New eBPF kernel (#10434)
Bring support for kernel 5.10.
thiagoftsm committed
Jan 13, 2021 at 15:02 UTC
7f002c126d41c434df422804941bb254f13a913f
11 files changed
+40
-98
collectors/ebpf.plugin/ebpf.c
+3
-41
@@ -75,43 +75,15 @@ pthread_mutex_t lock;
75
pthread_mutex_t collect_data_mutex;
76
pthread_cond_t collect_data_cond_var;
77
78
-netdata_ebpf_events_t process_probes[] = {
79
- { .type = 'r', .name = "vfs_write" },
80
- { .type = 'r', .name = "vfs_writev" },
81
- { .type = 'r', .name = "vfs_read" },
82
- { .type = 'r', .name = "vfs_readv" },
83
- { .type = 'r', .name = "do_sys_open" },
84
- { .type = 'r', .name = "vfs_unlink" },
85
- { .type = 'p', .name = "do_exit" },
86
- { .type = 'p', .name = "release_task" },
87
- { .type = 'r', .name = "_do_fork" },
88
- { .type = 'r', .name = "__close_fd" },
89
- { .type = 'p', .name = "try_to_wake_up" },
90
- { .type = 'r', .name = "__x64_sys_clone" },
91
- { .type = 0, .name = NULL }
92
-};
93
-
94
-netdata_ebpf_events_t socket_probes[] = {
95
- { .type = 'p', .name = "tcp_cleanup_rbuf" },
96
- { .type = 'p', .name = "tcp_close" },
97
- { .type = 'p', .name = "udp_recvmsg" },
98
- { .type = 'r', .name = "udp_recvmsg" },
99
- { .type = 'r', .name = "udp_sendmsg" },
100
- { .type = 'p', .name = "do_exit" },
101
- { .type = 'p', .name = "tcp_sendmsg" },
102
- { .type = 'r', .name = "tcp_sendmsg" },
103
- { .type = 0, .name = NULL }
104
-};
105
-
78
ebpf_module_t ebpf_modules[] = {
79
{ .thread_name = "process", .config_name = "process", .enabled = 0, .start_routine = ebpf_process_thread,
108
- .update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY, .probes = process_probes,
80
+ .update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY,
81
.optional = 0 },
82
{ .thread_name = "socket", .config_name = "socket", .enabled = 0, .start_routine = ebpf_socket_thread,
111
- .update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY, .probes = socket_probes,
83
+ .update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY,
84
.optional = 0 },
85
{ .thread_name = NULL, .enabled = 0, .start_routine = NULL, .update_time = 1,
114
- .global_charts = 0, .apps_charts = 1, .mode = MODE_ENTRY, .probes = NULL,
86
+ .global_charts = 0, .apps_charts = 1, .mode = MODE_ENTRY,
87
.optional = 0 },
88
};
89
@@ -166,15 +138,6 @@ static void clean_ip_structure(ebpf_network_viewer_ip_list_t **clean)
138
*clean = NULL;
139
}
140
169
-static void change_events()
170
-{
171
- if (ebpf_modules[0].mode == MODE_ENTRY)
172
- change_process_event();
173
-
174
- if (ebpf_modules[1].mode == MODE_ENTRY)
175
- change_socket_event();
176
-}
177
-
141
/**
142
* Clean Loaded Events
143
*
@@ -1966,7 +1929,6 @@ int main(int argc, char **argv)
1929
{NULL , NULL, NULL, 0, NULL, NULL, NULL}
1930
};
1931
1969
- change_events();
1932
//clean_loaded_events();
1933
1934
int i;
collectors/ebpf.plugin/ebpf.h
-6
@@ -109,8 +109,6 @@ extern int ebpf_nprocs;
109
extern int running_on_kernel;
110
extern char *ebpf_plugin_dir;
111
extern char kernel_string[64];
112
-extern netdata_ebpf_events_t process_probes[];
113
-extern netdata_ebpf_events_t socket_probes[];
112
113
extern pthread_mutex_t collect_data_mutex;
114
extern pthread_cond_t collect_data_cond_var;
@@ -193,8 +191,4 @@ extern uint32_t finalized_threads;
191
192
#define EBPF_MAX_SYNCHRONIZATION_TIME 300
193
196
-// External functions
197
-extern void change_socket_event();
198
-extern void change_process_event();
199
-
194
#endif /* NETDATA_COLLECTOR_EBPF_H */
collectors/ebpf.plugin/ebpf_kernel_reject_list.txt
-1
@@ -1,2 +1 @@
1
Ubuntu 4.18.0-13.
