ebpf_vfs.c 86 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979
  1. // SPDX-License-Identifier: GPL-3.0-or-later
  2. #include <sys/resource.h>
  3. #include "ebpf.h"
  4. #include "ebpf_vfs.h"
  5. // ----------------------------------------------------------------------------
  6. // ARAL vectors used to speed up processing
  7. ARAL *ebpf_aral_vfs_pid = NULL;
  8. static char *vfs_dimension_names[NETDATA_KEY_PUBLISH_VFS_END] = { "delete", "read", "write",
  9. "fsync", "open", "create" };
  10. static char *vfs_id_names[NETDATA_KEY_PUBLISH_VFS_END] = { "vfs_unlink", "vfs_read", "vfs_write",
  11. "vfs_fsync", "vfs_open", "vfs_create"};
  12. static netdata_idx_t *vfs_hash_values = NULL;
  13. static netdata_syscall_stat_t vfs_aggregated_data[NETDATA_KEY_PUBLISH_VFS_END];
  14. static netdata_publish_syscall_t vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_END];
  15. netdata_publish_vfs_t **vfs_pid = NULL;
  16. netdata_publish_vfs_t *vfs_vector = NULL;
  17. static ebpf_local_maps_t vfs_maps[] = {{.name = "tbl_vfs_pid", .internal_input = ND_EBPF_DEFAULT_PID_SIZE,
  18. .user_input = 0, .type = NETDATA_EBPF_MAP_RESIZABLE | NETDATA_EBPF_MAP_PID,
  19. .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
  20. {.name = "tbl_vfs_stats", .internal_input = NETDATA_VFS_COUNTER,
  21. .user_input = 0, .type = NETDATA_EBPF_MAP_STATIC,
  22. .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
  23. {.name = "vfs_ctrl", .internal_input = NETDATA_CONTROLLER_END,
  24. .user_input = 0,
  25. .type = NETDATA_EBPF_MAP_CONTROLLER,
  26. .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
  27. {.name = NULL, .internal_input = 0, .user_input = 0}};
  28. struct config vfs_config = { .first_section = NULL,
  29. .last_section = NULL,
  30. .mutex = NETDATA_MUTEX_INITIALIZER,
  31. .index = { .avl_tree = { .root = NULL, .compar = appconfig_section_compare },
  32. .rwlock = AVL_LOCK_INITIALIZER } };
  33. netdata_ebpf_targets_t vfs_targets[] = { {.name = "vfs_write", .mode = EBPF_LOAD_TRAMPOLINE},
  34. {.name = "vfs_writev", .mode = EBPF_LOAD_TRAMPOLINE},
  35. {.name = "vfs_read", .mode = EBPF_LOAD_TRAMPOLINE},
  36. {.name = "vfs_readv", .mode = EBPF_LOAD_TRAMPOLINE},
  37. {.name = "vfs_unlink", .mode = EBPF_LOAD_TRAMPOLINE},
  38. {.name = "vfs_fsync", .mode = EBPF_LOAD_TRAMPOLINE},
  39. {.name = "vfs_open", .mode = EBPF_LOAD_TRAMPOLINE},
  40. {.name = "vfs_create", .mode = EBPF_LOAD_TRAMPOLINE},
  41. {.name = "release_task", .mode = EBPF_LOAD_TRAMPOLINE},
  42. {.name = NULL, .mode = EBPF_LOAD_TRAMPOLINE}};
  43. #ifdef LIBBPF_MAJOR_VERSION
  44. #include "includes/vfs.skel.h" // BTF code
  45. static struct vfs_bpf *bpf_obj = NULL;
  46. /**
  47. * Disable probe
  48. *
  49. * Disable all probes to use exclusively another method.
  50. *
  51. * @param obj is the main structure for bpf objects
  52. */
  53. static void ebpf_vfs_disable_probes(struct vfs_bpf *obj)
  54. {
  55. bpf_program__set_autoload(obj->progs.netdata_vfs_write_kprobe, false);
  56. bpf_program__set_autoload(obj->progs.netdata_vfs_write_kretprobe, false);
  57. bpf_program__set_autoload(obj->progs.netdata_vfs_writev_kprobe, false);
  58. bpf_program__set_autoload(obj->progs.netdata_vfs_writev_kretprobe, false);
  59. bpf_program__set_autoload(obj->progs.netdata_vfs_read_kprobe, false);
  60. bpf_program__set_autoload(obj->progs.netdata_vfs_read_kretprobe, false);
  61. bpf_program__set_autoload(obj->progs.netdata_vfs_readv_kprobe, false);
  62. bpf_program__set_autoload(obj->progs.netdata_vfs_readv_kretprobe, false);
  63. bpf_program__set_autoload(obj->progs.netdata_vfs_unlink_kprobe, false);
  64. bpf_program__set_autoload(obj->progs.netdata_vfs_unlink_kretprobe, false);
  65. bpf_program__set_autoload(obj->progs.netdata_vfs_fsync_kprobe, false);
  66. bpf_program__set_autoload(obj->progs.netdata_vfs_fsync_kretprobe, false);
  67. bpf_program__set_autoload(obj->progs.netdata_vfs_open_kprobe, false);
  68. bpf_program__set_autoload(obj->progs.netdata_vfs_open_kretprobe, false);
  69. bpf_program__set_autoload(obj->progs.netdata_vfs_create_kprobe, false);
  70. bpf_program__set_autoload(obj->progs.netdata_vfs_create_kretprobe, false);
  71. bpf_program__set_autoload(obj->progs.netdata_vfs_release_task_kprobe, false);
  72. }
  73. /*
  74. * Disable trampoline
  75. *
  76. * Disable all trampoline to use exclusively another method.
  77. *
  78. * @param obj is the main structure for bpf objects.
  79. */
  80. static void ebpf_vfs_disable_trampoline(struct vfs_bpf *obj)
  81. {
  82. bpf_program__set_autoload(obj->progs.netdata_vfs_write_fentry, false);
  83. bpf_program__set_autoload(obj->progs.netdata_vfs_write_fexit, false);
  84. bpf_program__set_autoload(obj->progs.netdata_vfs_writev_fentry, false);
  85. bpf_program__set_autoload(obj->progs.netdata_vfs_writev_fexit, false);
  86. bpf_program__set_autoload(obj->progs.netdata_vfs_read_fentry, false);
  87. bpf_program__set_autoload(obj->progs.netdata_vfs_read_fexit, false);
  88. bpf_program__set_autoload(obj->progs.netdata_vfs_readv_fentry, false);
  89. bpf_program__set_autoload(obj->progs.netdata_vfs_readv_fexit, false);
  90. bpf_program__set_autoload(obj->progs.netdata_vfs_unlink_fentry, false);
  91. bpf_program__set_autoload(obj->progs.netdata_vfs_fsync_fentry, false);
  92. bpf_program__set_autoload(obj->progs.netdata_vfs_fsync_fexit, false);
  93. bpf_program__set_autoload(obj->progs.netdata_vfs_open_fentry, false);
  94. bpf_program__set_autoload(obj->progs.netdata_vfs_open_fexit, false);
  95. bpf_program__set_autoload(obj->progs.netdata_vfs_create_fentry, false);
  96. bpf_program__set_autoload(obj->progs.netdata_vfs_release_task_fentry, false);
  97. }
  98. /**
  99. * Set trampoline target
  100. *
  101. * Set the targets we will monitor.
  102. *
  103. * @param obj is the main structure for bpf objects.
  104. */
  105. static void ebpf_vfs_set_trampoline_target(struct vfs_bpf *obj)
  106. {
  107. bpf_program__set_attach_target(obj->progs.netdata_vfs_write_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_WRITE].name);
  108. bpf_program__set_attach_target(obj->progs.netdata_vfs_write_fexit, 0, vfs_targets[NETDATA_EBPF_VFS_WRITE].name);
  109. bpf_program__set_attach_target(obj->progs.netdata_vfs_writev_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_WRITEV].name);
  110. bpf_program__set_attach_target(obj->progs.netdata_vfs_writev_fexit, 0, vfs_targets[NETDATA_EBPF_VFS_WRITEV].name);
  111. bpf_program__set_attach_target(obj->progs.netdata_vfs_read_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_READ].name);
  112. bpf_program__set_attach_target(obj->progs.netdata_vfs_read_fexit, 0, vfs_targets[NETDATA_EBPF_VFS_READ].name);
  113. bpf_program__set_attach_target(obj->progs.netdata_vfs_readv_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_READV].name);
  114. bpf_program__set_attach_target(obj->progs.netdata_vfs_readv_fexit, 0, vfs_targets[NETDATA_EBPF_VFS_READV].name);
  115. bpf_program__set_attach_target(obj->progs.netdata_vfs_unlink_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_UNLINK].name);
  116. bpf_program__set_attach_target(obj->progs.netdata_vfs_fsync_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_FSYNC].name);
  117. bpf_program__set_attach_target(obj->progs.netdata_vfs_fsync_fexit, 0, vfs_targets[NETDATA_EBPF_VFS_FSYNC].name);
  118. bpf_program__set_attach_target(obj->progs.netdata_vfs_open_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_OPEN].name);
  119. bpf_program__set_attach_target(obj->progs.netdata_vfs_open_fexit, 0, vfs_targets[NETDATA_EBPF_VFS_OPEN].name);
  120. bpf_program__set_attach_target(obj->progs.netdata_vfs_create_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_CREATE].name);
  121. bpf_program__set_attach_target(obj->progs.netdata_vfs_release_task_fentry, 0, EBPF_COMMON_FNCT_CLEAN_UP);
  122. }
  123. /**
  124. * Attach Probe
  125. *
  126. * Attach probes to target
  127. *
  128. * @param obj is the main structure for bpf objects.
  129. *
  130. * @return It returns 0 on success and -1 otherwise.
