Use the libbpf library for the eBPF plugin (#9490)

CMakeLists.txt

@@ -299,6 +299,30 @@ find_package(libmongoc-1.0)
 # ${MONGOC_INCLUDE_DIRS}
 
 
+# -----------------------------------------------------------------------------
+# Detect libbpf
+IF(LINUX AND EXISTS "${CMAKE_SOURCE_DIR}/externaldeps/libbpf/libbpf.a")
+    message(STATUS "libbpf library found")
+    pkg_check_modules(ELF REQUIRED libelf)
+    # later we use:
+    # ${ELF_LIBRARIES}
+    # ${ELF_CFLAGS_OTHER}
+    # ${ELF_INCLUDE_DIRS}
+    IF(ELF_LIBRARIES)
+        list(APPEND NETDATA_COMMON_CFLAGS ${ELF_CFLAGS_OTHER})
+        list(INSERT NETDATA_COMMON_LIBRARIES 0
+            ${CMAKE_SOURCE_DIR}/externaldeps/libbpf/libbpf.a
+            ${ELF_LIBRARIES})
+        list(APPEND NETDATA_COMMON_INCLUDE_DIRS ${ELF_INCLUDE_DIRS})
+        include_directories(BEFORE ${CMAKE_SOURCE_DIR}/externaldeps/libbpf/include)
+        set(ENABLE_PLUGIN_EBPF True)
+    ELSE(ELF_LIBRARIES)
+        set(ENABLE_PLUGIN_EBPF False)
+        message(STATUS "ebpf plugin: disabled (requires libelf)")
+    ENDIF(ELF_LIBRARIES)
+ENDIF()
+
+
 # -----------------------------------------------------------------------------
 # netdata files
 
@@ -315,8 +339,6 @@ set(LIBNETDATA_FILES
         libnetdata/clocks/clocks.h
         libnetdata/dictionary/dictionary.c
         libnetdata/dictionary/dictionary.h
-        libnetdata/ebpf/ebpf.c
-        libnetdata/ebpf/ebpf.h
         libnetdata/eval/eval.c
         libnetdata/eval/eval.h
         libnetdata/inlined.h
@@ -357,6 +379,12 @@ set(LIBNETDATA_FILES
         libnetdata/circular_buffer/circular_buffer.c
         libnetdata/circular_buffer/circular_buffer.h)
 
+IF(ENABLE_PLUGIN_EBPF)
+    list(APPEND LIBNETDATA_FILES
+        libnetdata/ebpf/ebpf.c
+        libnetdata/ebpf/ebpf.h)
+ENDIF()
+
 add_library(libnetdata OBJECT ${LIBNETDATA_FILES})
 
 set(APPS_PLUGIN_FILES
@@ -928,7 +956,6 @@ IF(LINUX)
     SET(ENABLE_PLUGIN_APPS True)
     SET(ENABLE_PLUGIN_PERF True)
     SET(ENABLE_PLUGIN_SLABINFO True)
-    SET(ENABLE_PLUGIN_EBPF True)
 
 ELSEIF(FREEBSD)
     add_executable(netdata config.h ${NETDATA_FILES} ${FREEBSD_PLUGIN_FILES})

Makefile.am

@@ -73,6 +73,8 @@ dist_noinst_DATA = \
     packaging/bundle-dashboard.sh \
     packaging/bundle-mosquitto.sh \
     packaging/check-kernel-config.sh \
+    packaging/libbpf.checksums \
+    packaging/libbpf.version \
     packaging/ebpf.checksums \
     packaging/ebpf.version \
     packaging/bundle-lws.sh \
@@ -124,6 +126,7 @@ AM_CFLAGS = \
     $(OPTIONAL_IPMIMONITORING_CFLAGS) \
     $(OPTIONAL_CUPS_CFLAGS) \
     $(OPTIONAL_XENSTAT_CFLAGS) \
+    $(OPTIONAL_BPF_CFLAGS) \
     $(NULL)
 
 sbin_PROGRAMS =
@@ -144,8 +147,6 @@ LIBNETDATA_FILES = \
     libnetdata/clocks/clocks.h \
     libnetdata/dictionary/dictionary.c \
     libnetdata/dictionary/dictionary.h \
-    libnetdata/ebpf/ebpf.c \
-    libnetdata/ebpf/ebpf.h \
     libnetdata/eval/eval.c \
     libnetdata/eval/eval.h \
     libnetdata/inlined.h \
@@ -185,6 +186,13 @@ LIBNETDATA_FILES = \
     libnetdata/string/utf8.h \
     $(NULL)
 
+if ENABLE_PLUGIN_EBPF
+    LIBNETDATA_FILES += \
+        libnetdata/ebpf/ebpf.c \
+        libnetdata/ebpf/ebpf.h \
+        $(NULL)
+endif
+
 APPS_PLUGIN_FILES = \
     collectors/apps.plugin/apps_plugin.c \
     $(LIBNETDATA_FILES) \
@@ -665,6 +673,7 @@ endif
 
 NETDATA_COMMON_LIBS = \
     $(OPTIONAL_MATH_LIBS) \
+    $(OPTIONAL_BPF_LIBS) \
     $(OPTIONAL_ZLIB_LIBS) \
     $(OPTIONAL_SSL_LIBS) \
     $(OPTIONAL_UUID_LIBS) \
@@ -674,7 +683,6 @@ NETDATA_COMMON_LIBS = \
     $(OPTIONAL_JUDY_LIBS) \
     $(OPTIONAL_SSL_LIBS) \
     $(OPTIONAL_JSONC_LIBS) \
-    $(OPTIONAL_EBPF_LIBS) \
     $(NULL)
 
 if LINK_STATIC_JSONC

collectors/ebpf.plugin/ebpf.c

@@ -11,33 +11,35 @@
  *
  *****************************************************************/
 
-
 // callback required by eval()
-int health_variable_lookup(const char *variable, uint32_t hash, struct rrdcalc *rc, calculated_number *result) {
-    (void)variable;
-    (void)hash;
-    (void)rc;
-    (void)result;
+int health_variable_lookup(const char *variable, uint32_t hash, struct rrdcalc *rc, calculated_number *result)
+{
+    UNUSED(variable);
+    UNUSED(hash);
+    UNUSED(rc);
+    UNUSED(result);
     return 0;
 };
 
-void send_statistics( const char *action, const char *action_result, const char *action_data) {
-    (void) action;
-    (void) action_result;
-    (void) action_data;
+void send_statistics(const char *action, const char *action_result, const char *action_data)
+{
+    UNUSED(action);
+    UNUSED(action_result);
+    UNUSED(action_data);
     return;
 }
 
 // callbacks required by popen()
-void signals_block(void) {};
-void signals_unblock(void) {};
-void signals_reset(void) {};
+void signals_block(void){};
+void signals_unblock(void){};
+void signals_reset(void){};
 
 // required by get_system_cpus()
 char *netdata_configured_host_prefix = "";
 
 // callback required by fatal()
-void netdata_cleanup_and_exit(int ret) {
+void netdata_cleanup_and_exit(int ret)
+{
     exit(ret);
 }
 
@@ -56,9 +58,11 @@ static char *ebpf_configured_log_dir = LOG_DIR;
 int update_every = 1;
 static int thread_finished = 0;
 int close_ebpf_plugin = 0;
-struct config collector_config = { .first_section = NULL, .last_section = NULL, .mutex = NETDATA_MUTEX_INITIALIZER,
-                                    .index = { .avl_tree = { .root = NULL, .compar = appconfig_section_compare },
-                                               .rwlock = AVL_LOCK_INITIALIZER } };
+struct config collector_config = { .first_section = NULL,
+                                   .last_section = NULL,
+                                   .mutex = NETDATA_MUTEX_INITIALIZER,
+                                   .index = { .avl_tree = { .root = NULL, .compar = appconfig_section_compare },
+                                              .rwlock = AVL_LOCK_INITIALIZER } };
 
 int running_on_kernel = 0;
 char kernel_string[64];
@@ -106,7 +110,7 @@ ebpf_module_t ebpf_modules[] = {
       .global_charts = 0, .apps_charts = 1, .mode = MODE_ENTRY, .probes = NULL },
 };
 
-//Link with apps.plugin
+// Link with apps.plugin
 pid_t *pid_index;
 ebpf_process_stat_t *global_process_stat = NULL;
 
@@ -146,7 +150,7 @@ static void ebpf_exit(int sig)
 {
     close_ebpf_plugin = 1;
 
-    //When both threads were not finished case I try to go in front this address, the collector will crash
+    // When both threads were not finished case I try to go in front this address, the collector will crash
     if (!thread_finished) {
         return;
     }
@@ -157,32 +161,32 @@ static void ebpf_exit(int sig)
     freez(global_process_stat);
 
     int ret = fork();
-    if (ret < 0) //error
+    if (ret < 0) // error
         error("Cannot fork(), so I won't be able to clean %skprobe_events", NETDATA_DEBUGFS);
-    else if (!ret) { //child
+    else if (!ret) { // child
         int i;
-        for ( i=getdtablesize(); i>=0; --i)
+        for (i = getdtablesize(); i >= 0; --i)
             close(i);
 
-        int fd = open("/dev/null",O_RDWR, 0);
+        int fd = open("/dev/null", O_RDWR, 0);
         if (fd != -1) {
-            dup2 (fd, STDIN_FILENO);
-            dup2 (fd, STDOUT_FILENO);
-            dup2 (fd, STDERR_FILENO);
+            dup2(fd, STDIN_FILENO);
+            dup2(fd, STDOUT_FILENO);
+            dup2(fd, STDERR_FILENO);
         }
 
         if (fd > 2)
-            close (fd);
+            close(fd);
 
         int sid = setsid();
-        if(sid >= 0) {
+        if (sid >= 0) {
             debug(D_EXIT, "Wait for father %d die", getpid());
             sleep_usec(200000); //Sleep 200 miliseconds to father dies.
             clean_loaded_events();
         } else {
             error("Cannot become session id leader, so I won't try to clean kprobe_events.\n");
         }
-    } else { //parent
+    } else { // parent
         exit(0);
     }
 
@@ -195,7 +199,6 @@ static void ebpf_exit(int sig)
  *
  *****************************************************************/
 
-
 /**
  * Get a value from a structure.
  *
@@ -205,10 +208,10 @@ static void ebpf_exit(int sig)
  */
 collected_number get_value_from_structure(char *basis, size_t offset)
 {
-    collected_number *value =  (collected_number *)(basis + offset);
+    collected_number *value = (collected_number *)(basis + offset);
 
-    collected_number ret =  (collected_number)llabs(*value);
-    //this reset is necessary to avoid keep a constant value while processing is not executing a task
+    collected_number ret = (collected_number)llabs(*value);
+    // this reset is necessary to avoid keep a constant value while processing is not executing a task
     *value = 0;
 
     return ret;
@@ -222,9 +225,7 @@ collected_number get_value_from_structure(char *basis, size_t offset)
  */
 void write_begin_chart(char *family, char *name)
 {
-    printf( "BEGIN %s.%s\n"
-           , family
-           , name);
+    printf("BEGIN %s.%s\n", family, name);
 }
 
 /**
@@ -244,7 +245,7 @@ inline void write_end_chart()
 void write_chart_dimension(char *dim, long long value)
 {
     int ret = printf("SET %s = %lld\n", dim, value);
-    (void)ret;
+    UNUSED(ret);
 }
 
 /**
@@ -257,7 +258,8 @@ void write_chart_dimension(char *dim, long long value)
  *
  * @return It returns a variable tha maps the charts that did not have zero values.
  */
-void write_count_chart(char *name, char *family, netdata_publish_syscall_t *move, uint32_t end) {
+void write_count_chart(char *name, char *family, netdata_publish_syscall_t *move, uint32_t end)
+{
     write_begin_chart(family, name);
 
     uint32_t i = 0;
@@ -279,7 +281,8 @@ void write_count_chart(char *name, char *family, netdata_publish_syscall_t *move
  * @param move    the pointer with the values that will be published
  * @param end     the number of values that will be written on standard output
  */
-void write_err_chart(char *name, char *family, netdata_publish_syscall_t *move, int end) {
+void write_err_chart(char *name, char *family, netdata_publish_syscall_t *move, int end)
+{
     write_begin_chart(family, name);
 
     int i = 0;
@@ -293,7 +296,6 @@ void write_err_chart(char *name, char *family, netdata_publish_syscall_t *move,
     write_end_chart();
 }
 
-
 /**
  * Call the necessary functions to create a chart.
  *
@@ -302,10 +304,11 @@ void write_err_chart(char *name, char *family, netdata_publish_syscall_t *move,
  *
  * @return It returns a variable tha maps the charts that did not have zero values.
  */
-void write_io_chart(char *chart, char *family, char *dwrite, char *dread, netdata_publish_vfs_common_t *pvc) {
+void write_io_chart(char *chart, char *family, char *dwrite, char *dread, netdata_publish_vfs_common_t *pvc)
+{
     write_begin_chart(family, chart);
 
