-
Sumanth Korikkar authored
s390 has overlapping address space for user and kernel. Hence separation of bpf_probe_read_user and bpf_probe_read_kernel is essential. Commit 6ae08ae3dea2 ("bpf: Add probe_read_{user, kernel} and probe_read_{user, kernel}_str helpers") introduced these changes into the kernel. However, bcc tools does not respect it. As a workaround, perform the following: 1. Use bpf_probe_read_user() explicitly in the bcc tools. 2. When kernel version < 5.5, perform the checks if the bpf_probe_read_user kernel helper is present in the backported kernel as well. If not found, then fallback from bpf_probe_read_user to bpf_probe_read. Signed-off-by:
Sumanth Korikkar <sumanthk@linux.ibm.com>
264b2ccf
ttysnoop.py 2.95 KiB