Feature #TASK_QT-18250 go tls恢复

ebpftracer/ebpf/ebpf.c

@@ -52,7 +52,7 @@
 #include "tcp/retransmit.c"
 //#include "l7/uprobe_base_bpf.c"
 #include "l7/l7.c"
-//#include "l7/gotls.c"
+#include "l7/gotls.c"
 //#include "l7/openssl.c"
 #include "utrace/go/net/server.probe.bpf.c"
 #include "utrace/go/net/client.probe.bpf.c"

ebpftracer/ebpf/l7/gotls.c

@@ -70,5 +70,5 @@ int go_crypto_tls_read_exit(struct pt_regs *ctx) {
     __u64 goroutine_id = GOROUTINE(ctx);
     __u64 id = pid << 32 | goroutine_id | IS_TLS_READ_ID;
     long int ret = GO_PARAM1(ctx);
-    return trace_exit_read(ctx, id, pid, 1, ret);
+    return trace_exit_read_up(ctx, id, pid, 1, ret);
 }

ebpftracer/ebpf/l7/l7.c

@@ -701,9 +701,7 @@ int trace_enter_write(void *ctx, __u64 fd, __u16 is_tls, char *buf, __u64 size,
 }
 
 static inline __attribute__((__always_inline__))
-int trace_enter_read(int _type , __u64 fd, char *buf, __u64 *ret, __u64 iovlen) {
-	__u64 id = bpf_get_current_pid_tgid();
-	__u32 pid = id >> 32;
+int trace_enter_read(__u64 id, __u32 pid, __u64 fd, char *buf, __u64 *ret, __u64 iovlen) {
 
 	if (load_filter_pid() != 0 && pid != load_filter_pid()) {
 		return 0;
@@ -717,8 +715,9 @@ int trace_enter_read(int _type , __u64 fd, char *buf, __u64 *ret, __u64 iovlen)
     return 0;
 }
 
+// 通用的trace_exit_read逻辑，通过参数控制是否执行bpf_tail_call
 static inline __attribute__((__always_inline__))
-int trace_exit_read(void *ctx, __u64 id, __u32 pid, __u16 is_tls, long int ret) {
+int trace_exit_read_common(void *ctx, __u64 id, __u32 pid, __u16 is_tls, long int ret, int tp_tail_call) {
     __u32 tid =  (__u32)id;
 
     if (load_filter_pid() != 0 && pid != load_filter_pid()) {
@@ -859,12 +858,12 @@ int trace_exit_read(void *ctx, __u64 id, __u32 pid, __u16 is_tls, long int ret)
         //     __sync_fetch_and_add(&accept_conn->bytes_received, total_size);
         // }
 
-        //bpf_tail_call PROGUP(l7_http_request)
+		//bpf_tail_call PROGUP(l7_http_request)
         cw_bpf_debug("======== PROG_DATA_L7_HTTP_TRACE_ID_UP_IDX ========== __KERNEL_FROM < 512 pid:[%d] ",tid);
-	    if (proc_info->code_type != CodeTypeGo) {
-		    bpf_tail_call(ctx, &NAME(progs_jmp_tp_map), PROG_DATA_L7_HTTP_TRACE_ID_TP_IDX);
-	    }
-         return 0;
+        if (tp_tail_call && proc_info->code_type != CodeTypeGo) {
+            bpf_tail_call(ctx, &NAME(progs_jmp_tp_map), PROG_DATA_L7_HTTP_TRACE_ID_TP_IDX);
+        }
+        return 0;
     }
 
     struct connection *conn = bpf_map_lookup_elem(&active_connections, &cid);
@@ -1210,6 +1209,16 @@ int trace_exit_read(void *ctx, __u64 id, __u32 pid, __u16 is_tls, long int ret)
     return 0;
 }
 
+static inline __attribute__((__always_inline__))
+int trace_exit_read_tp(void *ctx, __u64 id, __u32 pid, __u16 is_tls, long int ret) {
+    return trace_exit_read_common(ctx, id, pid, is_tls, ret, 1); // enable_tail_call = 1
+}
+
+static inline __attribute__((__always_inline__))
+int trace_exit_read_up(void *ctx, __u64 id, __u32 pid, __u16 is_tls, long int ret) {
+    return trace_exit_read_common(ctx, id, pid, is_tls, ret, 0); // enable_tail_call = 0
+}
+
 SEC("tracepoint/syscalls/sys_enter_write")
 int sys_enter_write(struct trace_event_raw_sys_enter_rw__stub* ctx) {
     return trace_enter_write(ctx, ctx->fd, 0, ctx->buf, ctx->size, 0);
@@ -1259,62 +1268,62 @@ int sys_enter_sendto(struct trace_event_raw_sys_enter_rw__stub* ctx) {
 
