chore(bpf): Use BPF ringbuf instead of perfbuf when kernel support is…

… available (#234) * chore(bpf/gotls): use ringbuf when available * fix running on linux 4.19 ~ 5.7 failed * chore(bpf/exec): use ringbuf when available * chore(bpf/tc): use ringbuf when available * chore(bpf/exit): use ringbuf when available * chore(bpf/tc): use bpf_skb_load_bytes instead of bpf_probe_read_kernel to read skb data * fix: fix "R3 min value is outside of the allowed memory range" when running on linux 5.8 ~ 6.7 * fix typo * fix typo
mozillazg · Jan 26, 2025 · 666f101 · 666f101
1 parent f5c4d69
commit 666f101
Show file tree

Hide file tree

Showing 30 changed files with 870 additions and 108 deletions.
diff --git a/bpf/bpf.go b/bpf/bpf.go
@@ -33,10 +33,12 @@ type BPF struct {
 	opts       Options
 	closeFuncs []func()
 
-	skipAttachCgroup bool
-	skipTcx          bool
-	isLegacyKernel   bool
-	report           *types.CountReport
+	skipAttachCgroup    bool
+	skipTcx             bool
+	isLegacyKernel      bool
+	supportRingBuf      bool
+	useRingBufSubmitSkb bool
+	report              *types.CountReport
 }
 
 type Options struct {
@@ -87,12 +89,14 @@ func NewBPF() (*BPF, error) {
 	}
 
 	bf := &BPF{
-		spec:             spec,
-		objs:             &BpfObjects{},
-		report:           &types.CountReport{},
-		isLegacyKernel:   legacyKernel,
-		skipAttachCgroup: skipAttachCgroup,
-		skipTcx:          !supportTcx(),
+		spec:                spec,
+		objs:                &BpfObjects{},
+		report:              &types.CountReport{},
+		isLegacyKernel:      legacyKernel,
+		skipAttachCgroup:    skipAttachCgroup,
+		skipTcx:             !supportTcx(),
+		supportRingBuf:      !legacyKernel && supportRingBuf(),
+		useRingBufSubmitSkb: canUseRingBufSubmitSkb(),
 	}
 
 	return bf, nil
@@ -113,6 +117,9 @@ func (b *BPF) Load(opts Options) error {
 	if len(opts.ifindexes) > 0 {
 		config.FilterIfindexEnable = 1
 	}
+	if b.useRingBufSubmitSkb {
+		config.UseRingbufSubmitSkb = 1
+	}
 	if opts.backend != types.NetHookBackendCgroupSkb {
 		b.disableCgroupSkb()
 	}
@@ -142,6 +149,7 @@ load:
 		IgnoreUnknownProgram:      true,
 		IgnoreNotSupportedProgram: true,
 		IgnoreUnknownVariable:     true,
+		IgnoreInvalidMap:          true,
 	})
 	if err != nil {
 		log.Infof("load and assign failed: %+v", err)
@@ -323,6 +331,7 @@ func (b *BPF) attachTcxHooks(ifindex int, egress, ingress bool) ([]func(), error
 	}
 
 	if egress {
+		log.Infof("attach tcx/egress hooks to ifindex %d", ifindex)
 		lk, err := link.AttachTCX(link.TCXOptions{
 			Interface: ifindex,
 			Program:   b.objs.TcxEgress,
@@ -337,6 +346,7 @@ func (b *BPF) attachTcxHooks(ifindex int, egress, ingress bool) ([]func(), error
 	}
 
 	if ingress {
+		log.Infof("attach tcx/ingress hooks to ifindex %d", ifindex)
 		lk, err := link.AttachTCX(link.TCXOptions{
 			Interface: ifindex,
 			Program:   b.objs.TcxIngress,

diff --git a/bpf/bpf_arm64_bpfel.go b/bpf/bpf_arm64_bpfel.go
diff --git a/bpf/bpf_arm64_bpfel.o b/bpf/bpf_arm64_bpfel.o
diff --git a/bpf/bpf_legacy.go b/bpf/bpf_legacy.go
@@ -54,6 +54,42 @@ func supportTcx() bool {
 	return versionCode >= kernelVersion(6, 6, 0)
 }
 
+func supportRingBuf() bool {
+	log.Info("Checking ringbuf support")
+	if ok := kernelVersionEqOrGreaterThan(5, 8, 0); !ok {
+		return false
+	}
+	if err := features.HaveMapType(ebpf.RingBuf); err != nil {
+		log.Infof("%+v", err)
+		return false
+	}
+	return true
+}
+
+func canUseRingBufSubmitSkb() bool {
+	log.Info("Checking ringbuf submit skb support")
+	if !supportRingBuf() {
+		return false
+	}
+	// 5.8 ~ 6.7 will raise "R3 min value is outside of the allowed memory range" error
+	if ok := kernelVersionEqOrGreaterThan(6, 8, 0); ok {
+		return true
+	}
+	return false
+}
+
+func kernelVersionEqOrGreaterThan(a, b, c int) bool {
+	versionCode, err := features.LinuxVersionCode()
+	if err != nil {
+		log.Infof("%+v", err)
+		return false
+	}
+	if versionCode >= kernelVersion(a, b, c) {
+		return true
+	}
+	return false
+}
+
 func loadBpfWithData(b []byte) (*ebpf.CollectionSpec, error) {
 	reader := bytes.NewReader(b)
 	spec, err := ebpf.LoadCollectionSpecFromReader(reader)

diff --git a/bpf/bpf_legacy_arm64_bpfel.go b/bpf/bpf_legacy_arm64_bpfel.go
diff --git a/bpf/bpf_legacy_arm64_bpfel.o b/bpf/bpf_legacy_arm64_bpfel.o
diff --git a/bpf/bpf_legacy_x86_bpfel.go b/bpf/bpf_legacy_x86_bpfel.go
diff --git a/bpf/bpf_legacy_x86_bpfel.o b/bpf/bpf_legacy_x86_bpfel.o