Re: Process-wide watchpoints

[Namhyung Kim <namhyung@kernel.org>]

Hello,

On Sun, Jan 31, 2021 at 7:28 PM Dmitry Vyukov <dvyukov@google.com> wrote:
> Not directly related to the above question, but related to my use case.
> Could we extend bpf_perf_event_data with some more data re breakpoint events?
>
> struct bpf_perf_event_data {
>     bpf_user_pt_regs_t regs;
>     __u64 sample_period;
>     __u64 addr;
> };
>
> Ideally, I would like to have an actual access address, size and
> read/write type (may not match bp addr/size). Is that info easily
> available at the point of bpf hook call?
> Or, if that's not available at least breakpoint bp_type/bp_size.
>
> Is it correct that we can materialize in bpf_perf_event_data anything
> that's available in bpf_perf_event_data_kern (if it makes sense in the
> public interface of course)?
>
> struct bpf_perf_event_data_kern {
>     bpf_user_pt_regs_t *regs;
>     struct perf_sample_data *data;
>     struct perf_event *event;
> };
>
> Unfortunately I don't see perf_event_attr.bp_type/bp_size
> stored/accessible anywhere in bpf_perf_event_data_kern. What would be
> the right way to expose them in bpf_perf_event_data?

I think you can access it via event->attr.bp_type/size in the struct
bpf_perf_event_data_kern.

Thanks,
Namhyung