bcc/tools: Introduce bpf_probe_read_user to the tools.
This is essential for architecture which do have overlapping address space.
- bpf_probe_read_kernel() shall be used for reading data from kernel space
to the bpf vm.
- bpf_probe_read_user() shall be used for reading data from user space
to the bpf vm.
Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
diff --git a/tools/mountsnoop.py b/tools/mountsnoop.py
index 17a2edb..667ea35 100755
--- a/tools/mountsnoop.py
+++ b/tools/mountsnoop.py
@@ -109,22 +109,22 @@
event.type = EVENT_MOUNT_SOURCE;
__builtin_memset(event.str, 0, sizeof(event.str));
- bpf_probe_read(event.str, sizeof(event.str), source);
+ bpf_probe_read_user(event.str, sizeof(event.str), source);
events.perf_submit(ctx, &event, sizeof(event));
event.type = EVENT_MOUNT_TARGET;
__builtin_memset(event.str, 0, sizeof(event.str));
- bpf_probe_read(event.str, sizeof(event.str), target);
+ bpf_probe_read_user(event.str, sizeof(event.str), target);
events.perf_submit(ctx, &event, sizeof(event));
event.type = EVENT_MOUNT_TYPE;
__builtin_memset(event.str, 0, sizeof(event.str));
- bpf_probe_read(event.str, sizeof(event.str), type);
+ bpf_probe_read_user(event.str, sizeof(event.str), type);
events.perf_submit(ctx, &event, sizeof(event));
event.type = EVENT_MOUNT_DATA;
__builtin_memset(event.str, 0, sizeof(event.str));
- bpf_probe_read(event.str, sizeof(event.str), data);
+ bpf_probe_read_user(event.str, sizeof(event.str), data);
events.perf_submit(ctx, &event, sizeof(event));
return 0;
@@ -164,7 +164,7 @@
event.type = EVENT_UMOUNT_TARGET;
__builtin_memset(event.str, 0, sizeof(event.str));
- bpf_probe_read(event.str, sizeof(event.str), target);
+ bpf_probe_read_user(event.str, sizeof(event.str), target);
events.perf_submit(ctx, &event, sizeof(event));
return 0;