  131. */
  132. static int ebpf_vfs_attach_probe(struct vfs_bpf *obj)
  133. {
  134. obj->links.netdata_vfs_write_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_write_kprobe, false,
  135. vfs_targets[NETDATA_EBPF_VFS_WRITE].name);
  136. int ret = libbpf_get_error(obj->links.netdata_vfs_write_kprobe);
  137. if (ret)
  138. return -1;
  139. obj->links.netdata_vfs_write_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_write_kretprobe, true,
  140. vfs_targets[NETDATA_EBPF_VFS_WRITE].name);
  141. ret = libbpf_get_error(obj->links.netdata_vfs_write_kretprobe);
  142. if (ret)
  143. return -1;
  144. obj->links.netdata_vfs_writev_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_writev_kprobe, false,
  145. vfs_targets[NETDATA_EBPF_VFS_WRITEV].name);
  146. ret = libbpf_get_error(obj->links.netdata_vfs_writev_kprobe);
  147. if (ret)
  148. return -1;
  149. obj->links.netdata_vfs_writev_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_writev_kretprobe, true,
  150. vfs_targets[NETDATA_EBPF_VFS_WRITEV].name);
  151. ret = libbpf_get_error(obj->links.netdata_vfs_writev_kretprobe);
  152. if (ret)
  153. return -1;
  154. obj->links.netdata_vfs_read_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_read_kprobe, false,
  155. vfs_targets[NETDATA_EBPF_VFS_READ].name);
  156. ret = libbpf_get_error(obj->links.netdata_vfs_read_kprobe);
  157. if (ret)
  158. return -1;
  159. obj->links.netdata_vfs_read_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_read_kretprobe, true,
  160. vfs_targets[NETDATA_EBPF_VFS_READ].name);
  161. ret = libbpf_get_error(obj->links.netdata_vfs_read_kretprobe);
  162. if (ret)
  163. return -1;
  164. obj->links.netdata_vfs_readv_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_readv_kprobe, false,
  165. vfs_targets[NETDATA_EBPF_VFS_READV].name);
  166. ret = libbpf_get_error(obj->links.netdata_vfs_readv_kprobe);
  167. if (ret)
  168. return -1;
  169. obj->links.netdata_vfs_readv_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_readv_kretprobe, true,
  170. vfs_targets[NETDATA_EBPF_VFS_READV].name);
  171. ret = libbpf_get_error(obj->links.netdata_vfs_readv_kretprobe);
  172. if (ret)
  173. return -1;
  174. obj->links.netdata_vfs_unlink_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_unlink_kprobe, false,
  175. vfs_targets[NETDATA_EBPF_VFS_UNLINK].name);
  176. ret = libbpf_get_error(obj->links.netdata_vfs_unlink_kprobe);
  177. if (ret)
  178. return -1;
  179. obj->links.netdata_vfs_unlink_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_unlink_kretprobe, true,
  180. vfs_targets[NETDATA_EBPF_VFS_UNLINK].name);
  181. ret = libbpf_get_error(obj->links.netdata_vfs_unlink_kretprobe);
  182. if (ret)
  183. return -1;
  184. obj->links.netdata_vfs_fsync_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_fsync_kprobe, false,
  185. vfs_targets[NETDATA_EBPF_VFS_FSYNC].name);
  186. ret = libbpf_get_error(obj->links.netdata_vfs_fsync_kprobe);
  187. if (ret)
  188. return -1;
  189. obj->links.netdata_vfs_fsync_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_fsync_kretprobe, true,
  190. vfs_targets[NETDATA_EBPF_VFS_FSYNC].name);
  191. ret = libbpf_get_error(obj->links.netdata_vfs_fsync_kretprobe);
  192. if (ret)
  193. return -1;
  194. obj->links.netdata_vfs_open_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_open_kprobe, false,
  195. vfs_targets[NETDATA_EBPF_VFS_OPEN].name);
  196. ret = libbpf_get_error(obj->links.netdata_vfs_open_kprobe);
  197. if (ret)
  198. return -1;
  199. obj->links.netdata_vfs_open_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_open_kretprobe, true,
  200. vfs_targets[NETDATA_EBPF_VFS_OPEN].name);
  201. ret = libbpf_get_error(obj->links.netdata_vfs_open_kretprobe);
  202. if (ret)
  203. return -1;
  204. obj->links.netdata_vfs_create_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_create_kprobe, false,
  205. vfs_targets[NETDATA_EBPF_VFS_CREATE].name);
  206. ret = libbpf_get_error(obj->links.netdata_vfs_create_kprobe);
  207. if (ret)
  208. return -1;
  209. obj->links.netdata_vfs_create_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_create_kretprobe, true,
  210. vfs_targets[NETDATA_EBPF_VFS_CREATE].name);
  211. ret = libbpf_get_error(obj->links.netdata_vfs_create_kretprobe);
  212. if (ret)
  213. return -1;
  214. obj->links.netdata_vfs_fsync_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_fsync_kprobe, false,
  215. vfs_targets[NETDATA_EBPF_VFS_FSYNC].name);
  216. ret = libbpf_get_error(obj->links.netdata_vfs_fsync_kprobe);
  217. if (ret)
  218. return -1;
  219. obj->links.netdata_vfs_fsync_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_fsync_kretprobe, true,
  220. vfs_targets[NETDATA_EBPF_VFS_FSYNC].name);
  221. ret = libbpf_get_error(obj->links.netdata_vfs_fsync_kretprobe);
  222. if (ret)
  223. return -1;
  224. obj->links.netdata_vfs_open_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_open_kprobe, false,
  225. vfs_targets[NETDATA_EBPF_VFS_OPEN].name);
  226. ret = libbpf_get_error(obj->links.netdata_vfs_open_kprobe);
  227. if (ret)
  228. return -1;
  229. obj->links.netdata_vfs_open_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_open_kretprobe, true,
  230. vfs_targets[NETDATA_EBPF_VFS_OPEN].name);
  231. ret = libbpf_get_error(obj->links.netdata_vfs_open_kretprobe);
  232. if (ret)
  233. return -1;
  234. obj->links.netdata_vfs_create_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_create_kprobe, false,
  235. vfs_targets[NETDATA_EBPF_VFS_CREATE].name);
  236. ret = libbpf_get_error(obj->links.netdata_vfs_create_kprobe);
  237. if (ret)
  238. return -1;
  239. obj->links.netdata_vfs_create_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_create_kretprobe, true,
  240. vfs_targets[NETDATA_EBPF_VFS_CREATE].name);
  241. ret = libbpf_get_error(obj->links.netdata_vfs_create_kretprobe);
  242. if (ret)
  243. return -1;
  244. obj->links.netdata_vfs_release_task_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_release_task_fentry,
  245. true,
  246. EBPF_COMMON_FNCT_CLEAN_UP);
  247. ret = libbpf_get_error(obj->links.netdata_vfs_release_task_kprobe);
  248. if (ret)
  249. return -1;
  250. return 0;
  251. }
  252. /**
  253. * Adjust Map Size
  254. *
  255. * Resize maps according input from users.
  256. *
  257. * @param obj is the main structure for bpf objects.
  258. * @param em structure with configuration
  259. */
  260. static void ebpf_vfs_adjust_map_size(struct vfs_bpf *obj, ebpf_module_t *em)
  261. {
  262. ebpf_update_map_size(obj->maps.tbl_vfs_pid, &vfs_maps[NETDATA_VFS_PID],
  263. em, bpf_map__name(obj->maps.tbl_vfs_pid));
  264. }
  265. /**
  266. * Set hash tables
  267. *
  268. * Set the values for maps according the value given by kernel.
  269. *
  270. * @param obj is the main structure for bpf objects.
  271. */
  272. static void ebpf_vfs_set_hash_tables(struct vfs_bpf *obj)
  273. {
  274. vfs_maps[NETDATA_VFS_ALL].map_fd = bpf_map__fd(obj->maps.tbl_vfs_stats);
  275. vfs_maps[NETDATA_VFS_PID].map_fd = bpf_map__fd(obj->maps.tbl_vfs_pid);
  276. vfs_maps[NETDATA_VFS_CTRL].map_fd = bpf_map__fd(obj->maps.vfs_ctrl);
  277. }
  278. /**
  279. * Disable Release Task
  280. *
  281. * Disable release task when apps is not enabled.
  282. *
  283. * @param obj is the main structure for bpf objects.
  284. */
  285. static void ebpf_vfs_disable_release_task(struct vfs_bpf *obj)
  286. {
  287. bpf_program__set_autoload(obj->progs.netdata_vfs_release_task_fentry, false);
  288. bpf_program__set_autoload(obj->progs.netdata_vfs_release_task_kprobe, false);
  289. }
  290. /**
  291. * Load and attach
  292. *
  293. * Load and attach the eBPF code in kernel.
  294. *
  295. * @param obj is the main structure for bpf objects.
  296. * @param em structure with configuration
  297. *
  298. * @return it returns 0 on success and -1 otherwise
  299. */
  300. static inline int ebpf_vfs_load_and_attach(struct vfs_bpf *obj, ebpf_module_t *em)
  301. {
  302. netdata_ebpf_targets_t *mt = em->targets;
  303. netdata_ebpf_program_loaded_t test = mt[NETDATA_EBPF_VFS_WRITE].mode;
  304. if (test == EBPF_LOAD_TRAMPOLINE) {
  305. ebpf_vfs_disable_probes(obj);
  306. ebpf_vfs_set_trampoline_target(obj);
  307. } else {
  308. ebpf_vfs_disable_trampoline(obj);
  309. }
  310. ebpf_vfs_adjust_map_size(obj, em);
  311. if (!em->apps_charts && !em->cgroup_charts)
  312. ebpf_vfs_disable_release_task(obj);
  313. int ret = vfs_bpf__load(obj);
  314. if (ret) {
  315. return ret;
  316. }
  317. ret = (test == EBPF_LOAD_TRAMPOLINE) ? vfs_bpf__attach(obj) : ebpf_vfs_attach_probe(obj);
  318. if (!ret) {
  319. ebpf_vfs_set_hash_tables(obj);
  320. ebpf_update_controller(vfs_maps[NETDATA_VFS_CTRL].map_fd, em);
  321. }
  322. return ret;
  323. }
  324. #endif
  325. /*****************************************************************
  326. *
  327. * ARAL FUNCTIONS
  328. *
  329. *****************************************************************/
  330. /**
  331. * eBPF VFS Aral init
  332. *
  333. * Initiallize array allocator that will be used when integration with apps is enabled.
  334. */
  335. static inline void ebpf_vfs_aral_init()
  336. {
  337. ebpf_aral_vfs_pid = ebpf_allocate_pid_aral(NETDATA_EBPF_VFS_ARAL_NAME, sizeof(netdata_publish_vfs_t));
  338. }
  339. /**
  340. * eBPF publish VFS get
  341. *
  342. * Get a netdata_publish_vfs_t entry to be used with a specific PID.
