On Fri, Oct 28, 2016 at 10:05:15AM -0700, Alexei Starovoitov wrote: > On Tue, Oct 25, 2016 at 5:19 PM, Krister Johansen via iovisor-dev > <[email protected]> wrote: > > Folks, > > I have a bcc script that I've been using to debug the packet path in a > > project that I'm working on. I've been using kprobes and tracepoints to > > grab skb pointers. Most of the time enough of the skb's data is linear > > and bcc can grab a ip header without trouble. But sometimes, I get > > garbage when I try to read them. > > > > I was playing around with making bpf_skb_load_bytes() work with kprobes > > and tracepoints, but I can't convince myself of a way to do this safely. > > Unless carefully validated, skb_copy_bits() looks like it has the > > potential to kmap pfns that may be totally arbitrary or non-existent. > > Short of taking the approach that TC already does with this (e.g. > > encoding a known skb into the context), is there a way to determine if a > > pointer to a kva is actually a skb? I looked but saw nothing obvious. > > It's possible, but pretty hard to teach kernel to allow skb_load_bytes > from tracing programs. There are too many corner cases to worry about. > As a workaround can you share a map between cls_bpf program that > looks into skb and tracing program that operates on kprobes?
Thanks for the suggestion. That option hadn't occurred to me. The one thing I did consider was forcing a specifc kva range for allocating skbs. However, it doesn't look like Linux encourages this kind of idenity by object address design pattern. -K _______________________________________________ iovisor-dev mailing list [email protected] https://lists.iovisor.org/mailman/listinfo/iovisor-dev
