Loading...
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 | /* SPDX-License-Identifier: GPL-2.0 * Copyright(c) 2017-2018 Jesper Dangaard Brouer, Red Hat Inc. * * XDP monitor tool, based on tracepoints */ #include <uapi/linux/bpf.h> #include <bpf/bpf_helpers.h> struct { __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); __type(key, u32); __type(value, u64); __uint(max_entries, 2); /* TODO: have entries for all possible errno's */ } redirect_err_cnt SEC(".maps"); #define XDP_UNKNOWN XDP_REDIRECT + 1 struct { __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); __type(key, u32); __type(value, u64); __uint(max_entries, XDP_UNKNOWN + 1); } exception_cnt SEC(".maps"); /* Tracepoint format: /sys/kernel/debug/tracing/events/xdp/xdp_redirect/format * Code in: kernel/include/trace/events/xdp.h */ struct xdp_redirect_ctx { u64 __pad; // First 8 bytes are not accessible by bpf code int prog_id; // offset:8; size:4; signed:1; u32 act; // offset:12 size:4; signed:0; int ifindex; // offset:16 size:4; signed:1; int err; // offset:20 size:4; signed:1; int to_ifindex; // offset:24 size:4; signed:1; u32 map_id; // offset:28 size:4; signed:0; int map_index; // offset:32 size:4; signed:1; }; // offset:36 enum { XDP_REDIRECT_SUCCESS = 0, XDP_REDIRECT_ERROR = 1 }; static __always_inline int xdp_redirect_collect_stat(struct xdp_redirect_ctx *ctx) { u32 key = XDP_REDIRECT_ERROR; int err = ctx->err; u64 *cnt; if (!err) key = XDP_REDIRECT_SUCCESS; cnt = bpf_map_lookup_elem(&redirect_err_cnt, &key); if (!cnt) return 1; *cnt += 1; return 0; /* Indicate event was filtered (no further processing)*/ /* * Returning 1 here would allow e.g. a perf-record tracepoint * to see and record these events, but it doesn't work well * in-practice as stopping perf-record also unload this * bpf_prog. Plus, there is additional overhead of doing so. */ } SEC("tracepoint/xdp/xdp_redirect_err") int trace_xdp_redirect_err(struct xdp_redirect_ctx *ctx) { return xdp_redirect_collect_stat(ctx); } SEC("tracepoint/xdp/xdp_redirect_map_err") int trace_xdp_redirect_map_err(struct xdp_redirect_ctx *ctx) { return xdp_redirect_collect_stat(ctx); } /* Likely unloaded when prog starts */ SEC("tracepoint/xdp/xdp_redirect") int trace_xdp_redirect(struct xdp_redirect_ctx *ctx) { return xdp_redirect_collect_stat(ctx); } /* Likely unloaded when prog starts */ SEC("tracepoint/xdp/xdp_redirect_map") int trace_xdp_redirect_map(struct xdp_redirect_ctx *ctx) { return xdp_redirect_collect_stat(ctx); } /* Tracepoint format: /sys/kernel/debug/tracing/events/xdp/xdp_exception/format * Code in: kernel/include/trace/events/xdp.h */ struct xdp_exception_ctx { u64 __pad; // First 8 bytes are not accessible by bpf code int prog_id; // offset:8; size:4; signed:1; u32 act; // offset:12; size:4; signed:0; int ifindex; // offset:16; size:4; signed:1; }; SEC("tracepoint/xdp/xdp_exception") int trace_xdp_exception(struct xdp_exception_ctx *ctx) { u64 *cnt; u32 key; key = ctx->act; if (key > XDP_REDIRECT) key = XDP_UNKNOWN; cnt = bpf_map_lookup_elem(&exception_cnt, &key); if (!cnt) return 1; *cnt += 1; return 0; } /* Common stats data record shared with _user.c */ struct datarec { u64 processed; u64 dropped; u64 info; u64 err; }; #define MAX_CPUS 64 struct { __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); __type(key, u32); __type(value, struct datarec); __uint(max_entries, MAX_CPUS); } cpumap_enqueue_cnt SEC(".maps"); struct { __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); __type(key, u32); __type(value, struct datarec); __uint(max_entries, 1); } cpumap_kthread_cnt SEC(".maps"); /* Tracepoint: /sys/kernel/debug/tracing/events/xdp/xdp_cpumap_enqueue/format * Code in: kernel/include/trace/events/xdp.h */ struct cpumap_enqueue_ctx { u64 __pad; // First 8 bytes are not accessible by bpf code int map_id; // offset:8; size:4; signed:1; u32 act; // offset:12; size:4; signed:0; int cpu; // offset:16; size:4; signed:1; unsigned int drops; // offset:20; size:4; signed:0; unsigned int processed; // offset:24; size:4; signed:0; int to_cpu; // offset:28; size:4; signed:1; }; SEC("tracepoint/xdp/xdp_cpumap_enqueue") int trace_xdp_cpumap_enqueue(struct cpumap_enqueue_ctx *ctx) { u32 to_cpu = ctx->to_cpu; struct datarec *rec; if (to_cpu >= MAX_CPUS) return 1; rec = bpf_map_lookup_elem(&cpumap_enqueue_cnt, &to_cpu); if (!rec) return 0; rec->processed += ctx->processed; rec->dropped += ctx->drops; /* Record bulk events, then userspace can calc average bulk size */ if (ctx->processed > 0) rec->info += 1; return 0; } /* Tracepoint: /sys/kernel/debug/tracing/events/xdp/xdp_cpumap_kthread/format * Code in: kernel/include/trace/events/xdp.h */ struct cpumap_kthread_ctx { u64 __pad; // First 8 bytes are not accessible by bpf code int map_id; // offset:8; size:4; signed:1; u32 act; // offset:12; size:4; signed:0; int cpu; // offset:16; size:4; signed:1; unsigned int drops; // offset:20; size:4; signed:0; unsigned int processed; // offset:24; size:4; signed:0; int sched; // offset:28; size:4; signed:1; }; SEC("tracepoint/xdp/xdp_cpumap_kthread") int trace_xdp_cpumap_kthread(struct cpumap_kthread_ctx *ctx) { struct datarec *rec; u32 key = 0; rec = bpf_map_lookup_elem(&cpumap_kthread_cnt, &key); if (!rec) return 0; rec->processed += ctx->processed; rec->dropped += ctx->drops; /* Count times kthread yielded CPU via schedule call */ if (ctx->sched) rec->info++; return 0; } struct { __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); __type(key, u32); __type(value, struct datarec); __uint(max_entries, 1); } devmap_xmit_cnt SEC(".maps"); /* Tracepoint: /sys/kernel/debug/tracing/events/xdp/xdp_devmap_xmit/format * Code in: kernel/include/trace/events/xdp.h */ struct devmap_xmit_ctx { u64 __pad; // First 8 bytes are not accessible by bpf code int from_ifindex; // offset:8; size:4; signed:1; u32 act; // offset:12; size:4; signed:0; int to_ifindex; // offset:16; size:4; signed:1; int drops; // offset:20; size:4; signed:1; int sent; // offset:24; size:4; signed:1; int err; // offset:28; size:4; signed:1; }; SEC("tracepoint/xdp/xdp_devmap_xmit") int trace_xdp_devmap_xmit(struct devmap_xmit_ctx *ctx) { struct datarec *rec; u32 key = 0; rec = bpf_map_lookup_elem(&devmap_xmit_cnt, &key); if (!rec) return 0; rec->processed += ctx->sent; rec->dropped += ctx->drops; /* Record bulk events, then userspace can calc average bulk size */ rec->info += 1; /* Record error cases, where no frame were sent */ if (ctx->err) rec->err++; /* Catch API error of drv ndo_xdp_xmit sent more than count */ if (ctx->drops < 0) rec->err++; return 1; } |