-
Yonghong Song authored
bpf_probe_read() is often used to access pointees in bpf programs. Recent rewriter has become smarter so a lot of bpf_probe_read() can be replaced with simple pointer/member access. In certain cases, bpf_probe_read() is still preferred though. For example, kernel net/tcp.h defined TCP_SKB_CB as below #define TCP_SKB_CB(__skb) ((struct tcp_skb_cb *)&((__skb)->cb[0])) User can use below to access tcp_gso_size of a skb data structure. TCP_SKB_CB(skb)->tcp_gso_size The rewriter will fail as it attempts to rewrite (__skb)->cb[0]. Instead of chasing down to prevent exactly the above pattern, this patch detects function bpf_probe_read() in ProbeVisitor and will skip it so bpf_probe_read()'s third parameter is a AddrOf. This can also help other cases where rewriter is not capable and user used bpf_probe_read() as the workaround. Also fixed tcptop.py to use direct assignment instead of bpf_probe_read. Otherwise, rewriter will actually rewrite src address reference inside the bpf_probe_read(). Signed-off-by: Yonghong Song <yhs@fb.com>
20fb64cd