  343. *
  344. * @return it returns the address on success.
  345. */
  346. netdata_publish_vfs_t *ebpf_vfs_get(void)
  347. {
  348. netdata_publish_vfs_t *target = aral_mallocz(ebpf_aral_vfs_pid);
  349. memset(target, 0, sizeof(netdata_publish_vfs_t));
  350. return target;
  351. }
  352. /**
  353. * eBPF VFS release
  354. *
  355. * @param stat Release a target after usage.
  356. */
  357. void ebpf_vfs_release(netdata_publish_vfs_t *stat)
  358. {
  359. aral_freez(ebpf_aral_vfs_pid, stat);
  360. }
  361. /*****************************************************************
  362. *
  363. * FUNCTIONS TO CLOSE THE THREAD
  364. *
  365. *****************************************************************/
  366. /**
  367. * Cachestat Free
  368. *
  369. * Cleanup variables after child threads to stop
  370. *
  371. * @param ptr thread data.
  372. */
  373. static void ebpf_vfs_free(ebpf_module_t *em)
  374. {
  375. pthread_mutex_lock(&ebpf_exit_cleanup);
  376. em->thread->enabled = NETDATA_THREAD_EBPF_STOPPING;
  377. pthread_mutex_unlock(&ebpf_exit_cleanup);
  378. freez(vfs_hash_values);
  379. freez(vfs_vector);
  380. #ifdef LIBBPF_MAJOR_VERSION
  381. if (bpf_obj)
  382. vfs_bpf__destroy(bpf_obj);
  383. #endif
  384. pthread_mutex_lock(&ebpf_exit_cleanup);
  385. em->thread->enabled = NETDATA_THREAD_EBPF_STOPPED;
  386. pthread_mutex_unlock(&ebpf_exit_cleanup);
  387. }
  388. /**
  389. * Exit
  390. *
  391. * Cancel thread and exit.
  392. *
  393. * @param ptr thread data.
  394. **/
  395. static void ebpf_vfs_exit(void *ptr)
  396. {
  397. ebpf_module_t *em = (ebpf_module_t *)ptr;
  398. ebpf_vfs_free(em);
  399. }
  400. /*****************************************************************
  401. *
  402. * FUNCTIONS WITH THE MAIN LOOP
  403. *
  404. *****************************************************************/
  405. /**
  406. * Send data to Netdata calling auxiliary functions.
  407. *
  408. * @param em the structure with thread information
  409. */
  410. static void ebpf_vfs_send_data(ebpf_module_t *em)
  411. {
  412. netdata_publish_vfs_common_t pvc;
  413. pvc.write = (long)vfs_aggregated_data[NETDATA_KEY_PUBLISH_VFS_WRITE].bytes;
  414. pvc.read = (long)vfs_aggregated_data[NETDATA_KEY_PUBLISH_VFS_READ].bytes;
  415. write_count_chart(NETDATA_VFS_FILE_CLEAN_COUNT, NETDATA_FILESYSTEM_FAMILY,
  416. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_UNLINK], 1);
  417. write_count_chart(NETDATA_VFS_FILE_IO_COUNT, NETDATA_FILESYSTEM_FAMILY,
  418. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ], 2);
  419. if (em->mode < MODE_ENTRY) {
  420. write_err_chart(NETDATA_VFS_FILE_ERR_COUNT, NETDATA_FILESYSTEM_FAMILY,
  421. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ], 2);
  422. }
  423. write_io_chart(NETDATA_VFS_IO_FILE_BYTES, NETDATA_FILESYSTEM_FAMILY, vfs_id_names[NETDATA_KEY_PUBLISH_VFS_WRITE],
  424. (long long)pvc.write, vfs_id_names[NETDATA_KEY_PUBLISH_VFS_READ], (long long)pvc.read);
  425. write_count_chart(NETDATA_VFS_FSYNC, NETDATA_FILESYSTEM_FAMILY,
  426. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC], 1);
  427. if (em->mode < MODE_ENTRY) {
  428. write_err_chart(NETDATA_VFS_FSYNC_ERR, NETDATA_FILESYSTEM_FAMILY,
  429. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC], 1);
  430. }
  431. write_count_chart(NETDATA_VFS_OPEN, NETDATA_FILESYSTEM_FAMILY,
  432. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN], 1);
  433. if (em->mode < MODE_ENTRY) {
  434. write_err_chart(NETDATA_VFS_OPEN_ERR, NETDATA_FILESYSTEM_FAMILY,
  435. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN], 1);
  436. }
  437. write_count_chart(NETDATA_VFS_CREATE, NETDATA_FILESYSTEM_FAMILY,
  438. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE], 1);
  439. if (em->mode < MODE_ENTRY) {
  440. write_err_chart(
  441. NETDATA_VFS_CREATE_ERR,
  442. NETDATA_FILESYSTEM_FAMILY,
  443. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE],
  444. 1);
  445. }
  446. }
  447. /**
  448. * Read the hash table and store data to allocated vectors.
  449. */
  450. static void ebpf_vfs_read_global_table()
  451. {
  452. uint64_t idx;
  453. netdata_idx_t res[NETDATA_VFS_COUNTER];
  454. netdata_idx_t *val = vfs_hash_values;
  455. int fd = vfs_maps[NETDATA_VFS_ALL].map_fd;
  456. for (idx = 0; idx < NETDATA_VFS_COUNTER; idx++) {
  457. uint64_t total = 0;
  458. if (!bpf_map_lookup_elem(fd, &idx, val)) {
  459. int i;
  460. int end = ebpf_nprocs;
  461. for (i = 0; i < end; i++)
  462. total += val[i];
  463. }
  464. res[idx] = total;
  465. }
  466. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_UNLINK].ncall = res[NETDATA_KEY_CALLS_VFS_UNLINK];
  467. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ].ncall = res[NETDATA_KEY_CALLS_VFS_READ] +
  468. res[NETDATA_KEY_CALLS_VFS_READV];
  469. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE].ncall = res[NETDATA_KEY_CALLS_VFS_WRITE] +
  470. res[NETDATA_KEY_CALLS_VFS_WRITEV];
  471. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC].ncall = res[NETDATA_KEY_CALLS_VFS_FSYNC];
  472. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN].ncall = res[NETDATA_KEY_CALLS_VFS_OPEN];
  473. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE].ncall = res[NETDATA_KEY_CALLS_VFS_CREATE];
  474. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_UNLINK].nerr = res[NETDATA_KEY_ERROR_VFS_UNLINK];
  475. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ].nerr = res[NETDATA_KEY_ERROR_VFS_READ] +
  476. res[NETDATA_KEY_ERROR_VFS_READV];
  477. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE].nerr = res[NETDATA_KEY_ERROR_VFS_WRITE] +
  478. res[NETDATA_KEY_ERROR_VFS_WRITEV];
  479. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC].nerr = res[NETDATA_KEY_ERROR_VFS_FSYNC];
  480. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN].nerr = res[NETDATA_KEY_ERROR_VFS_OPEN];
  481. vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE].nerr = res[NETDATA_KEY_ERROR_VFS_CREATE];
  482. vfs_aggregated_data[NETDATA_KEY_PUBLISH_VFS_WRITE].bytes = (uint64_t)res[NETDATA_KEY_BYTES_VFS_WRITE] +
  483. (uint64_t)res[NETDATA_KEY_BYTES_VFS_WRITEV];
  484. vfs_aggregated_data[NETDATA_KEY_PUBLISH_VFS_READ].bytes = (uint64_t)res[NETDATA_KEY_BYTES_VFS_READ] +
  485. (uint64_t)res[NETDATA_KEY_BYTES_VFS_READV];
  486. }
  487. /**
  488. * Sum PIDs
  489. *
  490. * Sum values for all targets.
  491. *
  492. * @param swap output structure
  493. * @param root link list with structure to be used
  494. */
  495. static void ebpf_vfs_sum_pids(netdata_publish_vfs_t *vfs, struct ebpf_pid_on_target *root)
  496. {
  497. netdata_publish_vfs_t accumulator;
  498. memset(&accumulator, 0, sizeof(accumulator));
  499. while (root) {
  500. int32_t pid = root->pid;
  501. netdata_publish_vfs_t *w = vfs_pid[pid];
  502. if (w) {
  503. accumulator.write_call += w->write_call;
  504. accumulator.writev_call += w->writev_call;
  505. accumulator.read_call += w->read_call;
  506. accumulator.readv_call += w->readv_call;
  507. accumulator.unlink_call += w->unlink_call;
  508. accumulator.fsync_call += w->fsync_call;
  509. accumulator.open_call += w->open_call;
  510. accumulator.create_call += w->create_call;
  511. accumulator.write_bytes += w->write_bytes;
  512. accumulator.writev_bytes += w->writev_bytes;
  513. accumulator.read_bytes += w->read_bytes;
  514. accumulator.readv_bytes += w->readv_bytes;
  515. accumulator.write_err += w->write_err;
  516. accumulator.writev_err += w->writev_err;
  517. accumulator.read_err += w->read_err;
  518. accumulator.readv_err += w->readv_err;
  519. accumulator.unlink_err += w->unlink_err;
  520. accumulator.fsync_err += w->fsync_err;
  521. accumulator.open_err += w->open_err;
  522. accumulator.create_err += w->create_err;
  523. }
  524. root = root->next;
  525. }
  526. // These conditions were added, because we are using incremental algorithm
  527. vfs->write_call = (accumulator.write_call >= vfs->write_call) ? accumulator.write_call : vfs->write_call;
  528. vfs->writev_call = (accumulator.writev_call >= vfs->writev_call) ? accumulator.writev_call : vfs->writev_call;
  529. vfs->read_call = (accumulator.read_call >= vfs->read_call) ? accumulator.read_call : vfs->read_call;
  530. vfs->readv_call = (accumulator.readv_call >= vfs->readv_call) ? accumulator.readv_call : vfs->readv_call;
  531. vfs->unlink_call = (accumulator.unlink_call >= vfs->unlink_call) ? accumulator.unlink_call : vfs->unlink_call;
  532. vfs->fsync_call = (accumulator.fsync_call >= vfs->fsync_call) ? accumulator.fsync_call : vfs->fsync_call;
  533. vfs->open_call = (accumulator.open_call >= vfs->open_call) ? accumulator.open_call : vfs->open_call;
  534. vfs->create_call = (accumulator.create_call >= vfs->create_call) ? accumulator.create_call : vfs->create_call;
  535. vfs->write_bytes = (accumulator.write_bytes >= vfs->write_bytes) ? accumulator.write_bytes : vfs->write_bytes;
  536. vfs->writev_bytes = (accumulator.writev_bytes >= vfs->writev_bytes) ? accumulator.writev_bytes : vfs->writev_bytes;
  537. vfs->read_bytes = (accumulator.read_bytes >= vfs->read_bytes) ? accumulator.read_bytes : vfs->read_bytes;
  538. vfs->readv_bytes = (accumulator.readv_bytes >= vfs->readv_bytes) ? accumulator.readv_bytes : vfs->readv_bytes;
  539. vfs->write_err = (accumulator.write_err >= vfs->write_err) ? accumulator.write_err : vfs->write_err;
  540. vfs->writev_err = (accumulator.writev_err >= vfs->writev_err) ? accumulator.writev_err : vfs->writev_err;
  541. vfs->read_err = (accumulator.read_err >= vfs->read_err) ? accumulator.read_err : vfs->read_err;
  542. vfs->readv_err = (accumulator.readv_err >= vfs->readv_err) ? accumulator.readv_err : vfs->readv_err;
  543. vfs->unlink_err = (accumulator.unlink_err >= vfs->unlink_err) ? accumulator.unlink_err : vfs->unlink_err;
  544. vfs->fsync_err = (accumulator.fsync_err >= vfs->fsync_err) ? accumulator.fsync_err : vfs->fsync_err;
  545. vfs->open_err = (accumulator.open_err >= vfs->open_err) ? accumulator.open_err : vfs->open_err;
  546. vfs->create_err = (accumulator.create_err >= vfs->create_err) ? accumulator.create_err : vfs->create_err;
  547. }
  548. /**
  549. * Send data to Netdata calling auxiliary functions.
