libbpf CO-RE read_user{,_str} macros

libbpf CO-RE read_user{,_str} macros

[Gilad Reti]

Hello there,
libbpf provides BPF_CORE_READ macros for reading struct members in a
CO-RE compatible way. By default those macros reduct to the relevant
bpf_probe_read_kernel functions. As far as I could tell, there are no
variants of this macros that wrap the _user variants of the read
functions. Are there any plans to support ones?
Thanks,
Gilad Reti.

Re: libbpf CO-RE read_user{,_str} macros

[Andrii Nakryiko]

On Mon, Dec 14, 2020 at 1:58 AM Gilad Reti <gilad.reti@gmail.com> wrote:
>
> Hello there,
> libbpf provides BPF_CORE_READ macros for reading struct members in a
> CO-RE compatible way. By default those macros reduct to the relevant
> bpf_probe_read_kernel functions. As far as I could tell, there are no
> variants of this macros that wrap the _user variants of the read
> functions. Are there any plans to support ones?

BPF_CORE_READ() are using BPF CO-RE and thus emit relocations, which
will be adjusted by libbpf to match kernel struct layouts by using
kernel's BTF(s). Because of this, having xxx_user() variants doesn't
make much sense, because libbpf can't relocate field offsets against
user-space types (as there is no BTF for user-space applications,
typically). Which is why there are no BPF_CORE_READ_USER()-like
macros.

What's your use case, though? There might be a valid one that we are
not aware of, so please provide more details. Thanks.

> Thanks,
> Gilad Reti.

Re: libbpf CO-RE read_user{,_str} macros

[Gilad Reti]

On Tue, Dec 15, 2020 at 3:26 AM Andrii Nakryiko
<andrii.nakryiko@gmail.com> wrote:
>
> On Mon, Dec 14, 2020 at 1:58 AM Gilad Reti <gilad.reti@gmail.com> wrote:
> >
> > Hello there,
> > libbpf provides BPF_CORE_READ macros for reading struct members in a
> > CO-RE compatible way. By default those macros reduct to the relevant
> > bpf_probe_read_kernel functions. As far as I could tell, there are no
> > variants of this macros that wrap the _user variants of the read
> > functions. Are there any plans to support ones?
>
> BPF_CORE_READ() are using BPF CO-RE and thus emit relocations, which
> will be adjusted by libbpf to match kernel struct layouts by using
> kernel's BTF(s). Because of this, having xxx_user() variants doesn't
> make much sense, because libbpf can't relocate field offsets against
> user-space types (as there is no BTF for user-space applications,
> typically). Which is why there are no BPF_CORE_READ_USER()-like
> macros.
>
> What's your use case, though? There might be a valid one that we are
> not aware of, so please provide more details. Thanks.
Currently my use case is tracing syscall pointer arguments (For
example, "connect" has a "struct sockaddr *" argument).
>
> > Thanks,
> > Gilad Reti.

Re: libbpf CO-RE read_user{,_str} macros

[Andrii Nakryiko]

On Tue, Dec 15, 2020 at 4:50 AM Gilad Reti <gilad.reti@gmail.com> wrote:
>
> On Tue, Dec 15, 2020 at 3:26 AM Andrii Nakryiko
> <andrii.nakryiko@gmail.com> wrote:
> >
> > On Mon, Dec 14, 2020 at 1:58 AM Gilad Reti <gilad.reti@gmail.com> wrote:
> > >
> > > Hello there,
> > > libbpf provides BPF_CORE_READ macros for reading struct members in a
> > > CO-RE compatible way. By default those macros reduct to the relevant
> > > bpf_probe_read_kernel functions. As far as I could tell, there are no
> > > variants of this macros that wrap the _user variants of the read
> > > functions. Are there any plans to support ones?
> >
> > BPF_CORE_READ() are using BPF CO-RE and thus emit relocations, which
> > will be adjusted by libbpf to match kernel struct layouts by using
> > kernel's BTF(s). Because of this, having xxx_user() variants doesn't
> > make much sense, because libbpf can't relocate field offsets against
> > user-space types (as there is no BTF for user-space applications,
> > typically). Which is why there are no BPF_CORE_READ_USER()-like
> > macros.
> >
> > What's your use case, though? There might be a valid one that we are
> > not aware of, so please provide more details. Thanks.
> Currently my use case is tracing syscall pointer arguments (For
> example, "connect" has a "struct sockaddr *" argument).

So if it's a kernel-defined data structure provided from user-space,
then it has to be part of a stable UAPI type definitions, right? In
such a case, you shouldn't need CO-RE, because the layout is stable.
So it's still unclear why you'd need BPF_CORE_READ for that?..


