On Wed, Oct 23, 2024 at 8:33 PM Yafang Shao <[email protected]> wrote: > > We previously hooked the tcp_drop_reason() function using BPF to monitor > TCP drop reasons. However, after upgrading our compiler from GCC 9 to GCC > 11, tcp_drop_reason() is now inlined, preventing us from hooking into it. > To address this, it would be beneficial to introduce a dedicated tracepoint > for monitoring.
Hello, Can the existing tracepoint kfree_skb do this work? AFAIK, you can attach you BPF to the kfree_skb tracepoint and do some filter according to the "protocol" field, or the information "sk" field. And this works fine in my tool. I hope I'm not missing something :/ BTW, I do such filter in probe_parse_skb_sk() in https://github.com/OpenCloudOS/nettrace/blob/master/shared/bpf/skb_parse.h Thanks! Menglong Dong > > Signed-off-by: Yafang Shao <[email protected]> > Cc: Menglong Dong <[email protected]> > --- > include/trace/events/tcp.h | 53 ++++++++++++++++++++++++++++++++++++++ > net/ipv4/tcp_input.c | 1 + > 2 files changed, 54 insertions(+) > > diff --git a/include/trace/events/tcp.h b/include/trace/events/tcp.h > index a27c4b619dff..056f7026224c 100644 > --- a/include/trace/events/tcp.h > +++ b/include/trace/events/tcp.h > @@ -12,6 +12,7 @@ > #include <net/tcp.h> > #include <linux/sock_diag.h> > #include <net/rstreason.h> > +#include <net/dropreason-core.h> > > /* > * tcp event with arguments sk and skb > @@ -728,6 +729,58 @@ DEFINE_EVENT(tcp_ao_event_sne, tcp_ao_rcv_sne_update, > TP_ARGS(sk, new_sne) > ); > > +#undef FN > +#undef FNe > +#define FN(reason) { SKB_DROP_REASON_##reason, #reason }, > +#define FNe(reason) { SKB_DROP_REASON_##reason, #reason } > + > +TRACE_EVENT(tcp_drop_reason, > + > + TP_PROTO(const struct sock *sk, const struct sk_buff *skb, > + const enum skb_drop_reason reason), > + > + TP_ARGS(sk, skb, reason), > + > + TP_STRUCT__entry( > + __field(const void *, skbaddr) > + __field(const void *, skaddr) > + __field(int, state) > + __field(enum skb_drop_reason, reason) > + __array(__u8, saddr, sizeof(struct sockaddr_in6)) > + __array(__u8, daddr, sizeof(struct sockaddr_in6)) > + ), > + > + TP_fast_assign( > + __entry->skbaddr = skb; > + __entry->skaddr = sk; > + /* Zero means unknown state. */ > + __entry->state = sk ? sk->sk_state : 0; > + > + memset(__entry->saddr, 0, sizeof(struct sockaddr_in6)); > + memset(__entry->daddr, 0, sizeof(struct sockaddr_in6)); > + > + if (sk && sk_fullsock(sk)) { > + const struct inet_sock *inet = inet_sk(sk); > + > + TP_STORE_ADDR_PORTS(__entry, inet, sk); > + } else { > + const struct tcphdr *th = (const struct tcphdr > *)skb->data; > + > + TP_STORE_ADDR_PORTS_SKB(skb, th, entry->saddr, > entry->daddr); > + } > + __entry->reason = reason; > + ), > + > + TP_printk("skbaddr=%p skaddr=%p src=%pISpc dest=%pISpc state=%s > reason=%s", > + __entry->skbaddr, __entry->skaddr, > + __entry->saddr, __entry->daddr, > + __entry->state ? show_tcp_state_name(__entry->state) : > "UNKNOWN", > + __print_symbolic(__entry->reason, DEFINE_DROP_REASON(FN, > FNe))) > +); > + > +#undef FN > +#undef FNe > + > #endif /* _TRACE_TCP_H */ > > /* This part must be outside protection */ > diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c > index cc05ec1faac8..44795555596a 100644 > --- a/net/ipv4/tcp_input.c > +++ b/net/ipv4/tcp_input.c > @@ -4897,6 +4897,7 @@ static bool tcp_ooo_try_coalesce(struct sock *sk, > static void tcp_drop_reason(struct sock *sk, struct sk_buff *skb, > enum skb_drop_reason reason) > { > + trace_tcp_drop_reason(sk, skb, reason); > sk_drops_add(sk, skb); > sk_skb_reason_drop(sk, skb, reason); > } > -- > 2.43.5 >
