Edward Cree <ecree@xxxxxxxxxxxxxx> writes: > On 14/10/2019 19:48, Toke Høiland-Jørgensen wrote: >> So that will end up with a single monolithic BPF program being loaded >> (from the kernel PoV), right? That won't do; we want to be able to go >> back to the component programs, and manipulate them as separate kernel >> objects. > Why's that? (Since it also applies to the static-linking PoC I'm > putting together.) What do you gain by having the components be > kernel-visible? Because then userspace will have to keep state to be able to answer questions like "show me the list of programs that are currently loaded (and their call chain)", or do operations like "insert this program into the call chain at position X". We already keep all this state in the kernel, so replicating it all in userspace means both a lot of extra work to implement that functionality, and having to deal with the inevitable fallout when the userspace and kernel space state get out of sync... -Toke