  550. *
  551. * @param em the structure with thread information
  552. * @param root the target list.
  553. */
  554. void ebpf_vfs_send_apps_data(ebpf_module_t *em, struct ebpf_target *root)
  555. {
  556. struct ebpf_target *w;
  557. for (w = root; w; w = w->next) {
  558. if (unlikely(w->exposed && w->processes)) {
  559. ebpf_vfs_sum_pids(&w->vfs, w->root_pid);
  560. }
  561. }
  562. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_FILE_DELETED);
  563. for (w = root; w; w = w->next) {
  564. if (unlikely(w->exposed && w->processes)) {
  565. write_chart_dimension(w->name, w->vfs.unlink_call);
  566. }
  567. }
  568. write_end_chart();
  569. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS);
  570. for (w = root; w; w = w->next) {
  571. if (unlikely(w->exposed && w->processes)) {
  572. write_chart_dimension(w->name, w->vfs.write_call + w->vfs.writev_call);
  573. }
  574. }
  575. write_end_chart();
  576. if (em->mode < MODE_ENTRY) {
  577. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR);
  578. for (w = root; w; w = w->next) {
  579. if (unlikely(w->exposed && w->processes)) {
  580. write_chart_dimension(w->name, w->vfs.write_err + w->vfs.writev_err);
  581. }
  582. }
  583. write_end_chart();
  584. }
  585. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_CALLS);
  586. for (w = root; w; w = w->next) {
  587. if (unlikely(w->exposed && w->processes)) {
  588. write_chart_dimension(w->name, w->vfs.read_call + w->vfs.readv_call);
  589. }
  590. }
  591. write_end_chart();
  592. if (em->mode < MODE_ENTRY) {
  593. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR);
  594. for (w = root; w; w = w->next) {
  595. if (unlikely(w->exposed && w->processes)) {
  596. write_chart_dimension(w->name, w->vfs.read_err + w->vfs.readv_err);
  597. }
  598. }
  599. write_end_chart();
  600. }
  601. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES);
  602. for (w = root; w; w = w->next) {
  603. if (unlikely(w->exposed && w->processes)) {
  604. write_chart_dimension(w->name, w->vfs.write_bytes + w->vfs.writev_bytes);
  605. }
  606. }
  607. write_end_chart();
  608. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_BYTES);
  609. for (w = root; w; w = w->next) {
  610. if (unlikely(w->exposed && w->processes)) {
  611. write_chart_dimension(w->name, w->vfs.read_bytes + w->vfs.readv_bytes);
  612. }
  613. }
  614. write_end_chart();
  615. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_FSYNC);
  616. for (w = root; w; w = w->next) {
  617. if (unlikely(w->exposed && w->processes)) {
  618. write_chart_dimension(w->name, w->vfs.fsync_call);
  619. }
  620. }
  621. write_end_chart();
  622. if (em->mode < MODE_ENTRY) {
  623. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_FSYNC_CALLS_ERROR);
  624. for (w = root; w; w = w->next) {
  625. if (unlikely(w->exposed && w->processes)) {
  626. write_chart_dimension(w->name, w->vfs.fsync_err);
  627. }
  628. }
  629. write_end_chart();
  630. }
  631. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_OPEN);
  632. for (w = root; w; w = w->next) {
  633. if (unlikely(w->exposed && w->processes)) {
  634. write_chart_dimension(w->name, w->vfs.open_call);
  635. }
  636. }
  637. write_end_chart();
  638. if (em->mode < MODE_ENTRY) {
  639. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_OPEN_CALLS_ERROR);
  640. for (w = root; w; w = w->next) {
  641. if (unlikely(w->exposed && w->processes)) {
  642. write_chart_dimension(w->name, w->vfs.open_err);
  643. }
  644. }
  645. write_end_chart();
  646. }
  647. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_CREATE);
  648. for (w = root; w; w = w->next) {
  649. if (unlikely(w->exposed && w->processes)) {
  650. write_chart_dimension(w->name, w->vfs.create_call);
  651. }
  652. }
  653. write_end_chart();
  654. if (em->mode < MODE_ENTRY) {
  655. write_begin_chart(NETDATA_APPS_FAMILY, NETDATA_SYSCALL_APPS_VFS_CREATE_CALLS_ERROR);
  656. for (w = root; w; w = w->next) {
  657. if (unlikely(w->exposed && w->processes)) {
  658. write_chart_dimension(w->name, w->vfs.create_err);
  659. }
  660. }
  661. write_end_chart();
  662. }
  663. }
  664. /**
  665. * Apps Accumulator
  666. *
  667. * Sum all values read from kernel and store in the first address.
  668. *
  669. * @param out the vector with read values.
  670. */
  671. static void vfs_apps_accumulator(netdata_publish_vfs_t *out)
  672. {
  673. int i, end = (running_on_kernel >= NETDATA_KERNEL_V4_15) ? ebpf_nprocs : 1;
  674. netdata_publish_vfs_t *total = &out[0];
  675. for (i = 1; i < end; i++) {
  676. netdata_publish_vfs_t *w = &out[i];
  677. total->write_call += w->write_call;
  678. total->writev_call += w->writev_call;
  679. total->read_call += w->read_call;
  680. total->readv_call += w->readv_call;
  681. total->unlink_call += w->unlink_call;
  682. total->write_bytes += w->write_bytes;
  683. total->writev_bytes += w->writev_bytes;
  684. total->read_bytes += w->read_bytes;
  685. total->readv_bytes += w->readv_bytes;
  686. total->write_err += w->write_err;
  687. total->writev_err += w->writev_err;
  688. total->read_err += w->read_err;
  689. total->readv_err += w->readv_err;
  690. total->unlink_err += w->unlink_err;
  691. }
  692. }
  693. /**
  694. * Fill PID
  695. *
  696. * Fill PID structures
  697. *
  698. * @param current_pid pid that we are collecting data
  699. * @param out values read from hash tables;
  700. */
  701. static void vfs_fill_pid(uint32_t current_pid, netdata_publish_vfs_t *publish)
  702. {
  703. netdata_publish_vfs_t *curr = vfs_pid[current_pid];
  704. if (!curr) {
  705. curr = ebpf_vfs_get();
  706. vfs_pid[current_pid] = curr;
  707. }
  708. memcpy(curr, &publish[0], sizeof(netdata_publish_vfs_t));
  709. }
  710. /**
  711. * Read the hash table and store data to allocated vectors.
  712. */
  713. static void ebpf_vfs_read_apps()
  714. {
  715. struct ebpf_pid_stat *pids = ebpf_root_of_pids;
  716. netdata_publish_vfs_t *vv = vfs_vector;
  717. int fd = vfs_maps[NETDATA_VFS_PID].map_fd;
  718. size_t length = sizeof(netdata_publish_vfs_t) * ebpf_nprocs;
  719. while (pids) {
  720. uint32_t key = pids->pid;
  721. if (bpf_map_lookup_elem(fd, &key, vv)) {
  722. pids = pids->next;
  723. continue;
  724. }
  725. vfs_apps_accumulator(vv);
  726. vfs_fill_pid(key, vv);
  727. // We are cleaning to avoid passing data read from one process to other.
  728. memset(vv, 0, length);
  729. pids = pids->next;
  730. }
  731. }
  732. /**
  733. * Update cgroup
  734. *
  735. * Update cgroup data based in
  736. */
  737. static void read_update_vfs_cgroup()
  738. {
  739. ebpf_cgroup_target_t *ect ;
  740. netdata_publish_vfs_t *vv = vfs_vector;
  741. int fd = vfs_maps[NETDATA_VFS_PID].map_fd;
  742. size_t length = sizeof(netdata_publish_vfs_t) * ebpf_nprocs;
  743. pthread_mutex_lock(&mutex_cgroup_shm);
  744. for (ect = ebpf_cgroup_pids; ect; ect = ect->next) {
  745. struct pid_on_target2 *pids;
  746. for (pids = ect->pids; pids; pids = pids->next) {
  747. int pid = pids->pid;
  748. netdata_publish_vfs_t *out = &pids->vfs;
  749. if (likely(vfs_pid) && vfs_pid[pid]) {
  750. netdata_publish_vfs_t *in = vfs_pid[pid];
  751. memcpy(out, in, sizeof(netdata_publish_vfs_t));
  752. } else {
  753. memset(vv, 0, length);
  754. if (!bpf_map_lookup_elem(fd, &pid, vv)) {
  755. vfs_apps_accumulator(vv);
  756. memcpy(out, vv, sizeof(netdata_publish_vfs_t));
  757. }
  758. }
  759. }
  760. }
  761. pthread_mutex_unlock(&mutex_cgroup_shm);
  762. }
  763. /**
  764. * Sum PIDs
  765. *
  766. * Sum values for all targets.