-    write_chart_dimension(dwrite, (long long) pvc->write);
+    write_chart_dimension(dwrite, (long long)pvc->write);
     write_chart_dimension(dread, (long long)pvc->read);
 
     write_end_chart();
@@ -377,15 +380,15 @@ void ebpf_create_global_dimension(void *ptr, int end)
  * @param move   a pointer for a structure that has the dimensions
  * @param end    number of dimensions for the chart created
  */
-void ebpf_create_chart(char *type
-    , char *id
-    , char *title
-    , char *units
-    , char *family
-    , int order
-    , void (*ncd)(void *, int)
-    , void *move
-    , int end)
+void ebpf_create_chart(char *type,
+                       char *id,
+                       char *title,
+                       char *units,
+                       char *family,
+                       int order,
+                       void (*ncd)(void *, int),
+                       void *move,
+                       int end)
 {
     ebpf_write_chart_cmd(type, id, title, units, family, "line", order);
 
@@ -407,8 +410,8 @@ void ebpf_create_charts_on_apps(char *id, char *title, char *units, char *family
     struct target *w;
     ebpf_write_chart_cmd(NETDATA_APPS_FAMILY, id, title, units, family, "stacked", order);
 
-    for (w = root; w ; w = w->next) {
-        if(unlikely(w->exposed))
+    for (w = root; w; w = w->next) {
+        if (unlikely(w->exposed))
             fprintf(stdout, "DIMENSION %s '' absolute 1 1\n", w->name);
     }
 }
@@ -428,20 +431,21 @@ void ebpf_create_charts_on_apps(char *id, char *title, char *units, char *family
  * @param name a pointer for the tensor with the name of the functions.
  * @param end  the number of elements in the previous 4 arguments.
  */
-void ebpf_global_labels(netdata_syscall_stat_t *is, netdata_publish_syscall_t *pio, char **dim, char **name, int end) {
+void ebpf_global_labels(netdata_syscall_stat_t *is, netdata_publish_syscall_t *pio, char **dim, char **name, int end)
+{
     int i;
 
     netdata_syscall_stat_t *prev = NULL;
     netdata_publish_syscall_t *publish_prev = NULL;
     for (i = 0; i < end; i++) {
-        if(prev) {
+        if (prev) {
             prev->next = &is[i];
         }
         prev = &is[i];
 
         pio[i].dimension = dim[i];
         pio[i].name = name[i];
-        if(publish_prev) {
+        if (publish_prev) {
             publish_prev->next = &pio[i];
         }
         publish_prev = &pio[i];
@@ -453,9 +457,10 @@ void ebpf_global_labels(netdata_syscall_stat_t *is, netdata_publish_syscall_t *p
  *
  * @param lmode  the mode that will be used for them.
  */
-static inline void ebpf_set_thread_mode(netdata_run_mode_t lmode) {
-    int i ;
-    for (i = 0 ; ebpf_modules[i].thread_name ; i++ ) {
+static inline void ebpf_set_thread_mode(netdata_run_mode_t lmode)
+{
+    int i;
+    for (i = 0; ebpf_modules[i].thread_name; i++) {
         ebpf_modules[i].mode = lmode;
     }
 }
@@ -466,7 +471,8 @@ static inline void ebpf_set_thread_mode(netdata_run_mode_t lmode) {
  * @param em      the structure that will be changed
  * @param enable the status about the apps charts.
  */
-static inline void ebpf_enable_specific_chart(struct  ebpf_module *em, int enable) {
+static inline void ebpf_enable_specific_chart(struct ebpf_module *em, int enable)
+{
     em->enabled = 1;
     if (!enable) {
         em->apps_charts = 1;
@@ -479,9 +485,10 @@ static inline void ebpf_enable_specific_chart(struct  ebpf_module *em, int enabl
  *
  * @param apps what is the current status of apps
  */
-static inline void ebpf_enable_all_charts(int apps) {
-    int i ;
-    for (i = 0 ; ebpf_modules[i].thread_name ; i++ ) {
+static inline void ebpf_enable_all_charts(int apps)
+{
+    int i;
+    for (i = 0; ebpf_modules[i].thread_name; i++) {
         ebpf_enable_specific_chart(&ebpf_modules[i], apps);
     }
 }
@@ -492,9 +499,10 @@ static inline void ebpf_enable_all_charts(int apps) {
  * @param idx            the index of ebpf_modules that I am enabling
  * @param disable_apps   should I keep apps charts?
  */
-static inline void ebpf_enable_chart(int idx, int disable_apps) {
-    int i ;
-    for (i = 0 ; ebpf_modules[i].thread_name ; i++ ) {
+static inline void ebpf_enable_chart(int idx, int disable_apps)
+{
+    int i;
+    for (i = 0; ebpf_modules[i].thread_name; i++) {
         if (i == idx) {
             ebpf_enable_specific_chart(&ebpf_modules[i], disable_apps);
             break;
@@ -507,9 +515,10 @@ static inline void ebpf_enable_chart(int idx, int disable_apps) {
  *
  * Disable charts for apps loading only global charts.
  */
-static inline void ebpf_disable_apps() {
-    int i ;
-    for (i = 0 ;ebpf_modules[i].thread_name ; i++ ) {
+static inline void ebpf_disable_apps()
+{
+    int i;
+    for (i = 0; ebpf_modules[i].thread_name; i++) {
         ebpf_modules[i].apps_charts = 0;
     }
 }
@@ -517,7 +526,8 @@ static inline void ebpf_disable_apps() {
 /**
  * Print help on standard error for user knows how to use the collector.
  */
-void ebpf_print_help() {
+void ebpf_print_help()
+{
     const time_t t = time(NULL);
     struct tm ct;
     struct tm *test = localtime_r(&t, &ct);
@@ -553,10 +563,9 @@ void ebpf_print_help() {
             " --process or -p   Enable charts related to process run time.\n"
             "\n"
             " --return or -r    Run the collector in return mode.\n"
-            "\n"
-            , VERSION
-            , (year >= 116)?year + 1900: 2020
-    );
+            "\n",
+            VERSION,
+            (year >= 116) ? year + 1900 : 2020);
 }
 
 /*****************************************************************
@@ -591,18 +600,19 @@ int ebpf_start_pthread_variables()
  */
 static void ebpf_allocate_common_vectors()
 {
-    all_pids = callocz((size_t) pid_max, sizeof(struct pid_stat *));
+    all_pids = callocz((size_t)pid_max, sizeof(struct pid_stat *));
     pid_index = callocz((size_t)pid_max, sizeof(pid_t));
     global_process_stat = callocz((size_t)ebpf_nprocs, sizeof(ebpf_process_stat_t));
 }
 
 /**
- * Fill the ebpf_functions structure with default values
+ * Fill the ebpf_data structure with default values
  *
  * @param ef the pointer to set default values
  */
-void fill_ebpf_functions(ebpf_functions_t *ef) {
-    memset(ef, 0, sizeof(ebpf_functions_t));
+void fill_ebpf_data(ebpf_data_t *ef)
+{
+    memset(ef, 0, sizeof(ebpf_data_t));
     ef->kernel_string = kernel_string;
     ef->running_on_kernel = running_on_kernel;
     ef->map_fd = callocz(EBPF_MAX_MAPS, sizeof(int));
@@ -648,10 +658,11 @@ static inline int parse_disable_apps(char *ptr)
  *
  * @param disable_apps variable to store information related to apps.
  */
-static void read_collector_values(int *disable_apps) {
+static void read_collector_values(int *disable_apps)
+{
     // Read global section
     char *value;
-    if (appconfig_exists(&collector_config,  EBPF_GLOBAL_SECTION, "load")) //Backward compatibility
+    if (appconfig_exists(&collector_config, EBPF_GLOBAL_SECTION, "load")) // Backward compatibility
         value = appconfig_get(&collector_config, EBPF_GLOBAL_SECTION, "load", "entry");
     else
         value = appconfig_get(&collector_config, EBPF_GLOBAL_SECTION, "ebpf load mode", "entry");
@@ -662,16 +673,14 @@ static void read_collector_values(int *disable_apps) {
     *disable_apps = parse_disable_apps(value);
 
     // Read ebpf programs section
-    uint32_t enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION,
-                                             ebpf_modules[0].config_name, 1);
+    uint32_t enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, ebpf_modules[0].config_name, 1);
     int started = 0;
     if (enabled) {
         ebpf_enable_chart(EBPF_MODULE_PROCESS_IDX, *disable_apps);
         started++;
     }
 
-    enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION,
-                                    ebpf_modules[1].config_name, 1);
+    enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, ebpf_modules[1].config_name, 1);
     if (enabled) {
         ebpf_enable_chart(EBPF_MODULE_SOCKET_IDX, *disable_apps);
         started++;
@@ -679,7 +688,6 @@ static void read_collector_values(int *disable_apps) {
 
     if (!started)
         ebpf_enable_all_charts(*disable_apps);
-
 }
 
 /**
@@ -690,10 +698,11 @@ static void read_collector_values(int *disable_apps) {
  *
  * @return 0 on success and -1 otherwise.
  */
-static int load_collector_config(char *path, int *disable_apps) {
+static int load_collector_config(char *path, int *disable_apps)
+{
     char lpath[4096];
 
-    snprintf(lpath, 4095, "%s/%s", path, "ebpf.conf" );
+    snprintf(lpath, 4095, "%s/%s", path, "ebpf.conf");
 
     if (!appconfig_load(&collector_config, lpath, 0, NULL))
         return -1;
@@ -706,22 +715,23 @@ static int load_collector_config(char *path, int *disable_apps) {
 /**
  * Set global variables reading environment variables
  */
-void set_global_variables() {
-    //Get environment variables
+void set_global_variables()
+{
+    // Get environment variables
     ebpf_plugin_dir = getenv("NETDATA_PLUGINS_DIR");
-    if(!ebpf_plugin_dir)
+    if (!ebpf_plugin_dir)
         ebpf_plugin_dir = PLUGINS_DIR;
 
     ebpf_user_config_dir = getenv("NETDATA_USER_CONFIG_DIR");
-    if(!ebpf_user_config_dir)
+    if (!ebpf_user_config_dir)
         ebpf_user_config_dir = CONFIG_DIR;
 
     ebpf_stock_config_dir = getenv("NETDATA_STOCK_CONFIG_DIR");
-    if(!ebpf_stock_config_dir)
+    if (!ebpf_stock_config_dir)
         ebpf_stock_config_dir = LIBCONFIG_DIR;
 
     ebpf_configured_log_dir = getenv("NETDATA_LOG_DIR");
-    if(!ebpf_configured_log_dir)
+    if (!ebpf_configured_log_dir)
         ebpf_configured_log_dir = LOG_DIR;
 
     ebpf_nprocs = (int)sysconf(_SC_NPROCESSORS_ONLN);
@@ -730,7 +740,7 @@ void set_global_variables() {
     }
 
     isrh = get_redhat_release();
-    pid_max =  get_system_pid_max();
+    pid_max = get_system_pid_max();
 }
 
 /**
@@ -758,13 +768,13 @@ static void parse_args(int argc, char **argv)
 
     if (argc > 1) {
         int n = (int)str2l(argv[1]);
-        if(n > 0) {
+        if (n > 0) {
             freq = n;
         }
     }
 
     while (1) {
-        int c = getopt_long(argc, argv, "hvganpr",long_options, &option_index);
+        int c = getopt_long(argc, argv, "hvganpr", long_options, &option_index);
         if (c == -1)
             break;
 
@@ -781,7 +791,8 @@ static void parse_args(int argc, char **argv)
                 disable_apps = 1;
                 ebpf_disable_apps();
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF running with global chart group, because it was started with the option \"--global\" or \"-g\".");
+                info(
+                    "EBPF running with global chart group, because it was started with the option \"--global\" or \"-g\".");
 #endif
                 break;
             }
@@ -804,7 +815,8 @@ static void parse_args(int argc, char **argv)
                 enabled = 1;
                 ebpf_enable_chart(EBPF_MODULE_PROCESS_IDX, disable_apps);
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"PROCESS\" charts, because it was started with the option \"--process\" or \"-p\".");
+                info(
+                    "EBPF enabling \"PROCESS\" charts, because it was started with the option \"--process\" or \"-p\".");
 #endif
                 break;
             }
@@ -826,8 +838,9 @@ static void parse_args(int argc, char **argv)
     }
 
     if (load_collector_config(ebpf_user_config_dir, &disable_apps)) {
-        info("Does not have a configuration file inside `%s/ebpf.conf. It will try to load stock file.",
-              ebpf_user_config_dir);
+        info(
+            "Does not have a configuration file inside `%s/ebpf.conf. It will try to load stock file.",
+            ebpf_user_config_dir);
         if (load_collector_config(ebpf_stock_config_dir, &disable_apps)) {
             info("Does not have a stock file. It is starting with default options.");
         } else {
@@ -847,15 +860,17 @@ static void parse_args(int argc, char **argv)
     if (disable_apps)
         return;
 
