| 1 | // SPDX-License-Identifier: GPL-3.0-or-later |
| 2 | |
| 3 | #ifndef NETDATA_EBPF_H |
| 4 | #define NETDATA_EBPF_H 1 |
| 5 | |
| 6 | #define NETDATA_EBPF_PLUGIN_NAME "ebpf.plugin" |
| 7 | |
| 8 | #include <bpf/bpf.h> |
| 9 | #include <bpf/libbpf.h> |
| 10 | #ifdef LIBBPF_DEPRECATED |
| 11 | #include <bpf/btf.h> |
| 12 | #include <linux/btf.h> |
| 13 | #endif |
| 14 | #include <stdlib.h> // Necessary for stdtoul |
| 15 | #include "libnetdata/aral/aral.h" |
| 16 | |
| 17 | #define NETDATA_DEBUGFS "/sys/kernel/debug/tracing/" |
| 18 | #define NETDATA_KALLSYMS "/proc/kallsyms" |
| 19 | |
| 20 | // Config files |
| 21 | #define EBPF_GLOBAL_SECTION "global" |
| 22 | #define EBPF_CFG_LOAD_MODE "ebpf load mode" |
| 23 | #define EBPF_CFG_LOAD_MODE_DEFAULT "entry" |
| 24 | #define EBPF_CFG_LOAD_MODE_RETURN "return" |
| 25 | #define EBPF_MAX_MODE_LENGTH 6 |
| 26 | |
| 27 | #define EBPF_CFG_TYPE_FORMAT "ebpf type format" |
| 28 | #define EBPF_CFG_DEFAULT_PROGRAM "auto" |
| 29 | #define EBPF_CFG_CORE_PROGRAM "CO-RE" |
| 30 | #define EBPF_CFG_LEGACY_PROGRAM "legacy" |
| 31 | |
| 32 | #define EBPF_CFG_COLLECT_PID "collect pid" |
| 33 | #define EBPF_CFG_PID_REAL_PARENT "real parent" |
| 34 | #define EBPF_CFG_PID_PARENT "parent" |
| 35 | #define EBPF_CFG_PID_ALL "all" |
| 36 | #define EBPF_CFG_PID_INTERNAL_USAGE "not used" |
| 37 | |
| 38 | #define EBPF_CFG_CORE_ATTACH "ebpf co-re tracing" |
| 39 | #define EBPF_CFG_ATTACH_TRAMPOLINE "trampoline" |
| 40 | #define EBPF_CFG_ATTACH_TRACEPOINT "tracepoint" |
| 41 | #define EBPF_CFG_ATTACH_PROBE "probe" |
| 42 | |
| 43 | #define EBPF_CFG_PROGRAM_PATH "btf path" |
| 44 | |
| 45 | #define EBPF_CFG_MAPS_PER_CORE "maps per core" |
| 46 | |
| 47 | #define EBPF_CFG_UPDATE_EVERY "update every" |
| 48 | #define EBPF_CFG_LIFETIME "lifetime" |
| 49 | #define EBPF_CFG_UPDATE_APPS_EVERY_DEFAULT 10 |
| 50 | #define EBPF_CFG_PID_SIZE "pid table size" |
| 51 | #define EBPF_CFG_APPLICATION "apps" |
| 52 | #define EBPF_CFG_CGROUP "cgroups" |
| 53 | |
| 54 | #define EBPF_COMMON_FNCT_CLEAN_UP "release_task" |
| 55 | |
| 56 | /** |
| 57 | * The RedHat magic number was got doing: |
| 58 | * |
| 59 | * 1797 = 7*256 + 5 |
| 60 | * |
| 61 | * For more details, please, read /usr/include/linux/version.h |
| 62 | * in any Red Hat installation. |
| 63 | */ |
| 64 | #define NETDATA_MINIMUM_RH_VERSION 1797 |
| 65 | |
| 66 | /** |
| 67 | * 2048 = 8*256 + 0 |
| 68 | */ |
| 69 | #define NETDATA_RH_8 2048 |
| 70 | |
| 71 | /** |
| 72 | * Kernel Version |
| 73 | * |
| 74 | * Kernel versions are calculated using the following formula: |
| 75 | * |
| 76 | * VERSION = LINUX_VERSION_MAJOR*65536 + LINUX_VERSION_PATCHLEVEL*256 + LINUX_VERSION_SUBLEVEL |
