netdev - Re: [PATCH bpf-next v5 0/3] add support for writable bare tracepoint

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20211011103442.2ce9fab7@gandalf.local.home>
Date:   Mon, 11 Oct 2021 10:34:42 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Hou Tao <houtao1@...wei.com>
Cc:     Hou Tao <hotforest@...il.com>, Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Yonghong Song <yhs@...com>, Martin KaFai Lau <kafai@...com>,
        Ingo Molnar <mingo@...hat.com>, <netdev@...r.kernel.org>,
        <bpf@...r.kernel.org>
Subject: Re: [PATCH bpf-next v5 0/3] add support for writable bare
 tracepoint

On Sat, 9 Oct 2021 20:07:10 +0800
Hou Tao <houtao1@...wei.com> wrote:

> Not tried yet, but considering that VFS maintainer refused to have tracepoint in
> VFS layer, I'm not sure it is worth trying.

The reason they refuse to is because it shows data that can become an API.
But if that data is just a pointer, then it's not possible to become an API
no more than a RAW tracepoint that BPF can hook to.

Try asking.

> >
> > That is, it only gives you a pointer to what is passed in, but does not
> > give you anything else to form any API against it.
> > This way, not only does BPF have access to this information, so do the
> > other tracers, through the new eprobe interface:  
> Or in a opposite way can eprobe add support for bare tracepoint ?

If there's a way to expose the parameters of a bare tracepoint, then it
should not be difficult to do so. Heck, we can just have "bare tracepoints"
be events, that do nothing but repeat their pointer parameters, as that's
basically all they do anyway. There's nothing fundamentally different
between a "bare tracepoint" and a trace event that just defines the fields
as the same as the parameters to a tracepoint, except now you have another
way to know what the parameters are.

-- Steve