| 1 | // SPDX-License-Identifier: GPL-3.0-or-later |
| 2 | |
| 3 | #ifndef NETDATA_EBPF_IPC_H |
| 4 | #define NETDATA_EBPF_IPC_H 1 |
| 5 | |
| 6 | #ifndef TASK_COMM_LEN |
| 7 | #define TASK_COMM_LEN 16 |
| 8 | #endif |
| 9 | |
| 10 | #include "libnetdata/libnetdata.h" |
| 11 | #include <fcntl.h> |
| 12 | #include <sys/stat.h> |
| 13 | #include <semaphore.h> |
| 14 | |
| 15 | #ifdef __cplusplus |
| 16 | extern "C" { |
| 17 | #endif |
| 18 | |
| 19 | #include <stdlib.h> |
| 20 | #include <stdio.h> |
| 21 | #include <stdint.h> |
| 22 | |
| 23 | #include <bpf/bpf.h> |
| 24 | #include <bpf/libbpf.h> |
| 25 | #ifdef LIBBPF_DEPRECATED |
| 26 | #include <bpf/btf.h> |
| 27 | #include <linux/btf.h> |
| 28 | #endif |
| 29 | |
| 30 | typedef struct ebpf_user_mem_stat { |
| 31 | uint32_t total; |
| 32 | uint32_t current; |
| 33 | } ebpf_user_mem_stat_t; |
| 34 | |
| 35 | // ---------------------------------------------------------------------------- |
| 36 | // Enumeration used to identify threads with eBPF PIDs |
| 37 | enum ebpf_pids_index { |
| 38 | NETDATA_EBPF_PIDS_PROCESS_IDX, |
| 39 | NETDATA_EBPF_PIDS_SOCKET_IDX, |
| 40 | NETDATA_EBPF_PIDS_CACHESTAT_IDX, |
| 41 | NETDATA_EBPF_PIDS_DCSTAT_IDX, |
| 42 | NETDATA_EBPF_PIDS_SWAP_IDX, |
| 43 | NETDATA_EBPF_PIDS_VFS_IDX, |
| 44 | NETDATA_EBPF_PIDS_FD_IDX, |
| 45 | NETDATA_EBPF_PIDS_SHM_IDX, |
| 46 | |
| 47 | NETDATA_EBPF_PIDS_PROC_FILE, |
| 48 | NETDATA_EBPF_PIDS_END_IDX |
| 49 | }; |
| 50 | |
| 51 | // ---------------------------------------------------------------------------- |
| 52 | // Structures used to read data from kernel ring |
| 53 | typedef struct ebpf_process_stat { |
| 54 | uint64_t ct; |
| 55 | uint32_t uid; |
| 56 | uint32_t gid; |
| 57 | char name[TASK_COMM_LEN]; |
| 58 | |
| 59 | uint32_t tgid; |
| 60 | uint32_t pid; |
| 61 | |
| 62 | //Counter |
| 63 | uint32_t exit_call; |
| 64 | uint32_t release_call; |
| 65 | uint32_t create_process; |
| 66 | uint32_t create_thread; |
| 67 | |
| 68 | //Counter |
| 69 | uint32_t task_err; |
| 70 | } ebpf_process_stat_t; |
| 71 | |
| 72 | typedef struct ebpf_publish_process { |
| 73 | uint64_t ct; |
| 74 | |
| 75 | //Counter |
| 76 | uint32_t exit_call; |
| 77 | uint32_t release_call; |
| 78 | uint32_t create_process; |
| 79 | uint32_t create_thread; |
| 80 | |
| 81 | //Counter |
| 82 | uint32_t task_err; |
| 83 | } ebpf_publish_process_t; |
| 84 | |
| 85 | typedef struct ebpf_socket_publish_apps { |
| 86 | // Data read |
| 87 | uint64_t bytes_sent; // Bytes sent |
| 88 | uint64_t bytes_received; // Bytes received |
| 89 | uint64_t call_tcp_sent; // Number of times tcp_sendmsg was called |
| 90 | uint64_t call_tcp_received; // Number of times tcp_cleanup_rbuf was called |
| 91 | uint64_t retransmit; // Number of times tcp_retransmit was called |
