diff --git a/pkg/ebpftracer/c/headers/common/network.h b/pkg/ebpftracer/c/headers/common/network.h index dbc4cee0..1b97142d 100644 --- a/pkg/ebpftracer/c/headers/common/network.h +++ b/pkg/ebpftracer/c/headers/common/network.h @@ -209,6 +209,13 @@ struct { __type(value, event_data_t); // ... linked to a scratch area } net_heap_event SEC(".maps"); +struct { + __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); + __uint(max_entries, 1); // simultaneous softirqs running per CPU (?) + __type(key, u32); // per cpu index ... (always zero) + __type(value, event_data_t); // ... linked to a scratch area +} net_heap_sock_state_event SEC(".maps"); + // CONSTANTS // Network return value (retval) codes diff --git a/pkg/ebpftracer/c/tracee.bpf.c b/pkg/ebpftracer/c/tracee.bpf.c index c878a073..3065b19e 100644 --- a/pkg/ebpftracer/c/tracee.bpf.c +++ b/pkg/ebpftracer/c/tracee.bpf.c @@ -7073,7 +7073,7 @@ int trace_inet_sock_set_state(struct bpf_raw_tracepoint_args *ctx) } u32 zero = 0; - event_data_t *e = bpf_map_lookup_elem(&net_heap_event, &zero); + event_data_t *e = bpf_map_lookup_elem(&net_heap_sock_state_event, &zero); if (unlikely(e == NULL)) return 0; diff --git a/pkg/ebpftracer/tracer_arm64_bpfel.go b/pkg/ebpftracer/tracer_arm64_bpfel.go index ee98b6b1..055089f0 100644 --- a/pkg/ebpftracer/tracer_arm64_bpfel.go +++ b/pkg/ebpftracer/tracer_arm64_bpfel.go @@ -238,6 +238,7 @@ type tracerMapSpecs struct { ModulesMap *ebpf.MapSpec `ebpf:"modules_map"` NetCapEvents *ebpf.MapSpec `ebpf:"net_cap_events"` NetHeapEvent *ebpf.MapSpec `ebpf:"net_heap_event"` + NetHeapSockStateEvent *ebpf.MapSpec `ebpf:"net_heap_sock_state_event"` NetconfigMap *ebpf.MapSpec `ebpf:"netconfig_map"` Netflowmap *ebpf.MapSpec `ebpf:"netflowmap"` NetflowsDataMap *ebpf.MapSpec `ebpf:"netflows_data_map"` @@ -324,6 +325,7 @@ type tracerMaps struct { ModulesMap *ebpf.Map `ebpf:"modules_map"` NetCapEvents *ebpf.Map `ebpf:"net_cap_events"` NetHeapEvent *ebpf.Map `ebpf:"net_heap_event"` + NetHeapSockStateEvent *ebpf.Map `ebpf:"net_heap_sock_state_event"` NetconfigMap *ebpf.Map `ebpf:"netconfig_map"` Netflowmap *ebpf.Map `ebpf:"netflowmap"` NetflowsDataMap *ebpf.Map `ebpf:"netflows_data_map"` @@ -393,6 +395,7 @@ func (m *tracerMaps) Close() error { m.ModulesMap, m.NetCapEvents, m.NetHeapEvent, + m.NetHeapSockStateEvent, m.NetconfigMap, m.Netflowmap, m.NetflowsDataMap, diff --git a/pkg/ebpftracer/tracer_arm64_bpfel.o b/pkg/ebpftracer/tracer_arm64_bpfel.o index f06eb1cc..1320c4fc 100644 Binary files a/pkg/ebpftracer/tracer_arm64_bpfel.o and b/pkg/ebpftracer/tracer_arm64_bpfel.o differ diff --git a/pkg/ebpftracer/tracer_x86_bpfel.go b/pkg/ebpftracer/tracer_x86_bpfel.go index 3f651cb7..08289ef7 100644 --- a/pkg/ebpftracer/tracer_x86_bpfel.go +++ b/pkg/ebpftracer/tracer_x86_bpfel.go @@ -238,6 +238,7 @@ type tracerMapSpecs struct { ModulesMap *ebpf.MapSpec `ebpf:"modules_map"` NetCapEvents *ebpf.MapSpec `ebpf:"net_cap_events"` NetHeapEvent *ebpf.MapSpec `ebpf:"net_heap_event"` + NetHeapSockStateEvent *ebpf.MapSpec `ebpf:"net_heap_sock_state_event"` NetconfigMap *ebpf.MapSpec `ebpf:"netconfig_map"` Netflowmap *ebpf.MapSpec `ebpf:"netflowmap"` NetflowsDataMap *ebpf.MapSpec `ebpf:"netflows_data_map"` @@ -324,6 +325,7 @@ type tracerMaps struct { ModulesMap *ebpf.Map `ebpf:"modules_map"` NetCapEvents *ebpf.Map `ebpf:"net_cap_events"` NetHeapEvent *ebpf.Map `ebpf:"net_heap_event"` + NetHeapSockStateEvent *ebpf.Map `ebpf:"net_heap_sock_state_event"` NetconfigMap *ebpf.Map `ebpf:"netconfig_map"` Netflowmap *ebpf.Map `ebpf:"netflowmap"` NetflowsDataMap *ebpf.Map `ebpf:"netflows_data_map"` @@ -393,6 +395,7 @@ func (m *tracerMaps) Close() error { m.ModulesMap, m.NetCapEvents, m.NetHeapEvent, + m.NetHeapSockStateEvent, m.NetconfigMap, m.Netflowmap, m.NetflowsDataMap, diff --git a/pkg/ebpftracer/tracer_x86_bpfel.o b/pkg/ebpftracer/tracer_x86_bpfel.o index d8656d7d..51b2d052 100644 Binary files a/pkg/ebpftracer/tracer_x86_bpfel.o and b/pkg/ebpftracer/tracer_x86_bpfel.o differ