From 2ed349da11e5100072d9435d0b85c0853b9b28be Mon Sep 17 00:00:00 2001 From: Dan Partelly Date: Sat, 5 Oct 2024 12:28:28 +0300 Subject: [PATCH] Print drop reason from sk_skb_reason_drop This commit extracts a drop reason from sk_skb_reason_drop(), and prints it when sk_skb_drop_reason() is called. This function was introduced in kernel v6.11-rc1. At the same time, kfree_skb_reason() became an inline helper which just calls sk_skb_reason_drop(). See: https://github.com/torvalds/linux/commit/ba8de796baf4bdc03530774fb284fe3c97875566 --- bpf/kprobe_pwru.c | 2 ++ internal/pwru/output.go | 13 +++++++++++-- internal/pwru/types.go | 1 + 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/bpf/kprobe_pwru.c b/bpf/kprobe_pwru.c index 3f196395..9e209fce 100644 --- a/bpf/kprobe_pwru.c +++ b/bpf/kprobe_pwru.c @@ -86,6 +86,7 @@ struct event_t { struct tuple tuple; s64 print_stack_id; u64 param_second; + u64 param_third; u32 cpu_id; } __attribute__((packed)); @@ -504,6 +505,7 @@ kprobe_skb(struct sk_buff *skb, struct pt_regs *ctx, bool has_get_func_ip, u64 * event.skb_addr = (u64) skb; event.addr = has_get_func_ip ? bpf_get_func_ip(ctx) : PT_REGS_IP(ctx); event.param_second = PT_REGS_PARM2(ctx); + event.param_third = PT_REGS_PARM3(ctx); if (CFG.output_caller) bpf_probe_read_kernel(&event.caller_addr, sizeof(event.caller_addr), (void *)PT_REGS_SP(ctx)); diff --git a/internal/pwru/output.go b/internal/pwru/output.go index 975805a8..254b9064 100644 --- a/internal/pwru/output.go +++ b/internal/pwru/output.go @@ -351,6 +351,12 @@ func getOutFuncName(o *output, event *Event, addr uint64) string { } else { outFuncName = fmt.Sprintf("%s (%d)", funcName, event.ParamSecond) } + } else if funcName == "sk_skb_reason_drop" { + if reason, ok := o.kfreeReasons[event.ParamThird]; ok { + outFuncName = fmt.Sprintf("%s(%s)", funcName, reason) + } else { + outFuncName = fmt.Sprintf("%s (%d)", funcName, event.ParamThird) + } } if event.Type != eventTypeKprobe { @@ -478,8 +484,11 @@ func addrToStr(proto uint16, addr [16]byte) string { // defined in /include/net/dropreason.h. func getKFreeSKBReasons(spec *btf.Spec) (map[uint64]string, error) { if _, err := spec.AnyTypeByName("kfree_skb_reason"); err != nil { - // Kernel is too old to have kfree_skb_reason - return nil, nil + if _, err := spec.AnyTypeByName("sk_skb_reason_drop"); err != nil { + // Kernel is too old to have either kfree_skb_reason or sk_skb_reason_drop + // see https://github.com/torvalds/linux/commit/ba8de796baf4bdc03530774fb284fe3c97875566 + return nil, nil + } } var dropReasonsEnum *btf.Enum diff --git a/internal/pwru/types.go b/internal/pwru/types.go index f7ec9a92..b6276487 100644 --- a/internal/pwru/types.go +++ b/internal/pwru/types.go @@ -150,5 +150,6 @@ type Event struct { Tuple Tuple PrintStackId int64 ParamSecond uint64 + ParamThird uint64 CPU uint32 }