From a2e426b4631b7a9c4ea55ac7ac5066269348af3d Mon Sep 17 00:00:00 2001 From: Tom Weisshuhn Date: Tue, 19 Nov 2024 16:59:59 +0100 Subject: [PATCH] chore(eBPF) fixed return KProbe time difference Signed-off-by: Tom Weisshuhn --- rust/backend/ebpf/src/vfs_tracing.rs | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/rust/backend/ebpf/src/vfs_tracing.rs b/rust/backend/ebpf/src/vfs_tracing.rs index 3cb49652..61a1747d 100644 --- a/rust/backend/ebpf/src/vfs_tracing.rs +++ b/rust/backend/ebpf/src/vfs_tracing.rs @@ -7,12 +7,13 @@ const TIME_LIMIT_NS: u64 = 100_000_000; use aya_ebpf::{ - macros::{kprobe, map}, + macros::{kprobe, map, kretprobe}, maps::{HashMap, RingBuf}, - programs::ProbeContext, + programs::{ProbeContext, RetProbeContext}, EbpfContext, helpers::gen::bpf_ktime_get_ns, }; +use aya_log_ebpf::info; use backend_common::{generate_id, VfsWriteCall}; @@ -31,7 +32,6 @@ struct VfsWriteIntern { bytes_written: usize, } - #[kprobe] pub fn vfs_write(ctx: ProbeContext) -> Result<(), u32> { let id = generate_id(ctx.pid(), ctx.tgid()); @@ -49,8 +49,8 @@ pub fn vfs_write(ctx: ProbeContext) -> Result<(), u32> { } -#[kprobe] -pub fn vfs_write_ret(ctx: ProbeContext) -> Result<(), u32> { +#[kretprobe] +pub fn vfs_write_ret(ctx: RetProbeContext) -> Result<(), u32> { let probe_end = unsafe { bpf_ktime_get_ns() }; let pid = ctx.pid(); @@ -61,12 +61,9 @@ pub fn vfs_write_ret(ctx: ProbeContext) -> Result<(), u32> { Some(entry) => {entry} }; - if data.begin_time_stamp - probe_end > TIME_LIMIT_NS { - - + if probe_end - data.begin_time_stamp > TIME_LIMIT_NS { let data = VfsWriteCall::new(pid, tgid, data.begin_time_stamp, data.fd, data.bytes_written); - let mut entry = match VFS_WRITE_MAP.reserve::(0) { Some(entry) => entry, None => return Err(0),