-    //Load apps_groups.conf
-    if (ebpf_read_apps_groups_conf(&apps_groups_default_target, &apps_groups_root_target,
-                                   ebpf_user_config_dir, "groups") ) {
-        info("Cannot read process groups configuration file '%s/apps_groups.conf'. Will try '%s/apps_groups.conf'",
-             ebpf_user_config_dir, ebpf_stock_config_dir);
-        if (ebpf_read_apps_groups_conf(&apps_groups_default_target, &apps_groups_root_target,
-                                       ebpf_stock_config_dir, "groups") ) {
-            error("Cannot read process groups '%s/apps_groups.conf'. There are no internal defaults. Failing.",
-                  ebpf_stock_config_dir);
+    // Load apps_groups.conf
+    if (ebpf_read_apps_groups_conf(
+            &apps_groups_default_target, &apps_groups_root_target, ebpf_user_config_dir, "groups")) {
+        info(
+            "Cannot read process groups configuration file '%s/apps_groups.conf'. Will try '%s/apps_groups.conf'",
+            ebpf_user_config_dir, ebpf_stock_config_dir);
+        if (ebpf_read_apps_groups_conf(
+                &apps_groups_default_target, &apps_groups_root_target, ebpf_stock_config_dir, "groups")) {
+            error(
+                "Cannot read process groups '%s/apps_groups.conf'. There are no internal defaults. Failing.",
+                ebpf_stock_config_dir);
             thread_finished++;
             ebpf_exit(1);
         }
@@ -863,7 +878,6 @@ static void parse_args(int argc, char **argv)
         info("Loaded config file '%s/apps_groups.conf'", ebpf_user_config_dir);
 }
 
-
 /*****************************************************************
  *
  *  COLLECTOR ENTRY POINT
@@ -883,30 +897,30 @@ int main(int argc, char **argv)
     set_global_variables();
     parse_args(argc, argv);
 
-    running_on_kernel =  get_kernel_version(kernel_string, 63);
-    if(!has_condition_to_run(running_on_kernel)) {
+    running_on_kernel = get_kernel_version(kernel_string, 63);
+    if (!has_condition_to_run(running_on_kernel)) {
         error("The current collector cannot run on this kernel.");
         return 2;
     }
 
-    if(!am_i_running_as_root()) {
-        error("ebpf.plugin should either run as root (now running with uid %u, euid %u) or have special capabilities..",
-              (unsigned int)getuid(), (unsigned int)geteuid()
-              );
+    if (!am_i_running_as_root()) {
+        error(
+            "ebpf.plugin should either run as root (now running with uid %u, euid %u) or have special capabilities..",
+            (unsigned int)getuid(), (unsigned int)geteuid());
         return 3;
     }
 
-    //set name
+    // set name
     program_name = "ebpf.plugin";
 
-    //disable syslog
+    // disable syslog
     error_log_syslog = 0;
 
     // set errors flood protection to 100 logs per hour
     error_log_errors_per_period = 100;
     error_log_throttle_period = 3600;
 
-    struct rlimit r = {RLIM_INFINITY, RLIM_INFINITY};
+    struct rlimit r = { RLIM_INFINITY, RLIM_INFINITY };
     if (setrlimit(RLIMIT_MEMLOCK, &r)) {
         error("Setrlimit(RLIMIT_MEMLOCK)");
         return 4;
@@ -925,16 +939,16 @@ int main(int argc, char **argv)
     ebpf_allocate_common_vectors();
 
     struct netdata_static_thread ebpf_threads[] = {
-        {"EBPF PROCESS",             NULL,                    NULL,         1, NULL, NULL,  ebpf_modules[0].start_routine},
-        {"EBPF SOCKET",             NULL,                    NULL,         1, NULL, NULL,  ebpf_modules[1].start_routine},
-        {NULL,                   NULL,                    NULL,         0, NULL, NULL, NULL}
+        {"EBPF PROCESS", NULL, NULL, 1, NULL, NULL, ebpf_modules[0].start_routine},
+        {"EBPF SOCKET" , NULL, NULL, 1, NULL, NULL, ebpf_modules[1].start_routine},
+        {NULL          , NULL, NULL, 0, NULL, NULL, NULL}
     };
 
     change_events();
     clean_loaded_events();
 
     int i;
-    for (i = 0; ebpf_threads[i].name != NULL ; i++) {
+    for (i = 0; ebpf_threads[i].name != NULL; i++) {
         struct netdata_static_thread *st = &ebpf_threads[i];
         st->thread = mallocz(sizeof(netdata_thread_t));
 
@@ -943,7 +957,7 @@ int main(int argc, char **argv)
         netdata_thread_create(st->thread, st->name, NETDATA_THREAD_OPTION_JOINABLE, st->start_routine, em);
     }
 
-    for (i = 0; ebpf_threads[i].name != NULL ; i++) {
+    for (i = 0; ebpf_threads[i].name != NULL; i++) {
         struct netdata_static_thread *st = &ebpf_threads[i];
         netdata_thread_join(*st->thread, NULL);
     }

collectors/ebpf.plugin/ebpf.h

@@ -1,49 +1,48 @@
-#ifndef _NETDATA_VFS_EBPF_H_
-# define _NETDATA_VFS_EBPF_H_ 1
+// SPDX-License-Identifier: GPL-3.0-or-later
 
-# include <stdint.h>
+#ifndef NETDATA_COLLECTOR_EBPF_H
+#define NETDATA_COLLECTOR_EBPF_H 1
 
 #ifndef __FreeBSD__
-#   include <linux/perf_event.h>
-# endif
-# include <stdint.h>
-# include <errno.h>
-# include <signal.h>
-# include <stdio.h>
-# include <stdint.h>
-# include <stdlib.h>
-# include <string.h>
-# include <unistd.h>
-# include <dlfcn.h>
-
-# include <fcntl.h>
-# include <ctype.h>
-# include <dirent.h>
-
-//From libnetdata.h
-# include "libnetdata/threads/threads.h"
-# include "libnetdata/locks/locks.h"
-# include "libnetdata/avl/avl.h"
-# include "libnetdata/clocks/clocks.h"
-# include "libnetdata/config/appconfig.h"
-# include "libnetdata/ebpf/ebpf.h"
-# include "libnetdata/procfile/procfile.h"
-# include "daemon/main.h"
-
-# include "ebpf_apps.h"
+#include <linux/perf_event.h>
+#endif
+#include <stdint.h>
+#include <errno.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <dlfcn.h>
+
+#include <fcntl.h>
+#include <ctype.h>
+#include <dirent.h>
+
+// From libnetdata.h
+#include "libnetdata/threads/threads.h"
+#include "libnetdata/locks/locks.h"
+#include "libnetdata/avl/avl.h"
+#include "libnetdata/clocks/clocks.h"
+#include "libnetdata/config/appconfig.h"
+#include "libnetdata/ebpf/ebpf.h"
+#include "libnetdata/procfile/procfile.h"
+#include "daemon/main.h"
+
+#include "ebpf_apps.h"
 
 typedef enum {
-    MODE_RETURN = 0,    //This attaches kprobe when the function returns
-    MODE_DEVMODE,       //This stores log given description about the errors raised
-    MODE_ENTRY          //This attaches kprobe when the function is called
+    MODE_RETURN = 0, // This attaches kprobe when the function returns
+    MODE_DEVMODE,    // This stores log given description about the errors raised
+    MODE_ENTRY       // This attaches kprobe when the function is called
 } netdata_run_mode_t;
 
 typedef struct netdata_syscall_stat {
-    unsigned long bytes;                //total number of bytes
-    uint64_t call;                      //total number of calls
-    uint64_t ecall;                     //number of calls that returned error
-    struct netdata_syscall_stat  *next; //Link list
-}netdata_syscall_stat_t;
+    unsigned long bytes;               // total number of bytes
+    uint64_t call;                     // total number of calls
+    uint64_t ecall;                    // number of calls that returned error
+    struct netdata_syscall_stat *next; // Link list
+} netdata_syscall_stat_t;
 
 typedef uint64_t netdata_idx_t;
 
@@ -57,7 +56,7 @@ typedef struct netdata_publish_syscall {
     uint64_t nerr;
     uint64_t perr;
     struct netdata_publish_syscall *next;
-}netdata_publish_syscall_t;
+} netdata_publish_syscall_t;
 
 typedef struct netdata_publish_vfs_common {
     long write;
@@ -65,7 +64,7 @@ typedef struct netdata_publish_vfs_common {
 
     long running;
     long zombie;
-}netdata_publish_vfs_common_t;
+} netdata_publish_vfs_common_t;
 
 typedef struct netdata_error_report {
     char comm[16];
@@ -73,13 +72,13 @@ typedef struct netdata_error_report {
 
     int type;
     int err;
-}netdata_error_report_t;
+} netdata_error_report_t;
 
 typedef struct ebpf_module {
     const char *thread_name;
     const char *config_name;
     int enabled;
-    void *(*start_routine) (void *);
+    void *(*start_routine)(void *);
     int update_time;
     int global_charts;
     int apps_charts;
@@ -93,38 +92,36 @@ extern ebpf_module_t ebpf_modules[];
 #define EBPF_MODULE_SOCKET_IDX 1
 
 // Copied from musl header
-//
 #ifndef offsetof
-# if __GNUC__ > 3
-#  define offsetof(type, member) __builtin_offsetof(type, member)
-# else
-#  define offsetof(type, member) ((size_t)( (char *)&(((type *)0)->member) - (char *)0 ))
-# endif
+#if __GNUC__ > 3
+#define offsetof(type, member) __builtin_offsetof(type, member)
+#else
+#define offsetof(type, member) ((size_t)((char *)&(((type *)0)->member) - (char *)0))
+#endif
 #endif
 
-//Chart defintions
-# define NETDATA_EBPF_FAMILY "ebpf"
-
-//Log file
-# define NETDATA_DEVELOPER_LOG_FILE "developer.log"
+// Chart defintions
+#define NETDATA_EBPF_FAMILY "ebpf"
 
-//Maximum number of processors monitored on perf events
-# define NETDATA_MAX_PROCESSOR 512
+// Log file
+#define NETDATA_DEVELOPER_LOG_FILE "developer.log"
 
-//Kernel versions calculated with the formula:
-//   R = MAJOR*65536 + MINOR*256 + PATCH
-# define NETDATA_KERNEL_V5_3 328448
-# define NETDATA_KERNEL_V4_15 265984
+// Maximum number of processors monitored on perf events
+#define NETDATA_MAX_PROCESSOR 512
 
-# define EBPF_SYS_CLONE_IDX 11
-# define EBPF_MAX_MAPS 32
+// Kernel versions calculated with the formula:
+// R = MAJOR*65536 + MINOR*256 + PATCH
+#define NETDATA_KERNEL_V5_3 328448
+#define NETDATA_KERNEL_V4_15 265984
 
+#define EBPF_SYS_CLONE_IDX 11
+#define EBPF_MAX_MAPS 32
 
-//Threads
+// Threads
 extern void *ebpf_process_thread(void *ptr);
 extern void *ebpf_socket_thread(void *ptr);
 
-//Common variables
+// Common variables
 extern pthread_mutex_t lock;
 extern int close_ebpf_plugin;
 extern int ebpf_nprocs;
@@ -137,29 +134,34 @@ extern netdata_ebpf_events_t socket_probes[];
 extern pthread_mutex_t collect_data_mutex;
 extern pthread_cond_t collect_data_cond_var;
 
-//Common functions
+// Common functions
 extern void ebpf_global_labels(netdata_syscall_stat_t *is,
                                netdata_publish_syscall_t *pio,
                                char **dim,
                                char **name,
                                int end);
 
-extern void ebpf_write_chart_cmd(char *type, char *id, char *title, char *units, char *family,
-                                 char *charttype, int order);
+extern void ebpf_write_chart_cmd(char *type,
+                                 char *id,
+                                 char *title,
+                                 char *units,
+                                 char *family,
+                                 char *charttype,
+                                 int order);
 
 extern void ebpf_write_global_dimension(char *n, char *d);
 
 extern void ebpf_create_global_dimension(void *ptr, int end);
 
-extern void ebpf_create_chart(char *type
-    , char *id
-    , char *title
-    , char *units
-    , char *family
-    , int order
-    , void (*ncd)(void *, int)
-    , void *move
-    , int end);
+extern void ebpf_create_chart(char *type,
+                              char *id,
+                              char *title,
+                              char *units,
+                              char *family,
+                              int order,
+                              void (*ncd)(void *, int),
+                              void *move,
+                              int end);
 
 extern void write_begin_chart(char *family, char *name);
 
@@ -171,39 +173,43 @@ extern void write_err_chart(char *name, char *family, netdata_publish_syscall_t
 
 extern void write_io_chart(char *chart, char *family, char *dwrite, char *dread, netdata_publish_vfs_common_t *pvc);
 
-extern void fill_ebpf_functions(ebpf_functions_t *ef);
+extern void fill_ebpf_data(ebpf_data_t *ef);
 
-extern void ebpf_create_charts_on_apps(char *name, char *title, char *units, char *family,
-                                       int order, struct target *root);
+extern void ebpf_create_charts_on_apps(char *name,
+                                       char *title,
+                                       char *units,
+                                       char *family,
+                                       int order,
+                                       struct target *root);
 
 extern void write_end_chart();
 
-# define EBPF_GLOBAL_SECTION "global"
-# define EBPF_PROGRAMS_SECTION "ebpf programs"
+#define EBPF_GLOBAL_SECTION "global"
+#define EBPF_PROGRAMS_SECTION "ebpf programs"
 
