bcc: Use bpf_probe_read_user in tools and provide backward compatibility
s390 has overlapping address space for user and kernel. Hence separation of
bpf_probe_read_user and bpf_probe_read_kernel is essential. Commit 6ae08ae3dea2
("bpf: Add probe_read_{user, kernel} and probe_read_{user, kernel}_str
helpers") introduced these changes into the kernel. However, bcc tools does not
respect it.
As a workaround, perform the following:
1. Use bpf_probe_read_user() explicitly in the bcc tools.
2. When kernel version < 5.5, perform the checks if the
bpf_probe_read_user kernel helper is present in the backported kernel
as well. If not found, then fallback from bpf_probe_read_user to
bpf_probe_read.
Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
diff --git a/tools/ttysnoop.py b/tools/ttysnoop.py
index 058dc7e..24c1180 100755
--- a/tools/ttysnoop.py
+++ b/tools/ttysnoop.py
@@ -80,7 +80,7 @@
// bpf_probe_read() can only use a fixed size, so truncate to count
// in user space:
struct data_t data = {};
- bpf_probe_read(&data.buf, BUFSIZE, (void *)buf);
+ bpf_probe_read_user(&data.buf, BUFSIZE, (void *)buf);
if (count > BUFSIZE)
data.count = BUFSIZE;
else