| 77 | * |
| 78 | * Where LINUX_VERSION_MAJOR, LINUX_VERSION_PATCHLEVEL, and LINUX_VERSION_SUBLEVEL are extracted |
| 79 | * from /usr/include/linux/version.h. |
| 80 | * |
| 81 | * LINUX_VERSION_SUBLEVEL has the maximum value 255, but linux can have more SUBLEVELS. |
| 82 | * |
| 83 | */ |
| 84 | enum netdata_ebpf_kernel_versions { |
| 85 | NETDATA_EBPF_KERNEL_4_06 = 263680, // 264960 = 4 * 65536 + 6 * 256 |
| 86 | NETDATA_EBPF_KERNEL_4_11 = 264960, // 264960 = 4 * 65536 + 15 * 256 |
| 87 | NETDATA_EBPF_KERNEL_4_14 = 265728, // 264960 = 4 * 65536 + 14 * 256 |
| 88 | NETDATA_EBPF_KERNEL_4_15 = 265984, // 265984 = 4 * 65536 + 15 * 256 |
| 89 | NETDATA_EBPF_KERNEL_4_17 = 266496, // 266496 = 4 * 65536 + 17 * 256 |
| 90 | NETDATA_EBPF_KERNEL_5_0 = 327680, // 327680 = 5 * 65536 + 0 * 256 |
| 91 | NETDATA_EBPF_KERNEL_5_3 = 328448, // 327680 = 5 * 65536 + 3 * 256 |
| 92 | NETDATA_EBPF_KERNEL_5_4 = 328704, // 327680 = 5 * 65536 + 4 * 256 |
| 93 | NETDATA_EBPF_KERNEL_5_5 = 328960, // 327680 = 5 * 65536 + 5 * 256 |
| 94 | NETDATA_EBPF_KERNEL_5_9_16 = 330000, // 330240 = 5 * 65536 + 9 * 256 + 16 |
| 95 | NETDATA_EBPF_KERNEL_5_10 = 330240, // 330240 = 5 * 65536 + 10 * 256 |
| 96 | NETDATA_EBPF_KERNEL_5_11 = 330496, // 330240 = 5 * 65536 + 11 * 256 |
| 97 | NETDATA_EBPF_KERNEL_5_14 = 331264, // 331264 = 5 * 65536 + 14 * 256 |
| 98 | NETDATA_EBPF_KERNEL_5_15 = 331520, // 331520 = 5 * 65536 + 15 * 256 |
| 99 | NETDATA_EBPF_KERNEL_5_16 = 331776, // 331776 = 5 * 65536 + 16 * 256 |
| 100 | NETDATA_EBPF_KERNEL_6_8 = 395264, // 395264 = 6 * 65536 + 8 * 256 |
| 101 | NETDATA_EBPF_KERNEL_6_16 = 397312 // 397312 = 6 * 65536 + 16 * 256 |
| 102 | }; |
| 103 | |
| 104 | enum netdata_kernel_flag { |
| 105 | NETDATA_V3_10 = 1 << 0, |
| 106 | NETDATA_V4_14 = 1 << 1, |
| 107 | NETDATA_V4_16 = 1 << 2, |
| 108 | NETDATA_V4_18 = 1 << 3, |
| 109 | NETDATA_V5_4 = 1 << 4, |
| 110 | NETDATA_V5_10 = 1 << 5, |
| 111 | NETDATA_V5_11 = 1 << 6, |
| 112 | NETDATA_V5_14 = 1 << 7, |
| 113 | NETDATA_V5_15 = 1 << 8, |
| 114 | NETDATA_V5_16 = 1 << 9, |
| 115 | NETDATA_V6_8 = 1 << 10 |
| 116 | }; |
| 117 | |
| 118 | enum netdata_kernel_idx { |
| 119 | NETDATA_IDX_V3_10, |
| 120 | NETDATA_IDX_V4_14, |
| 121 | NETDATA_IDX_V4_16, |
| 122 | NETDATA_IDX_V4_18, |
| 123 | NETDATA_IDX_V5_4, |
| 124 | NETDATA_IDX_V5_10, |
| 125 | NETDATA_IDX_V5_11, |
| 126 | NETDATA_IDX_V5_14, |
| 127 | NETDATA_IDX_V5_15, |
| 128 | NETDATA_IDX_V5_16, |
| 129 | NETDATA_IDX_V6_8 |
| 130 | }; |
| 131 | |
| 132 | #define NETDATA_IDX_STR_V3_10 "3.10" |
| 133 | #define NETDATA_IDX_STR_V4_14 "4.14" |
| 134 | #define NETDATA_IDX_STR_V4_16 "4.16" |
