Re: [PATCH] net: tracepoint: exposing sk_family in all tcp:tracepoints

On Fri, Jan 29, 2021 at 11:16 AM Alexei Starovoitov
[off-list ref] wrote:

On Thu, Jan 28, 2021 at 4:12 PM Hariharan Ananthakrishnan
[off-list ref] wrote:

quoted

Similar to sock:inet_sock_set_state tracepoint, expose sk_family to
distinguish AF_INET and AF_INET6 families.

The following tcp tracepoints are updated:
tcp:tcp_destroy_sock
tcp:tcp_rcv_space_adjust
tcp:tcp_retransmit_skb
tcp:tcp_send_reset
tcp:tcp_receive_reset
tcp:tcp_retransmit_synack
tcp:tcp_probe

Signed-off-by: Hariharan Ananthakrishnan <redacted>
Signed-off-by: Brendan Gregg <redacted>
---
 include/trace/events/tcp.h | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/include/trace/events/tcp.h b/include/trace/events/tcp.h
index cf97f6339acb..a319d2f86cd9 100644
--- a/include/trace/events/tcp.h
+++ b/include/trace/events/tcp.h

@@ -59,6 +59,7 @@ DECLARE_EVENT_CLASS(tcp_event_sk_skb,
                __field(int, state)
                __field(__u16, sport)
                __field(__u16, dport)
+               __field(__u16, family)
                __array(__u8, saddr, 4)
                __array(__u8, daddr, 4)
                __array(__u8, saddr_v6, 16)

raw tracepoint can access all sk and skb fields already.
Why do you need this?

We (Netflix) can dig it out using raw tracepoints and BTF (once it's
rolled out) but this was about fixing the existing tracepoints so they
were more useful.

I think tracepoints and their arguments suit a class of
non-kernel-hacker users: SREs, operators, sysadmins, etc. People who
run and tweak bpftrace one-liners.

Brendan

-- 
Brendan Gregg, Senior Performance Architect, Netflix