  767. *
  768. * @param vfs structure used to store data
  769. * @param pids input data
  770. */
  771. static void ebpf_vfs_sum_cgroup_pids(netdata_publish_vfs_t *vfs, struct pid_on_target2 *pids)
  772. {
  773. netdata_publish_vfs_t accumulator;
  774. memset(&accumulator, 0, sizeof(accumulator));
  775. while (pids) {
  776. netdata_publish_vfs_t *w = &pids->vfs;
  777. accumulator.write_call += w->write_call;
  778. accumulator.writev_call += w->writev_call;
  779. accumulator.read_call += w->read_call;
  780. accumulator.readv_call += w->readv_call;
  781. accumulator.unlink_call += w->unlink_call;
  782. accumulator.fsync_call += w->fsync_call;
  783. accumulator.open_call += w->open_call;
  784. accumulator.create_call += w->create_call;
  785. accumulator.write_bytes += w->write_bytes;
  786. accumulator.writev_bytes += w->writev_bytes;
  787. accumulator.read_bytes += w->read_bytes;
  788. accumulator.readv_bytes += w->readv_bytes;
  789. accumulator.write_err += w->write_err;
  790. accumulator.writev_err += w->writev_err;
  791. accumulator.read_err += w->read_err;
  792. accumulator.readv_err += w->readv_err;
  793. accumulator.unlink_err += w->unlink_err;
  794. accumulator.fsync_err += w->fsync_err;
  795. accumulator.open_err += w->open_err;
  796. accumulator.create_err += w->create_err;
  797. pids = pids->next;
  798. }
  799. // These conditions were added, because we are using incremental algorithm
  800. vfs->write_call = (accumulator.write_call >= vfs->write_call) ? accumulator.write_call : vfs->write_call;
  801. vfs->writev_call = (accumulator.writev_call >= vfs->writev_call) ? accumulator.writev_call : vfs->writev_call;
  802. vfs->read_call = (accumulator.read_call >= vfs->read_call) ? accumulator.read_call : vfs->read_call;
  803. vfs->readv_call = (accumulator.readv_call >= vfs->readv_call) ? accumulator.readv_call : vfs->readv_call;
  804. vfs->unlink_call = (accumulator.unlink_call >= vfs->unlink_call) ? accumulator.unlink_call : vfs->unlink_call;
  805. vfs->fsync_call = (accumulator.fsync_call >= vfs->fsync_call) ? accumulator.fsync_call : vfs->fsync_call;
  806. vfs->open_call = (accumulator.open_call >= vfs->open_call) ? accumulator.open_call : vfs->open_call;
  807. vfs->create_call = (accumulator.create_call >= vfs->create_call) ? accumulator.create_call : vfs->create_call;
  808. vfs->write_bytes = (accumulator.write_bytes >= vfs->write_bytes) ? accumulator.write_bytes : vfs->write_bytes;
  809. vfs->writev_bytes = (accumulator.writev_bytes >= vfs->writev_bytes) ? accumulator.writev_bytes : vfs->writev_bytes;
  810. vfs->read_bytes = (accumulator.read_bytes >= vfs->read_bytes) ? accumulator.read_bytes : vfs->read_bytes;
  811. vfs->readv_bytes = (accumulator.readv_bytes >= vfs->readv_bytes) ? accumulator.readv_bytes : vfs->readv_bytes;
  812. vfs->write_err = (accumulator.write_err >= vfs->write_err) ? accumulator.write_err : vfs->write_err;
  813. vfs->writev_err = (accumulator.writev_err >= vfs->writev_err) ? accumulator.writev_err : vfs->writev_err;
  814. vfs->read_err = (accumulator.read_err >= vfs->read_err) ? accumulator.read_err : vfs->read_err;
  815. vfs->readv_err = (accumulator.readv_err >= vfs->readv_err) ? accumulator.readv_err : vfs->readv_err;
  816. vfs->unlink_err = (accumulator.unlink_err >= vfs->unlink_err) ? accumulator.unlink_err : vfs->unlink_err;
  817. vfs->fsync_err = (accumulator.fsync_err >= vfs->fsync_err) ? accumulator.fsync_err : vfs->fsync_err;
  818. vfs->open_err = (accumulator.open_err >= vfs->open_err) ? accumulator.open_err : vfs->open_err;
  819. vfs->create_err = (accumulator.create_err >= vfs->create_err) ? accumulator.create_err : vfs->create_err;
  820. }
  821. /**
  822. * Create specific VFS charts
  823. *
  824. * Create charts for cgroup/application.
  825. *
  826. * @param type the chart type.
  827. * @param em the main thread structure.
  828. */
  829. static void ebpf_create_specific_vfs_charts(char *type, ebpf_module_t *em)
  830. {
  831. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_FILE_DELETED,"Files deleted",
  832. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_UNLINK_CONTEXT,
  833. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5500,
  834. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_UNLINK],
  835. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  836. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS, "Write to disk",
  837. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_WRITE_CONTEXT,
  838. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5501,
  839. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE],
  840. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  841. if (em->mode < MODE_ENTRY) {
  842. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR, "Fails to write",
  843. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_WRITE_ERROR_CONTEXT,
  844. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5502,
  845. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE],
  846. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  847. }
  848. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_READ_CALLS, "Read from disk",
  849. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_READ_CONTEXT,
  850. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5503,
  851. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ],
  852. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  853. if (em->mode < MODE_ENTRY) {
  854. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR, "Fails to read",
  855. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_READ_ERROR_CONTEXT,
  856. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5504,
  857. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ],
  858. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  859. }
  860. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES, "Bytes written on disk",
  861. EBPF_COMMON_DIMENSION_BYTES, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_WRITE_BYTES_CONTEXT,
  862. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5505,
  863. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE],
  864. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  865. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_READ_BYTES, "Bytes read from disk",
  866. EBPF_COMMON_DIMENSION_BYTES, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_READ_BYTES_CONTEXT,
  867. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5506,
  868. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ],
  869. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  870. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_FSYNC, "Calls for <code>vfs_fsync</code>",
  871. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_FSYNC_CONTEXT,
  872. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5507,
  873. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC],
  874. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  875. if (em->mode < MODE_ENTRY) {
  876. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_FSYNC_CALLS_ERROR, "Sync error",
  877. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_FSYNC_ERROR_CONTEXT,
  878. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5508,
  879. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC],
  880. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  881. }
  882. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_OPEN, "Calls for <code>vfs_open</code>",
  883. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_OPEN_CONTEXT,
  884. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5509,
  885. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN],
  886. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  887. if (em->mode < MODE_ENTRY) {
  888. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_OPEN_CALLS_ERROR, "Open error",
  889. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_OPEN_ERROR_CONTEXT,
  890. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5510,
  891. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN],
  892. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  893. }
  894. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_CREATE, "Calls for <code>vfs_create</code>",
  895. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_CREATE_CONTEXT,
  896. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5511,
  897. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE],
  898. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  899. if (em->mode < MODE_ENTRY) {
  900. ebpf_create_chart(type, NETDATA_SYSCALL_APPS_VFS_CREATE_CALLS_ERROR, "Create error",
  901. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP, NETDATA_CGROUP_VFS_CREATE_ERROR_CONTEXT,
  902. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5512,
  903. ebpf_create_global_dimension, &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE],
  904. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_SWAP);
  905. }
  906. }
  907. /**
  908. * Obsolete specific VFS charts
  909. *
  910. * Obsolete charts for cgroup/application.
  911. *
  912. * @param type the chart type.
  913. * @param em the main thread structure.
  914. */
  915. static void ebpf_obsolete_specific_vfs_charts(char *type, ebpf_module_t *em)
  916. {
  917. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_FILE_DELETED, "Files deleted",
  918. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  919. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_UNLINK_CONTEXT,
  920. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5500, em->update_every);
  921. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS, "Write to disk",
  922. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  923. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_WRITE_CONTEXT,
  924. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5501, em->update_every);
  925. if (em->mode < MODE_ENTRY) {
  926. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR, "Fails to write",
  927. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  928. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_WRITE_ERROR_CONTEXT,
  929. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5502, em->update_every);
  930. }
  931. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_READ_CALLS, "Read from disk",
  932. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  933. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_READ_CONTEXT,
  934. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5503, em->update_every);
  935. if (em->mode < MODE_ENTRY) {
  936. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR, "Fails to read",
  937. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  938. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_READ_ERROR_CONTEXT,
  939. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5504, em->update_every);
  940. }
  941. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES, "Bytes written on disk",
  942. EBPF_COMMON_DIMENSION_BYTES, NETDATA_VFS_GROUP,
  943. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_WRITE_BYTES_CONTEXT,
  944. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5505, em->update_every);
  945. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_READ_BYTES, "Bytes read from disk",
  946. EBPF_COMMON_DIMENSION_BYTES, NETDATA_VFS_GROUP,
  947. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_READ_BYTES_CONTEXT,
  948. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5506, em->update_every);
  949. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_FSYNC, "Calls for <code>vfs_fsync</code>",
  950. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  951. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_FSYNC_CONTEXT,
  952. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5507, em->update_every);
  953. if (em->mode < MODE_ENTRY) {
  954. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_FSYNC_CALLS_ERROR, "Sync error",
  955. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  956. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_FSYNC_ERROR_CONTEXT,
  957. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5508, em->update_every);
  958. }
  959. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_OPEN, "Calls for <code>vfs_open</code>",
  960. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  961. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_OPEN_CONTEXT,
  962. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5509, em->update_every);
  963. if (em->mode < MODE_ENTRY) {
  964. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_OPEN_CALLS_ERROR, "Open error",
  965. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  966. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_OPEN_ERROR_CONTEXT,
  967. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5510, em->update_every);
  968. }
  969. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_CREATE, "Calls for <code>vfs_create</code>",
  970. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  971. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_CREATE_CONTEXT,
  972. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5511, em->update_every);
  973. if (em->mode < MODE_ENTRY) {
  974. ebpf_write_chart_obsolete(type, NETDATA_SYSCALL_APPS_VFS_CREATE_CALLS_ERROR, "Create error",
  975. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_GROUP,
  976. NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CGROUP_VFS_CREATE_ERROR_CONTEXT,
  977. NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5512, em->update_every);
  978. }
  979. }
  980. /*
  981. * Send specific VFS data
  982. *
  983. * Send data for specific cgroup/apps.