| 135 | #define NETDATA_IDX_STR_V4_18 "4.18" |
| 136 | #define NETDATA_IDX_STR_V5_4 "5.4" |
| 137 | #define NETDATA_IDX_STR_V5_10 "5.10" |
| 138 | #define NETDATA_IDX_STR_V5_11 "5.11" |
| 139 | #define NETDATA_IDX_STR_V5_14 "5.14" |
| 140 | #define NETDATA_IDX_STR_V5_15 "5.15" |
| 141 | #define NETDATA_IDX_STR_V5_16 "5.16" |
| 142 | #define NETDATA_IDX_STR_V6_8 "6.8" |
| 143 | |
| 144 | /** |
| 145 | * Minimum value has relationship with libbpf support. |
| 146 | */ |
| 147 | #define NETDATA_MINIMUM_EBPF_KERNEL NETDATA_EBPF_KERNEL_4_11 |
| 148 | |
| 149 | #define VERSION_STRING_LEN 256 |
| 150 | #define EBPF_KERNEL_REJECT_LIST_FILE "ebpf_kernel_reject_list.txt" |
| 151 | |
| 152 | #define ND_EBPF_DEFAULT_MIN_PID 1U |
| 153 | #define ND_EBPF_MAP_FD_NOT_INITIALIZED ((int)-1) |
| 154 | |
| 155 | typedef struct ebpf_addresses { |
| 156 | char *function; |
| 157 | uint32_t hash; |
| 158 | // We use long as address, because it matches system length |
| 159 | unsigned long addr; |
| 160 | uint32_t type; |
| 161 | } ebpf_addresses_t; |
| 162 | |
| 163 | extern char *ebpf_user_config_dir; |
| 164 | extern char *ebpf_stock_config_dir; |
| 165 | |
| 166 | typedef struct ebpf_data { |
| 167 | int *map_fd; |
| 168 | |
| 169 | char *kernel_string; |
| 170 | uint32_t running_on_kernel; |
| 171 | int isrh; |
| 172 | } ebpf_data_t; |
| 173 | |
| 174 | typedef enum { |
| 175 | MODE_RETURN = 0, // This attaches kprobe when the function returns |
| 176 | MODE_DEVMODE, // This stores log given description about the errors raised |
| 177 | MODE_ENTRY // This attaches kprobe when the function is called |
| 178 | } netdata_run_mode_t; |
| 179 | |
| 180 | #define ND_EBPF_DEFAULT_PID_SIZE 32768U |
| 181 | |
| 182 | enum netdata_ebpf_map_type { |
| 183 | NETDATA_EBPF_MAP_STATIC = 0, |
| 184 | NETDATA_EBPF_MAP_RESIZABLE = 1, |
| 185 | NETDATA_EBPF_MAP_CONTROLLER = 2, |
| 186 | NETDATA_EBPF_MAP_CONTROLLER_UPDATED = 4, |
| 187 | NETDATA_EBPF_MAP_PID = 8 |
| 188 | }; |
| 189 | |
| 190 | enum netdata_controller { |
| 191 | NETDATA_CONTROLLER_APPS_ENABLED, |
| 192 | NETDATA_CONTROLLER_APPS_LEVEL, |
| 193 | |
| 194 | // These index show the number of elements |
| 195 | // stored inside hash tables. |
| 196 | // |
| 197 | // We have indexes to count increase and |
| 198 | // decrease events, because __sync_fetch_and_sub |
| 199 | // generates compilation errors. |
| 200 | NETDATA_CONTROLLER_PID_TABLE_ADD, |
| 201 | NETDATA_CONTROLLER_PID_TABLE_DEL, |
| 202 | NETDATA_CONTROLLER_TEMP_TABLE_ADD, |
| 203 | NETDATA_CONTROLLER_TEMP_TABLE_DEL, |
| 204 | |
| 205 | NETDATA_CONTROLLER_END |
| 206 | }; |
| 207 | |
