Ask HN: How to handle kernel struct changes (e.g. iov_iter) in eBPF?
3 points
8 hours ago
| 1 comment
| HN
I used the kernel vmlinux header file(6.10 version) from pwru to compile, but my actual kernel version was 6.6. the iov field name in iov_iter become an internal anonymous structure __iov file on kernel changing(6.10->6.6), so the led to that if I extracted and compiled according to the field name of version 6.10, I could not run in my current system, and vice versa. I would like to ask what is a more formal or official solution to deal with this change in kernel structure? My current solution is to directly customize two different versions of iov anonymous structures to judge whether two ways to obtain iov are compatible through bpf_core_field_exists.
▲
morolis
8 hours ago
[-]
I define structt iov_iter___old and struct iov_iter___new, and then use bpf_core_field_exists(((struct iov_iter___new )0)->__iov) to judge whether to use struct iov_iter___new iter = (void )&msg->msg_iter or struct iov_iter___old iter = (void *)&msg->msg_iter
reply
▲
morolis
7 hours ago
[-]
I should add that I am in the kprobe tcp_sendmsg function and need to get the contents of the iov field in msg_iter.
reply