Fix broken --filter-trace-tc

It fails to run with --filter-trace-tc:

```bash
2024/09/24 12:59:02 Attaching tc-bpf progs...
2024/09/24 12:59:02 failed to trace TC progs: failed to trace bpf progs: failed to find address for function entry2 of bpf prog SchedCLS(entry2)#28
```

Then, I fix it by matching prog ksym with prog tag.

And avoid `addr - 1` for `--filter-trace-{tc,xdp}`.

```bash
2024/09/25 13:57:00 Attaching tc-bpf progs...
2024/09/25 13:57:00 Attaching kprobes (via kprobe-multi)...
49 / 49 [--------------------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s
2024/09/25 13:57:00 Attached (ignored 0)
2024/09/25 13:57:00 Listening for events..
SKB                CPU PROCESS          NETNS      MARK/x        IFACE       PROTO  MTU   LEN   TUPLE FUNC
0xffff8e151d39be00 6   <empty>:0        4026531840 0            ens33:2      0x0800 1500  98    192.168.241.1:0->192.168.241.133:0(icmp) bpf_prog_e20a685998fd41c8_entry1[bpf](tc)
0xffff8e151d39a500 6   <empty>:0        4026531840 0            ens33:2      0x0800 1500  98    192.168.241.1:0->192.168.241.133:0(icmp) bpf_prog_e20a685998fd41c8_entry1[bpf](tc)
0xffff8e151d39bd00 6   <empty>:0        4026531840 0            ens33:2      0x0800 1500  98    192.168.241.1:0->192.168.241.133:0(icmp) bpf_prog_e20a685998fd41c8_entry1[bpf](tc)
0xffff8e151d39a200 6   <empty>:0        4026531840 0            ens33:2      0x0800 1500  98    192.168.241.1:0->192.168.241.133:0(icmp) bpf_prog_e20a685998fd41c8_entry1[bpf](tc)
0xffff8e151d39a800 6   <empty>:0        4026531840 0            ens33:2      0x0800 1500  98    192.168.241.1:0->192.168.241.133:0(icmp) bpf_prog_e20a685998fd41c8_entry1[bpf](tc)
^C2024/09/25 14:02:16 Received signal, exiting program..
2024/09/25 14:02:16 Detaching kprobes...
3 / 3 [---------------------------------------------------------------------------------------------------------------------------------------] 100.00% 50 p/s
```

Signed-off-by: Leon Hwang <[email protected]>

Author: Asphaltt

internal/pwru/bpf_prog.go

@@ -42,31 +42,35 @@ func listBpfProgs(typ ebpf.ProgramType) ([]*ebpf.Program, error) {
 	return progs, nil
 }
 
-func getEntryFuncName(prog *ebpf.Program) (string, string, error) {
+func getBpfProgInfo(prog *ebpf.Program) (entryFuncName, progName, tag string, err error) {
 	info, err := prog.Info()
 	if err != nil {
-		return "", "", fmt.Errorf("failed to get program info: %w", err)
+		err = fmt.Errorf("failed to get program info: %w", err)
+		return
 	}
 
 	_, ok := info.BTFID()
 	if !ok {
 		// FENTRY/FEXIT program can only be attached to another program
 		// annotated with BTF. So if the BTF ID is not found, it means
 		// the program is not annotated with BTF.
-		return "", "", errNotFound
+		err = errNotFound
+		return
 	}
 
 	insns, err := info.Instructions()
 	if err != nil {
-		return "", "", fmt.Errorf("failed to get program instructions: %w", err)
+		err = fmt.Errorf("failed to get program instructions: %w", err)
+		return
 	}
 
 	for _, insn := range insns {
 		sym := insn.Symbol()
 		if sym != "" {
-			return sym, info.Name, nil
+			return sym, info.Name, info.Tag, nil
 		}
 	}
 