-# define EBPF_COMMON_DIMENSION_CALL "Calls"
-# define EBPF_COMMON_DIMENSION_BYTESS "bytes/s"
-# define EBPF_COMMON_DIMENSION_DIFFERENCE "Difference"
+#define EBPF_COMMON_DIMENSION_CALL "Calls"
+#define EBPF_COMMON_DIMENSION_BYTESS "bytes/s"
+#define EBPF_COMMON_DIMENSION_DIFFERENCE "Difference"
 
-//Common variables
+// Common variables
 extern char *ebpf_user_config_dir;
 extern char *ebpf_stock_config_dir;
 extern pid_t *pid_index;
 extern int debug_enabled;
 
-//Socket functions and variables
-//Common functions
+// Socket functions and variables
+// Common functions
 extern void ebpf_socket_create_apps_charts(ebpf_module_t *em, struct target *root);
 extern collected_number get_value_from_structure(char *basis, size_t offset);
-extern struct pid_stat  *root_of_pids;
+extern struct pid_stat *root_of_pids;
 extern ebpf_process_stat_t *global_process_stat;
 extern size_t all_pids_count;
 extern int update_every;
 
-# define EBPF_MAX_SYNCHRONIZATION_TIME 300
+#define EBPF_MAX_SYNCHRONIZATION_TIME 300
 
 //External functions
 extern void change_socket_event();
 extern void change_process_event();
 
-#endif
+#endif /* NETDATA_COLLECTOR_EBPF_H */

collectors/ebpf.plugin/ebpf_apps.h

@@ -1,19 +1,21 @@
-#ifndef _NETDATA_EBPF_APPS_H
-# define _NETDATA_EBPF_APPS_H 1
+// SPDX-License-Identifier: GPL-3.0-or-later
 
-# include "libnetdata/threads/threads.h"
-# include "libnetdata/locks/locks.h"
-# include "libnetdata/avl/avl.h"
-# include "libnetdata/clocks/clocks.h"
-# include "libnetdata/config/appconfig.h"
-# include "libnetdata/ebpf/ebpf.h"
+#ifndef NETDATA_EBPF_APPS_H
+#define NETDATA_EBPF_APPS_H 1
 
-# define NETDATA_APPS_FAMILY "apps"
-# define NETDATA_APPS_SYSCALL_GROUP "ebpf syscall"
-# define NETDATA_APPS_NET_GROUP "ebpf net"
+#include "libnetdata/threads/threads.h"
+#include "libnetdata/locks/locks.h"
+#include "libnetdata/avl/avl.h"
+#include "libnetdata/clocks/clocks.h"
+#include "libnetdata/config/appconfig.h"
+#include "libnetdata/ebpf/ebpf.h"
 
-# define MAX_COMPARE_NAME 100
-# define MAX_NAME 100
+#define NETDATA_APPS_FAMILY "apps"
+#define NETDATA_APPS_SYSCALL_GROUP "ebpf syscall"
+#define NETDATA_APPS_NET_GROUP "ebpf net"
+
+#define MAX_COMPARE_NAME 100
+#define MAX_NAME 100
 
 // ----------------------------------------------------------------------------
 // process_pid_stat
@@ -21,10 +23,10 @@
 // Fields read from the kernel ring for a specific PID
 //
 typedef struct process_pid_stat {
-    uint64_t pid_tgid;                     //Unique identifier
-    uint32_t pid;                          //process id
+    uint64_t pid_tgid; // Unique identifier
+    uint32_t pid;      // process id
 
-    //Count number of calls done for specific function
+    // Count number of calls done for specific function
     uint32_t open_call;
     uint32_t write_call;
     uint32_t writev_call;
@@ -37,13 +39,13 @@ typedef struct process_pid_stat {
     uint32_t clone_call;
     uint32_t close_call;
 
-    //Count number of bytes written or read
+    // Count number of bytes written or read
     uint64_t write_bytes;
     uint64_t writev_bytes;
     uint64_t readv_bytes;
     uint64_t read_bytes;
 
-    //Count number of errors for the specified function
+    // Count number of errors for the specified function
     uint32_t open_err;
     uint32_t write_err;
     uint32_t writev_err;
@@ -68,7 +70,6 @@ typedef struct socket_bandwidth {
     unsigned char removed;
 } socket_bandwidth_t;
 
-
 // ----------------------------------------------------------------------------
 // pid_stat
 //
@@ -157,12 +158,12 @@ struct target {
     int hidden;             // if set, we set the hidden flag on the dimension
     int debug_enabled;
     int ends_with;
-    int starts_with;        // if set, the compare string matches only the
-                            // beginning of the command
+    int starts_with; // if set, the compare string matches only the
+                     // beginning of the command
 
     struct pid_on_target *root_pid; // list of aggregated pids for target debugging
 
-    struct target *target;  // the one that will be reported to netdata
+    struct target *target; // the one that will be reported to netdata
     struct target *next;
 };
 
@@ -268,24 +269,24 @@ struct pid_stat {
     // kernel_uint_t io_cancelled_write_bytes;
      */
 
-    struct pid_fd *fds;             // array of fds it uses
-    size_t fds_size;                   // the size of the fds array
+    struct pid_fd *fds; // array of fds it uses
+    size_t fds_size;    // the size of the fds array
 
-    int children_count;             // number of processes directly referencing this
-    unsigned char keep:1;           // 1 when we need to keep this process in memory even after it exited
-    int keeploops;                  // increases by 1 every time keep is 1 and updated 0
-    unsigned char updated:1;        // 1 when the process is currently running
-    unsigned char updated_twice:1;  // 1 when the process was running in the previous iteration
-    unsigned char merged:1;         // 1 when it has been merged to its parent
-    unsigned char read:1;           // 1 when we have already read this process for this iteration
+    int children_count;              // number of processes directly referencing this
+    unsigned char keep : 1;          // 1 when we need to keep this process in memory even after it exited
+    int keeploops;                   // increases by 1 every time keep is 1 and updated 0
+    unsigned char updated : 1;       // 1 when the process is currently running
+    unsigned char updated_twice : 1; // 1 when the process was running in the previous iteration
+    unsigned char merged : 1;        // 1 when it has been merged to its parent
+    unsigned char read : 1;          // 1 when we have already read this process for this iteration
 
-    int sortlist;                   // higher numbers = top on the process tree
+    int sortlist; // higher numbers = top on the process tree
 
     // each process gets a unique number
 
-    struct target *target;          // app_groups.conf targets
-    struct target *user_target;     // uid based targets
-    struct target *group_target;    // gid based targets
+    struct target *target;       // app_groups.conf targets
+    struct target *user_target;  // uid based targets
+    struct target *group_target; // gid based targets
 
     usec_t stat_collected_usec;
     usec_t last_stat_collected_usec;
@@ -295,7 +296,7 @@ struct pid_stat {
 
     kernel_uint_t uptime;
 
-    char *fds_dirname;              // the full directory name in /proc/PID/fd
+    char *fds_dirname; // the full directory name in /proc/PID/fd
 
     char *stat_filename;
     char *status_filename;
@@ -362,11 +363,11 @@ typedef struct ebpf_process_stat {
 typedef struct ebpf_bandwidth {
     uint32_t pid;
 
-    uint64_t first;                 //First timestamp
-    uint64_t ct;                    //Last timestamp
-    uint64_t sent;                  //Bytes sent
-    uint64_t received;              //Bytes received
-    unsigned char removed;          //Remove the PID from table
+    uint64_t first;        //First timestamp
+    uint64_t ct;           //Last timestamp
+    uint64_t sent;         //Bytes sent
+    uint64_t received;     //Bytes received
+    unsigned char removed; //Remove the PID from table
 } ebpf_bandwidth_t;
 
 /**
@@ -375,13 +376,14 @@ typedef struct ebpf_bandwidth {
  * @param fmt   the format to create the message.
  * @param ...   the arguments to fill the format.
  */
-static inline void debug_log_int(const char *fmt, ... ) {
+static inline void debug_log_int(const char *fmt, ...)
+{
     va_list args;
 
-    fprintf( stderr, "apps.plugin: ");
-    va_start( args, fmt );
-    vfprintf( stderr, fmt, args );
-    va_end( args );
+    fprintf(stderr, "apps.plugin: ");
+    va_start(args, fmt);
+    vfprintf(stderr, fmt, args);
+    va_end(args);
 
     fputc('\n', stderr);
 }
@@ -391,9 +393,10 @@ static inline void debug_log_int(const char *fmt, ... ) {
 //
 extern struct pid_stat **all_pids;
 
-
 extern int ebpf_read_apps_groups_conf(struct target **apps_groups_default_target,
-                                      struct target **apps_groups_root_target, const char *path, const char *file);
+                                      struct target **apps_groups_root_target,
+                                      const char *path,
+                                      const char *file);
 
 extern void clean_apps_groups_target(struct target *apps_groups_root_target);
 
@@ -403,30 +406,14 @@ extern int am_i_running_as_root();
 
 extern void cleanup_exited_pids(ebpf_process_stat_t **out);
 
-#ifndef STATIC
-extern int ebpf_read_hash_table(void *ep, int fd, uint32_t pid,
-                           int (*bpf_map_lookup_elem)(int, const void *, void *));
+extern int ebpf_read_hash_table(void *ep, int fd, uint32_t pid);
 
-extern size_t read_processes_statistic_using_pid_on_target(ebpf_process_stat_t **ep, int fd, ebpf_functions_t *ef,
+extern size_t read_processes_statistic_using_pid_on_target(ebpf_process_stat_t **ep,
+                                                           int fd,
                                                            struct pid_on_target *pids);
 
-extern size_t read_bandwidth_statistic_using_pid_on_target(ebpf_bandwidth_t **ep, int fd,
-                                                           ebpf_functions_t *ef, struct pid_on_target *pids);
-
-extern void collect_data_for_all_processes(ebpf_process_stat_t **out,
-                                          pid_t *index,
-                                          int (*bpf_map_lookup_elem)(int, const void *, void *),
-                                          int tbl_pid_stats_fd);
-
-#else
-extern int ebpf_read_hash_table(void *ep, int fd, pid_t pid);
+extern size_t read_bandwidth_statistic_using_pid_on_target(ebpf_bandwidth_t **ep, int fd, struct pid_on_target *pids);
 
-extern size_t read_processes_statistic_using_pid_on_target(ebpf_process_stat_t **ep, int fd,struct pid_on_target *pids);
+extern void collect_data_for_all_processes(ebpf_process_stat_t **out, pid_t *index, int tbl_pid_stats_fd);
 
-extern void collect_data_for_all_processes(ebpf_process_stat_t **out,
-                                          pid_t *index,
-                                          int tbl_pid_stats_fd);
-
-#endif
-
-#endif
+#endif /* NETDATA_EBPF_APPS_H */

collectors/ebpf.plugin/ebpf_process.c

@@ -11,17 +11,18 @@
  *
  *****************************************************************/
 
-static char *process_dimension_names[NETDATA_MAX_MONITOR_VECTOR] = { "open", "close", "delete", "read", "write",
-                                                             "process", "task", "process", "thread" };
-static char *process_id_names[NETDATA_MAX_MONITOR_VECTOR] = { "do_sys_open", "__close_fd", "vfs_unlink", "vfs_read", "vfs_write",
-                                                      "do_exit", "release_task", "_do_fork", "sys_clone" };
+static char *process_dimension_names[NETDATA_MAX_MONITOR_VECTOR] = { "open",    "close", "delete",  "read",  "write",
+                                                                     "process", "task",  "process", "thread" };
+static char *process_id_names[NETDATA_MAX_MONITOR_VECTOR] = { "do_sys_open",  "__close_fd", "vfs_unlink",
+                                                              "vfs_read",     "vfs_write",  "do_exit",
+                                                              "release_task", "_do_fork",   "sys_clone" };
 static char *status[] = { "process", "zombie" };
 
 static netdata_idx_t *process_hash_values = NULL;
 static netdata_syscall_stat_t *process_aggregated_data = NULL;
 static netdata_publish_syscall_t *process_publish_aggregated = NULL;
 
-static ebpf_functions_t process_functions;
+static ebpf_data_t process_data;
 
 static ebpf_process_stat_t **local_process_stats = NULL;
 static ebpf_process_publish_apps_t **current_apps_data = NULL;
@@ -29,20 +30,7 @@ static ebpf_process_publish_apps_t **prev_apps_data = NULL;
 
 int process_enabled = 0;
 
-#ifndef STATIC
-/**
- * Pointers used when collector is dynamically linked
- */
-
-//Libbpf (It is necessary to have at least kernel 4.10)
-static int (*bpf_map_lookup_elem)(int, const void *, void *) = NULL;
-static int (*bpf_map_delete_elem)(int fd, const void *key) = NULL;
-
 static int *map_fd = NULL;
-/**
- * End of the pointers
- */
- #endif
 
