On Tue, Dec 15, 2020 at 4:50 AM Gilad Reti <gilad.reti@xxxxxxxxx> wrote: > > On Tue, Dec 15, 2020 at 3:26 AM Andrii Nakryiko > <andrii.nakryiko@xxxxxxxxx> wrote: > > > > On Mon, Dec 14, 2020 at 1:58 AM Gilad Reti <gilad.reti@xxxxxxxxx> wrote: > > > > > > Hello there, > > > libbpf provides BPF_CORE_READ macros for reading struct members in a > > > CO-RE compatible way. By default those macros reduct to the relevant > > > bpf_probe_read_kernel functions. As far as I could tell, there are no > > > variants of this macros that wrap the _user variants of the read > > > functions. Are there any plans to support ones? > > > > BPF_CORE_READ() are using BPF CO-RE and thus emit relocations, which > > will be adjusted by libbpf to match kernel struct layouts by using > > kernel's BTF(s). Because of this, having xxx_user() variants doesn't > > make much sense, because libbpf can't relocate field offsets against > > user-space types (as there is no BTF for user-space applications, > > typically). Which is why there are no BPF_CORE_READ_USER()-like > > macros. > > > > What's your use case, though? There might be a valid one that we are > > not aware of, so please provide more details. Thanks. > Currently my use case is tracing syscall pointer arguments (For > example, "connect" has a "struct sockaddr *" argument). So if it's a kernel-defined data structure provided from user-space, then it has to be part of a stable UAPI type definitions, right? In such a case, you shouldn't need CO-RE, because the layout is stable. So it's still unclear why you'd need BPF_CORE_READ for that?.. Or is it because of the convenience of doing BPF_CORE_READ(s, field1, field2, field3) instead of a sequence of bpf_probe_read_user() calls? That's a different angle of BPF_CORE_READ() and we should clarify the desired functionality you are looking for. > > > > > Thanks, > > > Gilad Reti.
