On 24/07/2023 11:32, Timofei Pushkin wrote: > Dear BPF community, > > I'm developing a perf_event BPF program which reads some register > values (frame and instruction pointers in particular) from the context > provided to it. I found that CO-RE-enabled PT_REGS macros give results > different from the results of the usual PT_REGS macros. I run the > program on the same system I compiled it on, and so I cannot > understand why the results differ and which ones should I use? > > From my tests, the results of the usual macros are the correct ones > (e.g. I can symbolize the instruction pointers I get this way), but > since I try to follow the CO-RE principle, it seems like I should be > using the CO-RE-enabled variants instead. > > I did some experiments and found out that it is the > bpf_probe_read_kernel part of the CO-RE-enabled PT_REGS macros that > change the results and not __builtin_preserve_access_index. But I > still don't get why exactly it changes the results. > Can you provide the exact usage of the BPF CO-RE macros that isn't working, and the equivalent non-CO-RE version that is? Also if you can provide details on the platform you're running on that will help narrow down the issue. Thanks! Alan > Thank you in advance, > Timofei >
