ebpf_fd.c 41 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205
  1. // SPDX-License-Identifier: GPL-3.0-or-later
  2. #include "ebpf.h"
  3. #include "ebpf_fd.h"
  4. // ----------------------------------------------------------------------------
  5. // ARAL vectors used to speed up processing
  6. ARAL *ebpf_aral_fd_pid;
  7. static char *fd_dimension_names[NETDATA_FD_SYSCALL_END] = { "open", "close" };
  8. static char *fd_id_names[NETDATA_FD_SYSCALL_END] = { "do_sys_open", "__close_fd" };
  9. static char *close_targets[NETDATA_EBPF_MAX_FD_TARGETS] = {"close_fd", "__close_fd"};
  10. static char *open_targets[NETDATA_EBPF_MAX_FD_TARGETS] = {"do_sys_openat2", "do_sys_open"};
  11. static netdata_syscall_stat_t fd_aggregated_data[NETDATA_FD_SYSCALL_END];
  12. static netdata_publish_syscall_t fd_publish_aggregated[NETDATA_FD_SYSCALL_END];
  13. static ebpf_local_maps_t fd_maps[] = {{.name = "tbl_fd_pid", .internal_input = ND_EBPF_DEFAULT_PID_SIZE,
  14. .user_input = 0,
  15. .type = NETDATA_EBPF_MAP_RESIZABLE | NETDATA_EBPF_MAP_PID,
  16. .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
  17. {.name = "tbl_fd_global", .internal_input = NETDATA_KEY_END_VECTOR,
  18. .user_input = 0, .type = NETDATA_EBPF_MAP_STATIC,
  19. .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
  20. {.name = "fd_ctrl", .internal_input = NETDATA_CONTROLLER_END,
  21. .user_input = 0,
  22. .type = NETDATA_EBPF_MAP_CONTROLLER,
  23. .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
  24. {.name = NULL, .internal_input = 0, .user_input = 0,
  25. .type = NETDATA_EBPF_MAP_CONTROLLER,
  26. .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED}};
  27. struct config fd_config = { .first_section = NULL, .last_section = NULL, .mutex = NETDATA_MUTEX_INITIALIZER,
  28. .index = {.avl_tree = { .root = NULL, .compar = appconfig_section_compare },
  29. .rwlock = AVL_LOCK_INITIALIZER } };
  30. static netdata_idx_t fd_hash_values[NETDATA_FD_COUNTER];
  31. static netdata_idx_t *fd_values = NULL;
  32. netdata_fd_stat_t *fd_vector = NULL;
  33. netdata_fd_stat_t **fd_pid = NULL;
  34. netdata_ebpf_targets_t fd_targets[] = { {.name = "open", .mode = EBPF_LOAD_TRAMPOLINE},
  35. {.name = "close", .mode = EBPF_LOAD_TRAMPOLINE},
  36. {.name = NULL, .mode = EBPF_LOAD_TRAMPOLINE}};
  37. #ifdef LIBBPF_MAJOR_VERSION
  38. #include "includes/fd.skel.h" // BTF code
  39. static struct fd_bpf *bpf_obj = NULL;
  40. /**
  41. * Disable probe
  42. *
  43. * Disable all probes to use exclusively another method.
  44. *
  45. * @param obj is the main structure for bpf objects
  46. */
  47. static inline void ebpf_fd_disable_probes(struct fd_bpf *obj)
  48. {
  49. bpf_program__set_autoload(obj->progs.netdata_sys_open_kprobe, false);
  50. bpf_program__set_autoload(obj->progs.netdata_sys_open_kretprobe, false);
  51. bpf_program__set_autoload(obj->progs.netdata_release_task_fd_kprobe, false);
  52. if (!strcmp(fd_targets[NETDATA_FD_SYSCALL_CLOSE].name, close_targets[NETDATA_FD_CLOSE_FD])) {
  53. bpf_program__set_autoload(obj->progs.netdata___close_fd_kretprobe, false);
  54. bpf_program__set_autoload(obj->progs.netdata___close_fd_kprobe, false);
  55. bpf_program__set_autoload(obj->progs.netdata_close_fd_kprobe, false);
  56. } else {
  57. bpf_program__set_autoload(obj->progs.netdata___close_fd_kprobe, false);
  58. bpf_program__set_autoload(obj->progs.netdata_close_fd_kretprobe, false);
  59. bpf_program__set_autoload(obj->progs.netdata_close_fd_kprobe, false);
  60. }
  61. }
  62. /*
  63. * Disable specific probe
  64. *
  65. * Disable probes according the kernel version
  66. *
  67. * @param obj is the main structure for bpf objects
  68. */
  69. static inline void ebpf_disable_specific_probes(struct fd_bpf *obj)
  70. {
  71. if (!strcmp(fd_targets[NETDATA_FD_SYSCALL_CLOSE].name, close_targets[NETDATA_FD_CLOSE_FD])) {
  72. bpf_program__set_autoload(obj->progs.netdata___close_fd_kretprobe, false);
  73. bpf_program__set_autoload(obj->progs.netdata___close_fd_kprobe, false);
  74. } else {
  75. bpf_program__set_autoload(obj->progs.netdata_close_fd_kretprobe, false);
  76. bpf_program__set_autoload(obj->progs.netdata_close_fd_kprobe, false);
  77. }
  78. }
  79. /*
  80. * Disable trampoline
  81. *
  82. * Disable all trampoline to use exclusively another method.
  83. *
  84. * @param obj is the main structure for bpf objects.
  85. */
  86. static inline void ebpf_disable_trampoline(struct fd_bpf *obj)
  87. {
  88. bpf_program__set_autoload(obj->progs.netdata_sys_open_fentry, false);
  89. bpf_program__set_autoload(obj->progs.netdata_sys_open_fexit, false);
  90. bpf_program__set_autoload(obj->progs.netdata_close_fd_fentry, false);
  91. bpf_program__set_autoload(obj->progs.netdata_close_fd_fexit, false);
  92. bpf_program__set_autoload(obj->progs.netdata___close_fd_fentry, false);
  93. bpf_program__set_autoload(obj->progs.netdata___close_fd_fexit, false);
  94. bpf_program__set_autoload(obj->progs.netdata_release_task_fd_fentry, false);
  95. }
  96. /*
  97. * Disable specific trampoline
  98. *
  99. * Disable trampoline according to kernel version.
