Fix broken --filter-trace-tc

It fails to run with --filter-trace-tc: ```bash 2024/09/24 12:59:02 Attaching tc-bpf progs... 2024/09/24 12:59:02 failed to trace TC progs: failed to trace bpf progs: failed to find address for function entry2 of bpf prog SchedCLS(entry2)#28 ``` Then, I fix it by matching prog ksym with prog tag. And avoid `addr - 1` for `--filter-trace-{tc,xdp}`. ```bash 2024/09/25 13:57:00 Attaching tc-bpf progs... 2024/09/25 13:57:00 Attaching kprobes (via kprobe-multi)... 49 / 49 [--------------------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s 2024/09/25 13:57:00 Attached (ignored 0) 2024/09/25 13:57:00 Listening for events.. SKB CPU PROCESS NETNS MARK/x IFACE PROTO MTU LEN TUPLE FUNC 0xffff8e151d39be00 6 <empty>:0 4026531840 0 ens33:2 0x0800 1500 98 192.168.241.1:0->192.168.241.133:0(icmp) bpf_prog_e20a685998fd41c8_entry1[bpf](tc) 0xffff8e151d39a500 6 <empty>:0 4026531840 0 ens33:2 0x0800 1500 98 192.168.241.1:0->192.168.241.133:0(icmp) bpf_prog_e20a685998fd41c8_entry1[bpf](tc) 0xffff8e151d39bd00 6 <empty>:0 4026531840 0 ens33:2 0x0800 1500 98 192.168.241.1:0->192.168.241.133:0(icmp) bpf_prog_e20a685998fd41c8_entry1[bpf](tc) 0xffff8e151d39a200 6 <empty>:0 4026531840 0 ens33:2 0x0800 1500 98 192.168.241.1:0->192.168.241.133:0(icmp) bpf_prog_e20a685998fd41c8_entry1[bpf](tc) 0xffff8e151d39a800 6 <empty>:0 4026531840 0 ens33:2 0x0800 1500 98 192.168.241.1:0->192.168.241.133:0(icmp) bpf_prog_e20a685998fd41c8_entry1[bpf](tc) ^C2024/09/25 14:02:16 Received signal, exiting program.. 2024/09/25 14:02:16 Detaching kprobes... 3 / 3 [---------------------------------------------------------------------------------------------------------------------------------------] 100.00% 50 p/s ``` Signed-off-by: Leon Hwang <[email protected]>
cilium · Sep 26, 2024 · 759fc7a · 759fc7a
1 parent 81b7b62
commit 759fc7a
Show file tree

Hide file tree

Showing 4 changed files with 23 additions and 20 deletions.
diff --git a/internal/pwru/bpf_prog.go b/internal/pwru/bpf_prog.go
@@ -42,31 +42,35 @@ func listBpfProgs(typ ebpf.ProgramType) ([]*ebpf.Program, error) {
 	return progs, nil
 }
 
-func getEntryFuncName(prog *ebpf.Program) (string, string, error) {
+func getBpfProgInfo(prog *ebpf.Program) (entryFuncName, progName, tag string, err error) {
 	info, err := prog.Info()
 	if err != nil {
-		return "", "", fmt.Errorf("failed to get program info: %w", err)
+		err = fmt.Errorf("failed to get program info: %w", err)
+		return
 	}
 
 	_, ok := info.BTFID()
 	if !ok {
 		// FENTRY/FEXIT program can only be attached to another program
 		// annotated with BTF. So if the BTF ID is not found, it means
 		// the program is not annotated with BTF.
-		return "", "", errNotFound
+		err = errNotFound
+		return
 	}
 
 	insns, err := info.Instructions()
 	if err != nil {
-		return "", "", fmt.Errorf("failed to get program instructions: %w", err)
+		err = fmt.Errorf("failed to get program instructions: %w", err)
+		return
 	}
 
 	for _, insn := range insns {
 		sym := insn.Symbol()
 		if sym != "" {
-			return sym, info.Name, nil
+			return sym, info.Name, info.Tag, nil
 		}
 	}
 