 /*****************************************************************
  *
@@ -57,18 +45,17 @@ static int *map_fd = NULL;
  * @param pvc      the second output structure with correlated dimensions
  * @param input    the structure with the input data.
  */
-static void ebpf_update_global_publish(netdata_publish_syscall_t *publish,
-                                   netdata_publish_vfs_common_t *pvc,
-                                   netdata_syscall_stat_t *input) {
-
+static void ebpf_update_global_publish(
+    netdata_publish_syscall_t *publish, netdata_publish_vfs_common_t *pvc, netdata_syscall_stat_t *input)
+{
     netdata_publish_syscall_t *move = publish;
-    while(move) {
-        if(input->call != move->pcall) {
+    while (move) {
+        if (input->call != move->pcall) {
             //This condition happens to avoid initial values with dimensions higher than normal values.
-            if(move->pcall) {
-                move->ncall = (input->call > move->pcall)?input->call - move->pcall: move->pcall - input->call;
-                move->nbyte = (input->bytes > move->pbyte)?input->bytes - move->pbyte: move->pbyte - input->bytes;
-                move->nerr = (input->ecall > move->nerr)?input->ecall - move->perr: move->perr - input->ecall;
+            if (move->pcall) {
+                move->ncall = (input->call > move->pcall) ? input->call - move->pcall : move->pcall - input->call;
+                move->nbyte = (input->bytes > move->pbyte) ? input->bytes - move->pbyte : move->pbyte - input->bytes;
+                move->nerr = (input->ecall > move->nerr) ? input->ecall - move->perr : move->perr - input->ecall;
             } else {
                 move->ncall = 0;
                 move->nbyte = 0;
@@ -103,8 +90,8 @@ static void ebpf_update_global_publish(netdata_publish_syscall_t *publish,
  * @param prev Previous values read from memory.
  * @param first was it allocated now?
  */
-static void ebpf_process_update_apps_publish(ebpf_process_publish_apps_t *curr,
-                                             ebpf_process_publish_apps_t *prev,int first)
+static void
+ebpf_process_update_apps_publish(ebpf_process_publish_apps_t *curr, ebpf_process_publish_apps_t *prev, int first)
 {
     if (first)
         return;
@@ -116,7 +103,7 @@ static void ebpf_process_update_apps_publish(ebpf_process_publish_apps_t *curr,
     curr->publish_write_bytes  = curr->bytes_written - prev->bytes_written;
     curr->publish_read_call    = curr->call_read - prev->call_read;
     curr->publish_read_bytes   = curr->bytes_read - prev->bytes_read;
-    curr->publish_process       = curr->call_do_fork - prev->call_do_fork;
+    curr->publish_process      = curr->call_do_fork - prev->call_do_fork;
     curr->publish_thread       = curr->call_sys_clone - prev->call_sys_clone;
     curr->publish_task         = curr->call_release_task - prev->call_release_task;
     curr->publish_open_error   = curr->ecall_sys_open - prev->ecall_sys_open;
@@ -131,11 +118,12 @@ static void ebpf_process_update_apps_publish(ebpf_process_publish_apps_t *curr,
  * @param family  the chart family
  * @param move    the pointer with the values that will be published
  */
-static void write_status_chart(char *family, netdata_publish_vfs_common_t *pvc) {
+static void write_status_chart(char *family, netdata_publish_vfs_common_t *pvc)
+{
     write_begin_chart(family, NETDATA_PROCESS_STATUS_NAME);
 
-    write_chart_dimension(status[0], (long long) pvc->running);
-    write_chart_dimension(status[1], (long long) pvc->zombie);
+    write_chart_dimension(status[0], (long long)pvc->running);
+    write_chart_dimension(status[1], (long long)pvc->zombie);
 
     write_end_chart();
 }
@@ -145,46 +133,36 @@ static void write_status_chart(char *family, netdata_publish_vfs_common_t *pvc)
  *
  * @param em the structure with thread information
  */
-static void ebpf_process_send_data(ebpf_module_t *em) {
+static void ebpf_process_send_data(ebpf_module_t *em)
+{
     netdata_publish_vfs_common_t pvc;
     ebpf_update_global_publish(process_publish_aggregated, &pvc, process_aggregated_data);
 
-    write_count_chart(NETDATA_FILE_OPEN_CLOSE_COUNT, NETDATA_EBPF_FAMILY, process_publish_aggregated, 2);
+    write_count_chart(
+        NETDATA_FILE_OPEN_CLOSE_COUNT, NETDATA_EBPF_FAMILY, process_publish_aggregated, 2);
 
-    write_count_chart(NETDATA_VFS_FILE_CLEAN_COUNT,
-                            NETDATA_EBPF_FAMILY,
-                            &process_publish_aggregated[NETDATA_DEL_START],
-                            1);
+    write_count_chart(
+        NETDATA_VFS_FILE_CLEAN_COUNT, NETDATA_EBPF_FAMILY, &process_publish_aggregated[NETDATA_DEL_START], 1);
 
-    write_count_chart(NETDATA_VFS_FILE_IO_COUNT,
-                            NETDATA_EBPF_FAMILY,
-                            &process_publish_aggregated[NETDATA_IN_START_BYTE],
-                            2);
+    write_count_chart(
+        NETDATA_VFS_FILE_IO_COUNT, NETDATA_EBPF_FAMILY, &process_publish_aggregated[NETDATA_IN_START_BYTE], 2);
 
-    write_count_chart(NETDATA_EXIT_SYSCALL,
-                            NETDATA_EBPF_FAMILY,
-                            &process_publish_aggregated[NETDATA_EXIT_START],
-                            2);
-    write_count_chart(NETDATA_PROCESS_SYSCALL,
-                      NETDATA_EBPF_FAMILY,
-                      &process_publish_aggregated[NETDATA_PROCESS_START],
-                      2);
+    write_count_chart(
+        NETDATA_EXIT_SYSCALL, NETDATA_EBPF_FAMILY, &process_publish_aggregated[NETDATA_EXIT_START], 2);
+    write_count_chart(
+        NETDATA_PROCESS_SYSCALL, NETDATA_EBPF_FAMILY, &process_publish_aggregated[NETDATA_PROCESS_START], 2);
 
     write_status_chart(NETDATA_EBPF_FAMILY, &pvc);
-    if(em->mode < MODE_ENTRY) {
-        write_err_chart(NETDATA_FILE_OPEN_ERR_COUNT, NETDATA_EBPF_FAMILY, process_publish_aggregated, 2);
-        write_err_chart(NETDATA_VFS_FILE_ERR_COUNT,
-                               NETDATA_EBPF_FAMILY,
-                               &process_publish_aggregated[2],
-                               NETDATA_VFS_ERRORS);
-        write_err_chart(NETDATA_PROCESS_ERROR_NAME,
-                               NETDATA_EBPF_FAMILY,
-                               &process_publish_aggregated[NETDATA_PROCESS_START],
-                               2);
+    if (em->mode < MODE_ENTRY) {
+        write_err_chart(
+            NETDATA_FILE_OPEN_ERR_COUNT, NETDATA_EBPF_FAMILY, process_publish_aggregated, 2);
+        write_err_chart(
+            NETDATA_VFS_FILE_ERR_COUNT, NETDATA_EBPF_FAMILY, &process_publish_aggregated[2], NETDATA_VFS_ERRORS);
+        write_err_chart(
+            NETDATA_PROCESS_ERROR_NAME, NETDATA_EBPF_FAMILY, &process_publish_aggregated[NETDATA_PROCESS_START], 2);
     }
 
-    write_io_chart(NETDATA_VFS_IO_FILE_BYTES, NETDATA_EBPF_FAMILY, process_id_names[3],
-                         process_id_names[4], &pvc);
+    write_io_chart(NETDATA_VFS_IO_FILE_BYTES, NETDATA_EBPF_FAMILY, process_id_names[3], process_id_names[4], &pvc);
 }
 
 /**
@@ -219,7 +197,7 @@ long long ebpf_process_sum_values_for_pids(struct pid_on_target *root, size_t of
  */
 void ebpf_process_remove_pids()
 {
-    struct pid_stat  *pids = root_of_pids;
+    struct pid_stat *pids = root_of_pids;
     int pid_fd = map_fd[0];
     while (pids) {
         uint32_t pid = pids->pid;
@@ -248,7 +226,7 @@ void ebpf_process_send_apps_data(ebpf_module_t *em, struct target *root)
     collected_number value;
 
     write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_FILE_OPEN);
-    for (w = root; w ; w = w->next) {
+    for (w = root; w; w = w->next) {
         if (unlikely(w->exposed && w->processes)) {
             value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_open));
             write_chart_dimension(w->name, value);
@@ -258,9 +236,10 @@ void ebpf_process_send_apps_data(ebpf_module_t *em, struct target *root)
 
     if (em->mode < MODE_ENTRY) {
         write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_FILE_OPEN_ERROR);
-        for (w = root; w ; w = w->next) {
+        for (w = root; w; w = w->next) {
             if (unlikely(w->exposed && w->processes)) {
-                value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_open_error));
+                value = ebpf_process_sum_values_for_pids(
+                    w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_open_error));
                 write_chart_dimension(w->name, value);
             }
         }
@@ -268,9 +247,10 @@ void ebpf_process_send_apps_data(ebpf_module_t *em, struct target *root)
     }
 
     write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_FILE_CLOSED);
-    for (w = root; w ; w = w->next) {
+    for (w = root; w; w = w->next) {
         if (unlikely(w->exposed && w->processes)) {
-            value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_closed));
+            value =
+                ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_closed));
             write_chart_dimension(w->name, value);
         }
     }
@@ -278,9 +258,10 @@ void ebpf_process_send_apps_data(ebpf_module_t *em, struct target *root)
 
     if (em->mode < MODE_ENTRY) {
         write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_FILE_CLOSE_ERROR);
-        for (w = root; w ; w = w->next) {
+        for (w = root; w; w = w->next) {
             if (unlikely(w->exposed && w->processes)) {
-                value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_close_error));
+                value = ebpf_process_sum_values_for_pids(
+                    w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_close_error));
                 write_chart_dimension(w->name, value);
             }
         }
@@ -288,18 +269,20 @@ void ebpf_process_send_apps_data(ebpf_module_t *em, struct target *root)
     }
 
     write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_FILE_DELETED);
-    for (w = root; w ; w = w->next) {
+    for (w = root; w; w = w->next) {
         if (unlikely(w->exposed && w->processes)) {
-            value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_deleted));
+            value =
+                ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_deleted));
             write_chart_dimension(w->name, value);
         }
     }
     write_end_chart();
 
     write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS);
-    for (w = root; w ; w = w->next) {
+    for (w = root; w; w = w->next) {
         if (unlikely(w->exposed && w->processes)) {
-            value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_write_call));
+            value = ebpf_process_sum_values_for_pids(
+                w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_write_call));
             write_chart_dimension(w->name, value);
         }
     }
@@ -307,9 +290,10 @@ void ebpf_process_send_apps_data(ebpf_module_t *em, struct target *root)
 
     if (em->mode < MODE_ENTRY) {
         write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR);
-        for (w = root; w ; w = w->next) {
+        for (w = root; w; w = w->next) {
             if (unlikely(w->exposed && w->processes)) {
-                value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_write_error));
+                value = ebpf_process_sum_values_for_pids(
+                    w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_write_error));
                 write_chart_dimension(w->name, value);
             }
         }
@@ -317,9 +301,10 @@ void ebpf_process_send_apps_data(ebpf_module_t *em, struct target *root)
     }
 
     write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_CALLS);
-    for (w = root; w ; w = w->next) {
+    for (w = root; w; w = w->next) {
         if (unlikely(w->exposed && w->processes)) {
-            value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_read_call));
+            value =
+                ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_read_call));
             write_chart_dimension(w->name, value);
         }
     }
@@ -327,9 +312,10 @@ void ebpf_process_send_apps_data(ebpf_module_t *em, struct target *root)
 
     if (em->mode < MODE_ENTRY) {
         write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR);
-        for (w = root; w ; w = w->next) {
+        for (w = root; w; w = w->next) {
             if (unlikely(w->exposed && w->processes)) {
-                value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_read_error));
+                value = ebpf_process_sum_values_for_pids(
+                    w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_read_error));
                 write_chart_dimension(w->name, value);
             }
         }
@@ -337,43 +323,47 @@ void ebpf_process_send_apps_data(ebpf_module_t *em, struct target *root)
     }
 
     write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES);
-    for (w = root; w ; w = w->next) {
+    for (w = root; w; w = w->next) {
         if (unlikely(w->exposed && w->processes)) {
-            value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_write_bytes));
+            value = ebpf_process_sum_values_for_pids(
+                w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_write_bytes));
             write_chart_dimension(w->name, value);
         }
     }
     write_end_chart();
 
     write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_BYTES);
-    for (w = root; w ; w = w->next) {
+    for (w = root; w; w = w->next) {
         if (unlikely(w->exposed && w->processes)) {
-            value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_read_bytes));
+            value = ebpf_process_sum_values_for_pids(
+                w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_read_bytes));
             write_chart_dimension(w->name, value);
         }
     }
     write_end_chart();
 
     write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_TASK_PROCESS);
-    for (w = root; w ; w = w->next) {
+    for (w = root; w; w = w->next) {
         if (unlikely(w->exposed && w->processes)) {
-            value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_process));
+            value =
+                ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_process));
             write_chart_dimension(w->name, value);
         }
     }
     write_end_chart();
 
     write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_TASK_THREAD);
-    for (w = root; w ; w = w->next) {
+    for (w = root; w; w = w->next) {
         if (unlikely(w->exposed && w->processes)) {
-            value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_thread));
+            value =
+                ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_thread));
             write_chart_dimension(w->name, value);
         }
     }
     write_end_chart();
 
     write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_TASK_CLOSE);
-    for (w = root; w ; w = w->next) {
+    for (w = root; w; w = w->next) {
         if (unlikely(w->exposed && w->processes)) {
             value = ebpf_process_sum_values_for_pids(w->root_pid, offsetof(ebpf_process_publish_apps_t, publish_task));
             write_chart_dimension(w->name, value);
@@ -400,10 +390,10 @@ static void read_hash_global_tables()
 
     netdata_idx_t *val = process_hash_values;
     for (idx = 0; idx < NETDATA_GLOBAL_VECTOR; idx++) {
-        if(!bpf_map_lookup_elem(map_fd[1], &idx, val)) {
+        if (!bpf_map_lookup_elem(map_fd[1], &idx, val)) {
             uint64_t total = 0;
             int i;
-            int end = (running_on_kernel < NETDATA_KERNEL_V4_15)?1:ebpf_nprocs;
+            int end = (running_on_kernel < NETDATA_KERNEL_V4_15) ? 1 : ebpf_nprocs;
             for (i = 0; i < end; i++)
                 total += val[i];
 