  100. *
  101. * @param obj is the main structure for bpf objects.
  102. */
  103. static inline void ebpf_disable_specific_trampoline(struct fd_bpf *obj)
  104. {
  105. if (!strcmp(fd_targets[NETDATA_FD_SYSCALL_CLOSE].name, close_targets[NETDATA_FD_CLOSE_FD])) {
  106. bpf_program__set_autoload(obj->progs.netdata___close_fd_fentry, false);
  107. bpf_program__set_autoload(obj->progs.netdata___close_fd_fexit, false);
  108. } else {
  109. bpf_program__set_autoload(obj->progs.netdata_close_fd_fentry, false);
  110. bpf_program__set_autoload(obj->progs.netdata_close_fd_fexit, false);
  111. }
  112. }
  113. /**
  114. * Set trampoline target
  115. *
  116. * Set the targets we will monitor.
  117. *
  118. * @param obj is the main structure for bpf objects.
  119. */
  120. static void ebpf_set_trampoline_target(struct fd_bpf *obj)
  121. {
  122. bpf_program__set_attach_target(obj->progs.netdata_sys_open_fentry, 0, fd_targets[NETDATA_FD_SYSCALL_OPEN].name);
  123. bpf_program__set_attach_target(obj->progs.netdata_sys_open_fexit, 0, fd_targets[NETDATA_FD_SYSCALL_OPEN].name);
  124. bpf_program__set_attach_target(obj->progs.netdata_release_task_fd_fentry, 0, EBPF_COMMON_FNCT_CLEAN_UP);
  125. if (!strcmp(fd_targets[NETDATA_FD_SYSCALL_CLOSE].name, close_targets[NETDATA_FD_CLOSE_FD])) {
  126. bpf_program__set_attach_target(
  127. obj->progs.netdata_close_fd_fentry, 0, fd_targets[NETDATA_FD_SYSCALL_CLOSE].name);
  128. bpf_program__set_attach_target(obj->progs.netdata_close_fd_fexit, 0, fd_targets[NETDATA_FD_SYSCALL_CLOSE].name);
  129. } else {
  130. bpf_program__set_attach_target(
  131. obj->progs.netdata___close_fd_fentry, 0, fd_targets[NETDATA_FD_SYSCALL_CLOSE].name);
  132. bpf_program__set_attach_target(
  133. obj->progs.netdata___close_fd_fexit, 0, fd_targets[NETDATA_FD_SYSCALL_CLOSE].name);
  134. }
  135. }
  136. /**
  137. * Mount Attach Probe
  138. *
  139. * Attach probes to target
  140. *
  141. * @param obj is the main structure for bpf objects.
  142. *
  143. * @return It returns 0 on success and -1 otherwise.
  144. */
  145. static int ebpf_fd_attach_probe(struct fd_bpf *obj)
  146. {
  147. obj->links.netdata_sys_open_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_sys_open_kprobe, false,
  148. fd_targets[NETDATA_FD_SYSCALL_OPEN].name);
  149. int ret = libbpf_get_error(obj->links.netdata_sys_open_kprobe);
  150. if (ret)
  151. return -1;
  152. obj->links.netdata_sys_open_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_sys_open_kretprobe, true,
  153. fd_targets[NETDATA_FD_SYSCALL_OPEN].name);
  154. ret = libbpf_get_error(obj->links.netdata_sys_open_kretprobe);
  155. if (ret)
  156. return -1;
  157. obj->links.netdata_release_task_fd_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_release_task_fd_kprobe,
  158. false,
  159. EBPF_COMMON_FNCT_CLEAN_UP);
  160. ret = libbpf_get_error(obj->links.netdata_release_task_fd_kprobe);
  161. if (ret)
  162. return -1;
  163. if (!strcmp(fd_targets[NETDATA_FD_SYSCALL_CLOSE].name, close_targets[NETDATA_FD_CLOSE_FD])) {
  164. obj->links.netdata_close_fd_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_close_fd_kretprobe, true,
  165. fd_targets[NETDATA_FD_SYSCALL_CLOSE].name);
  166. ret = libbpf_get_error(obj->links.netdata_close_fd_kretprobe);
  167. if (ret)
  168. return -1;
  169. obj->links.netdata_close_fd_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_close_fd_kprobe, false,
  170. fd_targets[NETDATA_FD_SYSCALL_CLOSE].name);
  171. ret = libbpf_get_error(obj->links.netdata_close_fd_kprobe);
  172. if (ret)
  173. return -1;
  174. } else {
  175. obj->links.netdata___close_fd_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata___close_fd_kretprobe,
  176. true,
  177. fd_targets[NETDATA_FD_SYSCALL_CLOSE].name);
  178. ret = libbpf_get_error(obj->links.netdata___close_fd_kretprobe);
  179. if (ret)
  180. return -1;
  181. obj->links.netdata___close_fd_kprobe = bpf_program__attach_kprobe(obj->progs.netdata___close_fd_kprobe,
  182. false,
  183. fd_targets[NETDATA_FD_SYSCALL_CLOSE].name);
  184. ret = libbpf_get_error(obj->links.netdata___close_fd_kprobe);
  185. if (ret)
  186. return -1;
  187. }
  188. return 0;
  189. }
  190. /**
  191. * FD Fill Address
  192. *
  193. * Fill address value used to load probes/trampoline.
  194. */
  195. static inline void ebpf_fd_fill_address(ebpf_addresses_t *address, char **targets)
  196. {
  197. int i;
  198. for (i = 0; i < NETDATA_EBPF_MAX_FD_TARGETS; i++) {
  199. address->function = targets[i];
  200. ebpf_load_addresses(address, -1);
  201. if (address->addr)
  202. break;
  203. }
  204. }
  205. /**
  206. * Set target values
  207. *
  208. * Set pointers used to load data.
  209. *
  210. * @return It returns 0 on success and -1 otherwise.