  984. *
  985. * @param type chart type
  986. * @param values structure with values that will be sent to netdata
  987. */
  988. static void ebpf_send_specific_vfs_data(char *type, netdata_publish_vfs_t *values, ebpf_module_t *em)
  989. {
  990. write_begin_chart(type, NETDATA_SYSCALL_APPS_FILE_DELETED);
  991. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_UNLINK].name, (long long)values->unlink_call);
  992. write_end_chart();
  993. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS);
  994. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE].name,
  995. (long long)values->write_call + (long long)values->writev_call);
  996. write_end_chart();
  997. if (em->mode < MODE_ENTRY) {
  998. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR);
  999. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE].name,
  1000. (long long)values->write_err + (long long)values->writev_err);
  1001. write_end_chart();
  1002. }
  1003. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_READ_CALLS);
  1004. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ].name,
  1005. (long long)values->read_call + (long long)values->readv_call);
  1006. write_end_chart();
  1007. if (em->mode < MODE_ENTRY) {
  1008. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR);
  1009. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ].name,
  1010. (long long)values->read_err + (long long)values->readv_err);
  1011. write_end_chart();
  1012. }
  1013. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES);
  1014. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_WRITE].name,
  1015. (long long)values->write_bytes + (long long)values->writev_bytes);
  1016. write_end_chart();
  1017. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_READ_BYTES);
  1018. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ].name,
  1019. (long long)values->read_bytes + (long long)values->readv_bytes);
  1020. write_end_chart();
  1021. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_FSYNC);
  1022. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC].name,
  1023. (long long)values->fsync_call);
  1024. write_end_chart();
  1025. if (em->mode < MODE_ENTRY) {
  1026. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_FSYNC_CALLS_ERROR);
  1027. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC].name,
  1028. (long long)values->fsync_err);
  1029. write_end_chart();
  1030. }
  1031. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_OPEN);
  1032. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN].name,
  1033. (long long)values->open_call);
  1034. write_end_chart();
  1035. if (em->mode < MODE_ENTRY) {
  1036. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_OPEN_CALLS_ERROR);
  1037. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN].name,
  1038. (long long)values->open_err);
  1039. write_end_chart();
  1040. }
  1041. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_CREATE);
  1042. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE].name,
  1043. (long long)values->create_call);
  1044. write_end_chart();
  1045. if (em->mode < MODE_ENTRY) {
  1046. write_begin_chart(type, NETDATA_SYSCALL_APPS_VFS_CREATE_CALLS_ERROR);
  1047. write_chart_dimension(vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE].name,
  1048. (long long)values->create_err);
  1049. write_end_chart();
  1050. }
  1051. }
  1052. /**
  1053. * Create Systemd Socket Charts
  1054. *
  1055. * Create charts when systemd is enabled
  1056. *
  1057. * @param em the main collector structure
  1058. **/
  1059. static void ebpf_create_systemd_vfs_charts(ebpf_module_t *em)
  1060. {
  1061. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_FILE_DELETED, "Files deleted",
  1062. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1063. NETDATA_EBPF_CHART_TYPE_STACKED, 20065,
  1064. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_UNLINK_CONTEXT,
  1065. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1066. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS, "Write to disk",
  1067. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1068. NETDATA_EBPF_CHART_TYPE_STACKED, 20066,
  1069. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_WRITE_CONTEXT,
  1070. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1071. if (em->mode < MODE_ENTRY) {
  1072. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR, "Fails to write",
  1073. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1074. NETDATA_EBPF_CHART_TYPE_STACKED, 20067,
  1075. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1076. NETDATA_SYSTEMD_VFS_WRITE_ERROR_CONTEXT,
  1077. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1078. }
  1079. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_READ_CALLS, "Read from disk",
  1080. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1081. NETDATA_EBPF_CHART_TYPE_STACKED, 20068,
  1082. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_READ_CONTEXT,
  1083. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1084. if (em->mode < MODE_ENTRY) {
  1085. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR, "Fails to read",
  1086. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1087. NETDATA_EBPF_CHART_TYPE_STACKED, 20069,
  1088. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1089. NETDATA_SYSTEMD_VFS_READ_ERROR_CONTEXT,
  1090. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1091. }
  1092. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES, "Bytes written on disk",
  1093. EBPF_COMMON_DIMENSION_BYTES, NETDATA_VFS_CGROUP_GROUP,
  1094. NETDATA_EBPF_CHART_TYPE_STACKED, 20070,
  1095. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_WRITE_BYTES_CONTEXT,
  1096. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1097. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_READ_BYTES, "Bytes read from disk",
  1098. EBPF_COMMON_DIMENSION_BYTES, NETDATA_VFS_CGROUP_GROUP,
  1099. NETDATA_EBPF_CHART_TYPE_STACKED, 20071,
  1100. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_READ_BYTES_CONTEXT,
  1101. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1102. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_FSYNC, "Calls to <code>vfs_fsync</code>",
  1103. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1104. NETDATA_EBPF_CHART_TYPE_STACKED, 20072,
  1105. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_FSYNC_CONTEXT,
  1106. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1107. if (em->mode < MODE_ENTRY) {
  1108. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_FSYNC_CALLS_ERROR, "Sync error",
  1109. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1110. NETDATA_EBPF_CHART_TYPE_STACKED, 20073,
  1111. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_FSYNC_ERROR_CONTEXT,
  1112. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1113. }
  1114. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_OPEN, "Calls to <code>vfs_open</code>",
  1115. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1116. NETDATA_EBPF_CHART_TYPE_STACKED, 20074,
  1117. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_OPEN_CONTEXT,
  1118. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1119. if (em->mode < MODE_ENTRY) {
  1120. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_OPEN_CALLS_ERROR, "Open error",
  1121. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1122. NETDATA_EBPF_CHART_TYPE_STACKED, 20075,
  1123. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_OPEN_ERROR_CONTEXT,
  1124. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1125. }
  1126. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_CREATE, "Calls to <code>vfs_create</code>",
  1127. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1128. NETDATA_EBPF_CHART_TYPE_STACKED, 20076,
  1129. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_CREATE_CONTEXT,
  1130. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1131. if (em->mode < MODE_ENTRY) {
  1132. ebpf_create_charts_on_systemd(NETDATA_SYSCALL_APPS_VFS_CREATE_CALLS_ERROR, "Create error",
  1133. EBPF_COMMON_DIMENSION_CALL, NETDATA_VFS_CGROUP_GROUP,
  1134. NETDATA_EBPF_CHART_TYPE_STACKED, 20077,
  1135. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX], NETDATA_SYSTEMD_VFS_CREATE_ERROR_CONTEXT,
  1136. NETDATA_EBPF_MODULE_NAME_VFS, em->update_every);
  1137. }
  1138. }
  1139. /**
  1140. * Send Systemd charts
  1141. *
  1142. * Send collected data to Netdata.
  1143. *
  1144. * @param em the main collector structure
  1145. */
  1146. static void ebpf_send_systemd_vfs_charts(ebpf_module_t *em)
  1147. {
  1148. ebpf_cgroup_target_t *ect;
  1149. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_FILE_DELETED);
  1150. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1151. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1152. write_chart_dimension(ect->name, ect->publish_systemd_vfs.unlink_call);
  1153. }
  1154. }
  1155. write_end_chart();
  1156. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS);
  1157. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1158. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1159. write_chart_dimension(ect->name, ect->publish_systemd_vfs.write_call +
  1160. ect->publish_systemd_vfs.writev_call);
  1161. }
  1162. }
  1163. write_end_chart();
  1164. if (em->mode < MODE_ENTRY) {
  1165. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR);
  1166. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1167. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1168. write_chart_dimension(ect->name, ect->publish_systemd_vfs.write_err +
  1169. ect->publish_systemd_vfs.writev_err);
  1170. }
  1171. }
  1172. write_end_chart();
  1173. }
  1174. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_CALLS);
  1175. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1176. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1177. write_chart_dimension(ect->name, ect->publish_systemd_vfs.read_call +
  1178. ect->publish_systemd_vfs.readv_call);
  1179. }
  1180. }
  1181. write_end_chart();
  1182. if (em->mode < MODE_ENTRY) {
  1183. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR);
  1184. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1185. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1186. write_chart_dimension(ect->name, ect->publish_systemd_vfs.read_err +
  1187. ect->publish_systemd_vfs.readv_err);
  1188. }
  1189. }
  1190. write_end_chart();
  1191. }
  1192. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES);
  1193. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1194. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1195. write_chart_dimension(ect->name, ect->publish_systemd_vfs.write_bytes +
  1196. ect->publish_systemd_vfs.writev_bytes);
  1197. }
  1198. }
  1199. write_end_chart();
  1200. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_READ_BYTES);
  1201. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1202. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1203. write_chart_dimension(ect->name, ect->publish_systemd_vfs.read_bytes +
  1204. ect->publish_systemd_vfs.readv_bytes);
  1205. }
  1206. }
  1207. write_end_chart();
  1208. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_FSYNC);
  1209. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1210. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1211. write_chart_dimension(ect->name, ect->publish_systemd_vfs.fsync_call);
  1212. }
  1213. }
  1214. write_end_chart();
  1215. if (em->mode < MODE_ENTRY) {
  1216. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_FSYNC_CALLS_ERROR);
  1217. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1218. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1219. write_chart_dimension(ect->name, ect->publish_systemd_vfs.fsync_err);
  1220. }
  1221. }
  1222. write_end_chart();
  1223. }
  1224. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_OPEN);
  1225. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1226. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1227. write_chart_dimension(ect->name, ect->publish_systemd_vfs.open_call);
  1228. }
  1229. }
  1230. write_end_chart();
  1231. if (em->mode < MODE_ENTRY) {
  1232. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_OPEN_CALLS_ERROR);
  1233. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1234. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1235. write_chart_dimension(ect->name, ect->publish_systemd_vfs.open_err);
  1236. }
  1237. }
  1238. write_end_chart();
  1239. }
  1240. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_CREATE);
  1241. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1242. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1243. write_chart_dimension(ect->name, ect->publish_systemd_vfs.create_call);
  1244. }
  1245. }
  1246. write_end_chart();
  1247. if (em->mode < MODE_ENTRY) {
  1248. write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_SYSCALL_APPS_VFS_CREATE_CALLS_ERROR);
  1249. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1250. if (unlikely(ect->systemd) && unlikely(ect->updated)) {
  1251. write_chart_dimension(ect->name, ect->publish_systemd_vfs.create_err);
  1252. }
  1253. }
  1254. write_end_chart();
  1255. }
  1256. }
  1257. /**
  1258. * Send data to Netdata calling auxiliary functions.
  1259. *
  1260. * @param em the main collector structure
  1261. */
  1262. static void ebpf_vfs_send_cgroup_data(ebpf_module_t *em)
  1263. {
  1264. if (!ebpf_cgroup_pids)
  1265. return;
  1266. pthread_mutex_lock(&mutex_cgroup_shm);
  1267. ebpf_cgroup_target_t *ect;
  1268. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1269. ebpf_vfs_sum_cgroup_pids(&ect->publish_systemd_vfs, ect->pids);
  1270. }
  1271. int has_systemd = shm_ebpf_cgroup.header->systemd_enabled;
  1272. if (has_systemd) {
  1273. if (send_cgroup_chart) {
  1274. ebpf_create_systemd_vfs_charts(em);
  1275. }
  1276. ebpf_send_systemd_vfs_charts(em);
  1277. }
  1278. for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
  1279. if (ect->systemd)
  1280. continue;
  1281. if (!(ect->flags & NETDATA_EBPF_CGROUP_HAS_VFS_CHART) && ect->updated) {
  1282. ebpf_create_specific_vfs_charts(ect->name, em);
  1283. ect->flags |= NETDATA_EBPF_CGROUP_HAS_VFS_CHART;
  1284. }
  1285. if (ect->flags & NETDATA_EBPF_CGROUP_HAS_VFS_CHART) {
  1286. if (ect->updated) {
  1287. ebpf_send_specific_vfs_data(ect->name, &ect->publish_systemd_vfs, em);
  1288. } else {
  1289. ebpf_obsolete_specific_vfs_charts(ect->name, em);
  1290. ect->flags &= ~NETDATA_EBPF_CGROUP_HAS_VFS_CHART;
  1291. }
  1292. }
  1293. }
  1294. pthread_mutex_unlock(&mutex_cgroup_shm);
  1295. }
  1296. /**
  1297. * Main loop for this collector.
  1298. *
  1299. * @param step the number of microseconds used with heart beat
  1300. * @param em the structure with thread information
  1301. */
  1302. static void vfs_collector(ebpf_module_t *em)
  1303. {
  1304. int cgroups = em->cgroup_charts;
  1305. heartbeat_t hb;
  1306. heartbeat_init(&hb);
  1307. int update_every = em->update_every;
  1308. int counter = update_every - 1;
  1309. while (!ebpf_exit_plugin) {
  1310. (void)heartbeat_next(&hb, USEC_PER_SEC);
  1311. if (ebpf_exit_plugin || ++counter != update_every)
  1312. continue;
  1313. counter = 0;
  1314. netdata_apps_integration_flags_t apps = em->apps_charts;
  1315. ebpf_vfs_read_global_table();
  1316. pthread_mutex_lock(&collect_data_mutex);
  1317. if (apps)
  1318. ebpf_vfs_read_apps();
  1319. #ifdef NETDATA_DEV_MODE
  1320. if (ebpf_aral_vfs_pid)
  1321. ebpf_send_data_aral_chart(ebpf_aral_vfs_pid, em);
  1322. #endif
  1323. if (cgroups)
  1324. read_update_vfs_cgroup();
  1325. pthread_mutex_lock(&lock);
  1326. ebpf_vfs_send_data(em);
  1327. fflush(stdout);
  1328. if (apps & NETDATA_EBPF_APPS_FLAG_CHART_CREATED)
  1329. ebpf_vfs_send_apps_data(em, apps_groups_root_target);
  1330. if (cgroups)
  1331. ebpf_vfs_send_cgroup_data(em);
  1332. pthread_mutex_unlock(&lock);
  1333. pthread_mutex_unlock(&collect_data_mutex);
  1334. }
  1335. }
  1336. /*****************************************************************
  1337. *
  1338. * FUNCTIONS TO CREATE CHARTS
  1339. *
  1340. *****************************************************************/
  1341. /**
  1342. * Create IO chart
  1343. *
  1344. * @param family the chart family
  1345. * @param name the chart name
  1346. * @param axis the axis label
  1347. * @param web the group name used to attach the chart on dashboard
  1348. * @param order the order number of the specified chart
  1349. * @param algorithm the algorithm used to make the charts.
  1350. * @param update_every value to overwrite the update frequency set by the server.
  1351. */
  1352. static void ebpf_create_io_chart(char *family, char *name, char *axis, char *web,
  1353. int order, int algorithm, int update_every)
  1354. {
  1355. printf("CHART %s.%s '' 'Bytes written and read' '%s' '%s' '' line %d %d '' 'ebpf.plugin' 'filesystem'\n",
  1356. family,
  1357. name,
  1358. axis,
  1359. web,
  1360. order,
  1361. update_every);
  1362. printf("DIMENSION %s %s %s 1 1\n",
  1363. vfs_id_names[NETDATA_KEY_PUBLISH_VFS_READ],
  1364. vfs_dimension_names[NETDATA_KEY_PUBLISH_VFS_READ],
  1365. ebpf_algorithms[algorithm]);
  1366. printf("DIMENSION %s %s %s -1 1\n",
  1367. vfs_id_names[NETDATA_KEY_PUBLISH_VFS_WRITE],
  1368. vfs_dimension_names[NETDATA_KEY_PUBLISH_VFS_WRITE],
  1369. ebpf_algorithms[algorithm]);
  1370. }
  1371. /**
  1372. * Create global charts
  1373. *
  1374. * Call ebpf_create_chart to create the charts for the collector.
  1375. *
  1376. * @param em a pointer to the structure with the default values.
  1377. */
  1378. static void ebpf_create_global_charts(ebpf_module_t *em)
  1379. {
  1380. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1381. NETDATA_VFS_FILE_CLEAN_COUNT,
  1382. "Remove files",
  1383. EBPF_COMMON_DIMENSION_CALL,
  1384. NETDATA_VFS_GROUP,
  1385. NULL,
  1386. NETDATA_EBPF_CHART_TYPE_LINE,
  1387. NETDATA_CHART_PRIO_FILESYSTEM_VFS_CLEAN,
  1388. ebpf_create_global_dimension,
  1389. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_UNLINK],
  1390. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1391. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1392. NETDATA_VFS_FILE_IO_COUNT,
  1393. "Calls to IO",
  1394. EBPF_COMMON_DIMENSION_CALL,
  1395. NETDATA_VFS_GROUP,
  1396. NULL,
  1397. NETDATA_EBPF_CHART_TYPE_LINE,
  1398. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_COUNT,
  1399. ebpf_create_global_dimension,
  1400. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ],
  1401. 2, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1402. ebpf_create_io_chart(NETDATA_FILESYSTEM_FAMILY,
  1403. NETDATA_VFS_IO_FILE_BYTES, EBPF_COMMON_DIMENSION_BYTES,
  1404. NETDATA_VFS_GROUP,
  1405. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_BYTES,
  1406. NETDATA_EBPF_INCREMENTAL_IDX, em->update_every);
  1407. if (em->mode < MODE_ENTRY) {
  1408. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1409. NETDATA_VFS_FILE_ERR_COUNT,
  1410. "Fails to write or read",
  1411. EBPF_COMMON_DIMENSION_CALL,
  1412. NETDATA_VFS_GROUP,
  1413. NULL,
  1414. NETDATA_EBPF_CHART_TYPE_LINE,
  1415. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_EBYTES,
  1416. ebpf_create_global_dimension,
  1417. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_READ],
  1418. 2, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1419. }
  1420. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1421. NETDATA_VFS_FSYNC,
  1422. "Calls for <code>vfs_fsync</code>",
  1423. EBPF_COMMON_DIMENSION_CALL,
  1424. NETDATA_VFS_GROUP,
  1425. NULL,
  1426. NETDATA_EBPF_CHART_TYPE_LINE,
  1427. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_FSYNC,
  1428. ebpf_create_global_dimension,
  1429. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC],
  1430. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1431. if (em->mode < MODE_ENTRY) {
  1432. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1433. NETDATA_VFS_FSYNC_ERR,
  1434. "Fails to synchronize",
  1435. EBPF_COMMON_DIMENSION_CALL,
  1436. NETDATA_VFS_GROUP,
  1437. NULL,
  1438. NETDATA_EBPF_CHART_TYPE_LINE,
  1439. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_EFSYNC,
  1440. ebpf_create_global_dimension,
  1441. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_FSYNC],
  1442. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1443. }
  1444. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1445. NETDATA_VFS_OPEN,
  1446. "Calls for <code>vfs_open</code>",
  1447. EBPF_COMMON_DIMENSION_CALL,
  1448. NETDATA_VFS_GROUP,
  1449. NULL,
  1450. NETDATA_EBPF_CHART_TYPE_LINE,
  1451. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_OPEN,
  1452. ebpf_create_global_dimension,
  1453. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN],
  1454. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1455. if (em->mode < MODE_ENTRY) {
  1456. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1457. NETDATA_VFS_OPEN_ERR,
  1458. "Fails to open a file",
  1459. EBPF_COMMON_DIMENSION_CALL,
  1460. NETDATA_VFS_GROUP,
  1461. NULL,
  1462. NETDATA_EBPF_CHART_TYPE_LINE,
  1463. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_EOPEN,
  1464. ebpf_create_global_dimension,
  1465. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_OPEN],
  1466. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1467. }
  1468. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1469. NETDATA_VFS_CREATE,
  1470. "Calls for <code>vfs_create</code>",
  1471. EBPF_COMMON_DIMENSION_CALL,
  1472. NETDATA_VFS_GROUP,
  1473. NULL,
  1474. NETDATA_EBPF_CHART_TYPE_LINE,
  1475. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_CREATE,
  1476. ebpf_create_global_dimension,
  1477. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE],
  1478. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1479. if (em->mode < MODE_ENTRY) {
  1480. ebpf_create_chart(NETDATA_FILESYSTEM_FAMILY,
  1481. NETDATA_VFS_CREATE_ERR,
  1482. "Fails to create a file.",
  1483. EBPF_COMMON_DIMENSION_CALL,
  1484. NETDATA_VFS_GROUP,
  1485. NULL,
  1486. NETDATA_EBPF_CHART_TYPE_LINE,
  1487. NETDATA_CHART_PRIO_FILESYSTEM_VFS_IO_ECREATE,
  1488. ebpf_create_global_dimension,
  1489. &vfs_publish_aggregated[NETDATA_KEY_PUBLISH_VFS_CREATE],
  1490. 1, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1491. }
  1492. }
  1493. /**
  1494. * Create process apps charts
  1495. *
  1496. * Call ebpf_create_chart to create the charts on apps submenu.
  1497. *
  1498. * @param em a pointer to the structure with the default values.
  1499. * @param ptr a pointer for the targets.
  1500. **/
  1501. void ebpf_vfs_create_apps_charts(struct ebpf_module *em, void *ptr)
  1502. {
  1503. struct ebpf_target *root = ptr;
  1504. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_FILE_DELETED,
  1505. "Files deleted",
  1506. EBPF_COMMON_DIMENSION_CALL,
  1507. NETDATA_VFS_GROUP,
  1508. NETDATA_EBPF_CHART_TYPE_STACKED,
  1509. 20065,
  1510. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1511. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1512. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS,
  1513. "Write to disk",
  1514. EBPF_COMMON_DIMENSION_CALL,
  1515. NETDATA_VFS_GROUP,
  1516. NETDATA_EBPF_CHART_TYPE_STACKED,
  1517. 20066,
  1518. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1519. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1520. if (em->mode < MODE_ENTRY) {
  1521. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR,
  1522. "Fails to write",
  1523. EBPF_COMMON_DIMENSION_CALL,
  1524. NETDATA_VFS_GROUP,
  1525. NETDATA_EBPF_CHART_TYPE_STACKED,
  1526. 20067,
  1527. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1528. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1529. }
  1530. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_READ_CALLS,
  1531. "Read from disk",
  1532. EBPF_COMMON_DIMENSION_CALL,
  1533. NETDATA_VFS_GROUP,
  1534. NETDATA_EBPF_CHART_TYPE_STACKED,
  1535. 20068,
  1536. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1537. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1538. if (em->mode < MODE_ENTRY) {
  1539. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR,
  1540. "Fails to read",
  1541. EBPF_COMMON_DIMENSION_CALL,
  1542. NETDATA_VFS_GROUP,
  1543. NETDATA_EBPF_CHART_TYPE_STACKED,
  1544. 20069,
  1545. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1546. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1547. }
  1548. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES,
  1549. "Bytes written on disk", EBPF_COMMON_DIMENSION_BYTES,
  1550. NETDATA_VFS_GROUP,
  1551. NETDATA_EBPF_CHART_TYPE_STACKED,
  1552. 20070,
  1553. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1554. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1555. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_READ_BYTES,
  1556. "Bytes read from disk", EBPF_COMMON_DIMENSION_BYTES,
  1557. NETDATA_VFS_GROUP,
  1558. NETDATA_EBPF_CHART_TYPE_STACKED,
  1559. 20071,
  1560. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1561. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1562. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_FSYNC,
  1563. "Calls for <code>vfs_fsync</code>", EBPF_COMMON_DIMENSION_CALL,
  1564. NETDATA_VFS_GROUP,
  1565. NETDATA_EBPF_CHART_TYPE_STACKED,
  1566. 20072,
  1567. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1568. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1569. if (em->mode < MODE_ENTRY) {
  1570. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_FSYNC_CALLS_ERROR,
  1571. "Sync error",
  1572. EBPF_COMMON_DIMENSION_CALL,
  1573. NETDATA_VFS_GROUP,
  1574. NETDATA_EBPF_CHART_TYPE_STACKED,
  1575. 20073,
  1576. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1577. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1578. }
  1579. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_OPEN,
  1580. "Calls for <code>vfs_open</code>", EBPF_COMMON_DIMENSION_CALL,
  1581. NETDATA_VFS_GROUP,
  1582. NETDATA_EBPF_CHART_TYPE_STACKED,
  1583. 20074,
  1584. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1585. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1586. if (em->mode < MODE_ENTRY) {
  1587. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_OPEN_CALLS_ERROR,
  1588. "Open error",
  1589. EBPF_COMMON_DIMENSION_CALL,
  1590. NETDATA_VFS_GROUP,
  1591. NETDATA_EBPF_CHART_TYPE_STACKED,
  1592. 20075,
  1593. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1594. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1595. }
  1596. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_CREATE,
  1597. "Calls for <code>vfs_create</code>", EBPF_COMMON_DIMENSION_CALL,
  1598. NETDATA_VFS_GROUP,
  1599. NETDATA_EBPF_CHART_TYPE_STACKED,
  1600. 20076,
  1601. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1602. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1603. if (em->mode < MODE_ENTRY) {
  1604. ebpf_create_charts_on_apps(NETDATA_SYSCALL_APPS_VFS_CREATE_CALLS_ERROR,
  1605. "Create error",
  1606. EBPF_COMMON_DIMENSION_CALL,
  1607. NETDATA_VFS_GROUP,
  1608. NETDATA_EBPF_CHART_TYPE_STACKED,
  1609. 20077,
  1610. ebpf_algorithms[NETDATA_EBPF_INCREMENTAL_IDX],
  1611. root, em->update_every, NETDATA_EBPF_MODULE_NAME_VFS);
  1612. }
  1613. em->apps_charts |= NETDATA_EBPF_APPS_FLAG_CHART_CREATED;
  1614. }
  1615. /*****************************************************************
  1616. *
  1617. * FUNCTIONS TO START THREAD
  1618. *
  1619. *****************************************************************/
  1620. /**
  1621. * Allocate vectors used with this thread.
  1622. * We are not testing the return, because callocz does this and shutdown the software
  1623. * case it was not possible to allocate.
  1624. *
  1625. * @param apps is apps enabled?
  1626. */
  1627. static void ebpf_vfs_allocate_global_vectors(int apps)
  1628. {
  1629. if (apps) {
  1630. ebpf_vfs_aral_init();
  1631. vfs_pid = callocz((size_t)pid_max, sizeof(netdata_publish_vfs_t *));
  1632. vfs_vector = callocz(ebpf_nprocs, sizeof(netdata_publish_vfs_t));
  1633. }
  1634. memset(vfs_aggregated_data, 0, sizeof(vfs_aggregated_data));
  1635. memset(vfs_publish_aggregated, 0, sizeof(vfs_publish_aggregated));
  1636. vfs_hash_values = callocz(ebpf_nprocs, sizeof(netdata_idx_t));
  1637. }
  1638. /*****************************************************************
  1639. *
  1640. * EBPF VFS THREAD
  1641. *
  1642. *****************************************************************/
  1643. /*
  1644. * Load BPF
  1645. *
  1646. * Load BPF files.
  1647. *
  1648. * @param em the structure with configuration
  1649. */
  1650. static int ebpf_vfs_load_bpf(ebpf_module_t *em)
  1651. {
  1652. int ret = 0;
  1653. ebpf_adjust_apps_cgroup(em, em->targets[NETDATA_EBPF_VFS_WRITE].mode);
  1654. if (em->load & EBPF_LOAD_LEGACY) {
  1655. em->probe_links = ebpf_load_program(ebpf_plugin_dir, em, running_on_kernel, isrh, &em->objects);
  1656. if (!em->probe_links) {
  1657. ret = -1;
  1658. }
  1659. }
  1660. #ifdef LIBBPF_MAJOR_VERSION
  1661. else {
  1662. bpf_obj = vfs_bpf__open();
  1663. if (!bpf_obj)
  1664. ret = -1;
  1665. else
  1666. ret = ebpf_vfs_load_and_attach(bpf_obj, em);
  1667. }
  1668. #endif
  1669. return ret;
  1670. }
  1671. /**
  1672. * Process thread
  1673. *
  1674. * Thread used to generate process charts.
  1675. *
  1676. * @param ptr a pointer to `struct ebpf_module`
  1677. *
  1678. * @return It always return NULL
  1679. */
  1680. void *ebpf_vfs_thread(void *ptr)
  1681. {
  1682. netdata_thread_cleanup_push(ebpf_vfs_exit, ptr);
  1683. ebpf_module_t *em = (ebpf_module_t *)ptr;
  1684. em->maps = vfs_maps;
  1685. ebpf_update_pid_table(&vfs_maps[NETDATA_VFS_PID], em);
  1686. ebpf_vfs_allocate_global_vectors(em->apps_charts);
  1687. #ifdef LIBBPF_MAJOR_VERSION
  1688. ebpf_adjust_thread_load(em, default_btf);
  1689. #endif
  1690. if (ebpf_vfs_load_bpf(em)) {
  1691. em->thread->enabled = NETDATA_THREAD_EBPF_STOPPED;
  1692. goto endvfs;
  1693. }
  1694. int algorithms[NETDATA_KEY_PUBLISH_VFS_END] = {
  1695. NETDATA_EBPF_INCREMENTAL_IDX, NETDATA_EBPF_INCREMENTAL_IDX,NETDATA_EBPF_INCREMENTAL_IDX,
  1696. NETDATA_EBPF_INCREMENTAL_IDX, NETDATA_EBPF_INCREMENTAL_IDX,NETDATA_EBPF_INCREMENTAL_IDX
  1697. };
  1698. ebpf_global_labels(vfs_aggregated_data, vfs_publish_aggregated, vfs_dimension_names,
  1699. vfs_id_names, algorithms, NETDATA_KEY_PUBLISH_VFS_END);
  1700. pthread_mutex_lock(&lock);
  1701. ebpf_create_global_charts(em);
  1702. ebpf_update_stats(&plugin_statistics, em);
  1703. ebpf_update_kernel_memory_with_vector(&plugin_statistics, em->maps);
  1704. #ifdef NETDATA_DEV_MODE
  1705. if (ebpf_aral_vfs_pid)
  1706. ebpf_statistic_create_aral_chart(NETDATA_EBPF_VFS_ARAL_NAME, em);
  1707. #endif
  1708. pthread_mutex_unlock(&lock);
  1709. vfs_collector(em);
  1710. endvfs:
  1711. ebpf_update_disabled_plugin_stats(em);
  1712. netdata_thread_cleanup_pop(1);
  1713. return NULL;
  1714. }