netdev - Re: [PATCH bpf-next v5 0/3] add support for writable bare tracepoint

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211004104629.668cadeb@gandalf.local.home>
Date:   Mon, 4 Oct 2021 10:46:29 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Hou Tao <hotforest@...il.com>
Cc:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Yonghong Song <yhs@...com>, Martin KaFai Lau <kafai@...com>,
        Ingo Molnar <mingo@...hat.com>, netdev@...r.kernel.org,
        bpf@...r.kernel.org, houtao1@...wei.com
Subject: Re: [PATCH bpf-next v5 0/3] add support for writable bare
 tracepoint

On Mon,  4 Oct 2021 17:48:54 +0800
Hou Tao <hotforest@...il.com> wrote:

> The main idea comes from patchset "writable contexts for bpf raw
> tracepoints" [1], but it only supports normal tracepoint with
> associated trace event under tracefs. Now we have one use case
> in which we add bare tracepoint in VFS layer, and update
> file::f_mode for specific files. The reason using bare tracepoint
> is that it doesn't form a ABI and we can change it freely. So
> add support for it in BPF.

Are the VFS maintainers against adding a trace event with just a pointer as
an interface?

That is, it only gives you a pointer to what is passed in, but does not
give you anything else to form any API against it.

This way, not only does BPF have access to this information, so do the
other tracers, through the new eprobe interface:

  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/Documentation/trace?id=7491e2c442781a1860181adb5ab472a52075f393

(I just realized we are missing updates to the Documentation directory).

event probes allows one to attach to an existing trace event, and then
create a new trace event that can read through pointers. It uses the same
interface that kprobes has.

Just adding trace events to VFS that only have pointers would allow all of
BPF, perf and ftrace access as eprobes could then get the data you are
looking for.

-- Steve