  211. */
  212. static int ebpf_fd_set_target_values()
  213. {
  214. ebpf_addresses_t address = {.function = NULL, .hash = 0, .addr = 0};
  215. ebpf_fd_fill_address(&address, close_targets);
  216. if (!address.addr)
  217. return -1;
  218. fd_targets[NETDATA_FD_SYSCALL_CLOSE].name = address.function;
  219. address.addr = 0;
  220. ebpf_fd_fill_address(&address, open_targets);
  221. if (!address.addr)
  222. return -1;
  223. fd_targets[NETDATA_FD_SYSCALL_OPEN].name = address.function;
  224. return 0;
  225. }
  226. /**
  227. * Set hash tables
  228. *
  229. * Set the values for maps according the value given by kernel.
  230. *
  231. * @param obj is the main structure for bpf objects.
  232. */
  233. static void ebpf_fd_set_hash_tables(struct fd_bpf *obj)
  234. {
  235. fd_maps[NETDATA_FD_GLOBAL_STATS].map_fd = bpf_map__fd(obj->maps.tbl_fd_global);
  236. fd_maps[NETDATA_FD_PID_STATS].map_fd = bpf_map__fd(obj->maps.tbl_fd_pid);
  237. fd_maps[NETDATA_FD_CONTROLLER].map_fd = bpf_map__fd(obj->maps.fd_ctrl);
  238. }
  239. /**
  240. * Adjust Map Size
  241. *
  242. * Resize maps according input from users.
  243. *
  244. * @param obj is the main structure for bpf objects.
  245. * @param em structure with configuration
  246. */
  247. static void ebpf_fd_adjust_map_size(struct fd_bpf *obj, ebpf_module_t *em)
  248. {
  249. ebpf_update_map_size(obj->maps.tbl_fd_pid, &fd_maps[NETDATA_FD_PID_STATS],
  250. em, bpf_map__name(obj->maps.tbl_fd_pid));
  251. }
  252. /**
  253. * Disable Release Task
  254. *
  255. * Disable release task when apps is not enabled.
  256. *
  257. * @param obj is the main structure for bpf objects.
  258. */
  259. static void ebpf_fd_disable_release_task(struct fd_bpf *obj)
  260. {
  261. bpf_program__set_autoload(obj->progs.netdata_release_task_fd_kprobe, false);
  262. bpf_program__set_autoload(obj->progs.netdata_release_task_fd_fentry, false);
  263. }
  264. /**
  265. * Load and attach
  266. *
  267. * Load and attach the eBPF code in kernel.
  268. *
  269. * @param obj is the main structure for bpf objects.
  270. * @param em structure with configuration
  271. *
  272. * @return it returns 0 on success and -1 otherwise
  273. */
  274. static inline int ebpf_fd_load_and_attach(struct fd_bpf *obj, ebpf_module_t *em)
  275. {
  276. netdata_ebpf_targets_t *mt = em->targets;
  277. netdata_ebpf_program_loaded_t test = mt[NETDATA_FD_SYSCALL_OPEN].mode;
  278. if (ebpf_fd_set_target_values()) {
  279. error("%s file descriptor.", NETDATA_EBPF_DEFAULT_FNT_NOT_FOUND);
  280. return -1;
  281. }
  282. if (test == EBPF_LOAD_TRAMPOLINE) {
  283. ebpf_fd_disable_probes(obj);
  284. ebpf_disable_specific_trampoline(obj);
  285. ebpf_set_trampoline_target(obj);
  286. // TODO: Remove this in next PR, because this specific trampoline has an error.
  287. bpf_program__set_autoload(obj->progs.netdata_release_task_fd_fentry, false);
  288. } else {
  289. ebpf_disable_trampoline(obj);
  290. ebpf_disable_specific_probes(obj);
  291. }
  292. ebpf_fd_adjust_map_size(obj, em);
  293. if (!em->apps_charts && !em->cgroup_charts)
  294. ebpf_fd_disable_release_task(obj);
  295. int ret = fd_bpf__load(obj);
  296. if (ret) {
  297. return ret;
  298. }
  299. ret = (test == EBPF_LOAD_TRAMPOLINE) ? fd_bpf__attach(obj) : ebpf_fd_attach_probe(obj);
  300. if (!ret) {
  301. ebpf_fd_set_hash_tables(obj);
  302. ebpf_update_controller(fd_maps[NETDATA_CACHESTAT_CTRL].map_fd, em);
  303. }
  304. return ret;
  305. }
  306. #endif
  307. /*****************************************************************
  308. *
  309. * FUNCTIONS TO CLOSE THE THREAD
  310. *
  311. *****************************************************************/
  312. /**
  313. * FD Free
  314. *
  315. * Cleanup variables after child threads to stop
  316. *
  317. * @param ptr thread data.
  318. */
  319. static void ebpf_fd_free(ebpf_module_t *em)
  320. {
  321. pthread_mutex_lock(&ebpf_exit_cleanup);
  322. em->thread->enabled = NETDATA_THREAD_EBPF_STOPPING;
  323. pthread_mutex_unlock(&ebpf_exit_cleanup);
  324. ebpf_cleanup_publish_syscall(fd_publish_aggregated);
  325. freez(fd_values);
  326. freez(fd_vector);
  327. #ifdef LIBBPF_MAJOR_VERSION
  328. if (bpf_obj)
  329. fd_bpf__destroy(bpf_obj);
  330. #endif
  331. pthread_mutex_lock(&ebpf_exit_cleanup);
  332. em->thread->enabled = NETDATA_THREAD_EBPF_STOPPED;
  333. pthread_mutex_unlock(&ebpf_exit_cleanup);
  334. }
  335. /**
  336. * FD Exit
  337. *
  338. * Cancel child thread and exit.
  339. *
  340. * @param ptr thread data.
  341. */
  342. static void ebpf_fd_exit(void *ptr)
  343. {
  344. ebpf_module_t *em = (ebpf_module_t *)ptr;
  345. ebpf_fd_free(em);
  346. }
  347. /*****************************************************************
  348. *
  349. * ARAL FUNCTIONS
  350. *
  351. *****************************************************************/
  352. /**
  353. * eBPF file descriptor Aral init
  354. *
  355. * Initiallize array allocator that will be used when integration with apps is enabled.