-	return "", "", errNotFound
+	err = errNotFound
+	return
 }

internal/pwru/ksym.go

@@ -58,7 +58,7 @@ func ParseKallsyms(funcs Funcs, all bool) (Addr2Name, BpfProgName2Addr, error) {
 	scanner := bufio.NewScanner(file)
 	for scanner.Scan() {
 		line := strings.Split(scanner.Text(), " ")
-		name, isBpfProg := extractBpfProgName(line[2])
+		name := strings.ReplaceAll(line[2], "\t", "")
 		if all || (funcs[name] > 0) {
 			addr, err := strconv.ParseUint(line[0], 16, 64)
 			if err != nil {
@@ -73,7 +73,7 @@ func ParseKallsyms(funcs Funcs, all bool) (Addr2Name, BpfProgName2Addr, error) {
 			if all {
 				a2n.Addr2NameSlice = append(a2n.Addr2NameSlice, sym)
 			}
-			if isBpfProg {
+			if isBpfProg := strings.HasSuffix(name, "[bpf]"); isBpfProg {
 				n2a[name] = addr
 			}
 		}
@@ -88,7 +88,3 @@ func ParseKallsyms(funcs Funcs, all bool) (Addr2Name, BpfProgName2Addr, error) {
 
 	return a2n, n2a, nil
 }
-
-func extractBpfProgName(name string) (string, bool) {
-	return strings.ReplaceAll(name, "\t", ""), strings.HasSuffix(name, "[bpf]")
-}

internal/pwru/output.go

@@ -254,7 +254,7 @@ func getAddrByArch(event *Event, o *output) (addr uint64) {
 	switch runtime.GOARCH {
 	case "amd64":
 		addr = event.Addr
-		if !o.kprobeMulti {
+		if !o.kprobeMulti && event.Type == eventTypeKprobe {
 			addr -= 1
 		}
 	case "arm64":
@@ -365,8 +365,10 @@ func getOutFuncName(o *output, event *Event, addr uint64) string {
 	return outFuncName
 }
 
-var maxTupleLengthSeen int
-var maxFuncLengthSeen int
+var (
+	maxTupleLengthSeen int
+	maxFuncLengthSeen  int
+)
 
 func fprintWithPadding(writer *os.File, data string, maxLenSeen *int) {
 	if len(data) > *maxLenSeen {
@@ -412,7 +414,6 @@ func (o *output) Print(event *Event) {
 		fprintWithPadding(o.writer, outFuncName, &maxFuncLengthSeen)
 		fmt.Fprintf(o.writer, " %s", o.addr2name.findNearestSym(event.CallerAddr))
 	} else {
-
 		fmt.Fprintf(o.writer, " %s", outFuncName)
 	}
 

internal/pwru/tracing.go

@@ -64,7 +64,7 @@ func (t *tracing) traceProg(spec *ebpf.CollectionSpec,
 	opts *ebpf.CollectionOptions, prog *ebpf.Program, n2a BpfProgName2Addr,
 	tracingName string,
 ) error {
-	entryFn, name, err := getEntryFuncName(prog)
+	entryFn, progName, tag, err := getBpfProgInfo(prog)
 	if err != nil {
 		if errors.Is(err, errNotFound) {
 			log.Printf("Skip tracing bpf prog %s because cannot find its entry function name", prog)
@@ -80,11 +80,13 @@ func (t *tracing) traceProg(spec *ebpf.CollectionSpec,
 	// distinguish which exact bpf prog is called.
 	//   -- @jschwinger233
 
-	addr, ok := n2a[entryFn]
+	progKsym := fmt.Sprintf("bpf_prog_%s_%s[bpf]", tag, entryFn)
+	addr, ok := n2a[progKsym]
 	if !ok {
-		addr, ok = n2a[name]
+		progKsym = fmt.Sprintf("bpf_prog_%s_%s[bpf]", tag, progName)
+		addr, ok = n2a[progKsym]
 		if !ok {
-			return fmt.Errorf("failed to find address for function %s of bpf prog %v", name, prog)
+			return fmt.Errorf("failed to find address for function %s of bpf prog %v", progName, prog)
 		}
 	}