lkml.org 
[lkml]   [2021]   [Aug]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH bpf-next 1/2] bpf: Add bpf_task_pt_regs() helper
On Wed, Aug 18, 2021 at 4:42 PM Daniel Xu <dxu@dxuuu.xyz> wrote:
>
> The motivation behind this helper is to access userspace pt_regs in a
> kprobe handler.
>
> uprobe's ctx is the userspace pt_regs. kprobe's ctx is the kernelspace
> pt_regs. bpf_task_pt_regs() allows accessing userspace pt_regs in a
> kprobe handler. The final case (kernelspace pt_regs in uprobe) is
> pretty rare (usermode helper) so I think that can be solved later if
> necessary.
>
> More concretely, this helper is useful in doing BPF-based DWARF stack
> unwinding. Currently the kernel can only do framepointer based stack
> unwinds for userspace code. This is because the DWARF state machines are
> too fragile to be computed in kernelspace [0]. The idea behind
> DWARF-based stack unwinds w/ BPF is to copy a chunk of the userspace
> stack (while in prog context) and send it up to userspace for unwinding
> (probably with libunwind) [1]. This would effectively enable profiling
> applications with -fomit-frame-pointer using kprobes and uprobes.
>
> [0]: https://lkml.org/lkml/2012/2/10/356
> [1]: https://github.com/danobi/bpf-dwarf-walk
>
> Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
> ---

Seems like a really useful thing. Few notes:

1. Given this is user pt_regs, should we call it bpf_get_user_pt_regs()?
2. Would it be safe to enable it for all types of programs, not just
kprobe/tp/raw_tp/perf? Why limit the list?
3. It seems like it's the sixth declaration of BTF_ID for task_struct,
maybe it's time to consolidate them?

> include/uapi/linux/bpf.h | 7 +++++++
> kernel/trace/bpf_trace.c | 20 ++++++++++++++++++++
> tools/include/uapi/linux/bpf.h | 7 +++++++
> 3 files changed, 34 insertions(+)

[...]

\
 
 \ /
  Last update: 2021-08-19 22:28    [W:0.050 / U:0.088 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site