@@ -443,7 +433,7 @@ static void read_hash_global_tables()
 static void ebpf_process_update_apps_data()
 {
     size_t i;
-    for ( i = 0 ; i <  all_pids_count; i++) {
+    for (i = 0; i < all_pids_count; i++) {
         uint32_t current_pid = pid_index[i];
         ebpf_process_stat_t *ps = local_process_stats[current_pid];
         if (!ps)
@@ -483,10 +473,8 @@ static void ebpf_process_update_apps_data()
         cad->ecall_do_fork = ps->fork_err;
         cad->ecall_sys_clone = ps->clone_err;
 
-        cad->bytes_written = (uint64_t)ps->write_bytes +
-                                           (uint64_t)ps->write_bytes;
-        cad->bytes_read = (uint64_t)ps->read_bytes +
-                                           (uint64_t)ps->readv_bytes;
+        cad->bytes_written = (uint64_t)ps->write_bytes + (uint64_t)ps->write_bytes;
+        cad->bytes_read = (uint64_t)ps->read_bytes + (uint64_t)ps->readv_bytes;
 
         ebpf_process_update_apps_publish(cad, pad, lstatus);
     }
@@ -507,7 +495,8 @@ static void ebpf_process_update_apps_data()
  * @param web    the group name used to attach the chart on dashaboard
  * @param order  the order number of the specified chart
  */
-static void ebpf_create_io_chart(char *family, char *name, char *axis, char *web, int order) {
+static void ebpf_create_io_chart(char *family, char *name, char *axis, char *web, int order)
+{
     printf("CHART %s.%s '' 'Bytes written and read' '%s' '%s' '' line %d %d\n",
            family,
            name,
@@ -529,7 +518,8 @@ static void ebpf_create_io_chart(char *family, char *name, char *axis, char *web
  * @param web    the group name used to attach the chart on dashaboard
  * @param order  the order number of the specified chart
  */
-static void ebpf_process_status_chart(char *family, char *name, char *axis, char *web, int order) {
+static void ebpf_process_status_chart(char *family, char *name, char *axis, char *web, int order)
+{
     printf("CHART %s.%s '' 'Process not closed' '%s' '%s' '' line %d %d ''\n",
            family,
            name,
@@ -648,7 +638,6 @@ static void ebpf_create_global_charts(ebpf_module_t *em)
                           &process_publish_aggregated[NETDATA_PROCESS_START],
                           2);
     }
-
 }
 
 /**
@@ -781,15 +770,18 @@ static void ebpf_create_apps_charts(ebpf_module_t *em, struct target *root)
     struct target *w;
     int newly_added = 0;
 
-    for(w = root ; w ; w = w->next) {
-        if (w->target) continue;
+    for (w = root; w; w = w->next) {
+        if (w->target)
+            continue;
 
-        if(unlikely(w->processes && (debug_enabled || w->debug_enabled))) {
+        if (unlikely(w->processes && (debug_enabled || w->debug_enabled))) {
             struct pid_on_target *pid_on_target;
 
-            fprintf(stderr, "ebpf.plugin: target '%s' has aggregated %u process%s:", w->name, w->processes, (w->processes == 1)?"":"es");
+            fprintf(
+                stderr, "ebpf.plugin: target '%s' has aggregated %u process%s:", w->name, w->processes,
+                (w->processes == 1) ? "" : "es");
 
-            for(pid_on_target = w->root_pid; pid_on_target; pid_on_target = pid_on_target->next) {
+            for (pid_on_target = w->root_pid; pid_on_target; pid_on_target = pid_on_target->next) {
                 fprintf(stderr, " %d", pid_on_target->pid);
             }
 
@@ -804,7 +796,8 @@ static void ebpf_create_apps_charts(ebpf_module_t *em, struct target *root)
         }
     }
 
-    if (!newly_added) return;
+    if (!newly_added)
+        return;
 
     if (ebpf_modules[EBPF_MODULE_PROCESS_IDX].apps_charts)
         ebpf_process_create_apps_charts(em, root);
@@ -840,10 +833,7 @@ static void process_collector(usec_t step, ebpf_module_t *em)
 
         pthread_mutex_lock(&collect_data_mutex);
         cleanup_exited_pids(local_process_stats);
-        collect_data_for_all_processes(local_process_stats,
-                                                      pid_index,
-                                                      process_functions.bpf_map_lookup_elem,
-                                                      pid_fd);
+        collect_data_for_all_processes(local_process_stats, pid_index, pid_fd);
 
         ebpf_create_apps_charts(em, apps_groups_root_target);
 
@@ -851,7 +841,7 @@ static void process_collector(usec_t step, ebpf_module_t *em)
         pthread_mutex_unlock(&collect_data_mutex);
 
         int publish_apps = 0;
-        if (apps_enabled && all_pids_count > 0){
+        if (apps_enabled && all_pids_count > 0) {
             publish_apps = 1;
             ebpf_process_update_apps_data();
         }
@@ -891,11 +881,7 @@ static void ebpf_process_cleanup(void *ptr)
 
     freez(local_process_stats);
 
-    if (process_functions.libnetdata) {
-        dlclose(process_functions.libnetdata);
-    }
-
-    freez(process_functions.map_fd);
+    freez(process_data.map_fd);
     freez(current_apps_data);
     freez(prev_apps_data);
 }
@@ -913,7 +899,8 @@ static void ebpf_process_cleanup(void *ptr)
  *
  *  @param length is the length for the vectors used inside the collector.
  */
-static void ebpf_process_allocate_global_vectors(size_t length) {
+static void ebpf_process_allocate_global_vectors(size_t length)
+{
     process_aggregated_data = callocz(length, sizeof(netdata_syscall_stat_t));
     process_publish_aggregated = callocz(length, sizeof(netdata_publish_syscall_t));
     process_hash_values = callocz(ebpf_nprocs, sizeof(netdata_idx_t));
@@ -923,17 +910,19 @@ static void ebpf_process_allocate_global_vectors(size_t length) {
     prev_apps_data = callocz((size_t)pid_max, sizeof(ebpf_process_publish_apps_t *));
 }
 
-void change_process_event() {
+void change_process_event()
+{
     int i;
     if (running_on_kernel < NETDATA_KERNEL_V5_3)
         process_probes[EBPF_SYS_CLONE_IDX].name = NULL;
 
-    for (i = 0; process_probes[i].name ; i++ ) {
+    for (i = 0; process_probes[i].name; i++) {
         process_probes[i].type = 'p';
     }
 }
 
-static void change_syscalls() {
+static void change_syscalls()
+{
     static char *lfork = { "do_fork" };
     process_id_names[7] = lfork;
     process_probes[8].name = lfork;
@@ -943,16 +932,11 @@ static void change_syscalls() {
  * Set local variables
  *
  */
-static void set_local_pointers() {
-#ifndef STATIC
-    bpf_map_lookup_elem = process_functions.bpf_map_lookup_elem;
-
-    bpf_map_delete_elem = process_functions.bpf_map_delete_elem;
-#endif
-
-    map_fd = process_functions.map_fd;
+static void set_local_pointers()
+{
+    map_fd = process_data.map_fd;
 
-    if (process_functions.isrh >= NETDATA_MINIMUM_RH_VERSION && process_functions.isrh < NETDATA_RH_8)
+    if (process_data.isrh >= NETDATA_MINIMUM_RH_VERSION && process_data.isrh < NETDATA_RH_8)
         change_syscalls();
 }
 
@@ -974,7 +958,7 @@ static void wait_for_all_threads_die()
 
     int max = 10;
     int i;
-    for (i = 0; i < max ; i++) {
+    for (i = 0; i < max; i++) {
         heartbeat_next(&hb, 200000);
 
         size_t j, counter = 0, compare = 0;
@@ -1005,25 +989,26 @@ void *ebpf_process_thread(void *ptr)
 
     ebpf_module_t *em = (ebpf_module_t *)ptr;
     process_enabled = em->enabled;
-    fill_ebpf_functions(&process_functions);
+    fill_ebpf_data(&process_data);
 
     pthread_mutex_lock(&lock);
     ebpf_process_allocate_global_vectors(NETDATA_MAX_MONITOR_VECTOR);
 
-    if (ebpf_load_libraries(&process_functions, "libnetdata_ebpf.so", ebpf_plugin_dir)) {
+    if (ebpf_update_kernel(&process_data)) {
         pthread_mutex_unlock(&lock);
         goto endprocess;
     }
 
     set_local_pointers();
-    if (ebpf_load_program(ebpf_plugin_dir, em->thread_id, em->mode, kernel_string,
-                      em->thread_name, process_functions.map_fd, process_functions.load_bpf_file) ) {
+    if (ebpf_load_program(
+            ebpf_plugin_dir, em->thread_id, em->mode, kernel_string, em->thread_name, process_data.map_fd)) {
         pthread_mutex_unlock(&lock);
         goto endprocess;
     }
 
-    ebpf_global_labels(process_aggregated_data, process_publish_aggregated, process_dimension_names,
-                       process_id_names, NETDATA_MAX_MONITOR_VECTOR);
+    ebpf_global_labels(
+        process_aggregated_data, process_publish_aggregated, process_dimension_names, process_id_names,
+        NETDATA_MAX_MONITOR_VECTOR);
 
     if (process_enabled) {
         ebpf_create_global_charts(em);
@@ -1031,7 +1016,7 @@ void *ebpf_process_thread(void *ptr)
 
     pthread_mutex_unlock(&lock);
 
-    process_collector((usec_t)(em->update_time*USEC_PER_SEC), em);
+    process_collector((usec_t)(em->update_time * USEC_PER_SEC), em);
 
 endprocess:
     wait_for_all_threads_die();

collectors/ebpf.plugin/ebpf_process.h

@@ -1,59 +1,60 @@
-#ifndef _NETDATA_EBPF_PROCESS_H_
-# define _NETDATA_EBPF_PROCESS_H_ 1
+// SPDX-License-Identifier: GPL-3.0-or-later
 
-//Groups used on Dashboard
-# define NETDATA_FILE_GROUP "File"
-# define NETDATA_VFS_GROUP "VFS"
-# define NETDATA_PROCESS_GROUP "Process"
+#ifndef NETDATA_EBPF_PROCESS_H
+#define NETDATA_EBPF_PROCESS_H 1
 
-//Internal constants
-# define NETDATA_GLOBAL_VECTOR 24
-# define NETDATA_MAX_MONITOR_VECTOR 9
-# define NETDATA_VFS_ERRORS 3
+// Groups used on Dashboard
+#define NETDATA_FILE_GROUP "File"
+#define NETDATA_VFS_GROUP "VFS"
+#define NETDATA_PROCESS_GROUP "Process"
 
-//Map index
-# define NETDATA_DEL_START 2
-# define NETDATA_IN_START_BYTE 3
-# define NETDATA_EXIT_START 5
-# define NETDATA_PROCESS_START 7
+// Internal constants
+#define NETDATA_GLOBAL_VECTOR 24
+#define NETDATA_MAX_MONITOR_VECTOR 9
+#define NETDATA_VFS_ERRORS 3
+
+// Map index
+#define NETDATA_DEL_START 2
+#define NETDATA_IN_START_BYTE 3
+#define NETDATA_EXIT_START 5
+#define NETDATA_PROCESS_START 7
 