Or is it because of the convenience of doing BPF_CORE_READ(s, field1,
field2, field3) instead of a sequence of bpf_probe_read_user() calls?
That's a different angle of BPF_CORE_READ() and we should clarify the
desired functionality you are looking for.


> >
> > > Thanks,
> > > Gilad Reti.

Re: libbpf CO-RE read_user{,_str} macros

[Gilad Reti]

On Tue, Dec 15, 2020 at 8:47 PM Andrii Nakryiko
<andrii.nakryiko@gmail.com> wrote:
>
> On Tue, Dec 15, 2020 at 4:50 AM Gilad Reti <gilad.reti@gmail.com> wrote:
> >
> > On Tue, Dec 15, 2020 at 3:26 AM Andrii Nakryiko
> > <andrii.nakryiko@gmail.com> wrote:
> > >
> > > On Mon, Dec 14, 2020 at 1:58 AM Gilad Reti <gilad.reti@gmail.com> wrote:
> > > >
> > > > Hello there,
> > > > libbpf provides BPF_CORE_READ macros for reading struct members in a
> > > > CO-RE compatible way. By default those macros reduct to the relevant
> > > > bpf_probe_read_kernel functions. As far as I could tell, there are no
> > > > variants of this macros that wrap the _user variants of the read
> > > > functions. Are there any plans to support ones?
> > >
> > > BPF_CORE_READ() are using BPF CO-RE and thus emit relocations, which
> > > will be adjusted by libbpf to match kernel struct layouts by using
> > > kernel's BTF(s). Because of this, having xxx_user() variants doesn't
> > > make much sense, because libbpf can't relocate field offsets against
> > > user-space types (as there is no BTF for user-space applications,
> > > typically). Which is why there are no BPF_CORE_READ_USER()-like
> > > macros.
> > >
> > > What's your use case, though? There might be a valid one that we are
> > > not aware of, so please provide more details. Thanks.
> > Currently my use case is tracing syscall pointer arguments (For
> > example, "connect" has a "struct sockaddr *" argument).
>
> So if it's a kernel-defined data structure provided from user-space,
> then it has to be part of a stable UAPI type definitions, right? In
> such a case, you shouldn't need CO-RE, because the layout is stable.
> So it's still unclear why you'd need BPF_CORE_READ for that?..
I may be completely off, but can't struct offsets and members change
across different architectures?
>
>
> Or is it because of the convenience of doing BPF_CORE_READ(s, field1,
> field2, field3) instead of a sequence of bpf_probe_read_user() calls?
> That's a different angle of BPF_CORE_READ() and we should clarify the
> desired functionality you are looking for.
>
>
> > >
> > > > Thanks,
> > > > Gilad Reti.

Re: libbpf CO-RE read_user{,_str} macros

[Andrii Nakryiko]

On Tue, Dec 15, 2020 at 12:44 PM Gilad Reti <gilad.reti@gmail.com> wrote:
>
> On Tue, Dec 15, 2020 at 8:47 PM Andrii Nakryiko
> <andrii.nakryiko@gmail.com> wrote:
> >
> > On Tue, Dec 15, 2020 at 4:50 AM Gilad Reti <gilad.reti@gmail.com> wrote:
> > >
> > > On Tue, Dec 15, 2020 at 3:26 AM Andrii Nakryiko
> > > <andrii.nakryiko@gmail.com> wrote:
> > > >
> > > > On Mon, Dec 14, 2020 at 1:58 AM Gilad Reti <gilad.reti@gmail.com> wrote:
> > > > >
> > > > > Hello there,
> > > > > libbpf provides BPF_CORE_READ macros for reading struct members in a
> > > > > CO-RE compatible way. By default those macros reduct to the relevant
> > > > > bpf_probe_read_kernel functions. As far as I could tell, there are no
> > > > > variants of this macros that wrap the _user variants of the read
> > > > > functions. Are there any plans to support ones?
> > > >
> > > > BPF_CORE_READ() are using BPF CO-RE and thus emit relocations, which
> > > > will be adjusted by libbpf to match kernel struct layouts by using
> > > > kernel's BTF(s). Because of this, having xxx_user() variants doesn't
> > > > make much sense, because libbpf can't relocate field offsets against
> > > > user-space types (as there is no BTF for user-space applications,
> > > > typically). Which is why there are no BPF_CORE_READ_USER()-like
> > > > macros.
> > > >
> > > > What's your use case, though? There might be a valid one that we are
> > > > not aware of, so please provide more details. Thanks.
> > > Currently my use case is tracing syscall pointer arguments (For
> > > example, "connect" has a "struct sockaddr *" argument).
> >
> > So if it's a kernel-defined data structure provided from user-space,
> > then it has to be part of a stable UAPI type definitions, right? In
> > such a case, you shouldn't need CO-RE, because the layout is stable.
> > So it's still unclear why you'd need BPF_CORE_READ for that?..
> I may be completely off, but can't struct offsets and members change
> across different architectures?