  356. */
  357. static inline void ebpf_fd_aral_init()
  358. {
  359. ebpf_aral_fd_pid = ebpf_allocate_pid_aral("ebpf-fd", sizeof(netdata_fd_stat_t));
  360. }
  361. /**
  362. * eBPF publish file descriptor get
  363. *
  364. * Get a netdata_fd_stat_t entry to be used with a specific PID.
  365. *
  366. * @return it returns the address on success.
  367. */
  368. netdata_fd_stat_t *ebpf_fd_stat_get(void)
  369. {
  370. netdata_fd_stat_t *target = aral_mallocz(ebpf_aral_fd_pid);
  371. memset(target, 0, sizeof(netdata_fd_stat_t));
  372. return target;
  373. }
  374. /**
  375. * eBPF file descriptor release
  376. *
  377. * @param stat Release a target after usage.
  378. */
  379. void ebpf_fd_release(netdata_fd_stat_t *stat)
  380. {
  381. aral_freez(ebpf_aral_fd_pid, stat);
  382. }
  383. /*****************************************************************
  384. *
  385. * MAIN LOOP
  386. *
  387. *****************************************************************/
  388. /**
  389. * Send data to Netdata calling auxiliary functions.
  390. *
  391. * @param em the structure with thread information
  392. */
  393. static void ebpf_fd_send_data(ebpf_module_t *em)
  394. {
  395. fd_publish_aggregated[NETDATA_FD_SYSCALL_OPEN].ncall = fd_hash_values[NETDATA_KEY_CALLS_DO_SYS_OPEN];
  396. fd_publish_aggregated[NETDATA_FD_SYSCALL_OPEN].nerr = fd_hash_values[NETDATA_KEY_ERROR_DO_SYS_OPEN];
  397. fd_publish_aggregated[NETDATA_FD_SYSCALL_CLOSE].ncall = fd_hash_values[NETDATA_KEY_CALLS_CLOSE_FD];
  398. fd_publish_aggregated[NETDATA_FD_SYSCALL_CLOSE].nerr = fd_hash_values[NETDATA_KEY_ERROR_CLOSE_FD];
  399. write_count_chart(NETDATA_FILE_OPEN_CLOSE_COUNT, NETDATA_FILESYSTEM_FAMILY, fd_publish_aggregated,
  400. NETDATA_FD_SYSCALL_END);
  401. if (em->mode < MODE_ENTRY) {
  402. write_err_chart(NETDATA_FILE_OPEN_ERR_COUNT, NETDATA_FILESYSTEM_FAMILY,
  403. fd_publish_aggregated, NETDATA_FD_SYSCALL_END);
  404. }
  405. }
  406. /**
  407. * Read global counter
  408. *
  409. * Read the table with number of calls for all functions
  410. */
  411. static void ebpf_fd_read_global_table()
  412. {
  413. uint32_t idx;
  414. netdata_idx_t *val = fd_hash_values;
  415. netdata_idx_t *stored = fd_values;
  416. int fd = fd_maps[NETDATA_FD_GLOBAL_STATS].map_fd;
  417. for (idx = NETDATA_KEY_CALLS_DO_SYS_OPEN; idx < NETDATA_FD_COUNTER; idx++) {
  418. if (!bpf_map_lookup_elem(fd, &idx, stored)) {
  419. int i;
  420. int end = ebpf_nprocs;
  421. netdata_idx_t total = 0;
  422. for (i = 0; i < end; i++)
  423. total += stored[i];
  424. val[idx] = total;
  425. }
  426. }
  427. }
  428. /**
  429. * Apps Accumulator
  430. *
  431. * Sum all values read from kernel and store in the first address.
  432. *
  433. * @param out the vector with read values.
  434. */
  435. static void fd_apps_accumulator(netdata_fd_stat_t *out)
  436. {
  437. int i, end = (running_on_kernel >= NETDATA_KERNEL_V4_15) ? ebpf_nprocs : 1;
  438. netdata_fd_stat_t *total = &out[0];
  439. for (i = 1; i < end; i++) {
  440. netdata_fd_stat_t *w = &out[i];
  441. total->open_call += w->open_call;
  442. total->close_call += w->close_call;
  443. total->open_err += w->open_err;
  444. total->close_err += w->close_err;
  445. }
  446. }
  447. /**
  448. * Fill PID
  449. *
  450. * Fill PID structures
  451. *
  452. * @param current_pid pid that we are collecting data
  453. * @param out values read from hash tables;
  454. */
  455. static void fd_fill_pid(uint32_t current_pid, netdata_fd_stat_t *publish)
  456. {
  457. netdata_fd_stat_t *curr = fd_pid[current_pid];
  458. if (!curr) {
  459. curr = ebpf_fd_stat_get();
  460. fd_pid[current_pid] = curr;
  461. }
  462. memcpy(curr, &publish[0], sizeof(netdata_fd_stat_t));
  463. }
  464. /**
  465. * Read APPS table
  466. *
  467. * Read the apps table and store data inside the structure.
  468. */
  469. static void read_apps_table()
  470. {
  471. netdata_fd_stat_t *fv = fd_vector;
  472. uint32_t key;
  473. struct ebpf_pid_stat *pids = ebpf_root_of_pids;
  474. int fd = fd_maps[NETDATA_FD_PID_STATS].map_fd;
  475. size_t length = sizeof(netdata_fd_stat_t) * ebpf_nprocs;
  476. while (pids) {
  477. key = pids->pid;
  478. if (bpf_map_lookup_elem(fd, &key, fv)) {
  479. pids = pids->next;
  480. continue;
  481. }
  482. fd_apps_accumulator(fv);
  483. fd_fill_pid(key, fv);
  484. // We are cleaning to avoid passing data read from one process to other.
  485. memset(fv, 0, length);
  486. pids = pids->next;
  487. }
  488. }
  489. /**
  490. * Update cgroup
  491. *
  492. * Update cgroup data based in
  493. */
  494. static void ebpf_update_fd_cgroup()
  495. {
  496. ebpf_cgroup_target_t *ect ;
  497. netdata_fd_stat_t *fv = fd_vector;
  498. int fd = fd_maps[NETDATA_FD_PID_STATS].map_fd;
  499. size_t length = sizeof(netdata_fd_stat_t) * ebpf_nprocs;
  500. pthread_mutex_lock(&mutex_cgroup_shm);
  501. for (ect = ebpf_cgroup_pids; ect; ect = ect->next) {
  502. struct pid_on_target2 *pids;
  503. for (pids = ect->pids; pids; pids = pids->next) {
  504. int pid = pids->pid;
  505. netdata_fd_stat_t *out = &pids->fd;
  506. if (likely(fd_pid) && fd_pid[pid]) {
  507. netdata_fd_stat_t *in = fd_pid[pid];
  508. memcpy(out, in, sizeof(netdata_fd_stat_t));
  509. } else {
  510. memset(fv, 0, length);
  511. if (!bpf_map_lookup_elem(fd, &pid, fv)) {
  512. fd_apps_accumulator(fv);
  513. memcpy(out, fv, sizeof(netdata_fd_stat_t));
  514. }
  515. }
  516. }
  517. }
  518. pthread_mutex_unlock(&mutex_cgroup_shm);
  519. }
  520. /**
  521. * Sum PIDs
  522. *
  523. * Sum values for all targets.
  524. *
  525. * @param fd the output
  526. * @param root list of pids
  527. */
  528. static void ebpf_fd_sum_pids(netdata_fd_stat_t *fd, struct ebpf_pid_on_target *root)
  529. {
  530. uint32_t open_call = 0;
  531. uint32_t close_call = 0;
  532. uint32_t open_err = 0;
  533. uint32_t close_err = 0;
  534. while (root) {
  535. int32_t pid = root->pid;
  536. netdata_fd_stat_t *w = fd_pid[pid];
  537. if (w) {
  538. open_call += w->open_call;
  539. close_call += w->close_call;
  540. open_err += w->open_err;
  541. close_err += w->close_err;
  542. }
  543. root = root->next;
  544. }
  545. // These conditions were added, because we are using incremental algorithm
  546. fd->open_call = (open_call >= fd->open_call) ? open_call : fd->open_call;
  547. fd->close_call = (close_call >= fd->close_call) ? close_call : fd->close_call;
  548. fd->open_err = (open_err >= fd->open_err) ? open_err : fd->open_err;
  549. fd->close_err = (close_err >= fd->close_err) ? close_err : fd->close_err;
  550. }
  551. /**
  552. * Send data to Netdata calling auxiliary functions.
  553. *
  554. * @param em the structure with thread information
  555. * @param root the target list.
  556. */
  557. void ebpf_fd_send_apps_data(ebpf_module_t *em, struct ebpf_target *root)
  558. {
  559. struct ebpf_target *w;
  560. for (w = root; w; w = w->next) {
  561. if (unlikely(w->exposed && w->processes)) {
  562. ebpf_fd_sum_pids(&w->fd, w->root_pid);
  563. }
  564. }
  565. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_FILE_OPEN);
  566. for (w = root; w; w = w->next) {
  567. if (unlikely(w->exposed && w->processes)) {
  568. write_chart_dimension(w->name, w->fd.open_call);
  569. }
  570. }
  571. write_end_chart();
  572. if (em->mode < MODE_ENTRY) {
  573. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_FILE_OPEN_ERROR);
  574. for (w = root; w; w = w->next) {
  575. if (unlikely(w->exposed && w->processes)) {
  576. write_chart_dimension(w->name, w->fd.open_err);
  577. }
  578. }
  579. write_end_chart();
  580. }
  581. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_FILE_CLOSED);
  582. for (w = root; w; w = w->next) {
  583. if (unlikely(w->exposed && w->processes)) {
  584. write_chart_dimension(w->name, w->fd.close_call);
  585. }
  586. }
  587. write_end_chart();
  588. if (em->mode < MODE_ENTRY) {
  589. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_FILE_CLOSE_ERROR);
  590. for (w = root; w; w = w->next) {
  591. if (unlikely(w->exposed && w->processes)) {
  592. write_chart_dimension(w->name, w->fd.close_err);
  593. }
  594. }
  595. write_end_chart();
  596. }
  597. }
  598. /**
  599. * Sum PIDs
  600. *
  601. * Sum values for all targets.
  602. *
  603. * @param fd structure used to store data
  604. * @param pids input data
  605. */
  606. static void ebpf_fd_sum_cgroup_pids(netdata_fd_stat_t *fd, struct pid_on_target2 *pids)
  607. {
  608. netdata_fd_stat_t accumulator;
  609. memset(&accumulator, 0, sizeof(accumulator));
  610. while (pids) {
  611. netdata_fd_stat_t *w = &pids->fd;
  612. accumulator.open_err += w->open_err;
  613. accumulator.open_call += w->open_call;
  614. accumulator.close_call += w->close_call;
  615. accumulator.close_err += w->close_err;
  616. pids = pids->next;
  617. }
  618. fd->open_call = (accumulator.open_call >= fd->open_call) ? accumulator.open_call : fd->open_call;
  619. fd->open_err = (accumulator.open_err >= fd->open_err) ? accumulator.open_err : fd->open_err;
  620. fd->close_call = (accumulator.close_call >= fd->close_call) ? accumulator.close_call : fd->close_call;
  621. fd->close_err = (accumulator.close_err >= fd->close_err) ? accumulator.close_err : fd->close_err;
  622. }
  623. /**
  624. * Create specific file descriptor charts
  625. *
  626. * Create charts for cgroup/application.
  627. *
  628. * @param type the chart type.
  629. * @param em the main thread structure.
  630. */
  631. static void ebpf_create_specific_fd_charts(char *type, ebpf_module_t *em)
  632. {
  633. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_FILE_OPEN, "Number of open files",
  634. EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_FILE_CGROUP_GROUP,
  635. NETDATA_CGROUP_FD_OPEN_CONTEXT, NETDATA_EBPF_CHART_TYPE_LINE,
  636. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5400,
  637. ebpf_create_global_dimension,
  638. &fd_publish_aggregated[NETDATA_FD_SYSCALL_OPEN],
  639. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  640. if (em->mode < MODE_ENTRY) {
  641. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_FILE_OPEN_ERROR, "Fails to open files",
  642. EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_FILE_CGROUP_GROUP,
  643. NETDATA_CGROUP_FD_OPEN_ERR_CONTEXT, NETDATA_EBPF_CHART_TYPE_LINE,
  644. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5401,
  645. ebpf_create_global_dimension,
  646. &fd_publish_aggregated[NETDATA_FD_SYSCALL_OPEN],
  647. 1, em->update_every,
  648. NETDATA_EBPF_MODULE_NAME_SWAP);
  649. }
  650. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_FILE_CLOSED, "Files closed",
  651. EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_FILE_CGROUP_GROUP,
  652. NETDATA_CGROUP_FD_CLOSE_CONTEXT, NETDATA_EBPF_CHART_TYPE_LINE,
  653. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5402,
  654. ebpf_create_global_dimension,
  655. &fd_publish_aggregated[NETDATA_FD_SYSCALL_CLOSE],
  656. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  657. if (em->mode < MODE_ENTRY) {
  658. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_FILE_CLOSE_ERROR, "Fails to close files",
  659. EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_FILE_CGROUP_GROUP,
  660. NETDATA_CGROUP_FD_CLOSE_ERR_CONTEXT, NETDATA_EBPF_CHART_TYPE_LINE,
  661. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5403,
  662. ebpf_create_global_dimension,
  663. &fd_publish_aggregated[NETDATA_FD_SYSCALL_CLOSE],
  664. 1, em->update_every,
  665. NETDATA_EBPF_MODULE_NAME_SWAP);
  666. }
  667. }
  668. /**
  669. * Obsolete specific file descriptor charts
  670. *
  671. * Obsolete charts for cgroup/application.
  672. *
  673. * @param type the chart type.
  674. * @param em the main thread structure.
  675. */
  676. static void ebpf_obsolete_specific_fd_charts(char *type, ebpf_module_t *em)
  677. {
  678. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_FILE_OPEN, "Number of open files",
  679. EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_FILE_GROUP,
  680. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_FD_OPEN_CONTEXT,
  681. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5400, em->update_every);
  682. if (em->mode < MODE_ENTRY) {
  683. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_FILE_OPEN_ERROR, "Fails to open files",
  684. EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_FILE_GROUP,
  685. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_FD_OPEN_ERR_CONTEXT,
  686. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5401, em->update_every);
  687. }
  688. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_FILE_CLOSED, "Files closed",
  689. EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_FILE_GROUP,
  690. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_FD_CLOSE_CONTEXT,
  691. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5402, em->update_every);
  692. if (em->mode < MODE_ENTRY) {
  693. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_FILE_CLOSE_ERROR, "Fails to close files",
  694. EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_FILE_GROUP,
  695. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_FD_CLOSE_ERR_CONTEXT,
  696. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5403, em->update_every);
  697. }
  698. }
  699. /*
  700. * Send specific file descriptor data
  701. *
  702. * Send data for specific cgroup/apps.
  703. *
  704. * @param type chart type
  705. * @param values structure with values that will be sent to netdata
  706. */
  707. static void ebpf_send_specific_fd_data(char *type, netdata_fd_stat_t *values, ebpf_module_t *em)
  708. {
  709. write_begin_chart(type, NETDATA_SYSCALL_APPS_FILE_OPEN);
  710. write_chart_dimension(fd_publish_aggregated[NETDATA_FD_SYSCALL_OPEN].name, (long long)values->open_call);
  711. write_end_chart();
  712. if (em->mode < MODE_ENTRY) {
  713. write_begin_chart(type, NETDATA_SYSCALL_APPS_FILE_OPEN_ERROR);
  714. write_chart_dimension(fd_publish_aggregated[NETDATA_FD_SYSCALL_OPEN].name, (long long)values->open_err);
  715. write_end_chart();
  716. }
  717. write_begin_chart(type, NETDATA_SYSCALL_APPS_FILE_CLOSED);
  718. write_chart_dimension(fd_publish_aggregated[NETDATA_FD_SYSCALL_CLOSE].name, (long long)values->close_call);
  719. write_end_chart();
  720. if (em->mode < MODE_ENTRY) {
  721. write_begin_chart(type, NETDATA_SYSCALL_APPS_FILE_CLOSE_ERROR);
  722. write_chart_dimension(fd_publish_aggregated[NETDATA_FD_SYSCALL_CLOSE].name, (long long)values->close_err);
  723. write_end_chart();
  724. }
  725. }
  726. /**
  727. * Create systemd file descriptor charts
  728. *
  729. * Create charts when systemd is enabled
  730. *
  731. * @param em the main collector structure
  732. **/
  733. static void ebpf_create_systemd_fd_charts(ebpf_module_t *em)
  734. {
  735. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_FILE_OPEN, "Number of open files",
  736. EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_FILE_CGROUP_GROUP,
  737. NETDATA_EBPF_CHART_TYPE_STACKED, 20061,
  738. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_FD_OPEN_CONTEXT,
  739. NETDATA_EBPF_MODULE_NAME_PROCESS, em->update_every);
  740. if (em->mode < MODE_ENTRY) {
  741. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_FILE_OPEN_ERROR, "Fails to open files",
  742. EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_FILE_CGROUP_GROUP,
  743. NETDATA_EBPF_CHART_TYPE_STACKED, 20062,
  744. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_FD_OPEN_ERR_CONTEXT,
  745. NETDATA_EBPF_MODULE_NAME_PROCESS, em->update_every);
  746. }
  747. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_FILE_CLOSED, "Files closed",
  748. EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_FILE_CGROUP_GROUP,
  749. NETDATA_EBPF_CHART_TYPE_STACKED, 20063,
  750. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_FD_CLOSE_CONTEXT,
  751. NETDATA_EBPF_MODULE_NAME_PROCESS, em->update_every);
  752. if (em->mode < MODE_ENTRY) {
  753. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_FILE_CLOSE_ERROR, "Fails to close files",
  754. EBPF_COMMON_DIMENSION_CALL, NETDATA_APPS_FILE_CGROUP_GROUP,
  755. NETDATA_EBPF_CHART_TYPE_STACKED, 20064,
  756. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_FD_CLOSE_ERR_CONTEXT,
  757. NETDATA_EBPF_MODULE_NAME_PROCESS, em->update_every);
  758. }
  759. }
  760. /**
  761. * Send Systemd charts
  762. *
  763. * Send collected data to Netdata.
  764. *
  765. * @param em the main collector structure
  766. */
  767. static void ebpf_send_systemd_fd_charts(ebpf_module_t *em)
  768. {
  769. ebpf_cgroup_target_t *ect;
  770. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_FILE_OPEN);
  771. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  772. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  773. write_chart_dimension(ect->name, ect->publish_systemd_fd.open_call);
  774. }
  775. }
  776. write_end_chart();
  777. if (em->mode < MODE_ENTRY) {
  778. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_FILE_OPEN_ERROR);
  779. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  780. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  781. write_chart_dimension(ect->name, ect->publish_systemd_fd.open_err);
  782. }
  783. }
  784. write_end_chart();
  785. }
  786. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_FILE_CLOSED);
  787. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  788. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  789. write_chart_dimension(ect->name, ect->publish_systemd_fd.close_call);
  790. }
  791. }
  792. write_end_chart();
  793. if (em->mode < MODE_ENTRY) {
  794. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_FILE_CLOSE_ERROR);
  795. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  796. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  797. write_chart_dimension(ect->name, ect->publish_systemd_fd.close_err);
  798. }
  799. }
  800. write_end_chart();
  801. }
  802. }
  803. /**
  804. * Send data to Netdata calling auxiliary functions.
  805. *
  806. * @param em the main collector structure
  807. */
  808. static void ebpf_fd_send_cgroup_data(ebpf_module_t *em)
  809. {
  810. if (!ebpf_cgroup_pids)
  811. return;
  812. pthread_mutex_lock(&mutex_cgroup_shm);
  813. ebpf_cgroup_target_t *ect;
  814. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  815. ebpf_fd_sum_cgroup_pids(&ect->publish_systemd_fd, ect->pids);
  816. }
  817. int has_systemd = shm_ebpf_cgroup.header->systemd_enabled;
  818. if (has_systemd) {
  819. if (send_cgroup_chart) {
  820. ebpf_create_systemd_fd_charts(em);
  821. }
  822. ebpf_send_systemd_fd_charts(em);
  823. }
  824. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  825. if (ect->systemd)
  826. continue;
  827. if (!(ect->flags & NETDATA_EBPF_CGROUP_HAS_FD_CHART) && ect->updated) {
  828. ebpf_create_specific_fd_charts(ect->name, em);
  829. ect->flags |= NETDATA_EBPF_CGROUP_HAS_FD_CHART;
  830. }
  831. if (ect->flags & NETDATA_EBPF_CGROUP_HAS_FD_CHART ) {
  832. if (ect->updated) {
  833. ebpf_send_specific_fd_data(ect->name, &ect->publish_systemd_fd, em);
  834. } else {
  835. ebpf_obsolete_specific_fd_charts(ect->name, em);
  836. ect->flags &= ~NETDATA_EBPF_CGROUP_HAS_FD_CHART;
  837. }
  838. }
  839. }
  840. pthread_mutex_unlock(&mutex_cgroup_shm);
  841. }
  842. /**
  843. * Main loop for this collector.
  844. */
  845. static void fd_collector(ebpf_module_t *em)
  846. {
  847. int cgroups = em->cgroup_charts;
  848. heartbeat_t hb;
  849. heartbeat_init(&hb);
  850. int update_every = em->update_every;
  851. int counter = update_every - 1;
  852. while (!ebpf_exit_plugin) {
  853. (void)heartbeat_next(&hb, USEC_PER_SEC);
  854. if (ebpf_exit_plugin || ++counter != update_every)
  855. continue;
  856. counter = 0;
  857. netdata_apps_integration_flags_t apps = em->apps_charts;
  858. ebpf_fd_read_global_table();
  859. pthread_mutex_lock(&collect_data_mutex);
  860. if (apps)
  861. read_apps_table();
  862. if (cgroups)
  863. ebpf_update_fd_cgroup();
  864. pthread_mutex_lock(&lock);
  865. ebpf_fd_send_data(em);
  866. if (apps & NETDATA_EBPF_APPS_FLAG_CHART_CREATED)
  867. ebpf_fd_send_apps_data(em, apps_groups_root_target);
  868. if (cgroups)
  869. ebpf_fd_send_cgroup_data(em);
  870. pthread_mutex_unlock(&lock);
  871. pthread_mutex_unlock(&collect_data_mutex);
  872. }
  873. }
  874. /*****************************************************************
  875. *
  876. * CREATE CHARTS
  877. *
  878. *****************************************************************/
  879. /**
  880. * Create apps charts
  881. *
  882. * Call ebpf_create_chart to create the charts on apps submenu.
  883. *
  884. * @param em a pointer to the structure with the default values.
  885. */
  886. void ebpf_fd_create_apps_charts(struct ebpf_module *em, void *ptr)
  887. {
  888. struct ebpf_target *root = ptr;
  889. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_FILE_OPEN,
  890. "Number of open files",
  891. EBPF_COMMON_DIMENSION_CALL,
  892. NETDATA_APPS_FILE_GROUP,
  893. NETDATA_EBPF_CHART_TYPE_STACKED,
  894. 20061,
  895. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  896. root, em->update_every, NETDATA_EBPF_MODULE_NAME_PROCESS);
  897. if (em->mode < MODE_ENTRY) {
  898. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_FILE_OPEN_ERROR,
  899. "Fails to open files",
  900. EBPF_COMMON_DIMENSION_CALL,
  901. NETDATA_APPS_FILE_GROUP,
  902. NETDATA_EBPF_CHART_TYPE_STACKED,
  903. 20062,
  904. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  905. root, em->update_every, NETDATA_EBPF_MODULE_NAME_PROCESS);
  906. }
  907. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_FILE_CLOSED,
  908. "Files closed",
  909. EBPF_COMMON_DIMENSION_CALL,
  910. NETDATA_APPS_FILE_GROUP,
  911. NETDATA_EBPF_CHART_TYPE_STACKED,
  912. 20063,
  913. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  914. root, em->update_every, NETDATA_EBPF_MODULE_NAME_PROCESS);
  915. if (em->mode < MODE_ENTRY) {
  916. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_FILE_CLOSE_ERROR,
  917. "Fails to close files",
  918. EBPF_COMMON_DIMENSION_CALL,
  919. NETDATA_APPS_FILE_GROUP,
  920. NETDATA_EBPF_CHART_TYPE_STACKED,
  921. 20064,
  922. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  923. root, em->update_every, NETDATA_EBPF_MODULE_NAME_PROCESS);
  924. }
  925. em->apps_charts |= NETDATA_EBPF_APPS_FLAG_CHART_CREATED;
  926. }
  927. /**
  928. * Create global charts
  929. *
  930. * Call ebpf_create_chart to create the charts for the collector.