| 208 | // Control how Netdata will monitor PIDs (apps and cgroups) |
| 209 | typedef enum netdata_apps_level { |
| 210 | NETDATA_APPS_LEVEL_REAL_PARENT, |
| 211 | NETDATA_APPS_LEVEL_PARENT, |
| 212 | NETDATA_APPS_LEVEL_ALL, |
| 213 | |
| 214 | // Present only in user ring |
| 215 | NETDATA_APPS_NOT_SET |
| 216 | } netdata_apps_level_t; |
| 217 | |
| 218 | typedef struct ebpf_local_maps { |
| 219 | const char *name; |
| 220 | uint32_t internal_input; |
| 221 | uint32_t user_input; |
| 222 | uint32_t type; |
| 223 | int map_fd; |
| 224 | #ifdef LIBBPF_MAJOR_VERSION |
| 225 | enum bpf_map_type map_type; |
| 226 | #endif |
| 227 | } ebpf_local_maps_t; |
| 228 | |
| 229 | typedef struct ebpf_specify_name { |
| 230 | char *program_name; |
| 231 | char *function_to_attach; |
| 232 | char *optional; |
| 233 | bool retprobe; |
| 234 | } ebpf_specify_name_t; |
| 235 | |
| 236 | typedef enum netdata_ebpf_load_mode { |
| 237 | EBPF_LOAD_LEGACY = 1 << 0, // Select legacy mode, this means we will load binaries |
| 238 | EBPF_LOAD_CORE = 1 << 1, // When CO-RE is used, it is necessary to use the source code |
| 239 | EBPF_LOAD_PLAY_DICE = 1 << 2, // Take a look on environment and choose the best option |
| 240 | EBPF_LOADED_FROM_STOCK = 1 << 3, // Configuration loaded from Stock file |
| 241 | EBPF_LOADED_FROM_USER = 1 << 4 // Configuration loaded from user |
| 242 | } netdata_ebpf_load_mode_t; |
| 243 | #define NETDATA_EBPF_LOAD_METHODS (EBPF_LOAD_LEGACY | EBPF_LOAD_CORE | EBPF_LOAD_PLAY_DICE) |
| 244 | #define NETDATA_EBPF_LOAD_SOURCE (EBPF_LOADED_FROM_STOCK | EBPF_LOADED_FROM_USER) |
| 245 | |
| 246 | typedef enum netdata_ebpf_program_loaded { |
| 247 | EBPF_LOAD_PROBE, // Attach probes on targets |
| 248 | EBPF_LOAD_RETPROBE, // Attach retprobes on targets |
| 249 | EBPF_LOAD_TRACEPOINT, // This stores log given description about the errors raised |
| 250 | EBPF_LOAD_TRAMPOLINE, // This attaches kprobe when the function is called |
| 251 | } netdata_ebpf_program_loaded_t; |
| 252 | |
| 253 | typedef struct netdata_ebpf_targets { |
| 254 | char *name; |
| 255 | netdata_ebpf_program_loaded_t mode; |
| 256 | } netdata_ebpf_targets_t; |
| 257 | |
| 258 | typedef struct ebpf_plugin_stats { |
| 259 | // Load options |
| 260 | uint32_t legacy; // Legacy codes |
| 261 | uint32_t core; // CO-RE codes, this means we are using source code compiled. |
| 262 | |
| 263 | uint32_t threads; // Total number of threads |
| 264 | uint32_t running; // total number of threads running |
| 265 | |
| 266 | uint32_t probes; // Number of kprobes loaded |
| 267 | uint32_t retprobes; // Number of kretprobes loaded |
| 268 | uint32_t tracepoints; // Number of tracepoints used |