-	return "", "", errNotFound
+	err = errNotFound
+	return
 }
diff --git a/internal/pwru/ksym.go b/internal/pwru/ksym.go
@@ -58,7 +58,7 @@ func ParseKallsyms(funcs Funcs, all bool) (Addr2Name, BpfProgName2Addr, error) {
 	scanner := bufio.NewScanner(file)
 	for scanner.Scan() {
 		line := strings.Split(scanner.Text(), " ")
-		name, isBpfProg := extractBpfProgName(line[2])
+		name := strings.ReplaceAll(line[2], "\t", "")
 		if all || (funcs[name] > 0) {
 			addr, err := strconv.ParseUint(line[0], 16, 64)
 			if err != nil {
@@ -73,7 +73,7 @@ func ParseKallsyms(funcs Funcs, all bool) (Addr2Name, BpfProgName2Addr, error) {
 			if all {
 				a2n.Addr2NameSlice = append(a2n.Addr2NameSlice, sym)
 			}
-			if isBpfProg {
+			if isBpfProg := strings.HasSuffix(name, "[bpf]"); isBpfProg {
 				n2a[name] = addr
 			}
 		}
@@ -88,7 +88,3 @@ func ParseKallsyms(funcs Funcs, all bool) (Addr2Name, BpfProgName2Addr, error) {
 
 	return a2n, n2a, nil
 }
-
-func extractBpfProgName(name string) (string, bool) {
-	return strings.ReplaceAll(name, "\t", ""), strings.HasSuffix(name, "[bpf]")
-}
diff --git a/internal/pwru/output.go b/internal/pwru/output.go
@@ -254,7 +254,7 @@ func getAddrByArch(event *Event, o *output) (addr uint64) {
 	switch runtime.GOARCH {
 	case "amd64":
 		addr = event.Addr
-		if !o.kprobeMulti {
+		if !o.kprobeMulti && event.Type == eventTypeKprobe {
 			addr -= 1
 		}
 	case "arm64":
@@ -365,8 +365,10 @@ func getOutFuncName(o *output, event *Event, addr uint64) string {
 	return outFuncName
 }
 
-var maxTupleLengthSeen int
-var maxFuncLengthSeen int
+var (
+	maxTupleLengthSeen int
+	maxFuncLengthSeen  int
+)
 
 func fprintWithPadding(writer *os.File, data string, maxLenSeen *int) {
 	if len(data) > *maxLenSeen {
@@ -412,7 +414,6 @@ func (o *output) Print(event *Event) {
 		fprintWithPadding(o.writer, outFuncName, &maxFuncLengthSeen)
 		fmt.Fprintf(o.writer, " %s", o.addr2name.findNearestSym(event.CallerAddr))
 	} else {
-
 		fmt.Fprintf(o.writer, " %s", outFuncName)
 	}
 

diff --git a/internal/pwru/tracing.go b/internal/pwru/tracing.go
@@ -64,7 +64,7 @@ func (t *tracing) traceProg(spec *ebpf.CollectionSpec,
 	opts *ebpf.CollectionOptions, prog *ebpf.Program, n2a BpfProgName2Addr,
 	tracingName string,
 ) error {
-	entryFn, name, err := getEntryFuncName(prog)
+	entryFn, progName, tag, err := getBpfProgInfo(prog)
 	if err != nil {
 		if errors.Is(err, errNotFound) {
 			log.Printf("Skip tracing bpf prog %s because cannot find its entry function name", prog)
@@ -80,11 +80,13 @@ func (t *tracing) traceProg(spec *ebpf.CollectionSpec,
 	// distinguish which exact bpf prog is called.
 	//   -- @jschwinger233
 
-	addr, ok := n2a[entryFn]
+	progKsym := fmt.Sprintf("bpf_prog_%s_%s[bpf]", tag, entryFn)
+	addr, ok := n2a[progKsym]
 	if !ok {
-		addr, ok = n2a[name]
+		progKsym = fmt.Sprintf("bpf_prog_%s_%s[bpf]", tag, progName)
+		addr, ok = n2a[progKsym]
 		if !ok {
-			return fmt.Errorf("failed to find address for function %s of bpf prog %v", name, prog)
+			return fmt.Errorf("failed to find address for function %s of bpf prog %v", progName, prog)
 		}
 	}