libbpf-tools: add tcppktlat

Signed-off-by: Wenbo Zhang <[email protected]>

libbpf-tools/.gitignore

@@ -53,6 +53,7 @@
 /tcpconnect
 /tcpconnlat
 /tcplife
+/tcppktlat
 /tcptracer
 /tcprtt
 /tcpstates

libbpf-tools/Makefile

@@ -81,6 +81,7 @@ APPS = \
  tcpconnect \
  tcpconnlat \
  tcplife \
+ tcppktlat \
  tcprtt \
  tcpstates \
  tcpsynbl \

libbpf-tools/tcppktlat.bpf.c

@@ -0,0 +1,121 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2023 Wenbo Zhang
+#include <vmlinux.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_core_read.h>
+#include <bpf/bpf_tracing.h>
+
+#include "compat.bpf.h"
+#include "tcppktlat.h"
+
+#define MAX_ENTRIES 10240
+#define AF_INET 2
+
+const volatile pid_t targ_pid = 0;
+const volatile pid_t targ_tid = 0;
+const volatile __u16 targ_sport = 0;
+const volatile __u16 targ_dport = 0;
+const volatile __u64 targ_min_us = 0;
+
+struct {
+ __uint(type, BPF_MAP_TYPE_HASH);
+ __uint(max_entries, MAX_ENTRIES);
+ __type(key, u64);
+ __type(value, u64);
+} start SEC(".maps");
+
+static int handle_tcp_probe(struct sock *sk, struct sk_buff *skb)
+{
+ const struct inet_sock *inet = (struct inet_sock *)(sk);
+ u64 sock_cookie, ts, len, doff;
+ const struct tcphdr *th;
+
+ if (targ_sport && targ_sport != BPF_CORE_READ(inet, inet_sport))
+ return 0;
+ if (targ_dport && targ_dport != BPF_CORE_READ(sk, __sk_common.skc_dport))
+ return 0;
+ th = (const struct tcphdr*)BPF_CORE_READ(skb, data);
+ doff = BPF_CORE_READ_BITFIELD_PROBED(th, doff);
+ len = BPF_CORE_READ(skb, len);
+ /* `doff * 4` means `__tcp_hdrlen` */
+ if (len <= doff * 4)
+ return 0;
+ sock_cookie = bpf_get_socket_cookie(sk);
+ ts = bpf_ktime_get_ns();
+ bpf_map_update_elem(&start, &sock_cookie, &ts, 0);
+ return 0;
+}
+
+static int handle_tcp_rcv_space_adjust(void *ctx, struct sock *sk)
+{
+ const struct inet_sock *inet = (struct inet_sock *)(sk);
+ u64 sock_cookie = bpf_get_socket_cookie(sk);
+ u64 id = bpf_get_current_pid_tgid(), *tsp;
+ u32 pid = id >> 32, tid = id;
+ struct event *eventp;
+ s64 delta_us;
+ u16 family;
+
+ tsp = bpf_map_lookup_elem(&start, &sock_cookie);
+ if (!tsp)
+ return 0;
+
+ if (targ_pid && targ_pid != pid)
+ goto cleanup;
+ if (targ_tid && targ_tid != tid)
+ goto cleanup;
+
+ delta_us = (bpf_ktime_get_ns() - *tsp) / 1000;
+ if (delta_us < 0 || delta_us <= targ_min_us)
+ goto cleanup;
+
+ eventp = reserve_buf(sizeof(*eventp));
+ if (!eventp)
+ goto cleanup;
+
+ eventp->pid = pid;
+ eventp->tid = tid;
+ eventp->delta_us = delta_us;
+ eventp->sport = BPF_CORE_READ(inet, inet_sport);
+ eventp->dport = BPF_CORE_READ(sk, __sk_common.skc_dport);
+ bpf_get_current_comm(&eventp->comm, TASK_COMM_LEN);
+ family = BPF_CORE_READ(sk, __sk_common.skc_family);
+ if (family == AF_INET) {
+ eventp->saddr[0] = BPF_CORE_READ(sk, __sk_common.skc_rcv_saddr);
+ eventp->daddr[0] = BPF_CORE_READ(sk, __sk_common.skc_daddr);
+ } else { /* family == AF_INET6 */
+ BPF_CORE_READ_INTO(eventp->saddr, sk, __sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
+ BPF_CORE_READ_INTO(eventp->daddr, sk, __sk_common.skc_v6_daddr.in6_u.u6_addr32);
+ }
+ eventp->family = family;
+ submit_buf(ctx, eventp, sizeof(*eventp));
+
+cleanup:
+ bpf_map_delete_elem(&start, &sock_cookie);
+ return 0;
+}
+
+SEC("tp_btf/tcp_probe")
+int BPF_PROG(tcp_probe_btf, struct sock *sk, struct sk_buff *skb)
+{
+ return handle_tcp_probe(sk, skb);
+}
+
+SEC("tp_btf/tcp_rcv_space_adjust")
+int BPF_PROG(tcp_rcv_space_adjust_btf, struct sock *sk)
+{
+ return handle_tcp_rcv_space_adjust(ctx, sk);
+}
+
+SEC("raw_tp/tcp_probe")
+int BPF_PROG(tcp_probe, struct sock *sk, struct sk_buff *skb) {
+ return handle_tcp_probe(sk, skb);
+}
+
+SEC("raw_tp/tcp_rcv_space_adjust")
+int BPF_PROG(tcp_rcv_space_adjust, struct sock *sk)
+{
+ return handle_tcp_rcv_space_adjust(ctx, sk);
+}
+
+char LICENSE[] SEC("license") = "GPL";