fix: use tracepoint instead of kprobe to trace skb_copy_datagram_iovec (

#243)
hengyoush · Jan 3, 2025 · ca70f6d · ca70f6d
1 parent a60ee5e
commit ca70f6d
Show file tree

Hide file tree

Showing 6 changed files with 23 additions and 5 deletions.
diff --git a/agent/compatible/type.go b/agent/compatible/type.go
@@ -112,7 +112,7 @@ func init() {
 			bpf.AgentStepTDEV_IN:    {InstrumentFunction{"tracepoint/net/netif_receive_skb", "TracepointNetifReceiveSkb"}},
 			bpf.AgentStepTIP_IN:     {InstrumentFunction{"kprobe/ip_rcv_core", "IpRcvCore"}},
 			bpf.AgentStepTTCP_IN:    {InstrumentFunction{"kprobe/tcp_v4_do_rcv", "TcpV4DoRcv"}},
-			bpf.AgentStepTUSER_COPY: {InstrumentFunction{"kprobe/__skb_datagram_iter", "SkbCopyDatagramIter"}},
+			bpf.AgentStepTUSER_COPY: {InstrumentFunction{"tracepoint/skb/skb_copy_datagram_iovec", "TracepointSkbCopyDatagramIovec"}},
 		},
 		Capabilities: map[Capability]bool{
 			SupportConstants:         true,
@@ -140,17 +140,13 @@ func init() {
 	v4d14.addBackupInstrumentFunction(bpf.AgentStepTIP_OUT, InstrumentFunction{"kprobe/__ip_queue_xmit", "IpQueueXmit"})
 	v4d14.InstrumentFunctions[bpf.AgentStepTIP_IN] =
 		[]InstrumentFunction{{"kprobe/ip_rcv", "IpRcvCore"}}
-	v4d14.InstrumentFunctions[bpf.AgentStepTUSER_COPY] =
-		[]InstrumentFunction{{"kprobe/skb_copy_datagram_iter", "SkbCopyDatagramIter"}}
 	v4d14.removeCapability(SupportConstants).removeCapability(SupportRawTracepoint).removeCapability(SupportBTF).removeCapability(SupportXDP)
 	KernelVersionsMap.Put(v4d14.Version, v4d14)
 
 	v310 := copyKernelVersion(v5d4)
 	v310.Version = "3.10.0"
 	v310.InstrumentFunctions[bpf.AgentStepTIP_OUT] =
 		[]InstrumentFunction{{"kprobe/ip_queue_xmit", "IpQueueXmit2"}}
-	v310.InstrumentFunctions[bpf.AgentStepTUSER_COPY] =
-		[]InstrumentFunction{{"kprobe/skb_copy_datagram_iovec", "SkbCopyDatagramIter"}}
 	v310.addBackupInstrumentFunction(bpf.AgentStepTIP_IN, InstrumentFunction{"kprobe/ip_rcv", "IpRcvCore"})
 	v310.removeCapability(SupportConstants).
 		removeCapability(SupportRawTracepoint).

diff --git a/bpf/agent_arm64_bpfel.go b/bpf/agent_arm64_bpfel.go
diff --git a/bpf/agent_x86_bpfel.go b/bpf/agent_x86_bpfel.go
diff --git a/bpf/agentlagacykernel310_arm64_bpfel.go b/bpf/agentlagacykernel310_arm64_bpfel.go
diff --git a/bpf/agentlagacykernel310_x86_bpfel.go b/bpf/agentlagacykernel310_x86_bpfel.go
diff --git a/bpf/pktlatency.bpf.c b/bpf/pktlatency.bpf.c
@@ -583,6 +583,16 @@ int BPF_KPROBE(skb_copy_datagram_iovec, struct sk_buff *skb, int offset, struct
 	return handle_skb_data_copy(ctx, skb, offset, to, len);
 }
 
+SEC("tracepoint/skb/skb_copy_datagram_iovec")
+int tracepoint__skb_copy_datagram_iovec(struct trace_event_raw_skb_copy_datagram_iovec  *ctx) {
+	void *p = (void*)ctx + sizeof(struct trace_entry);
+	struct sk_buff *skb;
+	bpf_probe_read_kernel(&skb, sizeof(struct sk_buff *), p);
+	p += sizeof(struct sk_buff *);
+	int len = 0;
+	bpf_probe_read_kernel(&len, sizeof(int), p);
+	return handle_skb_data_copy(ctx, skb, 0, NULL, len);
+}
 
 SEC("tracepoint/net/netif_receive_skb")
 int tracepoint__netif_receive_skb(struct trace_event_raw_net_dev_template  *ctx) {