| 92 | uint64_t call_udp_sent; // Number of times udp_sendmsg was called |
| 93 | uint64_t call_udp_received; // Number of times udp_recvmsg was called |
| 94 | uint64_t call_close; // Number of times tcp_close was called |
| 95 | uint64_t call_tcp_v4_connection; // Number of times tcp_v4_connect was called |
| 96 | uint64_t call_tcp_v6_connection; // Number of times tcp_v6_connect was called |
| 97 | } ebpf_socket_publish_apps_t; |
| 98 | |
| 99 | typedef struct netdata_socket { |
| 100 | char name[TASK_COMM_LEN]; |
| 101 | |
| 102 | // Timestamp |
| 103 | uint64_t first_timestamp; |
| 104 | uint64_t current_timestamp; |
| 105 | // Socket additional info |
| 106 | uint16_t protocol; |
| 107 | uint16_t family; |
| 108 | uint32_t external_origin; |
| 109 | struct { |
| 110 | uint32_t call_tcp_sent; |
| 111 | uint32_t call_tcp_received; |
| 112 | uint64_t tcp_bytes_sent; |
| 113 | uint64_t tcp_bytes_received; |
| 114 | uint32_t close; //It is never used with UDP |
| 115 | uint32_t retransmit; //It is never used with UDP |
| 116 | uint32_t ipv4_connect; |
| 117 | uint32_t ipv6_connect; |
| 118 | uint32_t state; // We do not have charts for it, because we are using network viewer plugin |
| 119 | } tcp; |
| 120 | |
| 121 | struct { |
| 122 | uint32_t call_udp_sent; |
| 123 | uint32_t call_udp_received; |
| 124 | uint64_t udp_bytes_sent; |
| 125 | uint64_t udp_bytes_received; |
| 126 | } udp; |
| 127 | } netdata_socket_t; |
| 128 | |
| 129 | typedef struct netdata_cachestat_pid { |
| 130 | uint64_t ct; |
| 131 | uint32_t tgid; |
| 132 | uint32_t uid; |
| 133 | uint32_t gid; |
| 134 | char name[TASK_COMM_LEN]; |
| 135 | |
| 136 | uint32_t add_to_page_cache_lru; |
| 137 | uint32_t mark_page_accessed; |
| 138 | uint32_t account_page_dirtied; |
| 139 | uint32_t mark_buffer_dirty; |
| 140 | } netdata_cachestat_pid_t; |
| 141 | |
| 142 | typedef struct netdata_cachestat { |
| 143 | uint32_t add_to_page_cache_lru; |
| 144 | uint32_t mark_page_accessed; |
| 145 | uint32_t account_page_dirtied; |
| 146 | uint32_t mark_buffer_dirty; |
| 147 | } netdata_cachestat_t; |
| 148 | |
| 149 | typedef struct netdata_publish_cachestat { |
| 150 | uint64_t ct; |
| 151 | |
| 152 | long long ratio; |
| 153 | long long dirty; |
| 154 | long long hit; |
| 155 | long long miss; |
| 156 | |
| 157 | netdata_cachestat_t current; |
| 158 | netdata_cachestat_t prev; |
| 159 | } netdata_publish_cachestat_t; |
| 160 | |
| 161 | typedef struct netdata_publish_dcstat_pid { |
| 162 | uint64_t cache_access; |
| 163 | uint64_t file_system; |
| 164 | uint64_t not_found; |
| 165 | } netdata_publish_dcstat_pid_t; |
| 166 | |
| 167 | typedef struct netdata_publish_dcstat { |
| 168 | uint64_t ct; |
| 169 | |
| 170 | long long ratio; |
| 171 | long long cache_access; |
| 172 | |
| 173 | netdata_publish_dcstat_pid_t curr; |