 // Global chart name
-# define NETDATA_FILE_OPEN_CLOSE_COUNT "file_descriptor"
-# define NETDATA_FILE_OPEN_ERR_COUNT "file_error"
-# define NETDATA_VFS_FILE_CLEAN_COUNT "deleted_objects"
-# define NETDATA_VFS_FILE_IO_COUNT "io"
-# define NETDATA_VFS_FILE_ERR_COUNT "io_error"
+#define NETDATA_FILE_OPEN_CLOSE_COUNT "file_descriptor"
+#define NETDATA_FILE_OPEN_ERR_COUNT "file_error"
+#define NETDATA_VFS_FILE_CLEAN_COUNT "deleted_objects"
+#define NETDATA_VFS_FILE_IO_COUNT "io"
+#define NETDATA_VFS_FILE_ERR_COUNT "io_error"
 
-# define NETDATA_EXIT_SYSCALL "exit"
-# define NETDATA_PROCESS_SYSCALL "process_thread"
-# define NETDATA_PROCESS_ERROR_NAME "task_error"
-# define NETDATA_PROCESS_STATUS_NAME "process_status"
+#define NETDATA_EXIT_SYSCALL "exit"
+#define NETDATA_PROCESS_SYSCALL "process_thread"
+#define NETDATA_PROCESS_ERROR_NAME "task_error"
+#define NETDATA_PROCESS_STATUS_NAME "process_status"
 
-# define NETDATA_VFS_IO_FILE_BYTES "io_bytes"
-# define NETDATA_VFS_DIM_IN_FILE_BYTES "write"
-# define NETDATA_VFS_DIM_OUT_FILE_BYTES "read"
+#define NETDATA_VFS_IO_FILE_BYTES "io_bytes"
+#define NETDATA_VFS_DIM_IN_FILE_BYTES "write"
+#define NETDATA_VFS_DIM_OUT_FILE_BYTES "read"
 
 // Charts created on Apps submenu
-# define NETDATA_SYSCALL_APPS_FILE_OPEN "file_open"
-# define NETDATA_SYSCALL_APPS_FILE_CLOSED "file_closed"
-# define NETDATA_SYSCALL_APPS_FILE_DELETED "file_deleted"
-# define NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS "vfs_write_call"
-# define NETDATA_SYSCALL_APPS_VFS_READ_CALLS "vfs_read_call"
-# define NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES "vfs_write_bytes"
-# define NETDATA_SYSCALL_APPS_VFS_READ_BYTES "vfs_read_bytes"
-# define NETDATA_SYSCALL_APPS_TASK_PROCESS "process_create"
-# define NETDATA_SYSCALL_APPS_TASK_THREAD "thread_create"
-# define NETDATA_SYSCALL_APPS_TASK_CLOSE "task_close"
+#define NETDATA_SYSCALL_APPS_FILE_OPEN "file_open"
+#define NETDATA_SYSCALL_APPS_FILE_CLOSED "file_closed"
+#define NETDATA_SYSCALL_APPS_FILE_DELETED "file_deleted"
+#define NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS "vfs_write_call"
+#define NETDATA_SYSCALL_APPS_VFS_READ_CALLS "vfs_read_call"
+#define NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES "vfs_write_bytes"
+#define NETDATA_SYSCALL_APPS_VFS_READ_BYTES "vfs_read_bytes"
+#define NETDATA_SYSCALL_APPS_TASK_PROCESS "process_create"
+#define NETDATA_SYSCALL_APPS_TASK_THREAD "thread_create"
+#define NETDATA_SYSCALL_APPS_TASK_CLOSE "task_close"
 
 // Charts created on Apps submenu, if and only if, the return mode is active
 
-# define NETDATA_SYSCALL_APPS_FILE_OPEN_ERROR "file_open_error"
-# define NETDATA_SYSCALL_APPS_FILE_CLOSE_ERROR "file_close_error"
-# define NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR "vfs_write_error"
-# define NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR "vfs_read_error"
-
+#define NETDATA_SYSCALL_APPS_FILE_OPEN_ERROR "file_open_error"
+#define NETDATA_SYSCALL_APPS_FILE_CLOSE_ERROR "file_close_error"
+#define NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR "vfs_write_error"
+#define NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR "vfs_read_error"
 
-//Index from kernel
+// Index from kernel
 typedef enum ebpf_process_index {
     NETDATA_KEY_CALLS_DO_SYS_OPEN,
     NETDATA_KEY_ERROR_DO_SYS_OPEN,
@@ -93,7 +94,7 @@ typedef enum ebpf_process_index {
 } ebpf_process_index_t;
 
 typedef struct ebpf_process_publish_apps {
-    //Number of calls during the last read
+    // Number of calls during the last read
     uint64_t call_sys_open;
     uint64_t call_close_fd;
     uint64_t call_vfs_unlink;
@@ -104,7 +105,7 @@ typedef struct ebpf_process_publish_apps {
     uint64_t call_do_fork;
     uint64_t call_sys_clone;
 
-    //Number of errors during the last read
+    // Number of errors during the last read
     uint64_t ecall_sys_open;
     uint64_t ecall_close_fd;
     uint64_t ecall_vfs_unlink;
@@ -113,24 +114,25 @@ typedef struct ebpf_process_publish_apps {
     uint64_t ecall_do_fork;
     uint64_t ecall_sys_clone;
 
-    //Number of bytes during the last read
+    // Number of bytes during the last read
     uint64_t bytes_written;
     uint64_t bytes_read;
 
-    //Dimensions sent to chart
-    uint64_t publish_open ;
-    uint64_t publish_closed ;
-    uint64_t publish_deleted ;
-    uint64_t publish_write_call ;
-    uint64_t publish_write_bytes ;
-    uint64_t publish_read_call ;
-    uint64_t publish_read_bytes ;
+    // Dimensions sent to chart
+    uint64_t publish_open;
+    uint64_t publish_closed;
+    uint64_t publish_deleted;
+    uint64_t publish_write_call;
+    uint64_t publish_write_bytes;
+    uint64_t publish_read_call;
+    uint64_t publish_read_bytes;
     uint64_t publish_process;
-    uint64_t publish_thread ;
-    uint64_t publish_task ;
-    uint64_t publish_open_error ;
-    uint64_t publish_close_error ;
-    uint64_t publish_write_error ;
-    uint64_t publish_read_error ;
-}ebpf_process_publish_apps_t;
-# endif
+    uint64_t publish_thread;
+    uint64_t publish_task;
+    uint64_t publish_open_error;
+    uint64_t publish_close_error;
+    uint64_t publish_write_error;
+    uint64_t publish_read_error;
+} ebpf_process_publish_apps_t;
+
+#endif /* NETDATA_EBPF_PROCESS_H */

collectors/ebpf.plugin/ebpf_socket.c

@@ -12,14 +12,14 @@
  *****************************************************************/
 
 static char *socket_dimension_names[NETDATA_MAX_SOCKET_VECTOR] = { "sent", "received", "close", "sent", "received" };
-static char *socket_id_names[NETDATA_MAX_SOCKET_VECTOR] = { "tcp_sendmsg", "tcp_cleanup_rbuf", "tcp_close", "udp_sendmsg",
-                                                            "udp_recvmsg" };
+static char *socket_id_names[NETDATA_MAX_SOCKET_VECTOR] = { "tcp_sendmsg", "tcp_cleanup_rbuf", "tcp_close",
+                                                            "udp_sendmsg", "udp_recvmsg" };
 
 static netdata_idx_t *socket_hash_values = NULL;
 static netdata_syscall_stat_t *socket_aggregated_data = NULL;
 static netdata_publish_syscall_t *socket_publish_aggregated = NULL;
 
-static ebpf_functions_t socket_functions;
+static ebpf_data_t socket_data;
 
 static ebpf_socket_publish_apps_t **socket_bandwidth_curr = NULL;
 static ebpf_socket_publish_apps_t **socket_bandwidth_prev = NULL;
@@ -27,20 +27,7 @@ static ebpf_bandwidth_t *bandwidth_vector = NULL;
 
 static int socket_apps_created = 0;
 
-#ifndef STATIC
-/**
- * Pointers used when collector is dynamically linked
- */
-
-//Libbpf (It is necessary to have at least kernel 4.10)
-static int (*bpf_map_lookup_elem)(int, const void *, void *);
-static int (*bpf_map_delete_elem)(int fd, const void *key);
-
 static int *map_fd = NULL;
-/**
- * End of the pointers
- */
-#endif
 
 /*****************************************************************
  *
@@ -56,19 +43,18 @@ static int *map_fd = NULL;
  * @param udp      structure to store IO from udp sockets
  * @param input    the structure with the input data.
  */
-static void ebpf_update_global_publish(netdata_publish_syscall_t *publish,
-                                       netdata_publish_vfs_common_t *tcp,
-                                       netdata_publish_vfs_common_t *udp,
-                                       netdata_syscall_stat_t *input) {
-
+static void ebpf_update_global_publish(
+    netdata_publish_syscall_t *publish, netdata_publish_vfs_common_t *tcp, netdata_publish_vfs_common_t *udp,
+    netdata_syscall_stat_t *input)
+{
     netdata_publish_syscall_t *move = publish;
-    while(move) {
-        if(input->call != move->pcall) {
+    while (move) {
+        if (input->call != move->pcall) {
             //This condition happens to avoid initial values with dimensions higher than normal values.
-            if(move->pcall) {
-                move->ncall = (input->call > move->pcall)?input->call - move->pcall: move->pcall - input->call;
-                move->nbyte = (input->bytes > move->pbyte)?input->bytes - move->pbyte: move->pbyte - input->bytes;
-                move->nerr = (input->ecall > move->nerr)?input->ecall - move->perr: move->perr - input->ecall;
+            if (move->pcall) {
+                move->ncall = (input->call > move->pcall) ? input->call - move->pcall : move->pcall - input->call;
+                move->nbyte = (input->bytes > move->pbyte) ? input->bytes - move->pbyte : move->pbyte - input->bytes;
+                move->nerr = (input->ecall > move->nerr) ? input->ecall - move->perr : move->perr - input->ecall;
             } else {
                 move->ncall = 0;
                 move->nbyte = 0;
@@ -101,8 +87,7 @@ static void ebpf_update_global_publish(netdata_publish_syscall_t *publish,
  * @param curr   Last values read from memory.
  * @param prev   Previous values read from memory.
  */
-static void ebpf_socket_update_apps_publish(ebpf_socket_publish_apps_t *curr,
-                                            ebpf_socket_publish_apps_t *prev)
+static void ebpf_socket_update_apps_publish(ebpf_socket_publish_apps_t *curr, ebpf_socket_publish_apps_t *prev)
 {
     curr->publish_recv = curr->received - prev->received;
     curr->publish_sent = curr->sent - prev->sent;
@@ -113,23 +98,28 @@ static void ebpf_socket_update_apps_publish(ebpf_socket_publish_apps_t *curr,
  *
  * @param em the structure with thread information
  */
-static void ebpf_socket_send_data(ebpf_module_t *em) {
+static void ebpf_socket_send_data(ebpf_module_t *em)
+{
     netdata_publish_vfs_common_t common_tcp;
     netdata_publish_vfs_common_t common_udp;
     ebpf_update_global_publish(socket_publish_aggregated, &common_tcp, &common_udp, socket_aggregated_data);
 
-    write_count_chart(NETDATA_TCP_FUNCTION_COUNT, NETDATA_EBPF_FAMILY, socket_publish_aggregated, 3);
-    write_io_chart(NETDATA_TCP_FUNCTION_BYTES, NETDATA_EBPF_FAMILY, socket_id_names[0], socket_id_names[1], &common_tcp);
+    write_count_chart(
+      NETDATA_TCP_FUNCTION_COUNT, NETDATA_EBPF_FAMILY, socket_publish_aggregated, 3);
+    write_io_chart(
+        NETDATA_TCP_FUNCTION_BYTES, NETDATA_EBPF_FAMILY, socket_id_names[0], socket_id_names[1], &common_tcp);
     if (em->mode < MODE_ENTRY) {
-        write_err_chart(NETDATA_TCP_FUNCTION_ERROR, NETDATA_EBPF_FAMILY, socket_publish_aggregated, 2);
+        write_err_chart(
+          NETDATA_TCP_FUNCTION_ERROR, NETDATA_EBPF_FAMILY, socket_publish_aggregated, 2);
     }
 
-    write_count_chart(NETDATA_UDP_FUNCTION_COUNT, NETDATA_EBPF_FAMILY,
-                             &socket_publish_aggregated[NETDATA_UDP_START], 2);
-    write_io_chart(NETDATA_UDP_FUNCTION_BYTES, NETDATA_EBPF_FAMILY, socket_id_names[3], socket_id_names[4], &common_udp);
+    write_count_chart(
+        NETDATA_UDP_FUNCTION_COUNT, NETDATA_EBPF_FAMILY, &socket_publish_aggregated[NETDATA_UDP_START], 2);
+    write_io_chart(
+        NETDATA_UDP_FUNCTION_BYTES, NETDATA_EBPF_FAMILY, socket_id_names[3], socket_id_names[4], &common_udp);
     if (em->mode < MODE_ENTRY) {
-        write_err_chart(NETDATA_UDP_FUNCTION_ERROR, NETDATA_EBPF_FAMILY,
-                               &socket_publish_aggregated[NETDATA_UDP_START], 2);
+        write_err_chart(
+            NETDATA_UDP_FUNCTION_ERROR, NETDATA_EBPF_FAMILY, &socket_publish_aggregated[NETDATA_UDP_START], 2);
     }
 }
 
