bpf_probe_read_kernel usage in tcplife

[tahirali-csc]

In tcplife.bpf.c, when reading ip4/pi6 source/dest addresses

bcc/libbpf-tools/tcplife.bpf.c

Line 138 in 8422cd4

bpf_probe_read_kernel(&event.saddr, sizeof(args->saddr), BPF_CORE_READ(args, saddr));

, we use bpf_probe_read_kernel instead of bpf_core_read. The whole purpose of bpf_core_read is that handles fields offset changes transparently across different kernel version. Any thoughts?

[chenhengqi]

The relocation is handled by BPF_CORE_READ(args, saddr).