| 269 | uint32_t trampolines; // Number of trampolines used |
| 270 | |
| 271 | uint64_t memlock_kern; // The same information reported by bpftool, but it is not accurated |
| 272 | // https://lore.kernel.org/linux-mm/20230112155326.26902-5-laoar.shao@gmail.com/T/ |
| 273 | uint32_t hash_tables; // Number of hash tables used on the system. |
| 274 | |
| 275 | uint32_t hash_percpu; // Number of threads running per cpu maps |
| 276 | uint32_t hash_unique; // Number of threads running an unique map for all cores. |
| 277 | } ebpf_plugin_stats_t; |
| 278 | |
| 279 | typedef enum ebpf_stats_action { |
| 280 | EBPF_ACTION_STAT_ADD, |
| 281 | EBPF_ACTION_STAT_REMOVE, |
| 282 | } ebpf_stats_action_t; |
| 283 | |
| 284 | typedef enum netdata_apps_integration_flags { |
| 285 | NETDATA_EBPF_APPS_FLAG_NO, |
| 286 | NETDATA_EBPF_APPS_FLAG_YES, |
| 287 | NETDATA_EBPF_APPS_FLAG_CHART_CREATED |
| 288 | } netdata_apps_integration_flags_t; |
| 289 | |
| 290 | #define NETDATA_EBPF_CHART_MEM_LENGTH 48 |
| 291 | #define NETDATA_EBPF_STAT_DIMENSION_MEMORY "memory" |
| 292 | #define NETDATA_EBPF_STAT_DIMENSION_ARAL "aral" |
| 293 | |
| 294 | enum ebpf_threads_status { |
| 295 | NETDATA_THREAD_EBPF_RUNNING, // started by plugin |
| 296 | NETDATA_THREAD_EBPF_FUNCTION_RUNNING, // started by function |
| 297 | NETDATA_THREAD_EBPF_STOPPING, // stopping thread |
| 298 | NETDATA_THREAD_EBPF_STOPPED, // thread stopped |
| 299 | NETDATA_THREAD_EBPF_NOT_RUNNING // thread was never started |
| 300 | }; |
| 301 | |
| 302 | enum ebpf_global_table_values { |
| 303 | NETDATA_EBPF_GLOBAL_TABLE_PID_TABLE_ADD, // Count elements added inside PID table |
| 304 | NETDATA_EBPF_GLOBAL_TABLE_PID_TABLE_DEL, // Count elements removed from PID table |
| 305 | NETDATA_EBPF_GLOBAL_TABLE_TEMP_TABLE_ADD, // Count elements added inside TEMP table |
| 306 | NETDATA_EBPF_GLOBAL_TABLE_TEMP_TABLE_DEL, // Count elements removed from TEMP table |
| 307 | |
| 308 | NETDATA_EBPF_GLOBAL_TABLE_STATUS_END |
| 309 | }; |
| 310 | |
| 311 | typedef uint64_t netdata_idx_t; |
| 312 | |
| 313 | typedef struct ebpf_module { |
| 314 | // Constants used with module |
| 315 | struct { |
| 316 | const char *thread_name; |
| 317 | const char *config_name; |
| 318 | const char *thread_description; |
| 319 | } info; |
| 320 | |
| 321 | // Helpers used with plugin |
| 322 | struct { |
| 323 | void (*start_routine)(void *); // the thread function |
| 324 | void (*apps_routine)(struct ebpf_module *em, void *ptr); // the apps charts |
| 325 | void (*fnct_routine)(BUFFER *bf, struct ebpf_module *em); // the function used for exteernal requests |
