Re: [PATCH RFC v4 net-next 17/26] tracing: allow eBPF programs to be attached to events

On Fri, Aug 15, 2014 at 11:56 AM, Alexei Starovoitov [off-list ref] wrote:

On Fri, Aug 15, 2014 at 11:50 AM, Andy Lutomirski [off-list ref] wrote:

quoted

On Aug 15, 2014 10:36 AM, "Alexei Starovoitov" [off-list ref] wrote:

quoted

On Fri, Aug 15, 2014 at 10:20 AM, Andy Lutomirski [off-list ref] wrote:

quoted

The downside of this approach is that compat support might be
difficult or impossible.

Would do you mean by compat? 32-bit programs on 64-bit kernels?
There is no such concept for eBPF. All eBPF programs are always
operating on 64-bit registers.

Doesn't the eBPF program need to know sizeof(long) to read these
fields correctly?  Or am I misunderstanding what the code does?

correct. eBPF program would be using 8-byte read on 64-bit kernel
and 4-byte read on 32-bit kernel. Same with access to ptrace fields
and pretty much all other fields in the kernel. The program will be
different on different kernels.
Say, this bpf_context struct doesn't exist at all. The programs would
still need to be different to walk in-kernel data structures...

Hmm.  I guess this isn't so bad.

What's the actual difficulty with using u64?  ISTM that, if the clang
front-end can't deal with u64, there's a bigger problem.  Or is it
something else I don't understand.

--Andy