 SEC("tracepoint/syscalls/sys_enter_read")
 int sys_enter_read(struct trace_event_raw_sys_enter_rw__stub* ctx) {
-//    __u64 id = bpf_get_current_pid_tgid();
-//    __u32 pid = id >> 32;
-	return trace_enter_read(1, ctx->fd, ctx->buf, 0, 0);
+    __u64 id = bpf_get_current_pid_tgid();
+    __u32 pid = id >> 32;
+	return trace_enter_read(id, pid, ctx->fd, ctx->buf, 0, 0);
 }
 
 SEC("tracepoint/syscalls/sys_enter_readv")
 int sys_enter_readv(struct trace_event_raw_sys_enter_rw__stub* ctx) {
-//    __u64 id = bpf_get_current_pid_tgid();
-//    __u32 pid = id >> 32;
-    return trace_enter_read(2, ctx->fd, ctx->buf, 0, ctx->size);
+    __u64 id = bpf_get_current_pid_tgid();
+    __u32 pid = id >> 32;
+	return trace_enter_read(id, pid, ctx->fd, ctx->buf, 0, ctx->size);
 }
 
 SEC("tracepoint/syscalls/sys_enter_recvmsg")
 int sys_enter_recvmsg(struct trace_event_raw_sys_enter_rw__stub* ctx) {
-//    __u64 id = bpf_get_current_pid_tgid();
+    __u64 id = bpf_get_current_pid_tgid();
     struct l7_user_msghdr msghdr = {};
     if (bpf_probe_read(&msghdr, sizeof(msghdr), (void *)ctx->buf)) {
         return 0;
     }
-//    __u32 pid = id >> 32;
-	return trace_enter_read(3, ctx->fd, (char *) msghdr.msg_iov, 0, msghdr.msg_iovlen);
+    __u32 pid = id >> 32;
+	return trace_enter_read(id, pid, ctx->fd, (char *) msghdr.msg_iov, 0, msghdr.msg_iovlen);
 }
 
 SEC("tracepoint/syscalls/sys_enter_recvfrom")
 int sys_enter_recvfrom(struct trace_event_raw_sys_enter_rw__stub* ctx) {
     __u64 id = bpf_get_current_pid_tgid();
-//    __u32 pid = id >> 32;
-    return trace_enter_read(4, ctx->fd, ctx->buf, 0, 0);
+    __u32 pid = id >> 32;
+	return trace_enter_read(id, pid, ctx->fd, ctx->buf, 0, 0);
 }
 
 SEC("tracepoint/syscalls/sys_exit_read")
 int sys_exit_read(struct trace_event_raw_sys_exit_rw__stub* ctx) {
     __u64 pid_tgid = bpf_get_current_pid_tgid();
     __u32 pid = pid_tgid >> 32;
-    return trace_exit_read(ctx, pid_tgid, pid, 0, ctx->ret);
+    return trace_exit_read_tp(ctx, pid_tgid, pid, 0, ctx->ret);
 }
 
 SEC("tracepoint/syscalls/sys_exit_readv")
 int sys_exit_readv(struct trace_event_raw_sys_exit_rw__stub* ctx) {
     __u64 pid_tgid = bpf_get_current_pid_tgid();
     __u32 pid = pid_tgid >> 32;
-    return trace_exit_read(ctx, pid_tgid, pid, 0, ctx->ret);
+    return trace_exit_read_tp(ctx, pid_tgid, pid, 0, ctx->ret);
 }
 
 SEC("tracepoint/syscalls/sys_exit_recvmsg")
 int sys_exit_recvmsg(struct trace_event_raw_sys_exit_rw__stub* ctx) {
     __u64 pid_tgid = bpf_get_current_pid_tgid();
     __u32 pid = pid_tgid >> 32;
-    return trace_exit_read(ctx, pid_tgid, pid, 0, ctx->ret);
+    return trace_exit_read_tp(ctx, pid_tgid, pid, 0, ctx->ret);
 }
 
 SEC("tracepoint/syscalls/sys_exit_recvfrom")
 int sys_exit_recvfrom(struct trace_event_raw_sys_exit_rw__stub* ctx) {
     __u64 pid_tgid = bpf_get_current_pid_tgid();
     __u32 pid = pid_tgid >> 32;
-    return trace_exit_read(ctx, pid_tgid, pid, 0, ctx->ret);
+    return trace_exit_read_tp(ctx, pid_tgid, pid, 0, ctx->ret);
 }
 //
 //SEC("tracepoint/syscalls/sys_exit_recvfrom")

ebpftracer/ebpf/l7/openssl.c

@@ -141,5 +141,5 @@ int openssl_SSL_read_exit(struct pt_regs *ctx) {
     __u64 pid = pid_tgid >> 32;
     __u64 id = pid_tgid | IS_TLS_READ_ID;
     int ret = (int)PT_REGS_RC(ctx);
-    return trace_exit_read(ctx, id, pid, 1, ret);
+    return trace_exit_read_up(ctx, id, pid, 1, ret);
 }