| 174 | netdata_publish_dcstat_pid_t prev; |
| 175 | } netdata_publish_dcstat_t; |
| 176 | |
| 177 | typedef struct netdata_dcstat_pid { |
| 178 | uint64_t ct; |
| 179 | uint32_t tgid; |
| 180 | uint32_t uid; |
| 181 | uint32_t gid; |
| 182 | char name[TASK_COMM_LEN]; |
| 183 | |
| 184 | uint64_t cache_access; |
| 185 | uint64_t file_system; |
| 186 | uint64_t not_found; |
| 187 | } netdata_dcstat_pid_t; |
| 188 | |
| 189 | typedef struct __attribute__((packed)) netdata_publish_swap { |
| 190 | uint64_t ct; |
| 191 | |
| 192 | uint32_t read; |
| 193 | uint32_t write; |
| 194 | } netdata_publish_swap_t; |
| 195 | |
| 196 | typedef struct netdata_ebpf_swap { |
| 197 | uint64_t ct; |
| 198 | uint32_t tgid; |
| 199 | uint32_t uid; |
| 200 | uint32_t gid; |
| 201 | char name[TASK_COMM_LEN]; |
| 202 | |
| 203 | uint32_t read; |
| 204 | uint32_t write; |
| 205 | } netdata_ebpf_swap_t; |
| 206 | |
| 207 | typedef struct netdata_publish_vfs { |
| 208 | uint64_t ct; |
| 209 | |
| 210 | //Counter |
| 211 | uint32_t write_call; |
| 212 | uint32_t writev_call; |
| 213 | uint32_t read_call; |
| 214 | uint32_t readv_call; |
| 215 | uint32_t unlink_call; |
| 216 | uint32_t fsync_call; |
| 217 | uint32_t open_call; |
| 218 | uint32_t create_call; |
| 219 | |
| 220 | //Accumulator |
| 221 | uint64_t write_bytes; |
| 222 | uint64_t writev_bytes; |
| 223 | uint64_t readv_bytes; |
| 224 | uint64_t read_bytes; |
| 225 | |
| 226 | //Counter |
| 227 | uint32_t write_err; |
| 228 | uint32_t writev_err; |
| 229 | uint32_t read_err; |
| 230 | uint32_t readv_err; |
| 231 | uint32_t unlink_err; |
| 232 | uint32_t fsync_err; |
| 233 | uint32_t open_err; |
| 234 | uint32_t create_err; |
| 235 | } netdata_publish_vfs_t; |
| 236 | |
| 237 | typedef struct netdata_ebpf_vfs { |
| 238 | uint64_t ct; |
| 239 | uint32_t tgid; |
| 240 | uint32_t uid; |
| 241 | uint32_t gid; |
| 242 | char name[TASK_COMM_LEN]; |
| 243 | |
| 244 | //Counter |
| 245 | uint32_t write_call; |
| 246 | uint32_t writev_call; |
| 247 | uint32_t read_call; |
| 248 | uint32_t readv_call; |
| 249 | uint32_t unlink_call; |
| 250 | uint32_t fsync_call; |
| 251 | uint32_t open_call; |
| 252 | uint32_t create_call; |
| 253 | |
| 254 | //Accumulator |
| 255 | uint64_t write_bytes; |
| 256 | uint64_t writev_bytes; |
| 257 | uint64_t readv_bytes; |
| 258 | uint64_t read_bytes; |
| 259 | |
| 260 | //Counter |
| 261 | uint32_t write_err; |
| 262 | uint32_t writev_err; |
| 263 | uint32_t read_err; |
| 264 | uint32_t readv_err; |
| 265 | uint32_t unlink_err; |
| 266 | uint32_t fsync_err; |
| 267 | uint32_t open_err; |
| 268 | uint32_t create_err; |
| 269 | } netdata_ebpf_vfs_t; |
| 270 | |
| 271 | typedef struct netdata_publish_fd_stat { |
| 272 | uint64_t ct; |
| 273 | |
| 274 | uint32_t open_call; // Open syscalls (open and openat) |
