On Wed, Aug 18, 2021 at 4:42 PM Daniel Xu <dxu@xxxxxxxxx> wrote: > > The motivation behind this helper is to access userspace pt_regs in a > kprobe handler. > > uprobe's ctx is the userspace pt_regs. kprobe's ctx is the kernelspace > pt_regs. bpf_task_pt_regs() allows accessing userspace pt_regs in a > kprobe handler. The final case (kernelspace pt_regs in uprobe) is > pretty rare (usermode helper) so I think that can be solved later if > necessary. > > More concretely, this helper is useful in doing BPF-based DWARF stack > unwinding. Currently the kernel can only do framepointer based stack > unwinds for userspace code. This is because the DWARF state machines are > too fragile to be computed in kernelspace [0]. The idea behind > DWARF-based stack unwinds w/ BPF is to copy a chunk of the userspace > stack (while in prog context) and send it up to userspace for unwinding > (probably with libunwind) [1]. This would effectively enable profiling > applications with -fomit-frame-pointer using kprobes and uprobes. > > [0]: https://lkml.org/lkml/2012/2/10/356 > [1]: https://github.com/danobi/bpf-dwarf-walk > > Signed-off-by: Daniel Xu <dxu@xxxxxxxxx> > --- Seems like a really useful thing. Few notes: 1. Given this is user pt_regs, should we call it bpf_get_user_pt_regs()? 2. Would it be safe to enable it for all types of programs, not just kprobe/tp/raw_tp/perf? Why limit the list? 3. It seems like it's the sixth declaration of BTF_ID for task_struct, maybe it's time to consolidate them? > include/uapi/linux/bpf.h | 7 +++++++ > kernel/trace/bpf_trace.c | 20 ++++++++++++++++++++ > tools/include/uapi/linux/bpf.h | 7 +++++++ > 3 files changed, 34 insertions(+) [...]
