From 02991808536d655c15a6c887e79cbeeb07fb65d3 Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Sat, 1 Jul 2023 08:35:43 +0000 Subject: [PATCH] tetragon: Add support to count lost events Signed-off-by: Jiri Olsa --- bpf/lib/bpf_event.h | 26 +++++++++++++++++++++++++- pkg/sensors/base/base.go | 4 +++- 2 files changed, 28 insertions(+), 2 deletions(-) diff --git a/bpf/lib/bpf_event.h b/bpf/lib/bpf_event.h index 4dadd6c6b17..291b99431ae 100644 --- a/bpf/lib/bpf_event.h +++ b/bpf/lib/bpf_event.h @@ -16,10 +16,34 @@ struct { __type(value, struct event); } tcpmon_map SEC(".maps"); +struct { + __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); + __uint(max_entries, 255); + __type(key, __u32); + __type(value, __u64); +} lost_event SEC(".maps"); + +static inline __attribute__((always_inline)) void +inc_lost_event(void *ctx, __u8 op) +{ + __u32 idx = op; + __u64 *lost; + + lost = map_lookup_elem(&lost_event, &idx); + if (lost) + (*lost)++; +} + +#define ENOSPC 28 + static inline __attribute__((always_inline)) void send_event(void *ctx, void *data, size_t total, __u8 op) { - perf_event_output(ctx, &tcpmon_map, BPF_F_CURRENT_CPU, data, total); + long err; + + err = perf_event_output(ctx, &tcpmon_map, BPF_F_CURRENT_CPU, data, total); + if (err == -ENOSPC) + inc_lost_event(ctx, op); } #endif // __HUBBLE_MSG_ diff --git a/pkg/sensors/base/base.go b/pkg/sensors/base/base.go index d33a0a59400..79ab8909d17 100644 --- a/pkg/sensors/base/base.go +++ b/pkg/sensors/base/base.go @@ -37,7 +37,8 @@ var ( ) /* Event Ring map */ - TCPMonMap = program.MapBuilder("tcpmon_map", Execve) + TCPMonMap = program.MapBuilder("tcpmon_map", Execve) + LostEventMap = program.MapBuilder("lost_event", Execve) /* Networking and Process Monitoring maps */ ExecveMap = program.MapBuilder("execve_map", Execve) ExecveTailCallsMap = program.MapBuilderPin("execve_calls", "execve_calls", Execve) @@ -80,6 +81,7 @@ func GetDefaultMaps() []*program.Map { ExecveTailCallsMap, NamesMap, TCPMonMap, + LostEventMap, TetragonConfMap, } return maps