On Fri, Sep 3, 2021 at 5:31 AM Jean-Philippe Brucker
<jean-philippe@xxxxxxxxxx> wrote:
>
> On Thu, Sep 02, 2021 at 12:13:40PM -0700, Alexei Starovoitov wrote:
> > On Thu, Sep 2, 2021 at 2:08 AM Jean-Philippe Brucker
> > <jean-philippe@xxxxxxxxxx> wrote:
> > >
> > > struct pt_regs is not exported to userspace on all archs. arm64 and s390
> > > export "user_pt_regs" instead, which causes build failure at the moment:
> > >
> > > progs/test_task_pt_regs.c:8:16: error: variable has incomplete type 'struct pt_regs'
> > > struct pt_regs current_regs = {};
> >
> > Right, which is 'bpf_user_pt_regs_t'.
> > It's defined for all archs and arm64/s390/ppc/risv define it
> > differently from pt_regs.
> >
> > >
> > > Use the multi-arch macros defined by tools/lib/bpf/bpf_tracing.h to copy
> > > the pt_regs into a locally-defined struct.
> > >
> > > Copying the user_pt_regs struct on arm64 wouldn't work because the
> > > struct is too large and the compiler complains about using too much
> > > stack.
> >
> > That's a different issue.
>
> It does work when doing an implicit copy (current_regs = *regs) rather
> than using __builtin_memcpy(). Don't know why but I'll take it.
>
> > I think the cleaner fix would be to make the test use
> > bpf_user_pt_regs_t instead.
>
> Right, although that comes with another complication. We end up including
> tools/include/uapi/asm/bpf_perf_event.h which requires the compiler
> builtins "__aarch64__", "__s390__", etc. Those are not defined with
> "clang -target bpf" so I have to add them to the command line.
> I'll resend with your suggestion but this patch is simpler.
>
The test doesn't care about struct pt_regs type itself, it only cares
to check that contents of captured pt_regs are the same.
We can use CO-RE to check whether user_pt_regs or pt_regs exists in
the kernel. We can also use bpf_core_type_size() to know exactly how
many bytes we want to capture. And then just use
bpf_probe_read_kernel() as memcpy() equivalent to capture bytes. This
should work on all architectures.
> Thanks,
> Jean
