Kernel ABI Monitoring a...
summary
Kernel ABI tooling adds a CTF reader that extracts type info from vmlinux and modules, serializes it to a corpus and XML, and feeds existing comparators (abidiff/abidw). Using CTF cuts ABI extraction time from about 4m47s to ~70s on large binaries, produces much smaller type sections, and makes many forward-declaration vs full-definition changes invisible to reports. genksyms CRC checks still cause false positives; CTF plus a VM-level archive (VM Linux.ctfa) lets comparators prove true binary compatibility for modules.
AI-written summary · about
chapters (28)
- 0:00Introduction to ABI monitoring
- 1:07ABI validation tools overview
- 2:35CTF format and kernel integration
- 4:48Corpus generation with CTF
- 6:14API difference detection tools
- 8:07Performance comparison CTF vs DWARF
- 10:20Performance discussion and optimizations
- 11:23Diff algorithm limitations
- 13:08Android kernel ABI handling
- 15:36False positives in ABI checks
- 17:48CRC-based module compatibility
- 19:10Stable kernel API strategies
- 21:02CTF type deduplication behavior
- 22:24Forward declaration challenges
- 24:10CTF detection of ABI breaks
- 25:58CTF size and performance details
- 26:41Limitations of ABI breakage detection
- 27:22API attribute changes impact
- 28:49Calling convention stability
- 30:15ABI definition and debug info
- 31:40Embedding API-relevant metadata
- 32:43Section changes and ABI breaks
- 33:46Source-level attribution in reports
- 35:03Actionable ABI reports
- 36:49Section information in APIs
- 37:36Additional metadata considerations
- 38:22CRC limitations and GenKSim
- 40:09Alternative hashing strategies
related talks
39mWhat Is an ABI, and Why Should You Care?
35mRethinking Linux tools with Compact Debuginfo Formats
23mAlways present type information thanks to BPF: BTF- 39mWhat Is an ABI, and Why Should You Care?
45mWelcome Back & Remarks & Code Aware Services in the Service of Vulnerability Detection
40mImproving UAPI Compatibility Review with Automated Tooling
35mDeep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel
58mFineIBT Enhanced: Hardening Linux’s Microarchitectural Security on X86