Ask HN: How to handle kernel struct changes (e.g. iov_iter) in eBPF?

3 pointsposted 9 hours ago
by morolis

Item id: 48609424

2 Comments

morolis

8 hours ago

I define structt iov_iter___old and struct iov_iter___new, and then use bpf_core_field_exists(((struct iov_iter___new )0)->__iov) to judge whether to use struct iov_iter___new iter = (void )&msg->msg_iter or struct iov_iter___old iter = (void *)&msg->msg_iter

morolis

8 hours ago

I should add that I am in the kprobe tcp_sendmsg function and need to get the contents of the iov field in msg_iter.