On Tue, Oct 25, 2016 at 5:19 PM, Krister Johansen via iovisor-dev <[email protected]> wrote: > Folks, > I have a bcc script that I've been using to debug the packet path in a > project that I'm working on. I've been using kprobes and tracepoints to > grab skb pointers. Most of the time enough of the skb's data is linear > and bcc can grab a ip header without trouble. But sometimes, I get > garbage when I try to read them. > > I was playing around with making bpf_skb_load_bytes() work with kprobes > and tracepoints, but I can't convince myself of a way to do this safely. > Unless carefully validated, skb_copy_bits() looks like it has the > potential to kmap pfns that may be totally arbitrary or non-existent. > Short of taking the approach that TC already does with this (e.g. > encoding a known skb into the context), is there a way to determine if a > pointer to a kva is actually a skb? I looked but saw nothing obvious.
It's possible, but pretty hard to teach kernel to allow skb_load_bytes from tracing programs. There are too many corner cases to worry about. As a workaround can you share a map between cls_bpf program that looks into skb and tracing program that operates on kprobes? _______________________________________________ iovisor-dev mailing list [email protected] https://lists.iovisor.org/mailman/listinfo/iovisor-dev
