2121#define SK_FL_TYPE_SHIFT 16
2222#define SK_FL_TYPE_MASK 0xffff0000
2323
24- /* Reserved for future kernel skb_drop_reason (SKB_DROP_REASON_NOT_SPECIFIED,
25- * ...) passthrough; (u32)-1 is out of band: kernel reason values grow upward
26- * from 0 (low 16 bits code, high 16 bits subsystem since v6.4) and can never
27- * reach it. */
28- #define SKB_DROP_REASON_UNSUPPORT ((u32)-1)
2924#define PKT_RAW_LEN 120
3025
3126struct packet_meta {
@@ -38,11 +33,10 @@ struct packet_meta {
3833 u32 dev_flags ; /* 4 */
3934 u32 queue_mapping ; /* 4 */
4035 u32 drop_reason ; /* 4 */
41- u32 type ; /* 4 */
4236 u32 net_inum ; /* 4 */
4337 u8 dev_name [IFNAMSIZ ]; /* 16 */
4438 u8 comm [COMPAT_TASK_COMM_LEN ]; /* 16 */
45- }; /* total: 96 bytes */
39+ }; /* 92 bytes + 4 tail pad = 96 */
4640
4741struct packet_raw {
4842 u16 eth_proto ; /* 2 */
@@ -86,6 +80,31 @@ char __license[] SEC("license") = "Dual MIT/GPL";
8680static const struct drop_packet_event zero_data = {};
8781static const u32 stackmap_key = 0 ;
8882
83+ /* kfree_skb gained an skb drop reason field in v5.17, absent from the BTF this
84+ * object is compiled against. Carry it in a CO-RE flavor relocated at load time:
85+ * the anonymous enum field matches the kernel's enum skb_drop_reason by the name
86+ * "reason". No reason constants are hardcoded (their values shift across kernels);
87+ * names are resolved at runtime from kernel BTF in userspace (loadDropReasonNames).
88+ *
89+ * SKB_DROP_REASON_UNSUPPORT = -1 satisfies C's "enum needs >=1 enumerator" rule
90+ * and is the out-of-band fallback for kernels predating the field: as (u32)-1 it
91+ * can never collide with real reasons (which grow from 0). */
92+ struct trace_event_raw_kfree_skb___reason {
93+ enum { SKB_DROP_REASON_UNSUPPORT = -1 } reason ;
94+ } __attribute__((preserve_access_index ));
95+
96+ /* Return the kernel skb drop reason when the running kernel supports it,
97+ * otherwise the out-of-band SKB_DROP_REASON_UNSUPPORT sentinel. */
98+ static inline u32 skb_get_drop_reason (struct trace_event_raw_kfree_skb * ctx )
99+ {
100+ struct trace_event_raw_kfree_skb___reason * ctx_reason = (void * )ctx ;
101+
102+ if (bpf_core_field_exists (ctx_reason -> reason ))
103+ return BPF_CORE_READ (ctx_reason , reason );
104+
105+ return SKB_DROP_REASON_UNSUPPORT ;
106+ }
107+
89108struct sock___5_10 {
90109 u16 sk_type ;
91110 u16 sk_protocol ;
@@ -187,7 +206,7 @@ int bpf_kfree_skb_prog(struct trace_event_raw_kfree_skb *ctx)
187206 return 0 ;
188207
189208 /* pcap filter via bpf_pcap_stub.h: pass-through stub patched at load
190- * time by internal/pcapinject with the compiled tcpdump expression.
209+ * time by internal/pcapfilter with the compiled tcpdump expression.
191210 */
192211 if (!PCAP_STUB_PASS_SKB (skb ))
193212 return 0 ;
@@ -205,16 +224,11 @@ int bpf_kfree_skb_prog(struct trace_event_raw_kfree_skb *ctx)
205224
206225 /* meta */
207226 data -> meta .ktime_ns = bpf_ktime_get_ns ();
208- /* tgid_pid and comm in SoftIRQ Context do not accurately reflect
209- * the process where the drop occurred, only for reference.
210- */
211227 data -> meta .tgid_pid = bpf_get_current_pid_tgid ();
212228 bpf_get_current_comm (& data -> meta .comm , sizeof (data -> meta .comm ));
213-
214229 data -> meta .kfree_skb_addr = (u64 )(unsigned long )ctx -> location ;
215230 data -> meta .queue_mapping = BPF_CORE_READ (skb , queue_mapping );
216- data -> meta .drop_reason = SKB_DROP_REASON_UNSUPPORT ;
217- data -> meta .type = 0 ;
231+ data -> meta .drop_reason = skb_get_drop_reason (ctx );
218232
219233 data -> pkt_hdr .pkt_len = BPF_CORE_READ (skb , len );
220234
0 commit comments