On Tue, Dec 15, 2020 at 12:44 PM Gilad Reti <gilad.reti@xxxxxxxxx> wrote: > > On Tue, Dec 15, 2020 at 8:47 PM Andrii Nakryiko > <andrii.nakryiko@xxxxxxxxx> wrote: > > > > On Tue, Dec 15, 2020 at 4:50 AM Gilad Reti <gilad.reti@xxxxxxxxx> wrote: > > > > > > On Tue, Dec 15, 2020 at 3:26 AM Andrii Nakryiko > > > <andrii.nakryiko@xxxxxxxxx> wrote: > > > > > > > > On Mon, Dec 14, 2020 at 1:58 AM Gilad Reti <gilad.reti@xxxxxxxxx> wrote: > > > > > > > > > > Hello there, > > > > > libbpf provides BPF_CORE_READ macros for reading struct members in a > > > > > CO-RE compatible way. By default those macros reduct to the relevant > > > > > bpf_probe_read_kernel functions. As far as I could tell, there are no > > > > > variants of this macros that wrap the _user variants of the read > > > > > functions. Are there any plans to support ones? > > > > > > > > BPF_CORE_READ() are using BPF CO-RE and thus emit relocations, which > > > > will be adjusted by libbpf to match kernel struct layouts by using > > > > kernel's BTF(s). Because of this, having xxx_user() variants doesn't > > > > make much sense, because libbpf can't relocate field offsets against > > > > user-space types (as there is no BTF for user-space applications, > > > > typically). Which is why there are no BPF_CORE_READ_USER()-like > > > > macros. > > > > > > > > What's your use case, though? There might be a valid one that we are > > > > not aware of, so please provide more details. Thanks. > > > Currently my use case is tracing syscall pointer arguments (For > > > example, "connect" has a "struct sockaddr *" argument). > > > > So if it's a kernel-defined data structure provided from user-space, > > then it has to be part of a stable UAPI type definitions, right? In > > such a case, you shouldn't need CO-RE, because the layout is stable. > > So it's still unclear why you'd need BPF_CORE_READ for that?.. > I may be completely off, but can't struct offsets and members change > across different architectures? Hm.. that's an interesting angle, certainly across 32-bit and 64-bit architectures UAPI structs can have different layouts and it's possible to write and compile a single BPF program that would work on both. You'll most likely still have to compile twice (once for each architecture) due to the user-space part. But I think there is a use case or BPF_CORE_READ_USER() macro, so I don't mind adding it, let's just figure out the best way to do this. Thanks for elaborating! > > > > > > Or is it because of the convenience of doing BPF_CORE_READ(s, field1, > > field2, field3) instead of a sequence of bpf_probe_read_user() calls? > > That's a different angle of BPF_CORE_READ() and we should clarify the > > desired functionality you are looking for. > > > > > > > > > > > > > Thanks, > > > > > Gilad Reti.