| 275 | uint32_t close_call; // Close syscall (close) |
| 276 | |
| 277 | // Errors |
| 278 | uint32_t open_err; |
| 279 | uint32_t close_err; |
| 280 | } netdata_publish_fd_stat_t; |
| 281 | |
| 282 | typedef struct netdata_fd_stat { |
| 283 | uint64_t ct; |
| 284 | uint32_t tgid; |
| 285 | uint32_t uid; |
| 286 | uint32_t gid; |
| 287 | char name[TASK_COMM_LEN]; |
| 288 | |
| 289 | uint32_t open_call; // Open syscalls (open and openat) |
| 290 | uint32_t close_call; // Close syscall (close) |
| 291 | |
| 292 | // Errors |
| 293 | uint32_t open_err; |
| 294 | uint32_t close_err; |
| 295 | } netdata_fd_stat_t; |
| 296 | |
| 297 | typedef struct netdata_publish_shm { |
| 298 | uint64_t ct; |
| 299 | |
| 300 | uint32_t get; |
| 301 | uint32_t at; |
| 302 | uint32_t dt; |
| 303 | uint32_t ctl; |
| 304 | } netdata_publish_shm_t; |
| 305 | |
| 306 | typedef struct netdata_ebpf_shm { |
| 307 | uint64_t ct; |
| 308 | uint32_t tgid; |
| 309 | uint32_t uid; |
| 310 | uint32_t gid; |
| 311 | char name[TASK_COMM_LEN]; |
| 312 | |
| 313 | uint32_t get; |
| 314 | uint32_t at; |
| 315 | uint32_t dt; |
| 316 | uint32_t ctl; |
| 317 | } netdata_ebpf_shm_t; |
| 318 | |
| 319 | typedef struct netdata_ebpf_pid_stats { |
| 320 | uint32_t threads; |
| 321 | uint32_t pid; |
| 322 | |
| 323 | ebpf_publish_process_t process; |
| 324 | ebpf_socket_publish_apps_t socket; |
| 325 | netdata_publish_cachestat_t cachestat; |
| 326 | netdata_publish_dcstat_t directory_cache; |
| 327 | netdata_publish_swap_t swap; |
| 328 | netdata_publish_vfs_t vfs; |
| 329 | netdata_publish_fd_stat_t fd; |
| 330 | netdata_publish_shm_t shm; |
| 331 | } netdata_ebpf_pid_stats_t; |
| 332 | |
| 333 | // ---------------------------------------------------------------------------- |
| 334 | // Helpers used during integration |
| 335 | |
| 336 | #define NETDATA_EBPF_INTEGRATION_NAME "netdata_shm_integration_ebpf" |
| 337 | #define NETDATA_EBPF_SHM_INTEGRATION_NAME "/netdata_sem_integration_ebpf" |
| 338 | |
| 339 | int netdata_integration_initialize_shm(size_t pids); |
| 340 | void netdata_integration_cleanup_shm(); |
| 341 | netdata_ebpf_pid_stats_t *netdata_ebpf_get_shm_pointer_unsafe(uint32_t pid, enum ebpf_pids_index idx); |
| 342 | netdata_ebpf_pid_stats_t *netdata_ebpf_lookup_shm_pointer_unsafe(uint32_t pid); |
| 343 | bool netdata_ebpf_reset_shm_pointer_unsafe(int fd, uint32_t pid, enum ebpf_pids_index idx); |
| 344 | void netdata_ebpf_sweep_shm_for_module_unsafe(enum ebpf_pids_index idx); |
| 345 | void netdata_integration_current_ipc_data(ebpf_user_mem_stat_t *values); |
| 346 | |
| 347 | extern sem_t *shm_mutex_ebpf_integration; |
| 348 | extern netdata_ebpf_pid_stats_t *integration_shm; |
| 349 | |
| 350 | #ifdef __cplusplus |
| 351 | } |
| 352 | #endif |
| 353 | |
| 354 | #endif //NETDATA_EBPF_IPC_H |