| 326 | void (*bpf_unload)(struct ebpf_module *em); // BPF teardown, called from the module's own cleanup function on normal (non-shutdown) exit |
| 327 | const char *fcnt_name; // name given to cloud |
| 328 | const char *fcnt_desc; // description given about function |
| 329 | const char *fcnt_thread_chart_name; |
| 330 | int order_thread_chart; |
| 331 | const char *fcnt_thread_lifetime_name; |
| 332 | int order_thread_lifetime; |
| 333 | } functions; |
| 334 | |
| 335 | enum ebpf_threads_status enabled; |
| 336 | int update_every; |
| 337 | int global_charts; |
| 338 | netdata_apps_integration_flags_t apps_charts; |
| 339 | netdata_apps_level_t apps_level; |
| 340 | int cgroup_charts; |
| 341 | netdata_run_mode_t mode; |
| 342 | uint32_t thread_id; |
| 343 | int optional; |
| 344 | ebpf_local_maps_t *maps; |
| 345 | ebpf_specify_name_t *names; |
| 346 | uint32_t pid_map_size; |
| 347 | struct config *cfg; |
| 348 | const char *config_file; |
| 349 | uint64_t kernels; |
| 350 | netdata_ebpf_load_mode_t load; |
| 351 | netdata_ebpf_targets_t *targets; |
| 352 | struct bpf_link **probe_links; |
| 353 | struct bpf_object *objects; |
| 354 | struct netdata_static_thread *thread; |
| 355 | |
| 356 | // charts |
| 357 | char memory_usage[NETDATA_EBPF_CHART_MEM_LENGTH]; |
| 358 | char memory_allocations[NETDATA_EBPF_CHART_MEM_LENGTH]; |
| 359 | int maps_per_core; |
| 360 | |
| 361 | // period to run |
| 362 | uint32_t running_time; // internal usage, this is used to reset a value when a new request happens. |
| 363 | uint32_t lifetime; |
| 364 | |
| 365 | netdata_idx_t hash_table_stats[NETDATA_EBPF_GLOBAL_TABLE_STATUS_END]; |
| 366 | } ebpf_module_t; |
| 367 | |
| 368 | #define EBPF_DEFAULT_LIFETIME 300 |
| 369 | // This will be present until all functions are merged. The deadline is planned for 68 years since plugin start |
| 370 | #define EBPF_NON_FUNCTION_LIFE_TIME UINT_MAX |
| 371 | |
| 372 | int ebpf_get_kernel_version(); |
| 373 | int get_redhat_release(); |
| 374 | char *ebpf_kernel_suffix(int version, int isrh); |
| 375 | struct bpf_link ** |
| 376 | ebpf_load_program(char *plugins_dir, ebpf_module_t *em, int kver, int is_rhf, struct bpf_object **obj); |
| 377 | |
| 378 | void ebpf_mount_config_name(char *filename, size_t length, char *path, const char *config); |
| 379 | int ebpf_load_config(struct config *config, char *filename); |
| 380 | void ebpf_update_module(ebpf_module_t *em, struct btf *btf_file, int kver, int is_rh); |
| 381 | void ebpf_update_names(ebpf_specify_name_t *opt, ebpf_module_t *em); |
| 382 | void ebpf_adjust_apps_cgroup(ebpf_module_t *em, netdata_ebpf_program_loaded_t mode); |
| 383 | char *ebpf_find_symbol(char *search); |