Hm.. that's an interesting angle, certainly across 32-bit and 64-bit
architectures UAPI structs can have different layouts and it's
possible to write and compile a single BPF program that would work on
both. You'll most likely still have to compile twice (once for each
architecture) due to the user-space part. But I think there is a use
case or BPF_CORE_READ_USER() macro, so I don't mind adding it, let's
just figure out the best way to do this. Thanks for elaborating!

> >
> >
> > Or is it because of the convenience of doing BPF_CORE_READ(s, field1,
> > field2, field3) instead of a sequence of bpf_probe_read_user() calls?
> > That's a different angle of BPF_CORE_READ() and we should clarify the
> > desired functionality you are looking for.
> >
> >
> > > >
> > > > > Thanks,
> > > > > Gilad Reti.

Re: libbpf CO-RE read_user{,_str} macros

[Gilad Reti]

On Tue, Dec 15, 2020 at 11:48 PM Andrii Nakryiko
<andrii.nakryiko@gmail.com> wrote:
>
> On Tue, Dec 15, 2020 at 12:44 PM Gilad Reti <gilad.reti@gmail.com> wrote:
> >
> > On Tue, Dec 15, 2020 at 8:47 PM Andrii Nakryiko
> > <andrii.nakryiko@gmail.com> wrote:
> > >
> > > On Tue, Dec 15, 2020 at 4:50 AM Gilad Reti <gilad.reti@gmail.com> wrote:
> > > >
> > > > On Tue, Dec 15, 2020 at 3:26 AM Andrii Nakryiko
> > > > <andrii.nakryiko@gmail.com> wrote:
> > > > >
> > > > > On Mon, Dec 14, 2020 at 1:58 AM Gilad Reti <gilad.reti@gmail.com>
> > > > > wrote:
> > > > > >
> > > > > > Hello there,
> > > > > > libbpf provides BPF_CORE_READ macros for reading struct members in
> > > > > > a
> > > > > > CO-RE compatible way. By default those macros reduct to the
> > > > > > relevant
> > > > > > bpf_probe_read_kernel functions. As far as I could tell, there are
> > > > > > no
> > > > > > variants of this macros that wrap the _user variants of the read
> > > > > > functions. Are there any plans to support ones?
> > > > >
> > > > > BPF_CORE_READ() are using BPF CO-RE and thus emit relocations, which
> > > > > will be adjusted by libbpf to match kernel struct layouts by using
> > > > > kernel's BTF(s). Because of this, having xxx_user() variants doesn't
> > > > > make much sense, because libbpf can't relocate field offsets against
> > > > > user-space types (as there is no BTF for user-space applications,
> > > > > typically). Which is why there are no BPF_CORE_READ_USER()-like
> > > > > macros.
> > > > >
> > > > > What's your use case, though? There might be a valid one that we are
> > > > > not aware of, so please provide more details. Thanks.
> > > > Currently my use case is tracing syscall pointer arguments (For
> > > > example, "connect" has a "struct sockaddr *" argument).
> > >
> > > So if it's a kernel-defined data structure provided from user-space,
> > > then it has to be part of a stable UAPI type definitions, right? In
> > > such a case, you shouldn't need CO-RE, because the layout is stable.
> > > So it's still unclear why you'd need BPF_CORE_READ for that?..
> > I may be completely off, but can't struct offsets and members change
> > across different architectures?
>
> Hm.. that's an interesting angle, certainly across 32-bit and 64-bit
> architectures UAPI structs can have different layouts and it's
> possible to write and compile a single BPF program that would work on
> both. You'll most likely still have to compile twice (once for each
> architecture) due to the user-space part. But I think there is a use
> case or BPF_CORE_READ_USER() macro, so I don't mind adding it, let's
> just figure out the best way to do this. Thanks for elaborating!
Thank you for your time!
>
> > >
> > >
> > > Or is it because of the convenience of doing BPF_CORE_READ(s, field1,
> > > field2, field3) instead of a sequence of bpf_probe_read_user() calls?
> > > That's a different angle of BPF_CORE_READ() and we should clarify the
> > > desired functionality you are looking for.
> > >
> > >
> > > > >
> > > > > > Thanks,
> > > > > > Gilad Reti.