Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Correct the trusted pointer story in the docs. #88

Open
dylandreimerink opened this issue Nov 21, 2024 · 0 comments
Open

Correct the trusted pointer story in the docs. #88

dylandreimerink opened this issue Nov 21, 2024 · 0 comments

Comments

@dylandreimerink
Copy link
Collaborator

It seems the current docs surrounding BPF_PROG_TYPE_RAW_TRACEPOINT and https://docs.ebpf.io/linux/program-type/BPF_PROG_TYPE_TRACING/#raw-tracepoint is not quite accurate. The tp_raw elf section in fact is a fentry program that attaches like a tracepoint and its arguments are BTF aware.

This ties into kernel pointers(__kptr) / trusted pointer (__arg_trusted) such as the one returned by bpf_get_current_task_btf or bpf_cpumask_create.

And the arguments to certain program types being trusted and thus not requiring the usage of bpf_probe_read_kernel

static bool prog_args_trusted(const struct bpf_prog *prog)
{
	enum bpf_attach_type atype = prog->expected_attach_type;

	switch (prog->type) {
	case BPF_PROG_TYPE_TRACING:
		return atype == BPF_TRACE_RAW_TP || atype == BPF_TRACE_ITER;
	case BPF_PROG_TYPE_LSM:
		return bpf_lsm_is_trusted(prog);
	case BPF_PROG_TYPE_STRUCT_OPS:
		return true;
	default:
		return false;
	}
}

https://mozillazg.com/2022/06/ebpf-libbpf-btf-powered-enabled-raw-tracepoint-common-questions-en.html

We should make a concept page for the concept of these trusted pointers and correct some incorrect and missing info on related pages.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant