Stash the active backend in quark_queue_stats{}

The whole idea of "the user should not even know which backend is being used",
worked a bit too much.

This was prompted by a bug in beats where seccomp was blocking a syscall needed
for EBPF, and so it fell back to kprobe all the time and the user had no proper
way to notice this.

Related to elastic/beats#41297

Purposedly stashed this into stats to make it hard to retrieve from quark.c,
if we start doing `if (qq->backend == QQ_EBPF)` we lost the war.

Author: haesbaert

CHANGES

@@ -0,0 +1,9 @@
+Quark Breaking Changes
+~~~~~~~~~~~~~~~~~~~~~~
+  This file documents breaking and/or other changes that might require
+  user interaction. Examples include: a user facing structure change; a
+  new library call; a change in behaviour.
+
+Changes from 0.1 to 0.2
+~~~~~~~~~~~~~~~~~~~~~~~
+  o quark_queue_stats{} got a "backend" member.

bpf_queue.c

@@ -292,6 +292,7 @@ bpf_queue_open(struct quark_queue *qq)
 		goto fail;
 
 	qq->queue_ops = &queue_ops_bpf;
+	qq->stats.backend = QQ_EBPF;
 
 	return (0);
 fail:

docs/index.html

@@ -387,7 +387,7 @@ <h1 class="Sh" id="HISTORY"><a class="permalink" href="#HISTORY">HISTORY</a></h1
 </div>
 <table class="foot">
   <tr>
-    <td class="foot-date">October 15, 2024</td>
+    <td class="foot-date">October 18, 2024</td>
     <td class="foot-os">Linux</td>
   </tr>
 </table>

docs/quark.7.html

@@ -387,7 +387,7 @@ <h1 class="Sh" id="HISTORY"><a class="permalink" href="#HISTORY">HISTORY</a></h1
 </div>
 <table class="foot">
   <tr>
-    <td class="foot-date">October 15, 2024</td>
+    <td class="foot-date">October 18, 2024</td>
     <td class="foot-os">Linux</td>
   </tr>
 </table>

docs/quark_queue_get_stats.3.html

@@ -41,6 +41,7 @@ <h1 class="Sh" id="DESCRIPTION"><a class="permalink" href="#DESCRIPTION">DESCRIP
 	u64	aggregations;
 	u64	non_aggregations;
 	u64	lost;
+	int	backend;
 };</pre>
 </div>
 <dl class="Bl-tag">
@@ -67,6 +68,9 @@ <h1 class="Sh" id="DESCRIPTION"><a class="permalink" href="#DESCRIPTION">DESCRIP
       simply can't handle the load, the former is way more likely. It is a state
       counter representing total loss, the user should compare to an old reading
       to know if it increased.</dd>
+  <dt id="backend"><a class="permalink" href="#backend"><i class="Em">backend</i></a></dt>
+  <dd>Active queue backend, either <code class="Dv">QQ_EBPF</code> or
+      <code class="Dv">QQ_KPROBE</code>.</dd>
 </dl>
 <section class="Sh">
 <h1 class="Sh" id="SEE_ALSO"><a class="permalink" href="#SEE_ALSO">SEE
@@ -85,7 +89,7 @@ <h1 class="Sh" id="SEE_ALSO"><a class="permalink" href="#SEE_ALSO">SEE
 </div>
 <table class="foot">
   <tr>
-    <td class="foot-date">September 19, 2024</td>
+    <td class="foot-date">October 18, 2024</td>
     <td class="foot-os">Linux</td>
   </tr>
 </table>

kprobe_queue.c

@@ -1268,6 +1268,7 @@ kprobe_queue_open(struct quark_queue *qq)
 	}
 
 	qq->queue_ops = &queue_ops_kprobe;
+	qq->stats.backend = QQ_KPROBE;
 
 	return (0);
 

quark-mon.c

@@ -17,9 +17,9 @@
 static int gotsigint;
 
 static void
-quark_queue_dump_stats(struct quark_queue *qq)
+dump_stats(struct quark_queue *qq)
 {
-	struct quark_queue_stats s;
+	struct quark_queue_stats	s;
 
 	quark_queue_get_stats(qq, &s);
 	printf("%8llu insertions %8llu removals %8llu aggregations "
@@ -28,6 +28,18 @@ quark_queue_dump_stats(struct quark_queue *qq)
 	    s.non_aggregations, s.lost);
 }
 
+static const char *
+fetch_backend(struct quark_queue *qq)
+{
+	struct quark_queue_stats	s;
+
+	quark_queue_get_stats(qq, &s);
+
+	return (s.backend == QQ_EBPF ? "ebpf" :
+	    s.backend == QQ_KPROBE ? "kprobe" :
+	    "invalid");
+}
+
 static void
 sigint_handler(int sig)
 {
@@ -179,6 +191,9 @@ main(int argc, char *argv[])
 	if ((qevs = calloc(nqevs, sizeof(*qevs))) == NULL)
 		err(1, "calloc");
 
+	if (quark_verbose)
+		printf("using %s for backend\n", fetch_backend(qq));
+
 	/* From now on we will be nobody */
 	if (do_priv_drop)
 		priv_drop();
@@ -204,7 +219,8 @@ main(int argc, char *argv[])
 			quark_event_dump(qev, stdout);
 		/* No events, just block */
 		if (n == 0) {
-			quark_queue_block(qq);
+			if (quark_queue_block(qq) == -1 && errno != EINTR)
+				err(1, "quark_queue_block");
 			continue;
 		}
 	}
@@ -225,7 +241,7 @@ main(int argc, char *argv[])
 	}
 
 	free(qevs);
-	quark_queue_dump_stats(qq);
+	dump_stats(qq);
 	quark_queue_close(qq);
 	free(qq);
 

quark.h

@@ -335,6 +335,7 @@ struct quark_queue_stats {
 	u64	aggregations;
 	u64	non_aggregations;
 	u64	lost;
+	int	backend;	/* active backend, QQ_EBPF or QQ_KPROBE */
 	/* TODO u64	peak_nodes; */
 };
 

quark_queue_get_stats.3

@@ -23,6 +23,7 @@ struct quark_queue_stats {
 	u64	aggregations;
 	u64	non_aggregations;
 	u64	lost;
+	int	backend;
 };
 .Ed
 .Bl -tag -width "non_aggregations"
@@ -50,6 +51,11 @@ fast enough or if
 simply can't handle the load, the former is way more likely.
 It is a state counter representing total loss, the user should compare to an old
 reading to know if it increased.
+.It Em backend
+Active queue backend, either
+.Dv QQ_EBPF
+or
+.Dv QQ_KPROBE .
 .El
 .Sh SEE ALSO
 .Xr quark_event_dump 3 ,