Current state of netlink decoding in strace
summary
strace implements netlink decoding since 2016 and now supports many protocols and most message types, using progressive parsing from traced process memory with elaborate error handling rather than copying whole messages. Tests use synthesized netlink payloads written to a netlink socket to validate parsers. Known failures include an SMC change that moved the address-family field and broke decoding for three kernel versions (SMC family-field break), and pain from raw-structure attributes that reintroduce ioctl-style compatibility problems. Generic netlink support is still incomplete.
AI-written summary · about
chapters (8)
- 0:00Netlink and strace intro
- 3:11Problems with ioctl
- 8:00Why netlink is better
- 10:56Strace implementation details
- 16:34Decoding netlink protocols
- 23:08Current netlink support
- 26:02Future netlink plans
- 28:15Q&A
related talks
49mModern strace
17mUse of Netlink for thermal kernel-user notification is problematic
26mstrace: fight for performance
44mAdvanced Linux Kernel Networking Monitoring
20mTeach an Old Network Driver New Tricks
47mSpeedrun through Splicing Sockets with Sockmap
41mLinux Tracing Techniques
14mRefining the Linux kernel CAN stack for RHIVOS