Skip to content
Snippets Groups Projects
  • Sumanth Korikkar's avatar
    bcc: Use bpf_probe_read_user in tools and provide backward compatibility · 264b2ccf
    Sumanth Korikkar authored
    
    s390 has overlapping address space for user and kernel. Hence separation of
    bpf_probe_read_user and bpf_probe_read_kernel is essential. Commit 6ae08ae3dea2
    ("bpf: Add probe_read_{user, kernel} and probe_read_{user, kernel}_str
    helpers") introduced these changes into the kernel. However, bcc tools does not
    respect it.
    
    As a workaround, perform the following:
    1. Use bpf_probe_read_user() explicitly in the bcc tools.
    2. When kernel version < 5.5, perform the checks if the
       bpf_probe_read_user kernel helper is present in the backported kernel
       as well. If not found, then fallback from bpf_probe_read_user to
       bpf_probe_read.
    
    Signed-off-by: default avatarSumanth Korikkar <sumanthk@linux.ibm.com>
    264b2ccf
ttysnoop.py 2.95 KiB