| 384 | void ebpf_load_addresses(ebpf_addresses_t *fa, int fd); |
| 385 | void ebpf_fill_algorithms(int *algorithms, size_t length, int algorithm); |
| 386 | char **ebpf_fill_histogram_dimension(size_t maximum); |
| 387 | void ebpf_update_stats(ebpf_plugin_stats_t *report, ebpf_module_t *em); |
| 388 | void ebpf_update_controller(int fd, ebpf_module_t *em); |
| 389 | void ebpf_update_map_size(struct bpf_map *map, ebpf_local_maps_t *lmap, ebpf_module_t *em, const char *map_name); |
| 390 | |
| 391 | // Histogram |
| 392 | #define NETDATA_EBPF_HIST_MAX_BINS 24UL |
| 393 | #define NETDATA_DISK_MAX 256U |
| 394 | #define NETDATA_DISK_HISTOGRAM_LENGTH (NETDATA_DISK_MAX * NETDATA_EBPF_HIST_MAX_BINS) |
| 395 | |
| 396 | typedef struct netdata_ebpf_histogram { |
| 397 | char *name; |
| 398 | char *title; |
| 399 | char *ctx; |
| 400 | int order; |
| 401 | uint64_t histogram[NETDATA_EBPF_HIST_MAX_BINS]; |
| 402 | } netdata_ebpf_histogram_t; |
| 403 | |
| 404 | enum fs_btf_counters { |
| 405 | NETDATA_KEY_BTF_READ, |
| 406 | NETDATA_KEY_BTF_WRITE, |
| 407 | NETDATA_KEY_BTF_OPEN, |
| 408 | NETDATA_KEY_BTF_SYNC_ATTR, |
| 409 | NETDATA_KEY_BTF_OPEN2, |
| 410 | |
| 411 | NETDATA_FS_BTF_END |
| 412 | }; |
| 413 | |
| 414 | typedef struct ebpf_filesystem_partitions { |
| 415 | char *filesystem; |
| 416 | char *optional_filesystem; |
| 417 | char *family; |
| 418 | char *family_name; |
| 419 | struct bpf_object *objects; |
| 420 | struct bpf_link **probe_links; |
| 421 | bool load_failed; |
| 422 | |
| 423 | netdata_ebpf_histogram_t hread; |
| 424 | netdata_ebpf_histogram_t hwrite; |
| 425 | netdata_ebpf_histogram_t hopen; |
| 426 | netdata_ebpf_histogram_t hadditional; |
| 427 | |
| 428 | uint32_t flags; |
| 429 | uint32_t enabled; |
| 430 | |
| 431 | ebpf_addresses_t addresses; |
| 432 | uint64_t kernels; |
| 433 | ebpf_local_maps_t *fs_maps; |
| 434 | |
| 435 | // BPF structure |
| 436 | #ifdef LIBBPF_MAJOR_VERSION |
| 437 | struct filesystem_bpf *fs_obj; |
| 438 | #else |
| 439 | void *fs_obj; |
| 440 | #endif |
| 441 | const char *functions[NETDATA_FS_BTF_END]; |
| 442 | } ebpf_filesystem_partitions_t; |
| 443 | |
| 444 | typedef struct ebpf_sync_syscalls { |
| 445 | char *syscall; |
| 446 | int enabled; |
| 447 | uint32_t flags; |
| 448 | |
| 449 | // BTF structure |
| 450 | struct bpf_object *objects; |
| 451 | struct bpf_link **probe_links; |
| 452 | |
| 453 | // BPF structure |
| 454 | #ifdef LIBBPF_MAJOR_VERSION |
| 455 | struct sync_bpf *sync_obj; |
| 456 | #else |
| 457 | void *sync_obj; |
| 458 | #endif |
| 459 | ebpf_local_maps_t *sync_maps; |
| 460 | } ebpf_sync_syscalls_t; |
| 461 | |
