Skip to content

Commit

Permalink
Rename skb_addr to skb_head
Browse files Browse the repository at this point in the history 
#339 changed how pwru collects
skb_addr, now it holds the value of skb->head instead of &skb.

This patch renames value name `skb_addr` to `skb_head`, as well as map
name `skb_addresses` to `skb_heads`.

Signed-off-by: gray <[email protected]>
  • Loading branch information
@jschwinger233 @brb
jschwinger233 authored and brb committed Jul 10, 2024
1 parent 063d67b commit 5699a37
Show file tree
Hide file tree
Showing 3 changed files with 24 additions and 24 deletions.
36 changes: 18 additions & 18 deletions bpf/kprobe_pwru.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ struct event_t {
u32 type;
u64 addr;
u64 caller_addr;
u64 skb_addr;
u64 skb_head;
u64 ts;
typeof(print_skb_id) print_skb_id;
typeof(print_shinfo_id) print_shinfo_id;
Expand All @@ -103,7 +103,7 @@ struct {
__type(key, __u64);
__type(value, bool);
__uint(max_entries, MAX_TRACK_SIZE);
} skb_addresses SEC(".maps");
} skb_heads SEC(".maps");

struct {
__uint(type, BPF_MAP_TYPE_HASH);
Expand Down Expand Up @@ -426,14 +426,14 @@ set_output(void *ctx, struct sk_buff *skb, struct event_t *event) {
static __noinline bool
handle_everything(struct sk_buff *skb, void *ctx, struct event_t *event, u64 *_stackid) {
u8 tracked_by;
u64 skb_addr = (u64) BPF_CORE_READ(skb, head);
u64 skb_head = (u64) BPF_CORE_READ(skb, head);
u64 stackid;

if (cfg->track_skb_by_stackid)
stackid = _stackid ? *_stackid : get_stackid(ctx);

if (cfg->is_set) {
if (cfg->track_skb && bpf_map_lookup_elem(&skb_addresses, &skb_addr)) {
if (cfg->track_skb && bpf_map_lookup_elem(&skb_heads, &skb_head)) {
tracked_by = _stackid ? TRACKED_BY_STACKID : TRACKED_BY_SKB;
goto cont;
}
Expand All @@ -455,7 +455,7 @@ handle_everything(struct sk_buff *skb, void *ctx, struct event_t *event, u64 *_s
}

if (cfg->track_skb && tracked_by == TRACKED_BY_FILTER) {
bpf_map_update_elem(&skb_addresses, &skb_addr, &TRUE, BPF_ANY);
bpf_map_update_elem(&skb_heads, &skb_head, &TRUE, BPF_ANY);
}

if (cfg->track_skb_by_stackid && tracked_by != TRACKED_BY_STACKID) {
Expand All @@ -481,7 +481,7 @@ kprobe_skb(struct sk_buff *skb, struct pt_regs *ctx, bool has_get_func_ip, u64 *
if (!handle_everything(skb, ctx, &event, _stackid))
return BPF_OK;

event.skb_addr = (u64) BPF_CORE_READ(skb, head);
event.skb_head = (u64) BPF_CORE_READ(skb, head);
event.addr = has_get_func_ip ? bpf_get_func_ip(ctx) : PT_REGS_IP(ctx);
event.param_second = PT_REGS_PARM2(ctx);
if (CFG.output_caller)
Expand Down Expand Up @@ -531,14 +531,14 @@ int kprobe_skb_by_stackid(struct pt_regs *ctx) {
SEC("kprobe/skb_lifetime_termination")
int kprobe_skb_lifetime_termination(struct pt_regs *ctx) {
struct sk_buff *skb = (typeof(skb)) PT_REGS_PARM1(ctx);
u64 skb_addr = (u64) BPF_CORE_READ(skb, head);
u64 skb_head = (u64) BPF_CORE_READ(skb, head);

bpf_map_delete_elem(&skb_addresses, &skb_addr);
bpf_map_delete_elem(&skb_heads, &skb_head);

if (cfg->track_skb_by_stackid) {
u64 stackid = get_stackid(ctx);
bpf_map_delete_elem(&stackid_skb, &stackid);
bpf_map_delete_elem(&skb_stackid, &skb_addr);
bpf_map_delete_elem(&skb_stackid, &skb_head);
}

return BPF_OK;
Expand All @@ -548,8 +548,8 @@ static __always_inline int
track_skb_clone(struct sk_buff *old, struct sk_buff *new) {
u64 skb_addr_old = (u64) BPF_CORE_READ(old, head);
u64 skb_addr_new = (u64) BPF_CORE_READ(new, head);
if (bpf_map_lookup_elem(&skb_addresses, &skb_addr_old))
bpf_map_update_elem(&skb_addresses, &skb_addr_new, &TRUE, BPF_ANY);
if (bpf_map_lookup_elem(&skb_heads, &skb_addr_old))
bpf_map_update_elem(&skb_heads, &skb_addr_new, &TRUE, BPF_ANY);

return BPF_OK;
}
Expand Down Expand Up @@ -577,7 +577,7 @@ int BPF_PROG(fentry_tc, struct sk_buff *skb) {
if (!handle_everything(skb, ctx, &event, NULL))
return BPF_OK;

event.skb_addr = (u64) BPF_CORE_READ(skb, head);
event.skb_head = (u64) BPF_CORE_READ(skb, head);
event.addr = BPF_PROG_ADDR;
event.type = EVENT_TYPE_TC;
bpf_map_push_elem(&events, &event, BPF_EXIST);
Expand Down Expand Up @@ -663,16 +663,16 @@ set_xdp_output(void *ctx, struct xdp_buff *xdp, struct event_t *event) {

