• Sowmini Varadhan's avatar
    bpf: add perf event notificaton support for sock_ops · a5a3a828
    Sowmini Varadhan authored
    This patch allows eBPF programs that use sock_ops to send perf
    based event notifications using bpf_perf_event_output(). Our main
    use case for this is the following:
    
      We would like to monitor some subset of TCP sockets in user-space,
      (the monitoring application would define 4-tuples it wants to monitor)
      using TCP_INFO stats to analyze reported problems. The idea is to
      use those stats to see where the bottlenecks are likely to be ("is
      it application-limited?" or "is there evidence of BufferBloat in
      the path?" etc).
    
      Today we can do this by periodically polling for tcp_info, but this
      could be made more efficient if the kernel would asynchronously
      notify the application via tcp_info when some "interesting"
      thresholds (e.g., "RTT variance > X", or "total_retrans > Y" etc)
      are reached. And to make this effective, it is better if
      we could apply the threshold check *before* constructing the
      tcp_info netlink notification, so that we don't waste resources
      constructing notifications that will be discarded by the filter.
    
    This work solves the problem by adding perf event based notification
    support for sock_ops. The eBPF program can thus be designed to apply
    any desired filters to the bpf_sock_ops and trigger a perf event
    notification based on the evaluation from the filter. The user space
    component can use these perf event notifications to either read any
    state managed by the eBPF program, or issue a TCP_INFO netlink call
    if desired.
    Signed-off-by: default avatarSowmini Varadhan <sowmini.varadhan@oracle.com>
    Co-developed-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    a5a3a828
filter.c 203 KB