feat(dropwatch): read kernel skb_drop_reason and resolve its name

Read the kfree_skb tracepoint reason field via CO-RE (a trace_event_raw_kfree_skb flavor + bpf_core_field_exists), falling back to the SKB_DROP_REASON_UNSUPPORT sentinel on kernels older than v5.17 that lack the field. The tracepoint attach point and ctx type are unchanged.

In userspace, resolve the numeric reason to its name from the running kernel's BTF (enum skb_drop_reason) at startup, handle the v6.4+ subsystem high-16-bits encoding, and surface it in both text and JSON output.

Change-Id: Ia7a11d20eab1fdb7c4f1e8ca4e0c38e4fec17982

Author: huhong-web

bpf/dropwatch.c

@@ -21,11 +21,6 @@
 #define SK_FL_TYPE_SHIFT 16
 #define SK_FL_TYPE_MASK 0xffff0000
 
-/* Reserved for future kernel skb_drop_reason (SKB_DROP_REASON_NOT_SPECIFIED,
- * ...) passthrough; (u32)-1 is out of band: kernel reason values grow upward
- * from 0 (low 16 bits code, high 16 bits subsystem since v6.4) and can never
- * reach it. */
-#define SKB_DROP_REASON_UNSUPPORT ((u32)-1)
 #define PKT_RAW_LEN 120
 
 struct packet_meta {
@@ -38,11 +33,10 @@ struct packet_meta {
 	u32 dev_flags;           /* 4  */
 	u32 queue_mapping;       /* 4  */
 	u32 drop_reason;         /* 4  */
-	u32 type;                /* 4  */
 	u32 net_inum;             /* 4  */
 	u8  dev_name[IFNAMSIZ];  /* 16 */
 	u8  comm[COMPAT_TASK_COMM_LEN]; /* 16 */
-};                           /* total: 96 bytes */
+};                           /* 92 bytes + 4 tail pad = 96 */
 
 struct packet_raw {
 	u16 eth_proto;    /* 2  */
@@ -86,6 +80,31 @@ char __license[] SEC("license") = "Dual MIT/GPL";
 static const struct drop_packet_event zero_data = {};
 static const u32 stackmap_key = 0;
 
+/* kfree_skb gained an skb drop reason field in v5.17, absent from the BTF this
+ * object is compiled against. Carry it in a CO-RE flavor relocated at load time:
+ * the anonymous enum field matches the kernel's enum skb_drop_reason by the name
+ * "reason". No reason constants are hardcoded (their values shift across kernels);
+ * names are resolved at runtime from kernel BTF in userspace (loadDropReasonNames).
+ *
+ * SKB_DROP_REASON_UNSUPPORT = -1 satisfies C's "enum needs >=1 enumerator" rule
+ * and is the out-of-band fallback for kernels predating the field: as (u32)-1 it
+ * can never collide with real reasons (which grow from 0). */
+struct trace_event_raw_kfree_skb___reason {
+	enum { SKB_DROP_REASON_UNSUPPORT = -1 } reason;
+} __attribute__((preserve_access_index));
+
+/* Return the kernel skb drop reason when the running kernel supports it,
+ * otherwise the out-of-band SKB_DROP_REASON_UNSUPPORT sentinel. */
+static inline u32 skb_get_drop_reason(struct trace_event_raw_kfree_skb *ctx)
+{
+	struct trace_event_raw_kfree_skb___reason *ctx_reason = (void *)ctx;
+
+	if (bpf_core_field_exists(ctx_reason->reason))
+		return BPF_CORE_READ(ctx_reason, reason);
+
+	return SKB_DROP_REASON_UNSUPPORT;
+}
+
 struct sock___5_10 {
 	u16 sk_type;
 	u16 sk_protocol;
@@ -209,8 +228,7 @@ int bpf_kfree_skb_prog(struct trace_event_raw_kfree_skb *ctx)
 	bpf_get_current_comm(&data->meta.comm, sizeof(data->meta.comm));
 	data->meta.kfree_skb_addr = (u64)(unsigned long)ctx->location;
 	data->meta.queue_mapping = BPF_CORE_READ(skb, queue_mapping);
-	data->meta.drop_reason = SKB_DROP_REASON_UNSUPPORT;
-	data->meta.type = 0;
+	data->meta.drop_reason = skb_get_drop_reason(ctx);
 
 	data->pkt_hdr.pkt_len = BPF_CORE_READ(skb, len);
 