SEC("fentry/xdp")
int BPF_PROG(fentry_xdp, struct xdp_buff *xdp) {
u64 skb_addr = (u64) BPF_CORE_READ(xdp, data_hard_start);
u64 skb_head = (u64) BPF_CORE_READ(xdp, data_hard_start);
struct event_t event = {};

if (cfg->is_set) {
if (cfg->track_skb) {
if (!bpf_map_lookup_elem(&skb_addresses, &skb_addr)) {
if (!bpf_map_lookup_elem(&skb_heads, &skb_head)) {
if (!filter_xdp(xdp))
return BPF_OK;

bpf_map_update_elem(&skb_addresses, &skb_addr, &TRUE, BPF_ANY);
bpf_map_update_elem(&skb_heads, &skb_head, &TRUE, BPF_ANY);
}

} else if (!filter_xdp(xdp)) {
Expand All @@ -685,7 +685,7 @@ int BPF_PROG(fentry_xdp, struct xdp_buff *xdp) {
event.pid = bpf_get_current_pid_tgid() >> 32;
event.ts = bpf_ktime_get_ns();
event.cpu_id = bpf_get_smp_processor_id();
event.skb_addr = (u64) skb_addr;
event.skb_head = (u64) skb_head;
event.addr = BPF_PROG_ADDR;
event.type = EVENT_TYPE_XDP;
bpf_map_push_elem(&events, &event, BPF_EXIST);
Expand All @@ -698,7 +698,7 @@ int kprobe_veth_convert_skb_to_xdp_buff(struct pt_regs *ctx) {
struct sk_buff **skb = (struct sk_buff **)PT_REGS_PARM3(ctx);
u64 skb_addr;
bpf_probe_read_kernel(&skb_addr, sizeof(skb_addr), (void *)skb);
if (bpf_map_lookup_elem(&skb_addresses, &skb_addr)) {
if (bpf_map_lookup_elem(&skb_heads, &skb_addr)) {
u64 pid_tgid = bpf_get_current_pid_tgid();
bpf_map_update_elem(&veth_skbs, &pid_tgid, &skb, BPF_ANY);
}
Expand All @@ -712,7 +712,7 @@ int kretprobe_veth_convert_skb_to_xdp_buff(struct pt_regs *ctx) {
if (skb && *skb) {
u64 skb_addr;
bpf_probe_read_kernel(&skb_addr, sizeof(skb_addr), (void *)*skb);
bpf_map_update_elem(&skb_addresses, &skb_addr, &TRUE, BPF_ANY);
bpf_map_update_elem(&skb_heads, &skb_addr, &TRUE, BPF_ANY);
bpf_map_delete_elem(&veth_skbs, &pid_tgid);
}
return BPF_OK;
Expand Down
10 changes: 5 additions & 5 deletions internal/pwru/output.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -159,15 +159,15 @@ func (o *output) PrintJson(event *Event) {
d := &jsonPrinter{}

// add the data to the struct
d.Skb = fmt.Sprintf("%#x", event.SAddr)
d.Skb = fmt.Sprintf("%#x", event.SkbHead)
d.Cpu = event.CPU
d.Process = getExecName(int(event.PID))
d.Func = getOutFuncName(o, event, event.Addr)
if o.flags.OutputCaller {
d.CallerFunc = o.addr2name.findNearestSym(event.CallerAddr)
}

o.lastSeenSkb[event.SAddr] = event.Timestamp
o.lastSeenSkb[event.SkbHead] = event.Timestamp

// add the timestamp to the struct if it is not set to none
if o.flags.OutputTS != "none" {
Expand Down Expand Up @@ -228,7 +228,7 @@ func getAbsoluteTs() string {

func getRelativeTs(event *Event, o *output) uint64 {
ts := event.Timestamp
if last, found := o.lastSeenSkb[event.SAddr]; found {
if last, found := o.lastSeenSkb[event.SkbHead]; found {
ts = ts - last
} else {
ts = 0
Expand Down Expand Up @@ -396,12 +396,12 @@ func (o *output) Print(event *Event) {

outFuncName := getOutFuncName(o, event, addr)

fmt.Fprintf(o.writer, "%-18s %-3s %-16s", fmt.Sprintf("%#x", event.SAddr),
fmt.Fprintf(o.writer, "%-18s %-3s %-16s", fmt.Sprintf("%#x", event.SkbHead),
fmt.Sprintf("%d", event.CPU), fmt.Sprintf("%s", execName))
if o.flags.OutputTS != "none" {
fmt.Fprintf(o.writer, " %-16d", ts)
}
o.lastSeenSkb[event.SAddr] = event.Timestamp
o.lastSeenSkb[event.SkbHead] = event.Timestamp

if o.flags.OutputMeta {
fmt.Fprintf(o.writer, " %s", getMetaData(event, o))
Expand Down
2 changes: 1 addition & 1 deletion internal/pwru/types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ type Event struct {
Type uint32
Addr uint64
CallerAddr uint64
SAddr uint64
SkbHead uint64
Timestamp uint64
PrintSkbId uint64
PrintShinfoId uint64
Expand Down

0 comments on commit 5699a37

Please sign in to comment.