| 462 | void ebpf_histogram_dimension_cleanup(char **ptr, size_t length); |
| 463 | |
| 464 | // Tracepoint helpers |
| 465 | // For more information related to tracepoints read https://www.kernel.org/doc/html/latest/trace/tracepoints.html |
| 466 | int ebpf_is_tracepoint_enabled(const char *subsys, const char *eventname); |
| 467 | int ebpf_enable_tracing_values(const char *subsys, const char *eventname); |
| 468 | int ebpf_disable_tracing_values(const char *subsys, const char *eventname); |
| 469 | |
| 470 | // BTF Section |
| 471 | #define EBPF_DEFAULT_BTF_FILE "vmlinux" |
| 472 | #define EBPF_DEFAULT_BTF_PATH "/sys/kernel/btf" |
| 473 | #define EBPF_DEFAULT_ERROR_MSG "Cannot open or load BPF file for thread" |
| 474 | |
| 475 | // BTF helpers |
| 476 | #define NETDATA_EBPF_MAX_SYSCALL_LENGTH 255 |
| 477 | |
| 478 | netdata_ebpf_load_mode_t epbf_convert_string_to_load_mode(const char *str); |
| 479 | netdata_ebpf_program_loaded_t ebpf_convert_core_type(const char *str, netdata_run_mode_t lmode); |
| 480 | void ebpf_select_host_prefix(char *output, size_t length, char *syscall, int kver); |
| 481 | #ifdef LIBBPF_MAJOR_VERSION |
| 482 | void ebpf_adjust_thread_load(ebpf_module_t *mod, struct btf *file); |
| 483 | struct btf *ebpf_parse_btf_file(const char *filename); |
| 484 | struct btf *ebpf_load_btf_file(const char *path, const char *filename); |
| 485 | int ebpf_is_function_inside_btf(struct btf *file, char *function); |
| 486 | void ebpf_update_map_type(struct bpf_map *map, ebpf_local_maps_t *w); |
| 487 | void ebpf_define_map_type(ebpf_local_maps_t *maps, int maps_per_core, int kver); |
| 488 | #endif |
| 489 | |
| 490 | void ebpf_update_kernel_memory_with_vector( |
| 491 | ebpf_plugin_stats_t *report, |
| 492 | ebpf_local_maps_t *maps, |
| 493 | ebpf_stats_action_t action); |
| 494 | void ebpf_update_kernel_memory(ebpf_plugin_stats_t *report, ebpf_local_maps_t *map, ebpf_stats_action_t action); |
| 495 | int ebpf_statistic_create_aral_chart(char *name, ebpf_module_t *em); |
| 496 | void ebpf_statistic_obsolete_aral_chart(ebpf_module_t *em, int prio); |
| 497 | void ebpf_send_data_aral_chart(ARAL *memory, ebpf_module_t *em); |
| 498 | |
| 499 | int ebpf_can_plugin_load_code(int kver, char *plugin_name); |
| 500 | int ebpf_adjust_memory_limit(); |
| 501 | |
| 502 | #ifdef LIBBPF_MAJOR_VERSION |
| 503 | static inline int netdata_silent_libbpf_vfprintf( |
| 504 | enum libbpf_print_level level __maybe_unused, |
| 505 | const char *format __maybe_unused, |
| 506 | va_list args __maybe_unused) |
| 507 | { |
| 508 | return 0; |
| 509 | } |
| 510 | #endif |
| 511 | |
| 512 | #endif /* NETDATA_EBPF_H */ |