  931. *
  932. * @param em a pointer to the structure with the default values.
  933. */
  934. static void ebpf_create_fd_global_charts(ebpf_module_t *em)
  935. {
  936. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  937. NETDATA_FILE_OPEN_CLOSE_COUNT,
  938. "Open and close calls",
  939. EBPF_COMMON_DIMENSION_CALL,
  940. NETDATA_FILE_GROUP,
  941. NULL,
  942. NETDATA_EBPF_CHART_TYPE_LINE,
  943. NETDATA_CHART_PRIO_EBPF_FD_CHARTS,
  944. ebpf_create_global_dimension,
  945. fd_publish_aggregated,
  946. NETDATA_FD_SYSCALL_END,
  947. em->update_every, NETDATA_EBPF_MODULE_NAME_FD);
  948. if (em->mode < MODE_ENTRY) {
  949. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  950. NETDATA_FILE_OPEN_ERR_COUNT,
  951. "Open fails",
  952. EBPF_COMMON_DIMENSION_CALL,
  953. NETDATA_FILE_GROUP,
  954. NULL,
  955. NETDATA_EBPF_CHART_TYPE_LINE,
  956. NETDATA_CHART_PRIO_EBPF_FD_CHARTS + 1,
  957. ebpf_create_global_dimension,
  958. fd_publish_aggregated,
  959. NETDATA_FD_SYSCALL_END,
  960. em->update_every, NETDATA_EBPF_MODULE_NAME_FD);
  961. }
  962. }
  963. /*****************************************************************
  964. *
  965. * MAIN THREAD
  966. *
  967. *****************************************************************/
  968. /**
  969. * Allocate vectors used with this thread.
  970. *
  971. * We are not testing the return, because callocz does this and shutdown the software
  972. * case it was not possible to allocate.
  973. *
  974. * @param apps is apps enabled?
  975. */
  976. static void ebpf_fd_allocate_global_vectors(int apps)
  977. {
  978. if (apps) {
  979. ebpf_fd_aral_init();
  980. fd_pid = callocz((size_t)pid_max, sizeof(netdata_fd_stat_t *));
  981. fd_vector = callocz((size_t)ebpf_nprocs, sizeof(netdata_fd_stat_t));
  982. }
  983. fd_values = callocz((size_t)ebpf_nprocs, sizeof(netdata_idx_t));
  984. }
  985. /*
  986. * Load BPF
  987. *
  988. * Load BPF files.
  989. *
  990. * @param em the structure with configuration
  991. */
  992. static int ebpf_fd_load_bpf(ebpf_module_t *em)
  993. {
  994. int ret = 0;
  995. ebpf_adjust_apps_cgroup(em, em->targets[NETDATA_FD_SYSCALL_OPEN].mode);
  996. if (em->load & EBPF_LOAD_LEGACY) {
  997. em->probe_links = ebpf_load_program(ebpf_plugin_dir, em, running_on_kernel, isrh, &em->objects);
  998. if (!em->probe_links) {
  999. em->enabled = CONFIG_BOOLEAN_NO;
  1000. ret = -1;
  1001. }
  1002. }
  1003. #ifdef LIBBPF_MAJOR_VERSION
  1004. else {
  1005. bpf_obj = fd_bpf__open();
  1006. if (!bpf_obj)
  1007. ret = -1;
  1008. else
  1009. ret = ebpf_fd_load_and_attach(bpf_obj, em);
  1010. }
  1011. #endif
  1012. if (ret)
  1013. error("%s %s", EBPF_DEFAULT_ERROR_MSG, em->thread_name);
  1014. return ret;
  1015. }
  1016. /**
  1017. * Directory Cache thread
  1018. *
  1019. * Thread used to make dcstat thread
  1020. *
  1021. * @param ptr a pointer to `struct ebpf_module`
  1022. *
  1023. * @return It always returns NULL
  1024. */
  1025. void *ebpf_fd_thread(void *ptr)
  1026. {
  1027. netdata_thread_cleanup_push(ebpf_fd_exit, ptr);
  1028. ebpf_module_t *em = (ebpf_module_t *)ptr;
  1029. em->maps = fd_maps;
  1030. #ifdef LIBBPF_MAJOR_VERSION
  1031. ebpf_adjust_thread_load(em, default_btf);
  1032. #endif
  1033. if (ebpf_fd_load_bpf(em)) {
  1034. em->thread->enabled = NETDATA_THREAD_EBPF_STOPPED;
  1035. goto endfd;
  1036. }
  1037. ebpf_fd_allocate_global_vectors(em->apps_charts);
  1038. int algorithms[NETDATA_FD_SYSCALL_END] = {
  1039. NETDATA_EBPF_INCREMENTAL_IDX, NETDATA_EBPF_INCREMENTAL_IDX
  1040. };
  1041. ebpf_global_labels(fd_aggregated_data, fd_publish_aggregated, fd_dimension_names, fd_id_names,
  1042. algorithms, NETDATA_FD_SYSCALL_END);
  1043. pthread_mutex_lock(&lock);
  1044. ebpf_create_fd_global_charts(em);
  1045. ebpf_update_stats(&plugin_statistics, em);
  1046. pthread_mutex_unlock(&lock);
  1047. fd_collector(em);
  1048. endfd:
  1049. ebpf_update_disabled_plugin_stats(em);
  1050. netdata_thread_cleanup_pop(1);
  1051. return NULL;
  1052. }