Skip to content

Commit

Permalink
tools/tcpstates: remove unnecessary checking of TCP
Browse files Browse the repository at this point in the history
  • Loading branch information
boat0 authored and yonghong-song committed Sep 25, 2020
1 parent 39a2a8f commit e548dd5
Showing 1 changed file with 0 additions and 36 deletions.
36 changes: 0 additions & 36 deletions tools/tcpstates.py
Original file line number Diff line number Diff line change
Expand Up @@ -169,42 +169,6 @@
bpf_text_kprobe = """
int kprobe__tcp_set_state(struct pt_regs *ctx, struct sock *sk, int state)
{
// check this is TCP
u8 protocol = 0;
// Following comments add by Joe Yin:
// Unfortunately,it can not work since Linux 4.10,
// because the sk_wmem_queued is not following the bitfield of sk_protocol.
// And the following member is sk_gso_max_segs.
// So, we can use this:
// bpf_probe_read_kernel(&protocol, 1, (void *)((u64)&newsk->sk_gso_max_segs) - 3);
// In order to diff the pre-4.10 and 4.10+ ,introduce the variables gso_max_segs_offset,sk_lingertime,
// sk_lingertime is closed to the gso_max_segs_offset,and
// the offset between the two members is 4
int gso_max_segs_offset = offsetof(struct sock, sk_gso_max_segs);
int sk_lingertime_offset = offsetof(struct sock, sk_lingertime);
if (sk_lingertime_offset - gso_max_segs_offset == 4)
// 4.10+ with little endian
#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
bpf_probe_read_kernel(&protocol, 1, (void *)((u64)&sk->sk_gso_max_segs) - 3);
else
// pre-4.10 with little endian
bpf_probe_read_kernel(&protocol, 1, (void *)((u64)&sk->sk_wmem_queued) - 3);
#elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
// 4.10+ with big endian
bpf_probe_read_kernel(&protocol, 1, (void *)((u64)&sk->sk_gso_max_segs) - 1);
else
// pre-4.10 with big endian
bpf_probe_read_kernel(&protocol, 1, (void *)((u64)&sk->sk_wmem_queued) - 1);
#else
# error "Fix your compiler's __BYTE_ORDER__?!"
#endif
if (protocol != IPPROTO_TCP)
return 0;
u32 pid = bpf_get_current_pid_tgid() >> 32;
// sk is used as a UUID
Expand Down

0 comments on commit e548dd5

Please sign in to comment.