@@ -166,7 +156,7 @@ long long ebpf_socket_sum_values_for_pids(struct pid_on_target *root, size_t off
  */
 void ebpf_socket_send_apps_data(ebpf_module_t *em, struct target *root)
 {
-    (void)em;
+    UNUSED(em);
     if (!socket_apps_created)
         return;
 
@@ -174,7 +164,7 @@ void ebpf_socket_send_apps_data(ebpf_module_t *em, struct target *root)
     collected_number value;
 
     write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_NET_APPS_BANDWIDTH_SENT);
-    for (w = root; w ; w = w->next) {
+    for (w = root; w; w = w->next) {
         if (unlikely(w->exposed && w->processes)) {
             value = ebpf_socket_sum_values_for_pids(w->root_pid, offsetof(ebpf_socket_publish_apps_t, publish_sent));
             write_chart_dimension(w->name, value);
@@ -183,7 +173,7 @@ void ebpf_socket_send_apps_data(ebpf_module_t *em, struct target *root)
     write_end_chart();
 
     write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_NET_APPS_BANDWIDTH_RECV);
-    for (w = root; w ; w = w->next) {
+    for (w = root; w; w = w->next) {
         if (unlikely(w->exposed && w->processes)) {
             value = ebpf_socket_sum_values_for_pids(w->root_pid, offsetof(ebpf_socket_publish_apps_t, publish_recv));
             write_chart_dimension(w->name, value);
@@ -205,7 +195,8 @@ void ebpf_socket_send_apps_data(ebpf_module_t *em, struct target *root)
  *
  * @param em a pointer to the structure with the default values.
  */
-static void ebpf_create_global_charts(ebpf_module_t *em) {
+static void ebpf_create_global_charts(ebpf_module_t *em)
+{
     ebpf_create_chart(NETDATA_EBPF_FAMILY,
                       NETDATA_TCP_FUNCTION_COUNT,
                       "Calls to internal functions",
@@ -280,7 +271,7 @@ static void ebpf_create_global_charts(ebpf_module_t *em) {
  */
 void ebpf_socket_create_apps_charts(ebpf_module_t *em, struct target *root)
 {
-    (void)em;
+    UNUSED(em);
     ebpf_create_charts_on_apps(NETDATA_NET_APPS_BANDWIDTH_SENT,
                                "Bytes sent",
                                EBPF_COMMON_DIMENSION_BYTESS,
@@ -314,7 +305,7 @@ static void read_hash_global_tables()
 
     netdata_idx_t *val = socket_hash_values;
     int fd = map_fd[4];
-    for (idx = 0; idx < NETDATA_SOCKET_COUNTER ; idx++) {
+    for (idx = 0; idx < NETDATA_SOCKET_COUNTER; idx++) {
         if (!bpf_map_lookup_elem(fd, &idx, val)) {
             uint64_t total = 0;
             int i;
@@ -353,7 +344,7 @@ static void read_hash_global_tables()
  */
 void ebpf_socket_fill_publish_apps(uint32_t current_pid, ebpf_bandwidth_t *eb)
 {
-    ebpf_socket_publish_apps_t *curr= socket_bandwidth_curr[current_pid];
+    ebpf_socket_publish_apps_t *curr = socket_bandwidth_curr[current_pid];
     ebpf_socket_publish_apps_t *prev = socket_bandwidth_prev[current_pid];
     if (!curr) {
         ebpf_socket_publish_apps_t *ptr = callocz(2, sizeof(ebpf_socket_publish_apps_t));
@@ -378,7 +369,7 @@ void ebpf_socket_fill_publish_apps(uint32_t current_pid, ebpf_bandwidth_t *eb)
  */
 void ebpf_socket_bandwidth_accumulator(ebpf_bandwidth_t *out)
 {
-    int i, end = (running_on_kernel >= NETDATA_KERNEL_V4_15)?ebpf_nprocs:1;
+    int i, end = (running_on_kernel >= NETDATA_KERNEL_V4_15) ? ebpf_nprocs : 1;
     ebpf_bandwidth_t *total = &out[0];
     for (i = 1; i < end; i++) {
         ebpf_bandwidth_t *move = &out[i];
@@ -395,7 +386,7 @@ static void ebpf_socket_update_apps_data()
     int fd = map_fd[0];
     ebpf_bandwidth_t *eb = bandwidth_vector;
     uint32_t key;
-    struct pid_stat  *pids = root_of_pids;
+    struct pid_stat *pids = root_of_pids;
     while (pids) {
         key = pids->pid;
 
@@ -421,7 +412,6 @@ static void ebpf_socket_update_apps_data()
  *
  *****************************************************************/
 
-
 /**
  * Main loop for this collector.
  *
@@ -430,14 +420,14 @@ static void ebpf_socket_update_apps_data()
  */
 static void socket_collector(usec_t step, ebpf_module_t *em)
 {
-    (void)em;
-    (void)step;
+    UNUSED(em);
+    UNUSED(step);
     heartbeat_t hb;
     heartbeat_init(&hb);
 
     int socket_apps_enabled = ebpf_modules[EBPF_MODULE_SOCKET_IDX].apps_charts;
     int socket_global_enabled = ebpf_modules[EBPF_MODULE_SOCKET_IDX].global_charts;
-    while(!close_ebpf_plugin) {
+    while (!close_ebpf_plugin) {
         pthread_mutex_lock(&collect_data_mutex);
         pthread_cond_wait(&collect_data_cond_var, &collect_data_mutex);
 
@@ -475,16 +465,12 @@ static void socket_collector(usec_t step, ebpf_module_t *em)
  */
 static void ebpf_socket_cleanup(void *ptr)
 {
-    (void)ptr;
+    UNUSED(ptr);
     freez(socket_aggregated_data);
     freez(socket_publish_aggregated);
     freez(socket_hash_values);
 
-    if (socket_functions.libnetdata) {
-        dlclose(socket_functions.libnetdata);
-    }
-
-    freez(socket_functions.map_fd);
+    freez(socket_data.map_fd);
     freez(socket_bandwidth_curr);
     freez(socket_bandwidth_prev);
     freez(bandwidth_vector);
@@ -505,17 +491,19 @@ static void ebpf_socket_cleanup(void *ptr)
  *
  * @param length is the length for the vectors used inside the collector.
  */
-static void ebpf_socket_allocate_global_vectors(size_t length) {
+static void ebpf_socket_allocate_global_vectors(size_t length)
+{
     socket_aggregated_data = callocz(length, sizeof(netdata_syscall_stat_t));
     socket_publish_aggregated = callocz(length, sizeof(netdata_publish_syscall_t));
     socket_hash_values = callocz(ebpf_nprocs, sizeof(netdata_idx_t));
 
     socket_bandwidth_curr = callocz((size_t)pid_max, sizeof(ebpf_socket_publish_apps_t *));
     socket_bandwidth_prev = callocz((size_t)pid_max, sizeof(ebpf_socket_publish_apps_t *));
-    bandwidth_vector = callocz((size_t) ebpf_nprocs, sizeof(ebpf_bandwidth_t));
+    bandwidth_vector = callocz((size_t)ebpf_nprocs, sizeof(ebpf_bandwidth_t));
 }
 
-void change_socket_event() {
+void change_socket_event()
+{
     socket_probes[0].type = 'p';
     socket_probes[4].type = 'p';
     socket_probes[5].type = 'p';
@@ -525,14 +513,9 @@ void change_socket_event() {
 /**
  * Set local function pointers, this function will never be compiled with static libraries
  */
-static void set_local_pointers(ebpf_module_t *em) {
-#ifndef STATIC
-    bpf_map_lookup_elem = socket_functions.bpf_map_lookup_elem;
-    (void) bpf_map_lookup_elem;
-    bpf_map_delete_elem = socket_functions.bpf_map_delete_elem;
-    (void) bpf_map_delete_elem;
-#endif
-    map_fd = socket_functions.map_fd;
+static void set_local_pointers(ebpf_module_t *em)
+{
+    map_fd = socket_data.map_fd;
 
     if (em->mode == MODE_ENTRY) {
         change_socket_event();
@@ -559,7 +542,7 @@ void *ebpf_socket_thread(void *ptr)
     netdata_thread_cleanup_push(ebpf_socket_cleanup, ptr);
 
     ebpf_module_t *em = (ebpf_module_t *)ptr;
-    fill_ebpf_functions(&socket_functions);
+    fill_ebpf_data(&socket_data);
 
     if (!em->enabled)
         goto endsocket;
@@ -568,26 +551,27 @@ void *ebpf_socket_thread(void *ptr)
 
     ebpf_socket_allocate_global_vectors(NETDATA_MAX_SOCKET_VECTOR);
 
-    if (ebpf_load_libraries(&socket_functions, "libnetdata_ebpf.so", ebpf_plugin_dir)) {
+    if (ebpf_update_kernel(&socket_data)) {
         pthread_mutex_unlock(&lock);
         goto endsocket;
     }
 
     set_local_pointers(em);
-    if (ebpf_load_program(ebpf_plugin_dir, em->thread_id, em->mode, kernel_string,
-                          em->thread_name, socket_functions.map_fd, socket_functions.load_bpf_file) ) {
+    if (ebpf_load_program(
+            ebpf_plugin_dir, em->thread_id, em->mode, kernel_string, em->thread_name, socket_data.map_fd)) {
         pthread_mutex_unlock(&lock);
         goto endsocket;
     }
 
-    ebpf_global_labels(socket_aggregated_data, socket_publish_aggregated, socket_dimension_names,
-                       socket_id_names, NETDATA_MAX_SOCKET_VECTOR);
+    ebpf_global_labels(
+        socket_aggregated_data, socket_publish_aggregated, socket_dimension_names, socket_id_names,
+        NETDATA_MAX_SOCKET_VECTOR);
 
     ebpf_create_global_charts(em);
 
     pthread_mutex_unlock(&lock);
 
-    socket_collector((usec_t)(em->update_time*USEC_PER_SEC), em);
+    socket_collector((usec_t)(em->update_time * USEC_PER_SEC), em);
 
 endsocket:
     netdata_thread_cleanup_pop(1);

collectors/ebpf.plugin/ebpf_socket.h

@@ -1,11 +1,13 @@
-#ifndef _NETDATA_EBPF_SOCKET_H_
-# define _NETDATA_EBPF_SOCKET_H_ 1
+// SPDX-License-Identifier: GPL-3.0-or-later
 
-# define NETDATA_SOCKET_COUNTER 13
+#ifndef NETDATA_EBPF_SOCKET_H
+#define NETDATA_EBPF_SOCKET_H 1
 
-# define NETDATA_MAX_SOCKET_VECTOR 5
+#define NETDATA_SOCKET_COUNTER 13
 
-# define NETDATA_UDP_START 3
+#define NETDATA_MAX_SOCKET_VECTOR 5
+
+#define NETDATA_UDP_START 3
 
 typedef enum ebpf_socket_idx {
     NETDATA_KEY_CALLS_TCP_SENDMSG,
@@ -27,28 +29,28 @@ typedef enum ebpf_socket_idx {
     NETDATA_KEY_BYTES_UDP_SENDMSG
 } ebpf_socket_index_t;
 
-# define NETDATA_SOCKET_GROUP "Socket"
+#define NETDATA_SOCKET_GROUP "Socket"
 
-//Global chart name
-# define NETDATA_TCP_FUNCTION_COUNT "tcp_functions"
-# define NETDATA_TCP_FUNCTION_BYTES "tcp_bandwidth"
-# define NETDATA_TCP_FUNCTION_ERROR "tcp_error"
-# define NETDATA_UDP_FUNCTION_COUNT "udp_functions"
-# define NETDATA_UDP_FUNCTION_BYTES "udp_bandwidth"
-# define NETDATA_UDP_FUNCTION_ERROR "udp_error"
+// Global chart name
+#define NETDATA_TCP_FUNCTION_COUNT "tcp_functions"
+#define NETDATA_TCP_FUNCTION_BYTES "tcp_bandwidth"
+#define NETDATA_TCP_FUNCTION_ERROR "tcp_error"
+#define NETDATA_UDP_FUNCTION_COUNT "udp_functions"
+#define NETDATA_UDP_FUNCTION_BYTES "udp_bandwidth"
+#define NETDATA_UDP_FUNCTION_ERROR "udp_error"
 
 // Charts created on Apps submenu
-# define NETDATA_NET_APPS_BANDWIDTH_SENT "bandwidth_sent"
-# define NETDATA_NET_APPS_BANDWIDTH_RECV "bandwidth_recv"
+#define NETDATA_NET_APPS_BANDWIDTH_SENT "bandwidth_sent"
+#define NETDATA_NET_APPS_BANDWIDTH_RECV "bandwidth_recv"
 
 typedef struct ebpf_socket_publish_apps {
-    //Data read
+    // Data read
     uint64_t sent;
     uint64_t received;
 
-    //Publish information.
+    // Publish information.
     uint64_t publish_sent;
     uint64_t publish_recv;
 } ebpf_socket_publish_apps_t;
 
-#endif
+#endif /* NETDATA_EBPF_SOCKET_H */