David S. Miller" <davem@...emloft.net>,
        Network Development <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>,
        Andrii Nakryiko <andriin@...com>
Subject: Re: [RFC PATCH bpf-next 0/3] bpf: add tracing for XDP programs using
 the BPF_PROG_TEST_RUN API

Em Tue, Apr 28, 2020 at 12:47:53PM +0200, Eelco Chaudron escreveu:
> On 28 Apr 2020, at 6:04, Alexei Starovoitov wrote:
> > On Fri, Apr 24, 2020 at 02:29:56PM +0200, Eelco Chaudron wrote:

> > > > But in reality I think few kprobes in the prog will be enough to
> > > > debug the program and XDP prog may still process millions of
> > > > packets because your kprobe could be in error path and the user
> > > > may want to capture only specific things when it triggers.

> > > > kprobe bpf prog will execute in such case and it can capture
> > > > necessary state from xdp prog, from packet or from maps that xdp
> > > > prog is using.

> > > > Some sort of bpf-gdb would be needed in user space.  Obviously
> > > > people shouldn't be writing such kprob-bpf progs that debug
> > > > other bpf progs by hand. bpf-gdb should be able to generate them
> > > > automatically.

> > > See my opening comment. What you're describing here is more when
> > > the right developer has access to the specific system. But this
> > > might not even be possible in some environments.

> > All I'm saying that kprobe is a way to trace kernel.
> > The same facility should be used to trace bpf progs.
 
> perf doesn’t support tracing bpf programs, do you know of any tools that
> can, or you have any examples that would do this?

I'm discussing with Yonghong and Masami what would be needed for 'perf
probe' to be able to add kprobes to BPF jitted areas in addition to
vmlinux and modules.

- Arnaldo