cmd/dropwatch/format.go

@@ -33,9 +33,9 @@ type writer interface {
 type textWriter struct{ w io.Writer }
 
 func (s *textWriter) Write(ev *types.DropWatchTracing) error {
-	if _, err := fmt.Fprintf(s.w, "%s %s len=%d dev=%s pid=%d[%s] addr=%s\n",
+	if _, err := fmt.Fprintf(s.w, "%s %s len=%d dev=%s pid=%d[%s] addr=%s reason=%s\n",
 		ev.ObservedTimestamp, ev.Layers,
-		ev.PacketLen, ev.NetdevName, ev.Pid, ev.Comm, ev.PacketSkbAddr); err != nil {
+		ev.PacketLen, ev.NetdevName, ev.Pid, ev.Comm, ev.PacketSkbAddr, ev.DropReason); err != nil {
 		return err
 	}
 

cmd/dropwatch/main.go

@@ -26,6 +26,7 @@ import (
 	"time"
 	"unsafe"
 
+	"github.com/cilium/ebpf/btf"
 	"github.com/urfave/cli/v2"
 	"golang.org/x/sys/unix"
 
@@ -78,7 +79,6 @@ type packetMeta struct {
 	NetdevFlags         uint32
 	NetdevQueueMapping  uint32
 	DropReason          uint32
-	Type                uint32
 	NetInode            uint32
 	NetdevName          [bpf.NetdevNameLen]byte
 	Comm                [bpf.TaskCommLen]byte
@@ -192,7 +192,50 @@ func installDeviceFilter(b bpf.BPF, mode uint32, ifindexes []uint32) error {
 	return b.WriteMapItems(mapID, items)
 }
 
-func formatEvent(ev *dropPacketEvent) *types.DropWatchTracing {
+// dropReasonUnsupport mirrors SKB_DROP_REASON_UNSUPPORT in bpf/dropwatch.c: the
+// sentinel emitted on kernels whose kfree_skb tracepoint has no reason field.
+const dropReasonUnsupport uint32 = 0xffffffff
+
+// loadDropReasonNames builds a map from skb_drop_reason value to name by reading
+// the running kernel's BTF. Returns nil when BTF or the enum is unavailable, in
+// which case reasons render numerically (see dropReasonName).
+func loadDropReasonNames() map[uint32]string {
+	spec, err := btf.LoadKernelSpec()
+	if err != nil {
+		return nil
+	}
+
+	var e *btf.Enum
+	if err := spec.TypeByName("skb_drop_reason", &e); err != nil {
+		return nil
+	}
+
+	names := make(map[uint32]string, len(e.Values))
+	for _, v := range e.Values {
+		names[uint32(v.Value)] = v.Name
+	}
+	return names
+}
+
+// dropReasonName translates a raw skb drop reason into its kernel name. The
+// out-of-band sentinel renders as SKB_DROP_REASON_UNSUPPORT. Since v6.4 the high
+// 16 bits carry the subsystem; only the CORE subsystem (0) maps to
+// enum skb_drop_reason. Unknown values and non-CORE subsystems render as hex.
+func dropReasonName(reason uint32, names map[uint32]string) string {
+	if reason == dropReasonUnsupport {
+		return "SKB_DROP_REASON_UNSUPPORT"
+	}
+
+	if reason>>16 == 0 {
+		if name, ok := names[reason&0xffff]; ok {
+			return name
+		}
+	}
+
+	return fmt.Sprintf("0x%x", reason)
+}
+
+func formatEvent(ev *dropPacketEvent, reasonNames map[uint32]string) *types.DropWatchTracing {
 	pkt := packet.Hdr{
 		EthProto:  ev.Raw.EthProto,
 		RawLen:    uint8(ev.Raw.RawLen),
@@ -211,6 +254,7 @@ func formatEvent(ev *dropPacketEvent) *types.DropWatchTracing {
 
 	return &types.DropWatchTracing{
 		ObservedTimestamp:   time.Now().UTC().Format(time.RFC3339Nano),
+		DropReason:          dropReasonName(ev.Meta.DropReason, reasonNames),
 		Comm:                bytesutil.ToStr(ev.Meta.Comm[:]),
 		Pid:                 ev.Meta.TgidPid >> 32,
 		MemoryCgroupCSSAddr: kernaddr.Format(ev.Meta.MemoryCgroupCSSAddr),
@@ -349,6 +393,8 @@ func mainAction(c *cli.Context) error {
 
 	sink := newWriter(outputFmt, sockClient)
 
+	reasonNames := loadDropReasonNames()
+
 	var ev dropPacketEvent
 
 	for {
@@ -366,7 +412,7 @@ func mainAction(c *cli.Context) error {
 			continue
 		}
 
-		if err := sink.Write(formatEvent(&ev)); err != nil {
+		if err := sink.Write(formatEvent(&ev, reasonNames)); err != nil {
 			log.Errorf("dropwatch: send event: %v", err)
 			return nil
 		}