bpftrace one-liners skbdump

bpftrace.md

$ sudo bpftrace -e 'tracepoint:napi:napi_poll /comm == "ping"/ { printf("%s\n", comm) }'
Attaching 1 probe...
ping
ping
ping

$ sudo bpftrace -e 'tracepoint:napi:napi_poll /comm == "ping"/ { printf("%d\n", args->work) }'
Attaching 1 probe...
1
1
1

$ sudo bpftrace -e 'tracepoint:napi:napi_poll /comm == "ping"/ { printf("%d\n", args->budget) }'
Attaching 1 probe...
64
64
64

$ sudo bpftrace -e 'kprobe:napi_* /comm == "iperf"/ { printf("%s: %x\n", probe, arg1) }'

$ sudo bpftrace -o log -e 'kprobe:veth_xmit { @[kstack()] = count(); }'

$ sudo bpftrace -e 'kprobe:veth_xmit { printf("%s\n", kstack()); }'
Attaching 1 probe...

        veth_xmit+1
        __dev_queue_xmit+1888
        dev_queue_xmit+16
        br_dev_queue_push_xmit+122
        br_forward_finish+73
        __br_forward+326
        br_forward+204
        br_dev_xmit+544
        dev_hard_start_xmit+150
        __dev_queue_xmit+1888
        dev_queue_xmit+16
        ip_finish_output2+766
        ip_finish_output+414
        ip_output+109
        ip_forward_finish+87
        ip_forward+908
        ip_rcv_finish+132
        ip_rcv+188
        __netif_receive_skb_core+773
        __netif_receive_skb_one_core+59
        __netif_receive_skb+24
        netif_receive_skb_internal+64
        napi_gro_receive+288
        i40e_napi_poll+2127
        net_rx_action+320
        __softirqentry_text_start+228
        irq_exit+182
        do_IRQ+134
        ret_from_intr+0
        cpuidle_enter_state+169
        cpuidle_enter+46
        call_cpuidle+35
        do_idle+516
        cpu_startup_entry+29
        start_secondary+385
        secondary_startup_64+164

        veth_xmit+1
        __dev_queue_xmit+1888
        dev_queue_xmit+16
        ip_finish_output2+766
        ip_finish_output+414
        ip_output+109
        ip_local_out+59
        ip_send_skb+25
        ip_push_pending_frames+51
        icmp_push_reply+223
        icmp_reply.constprop.28+698
        icmp_echo.part.25+90
        icmp_echo+48
        icmp_rcv+619
        ip_protocol_deliver_rcu+417
        ip_local_deliver_finish+72
        ip_local_deliver+126
        ip_rcv_finish+132
        ip_rcv+188
        __netif_receive_skb_one_core+132
        __netif_receive_skb+24
        process_backlog+160
        net_rx_action+320
        __softirqentry_text_start+228
        irq_exit+182
        do_IRQ+134
        ret_from_intr+0
        cpuidle_enter_state+169
        cpuidle_enter+46
        call_cpuidle+35
        do_idle+516
        cpu_startup_entry+29
        start_secondary+385
        secondary_startup_64+164

sudo bpftrace -o log -e 'kprobe:i40e_lan_xmit_frame { @[kstack()] = count(); }'

@[
    i40e_lan_xmit_frame+1
    sch_direct_xmit+330
    __dev_queue_xmit+2075
    dev_queue_xmit+16
    ip_finish_output2+766
    ip_finish_output+414
    ip_output+109
    ip_forward_finish+87
    ip_forward+908
    ip_rcv_finish+132
    ip_sabotage_in+89
    nf_hook_slow+72
    ip_rcv+144
    __netif_receive_skb_one_core+132
    __netif_receive_skb+24
    netif_receive_skb_internal+64
    netif_receive_skb+28
    br_netif_receive_skb+52
    br_pass_frame_up+324
    br_handle_frame_finish+349
    br_nf_hook_thresh+80
    br_nf_pre_routing_finish+349
    br_nf_pre_routing+688
    br_handle_frame+397
    __netif_receive_skb_core+403
    __netif_receive_skb_one_core+59
    __netif_receive_skb+24
    process_backlog+160
    net_rx_action+320
    __softirqentry_text_start+228
    irq_exit+182
    do_IRQ+134
    ret_from_intr+0
    cpuidle_enter_state+169
    cpuidle_enter+46
    call_cpuidle+35
    do_idle+516
    cpu_startup_entry+29
    start_secondary+385
    secondary_startup_64+164
]: 9955

skbdump.bt

#include <linux/skbuff.h>
#include <linux/netdevice.h>

BEGIN
{
        printf("Tracing packets phy -> bridge -> veth. Hit Ctrl-C to end.\n");
        printf("%-40s %-20s %-20s %-20s\n", "FUNC", "IFNAME", "QUEUE", "NAPI");
}

kprobe:veth_xmit
{
        $skb = (struct sk_buff *)arg0;
        $dev = $skb->dev;
        $name = $dev->name;
        if($name == str($3)){
                printf("%-40s %-20s %-20d %-20x\n", func, $name, $skb->queue_mapping, $skb->napi_id );
        }
}

kprobe:dev_hard_start_xmit
{
        $skb = (struct sk_buff *)arg0;
        $dev = $skb->dev;
        $name = $dev->name;
        if($name == str($2)){
        printf("%-40s %-20s %-20d %-20x\n", func, $name, $skb->queue_mapping, $skb->napi_id );
        }
}

kprobe:__dev_queue_xmit
{
        $skb = (struct sk_buff *)arg0;
        $dev = $skb->dev;
        $name = $dev->name;
        if($name == str($2)){
        printf("%-40s %-20s %-20d %-20x\n", func, $name, $skb->queue_mapping, $skb->napi_id );
        }
}

kprobe:ip_output
{
        $skb = (struct sk_buff *)arg2;
        $dev = $skb->dev;
        $name = $dev->name;
        if($name == str($1)){
                printf("%-40s %-20s %-20d %-20x\n", func, $name, $skb->queue_mapping, $skb->napi_id );
        }
}

tracepoint:net:napi_gro_receive_entry
{
        $skb = (struct sk_buff *)args->skbaddr;
        $dev = $skb->dev;
        $name = $dev->name;
        if($name == str($1)){
                printf("%-40s %-20s %-20d %-20x\n", "napi_gro_receive_entry", $name, $skb->queue_mapping, $skb->napi_id );
        }
}

$ sudo bpftrace skbdump.bt ens785f1 docker0 veth32abe19
Attaching 6 probes...
Tracing packets phy -> bridge -> veth. Hit Ctrl-C to end.
FUNC                                     IFNAME               QUEUE                NAPI
napi_gro_receive_entry                   ens785f1             41                   2220
ip_output                                ens785f1             41                   2220
__dev_queue_xmit                         docker0              41                   2220
dev_hard_start_xmit                      docker0              0                    2220
veth_xmit                                veth32abe19          0                    2220