2
-Ubuntu 4.18.0-25.
collectors/ebpf.plugin/ebpf_process.c
-12
@@ -968,22 +968,10 @@ static void ebpf_process_allocate_global_vectors(size_t length)
968
prev_apps_data = callocz((size_t)pid_max, sizeof(ebpf_process_publish_apps_t *));
969
}
970
971
-void change_process_event()
972
-{
973
- int i;
974
- if (running_on_kernel < NETDATA_KERNEL_V5_3)
975
- process_probes[EBPF_SYS_CLONE_IDX].name = NULL;
976
-
977
- for (i = 0; process_probes[i].name; i++) {
978
- process_probes[i].type = 'p';
979
- }
980
-}
981
-
971
static void change_syscalls()
972
{
973
static char *lfork = { "do_fork" };
974
process_id_names[7] = lfork;
986
- process_probes[8].name = lfork;
975
}
976
977
/**
collectors/ebpf.plugin/ebpf_socket.c
+2
-14
@@ -1851,24 +1851,12 @@ static void ebpf_socket_allocate_global_vectors(size_t length)
1851
outbound_vectors.plot = callocz(network_viewer_opt.max_dim, sizeof(netdata_socket_plot_t));
1852
}
1853
1854
-void change_socket_event()
1855
-{
1856
- socket_probes[0].type = 'p';
1857
- socket_probes[4].type = 'p';
1858
- socket_probes[5].type = 'p';
1859
- socket_probes[7].name = NULL;
1860
-}
1861
-
1854
/**
1855
* Set local function pointers, this function will never be compiled with static libraries
1856
*/
1865
-static void set_local_pointers(ebpf_module_t *em)
1857
+static void set_local_pointers()
1858
{
1859
map_fd = socket_data.map_fd;
1868
-
1869
- if (em->mode == MODE_ENTRY) {
1870
- change_socket_event();
1871
- }
1860
}
1861
1862
/**
@@ -1926,7 +1914,7 @@ void *ebpf_socket_thread(void *ptr)
1914
goto endsocket;
1915
}
1916
1929
- set_local_pointers(em);
1917
+ set_local_pointers();
1918
probe_links = ebpf_load_program(ebpf_plugin_dir, em, kernel_string, &objects, socket_data.map_fd);
1919
if (!probe_links) {
1920
pthread_mutex_unlock(&lock);
libnetdata/ebpf/ebpf.c
+9
-6
@@ -242,16 +242,18 @@ char *ebpf_kernel_suffix(int version, int isrh)
242
{
243
if (isrh) {
244
if (version >= NETDATA_EBPF_KERNEL_4_11)
245
- return "4.18.0";
245
+ return "4.18";
246
else
247
- return "3.10.0";
247
+ return "3.10";
248
} else {
249
- if (version >= NETDATA_EBPF_KERNEL_4_17)
250
- return "5.4.20";
249
+ if (version >= NETDATA_EBPF_KERNEL_5_10)
250
+ return "5.10";
251
+ else if (version >= NETDATA_EBPF_KERNEL_4_17)
252
+ return "5.4";
253
else if (version >= NETDATA_EBPF_KERNEL_4_15)
252
- return "4.16.18";
254
+ return "4.16";
255
else if (version >= NETDATA_EBPF_KERNEL_4_11)
254
- return "4.14.171";
256
+ return "4.14";
257
}
258
259
return NULL;
@@ -294,6 +296,7 @@ struct bpf_link **ebpf_load_program(char *plugins_dir, ebpf_module_t *em, char *
296
297
snprintf(lpath, 4096, "%s/%s", plugins_dir, lname);
298
if (bpf_prog_load(lpath, BPF_PROG_TYPE_KPROBE, obj, &prog_fd)) {
299
+ em->enabled = CONFIG_BOOLEAN_NO;
300
info("Cannot load program: %s", lpath);
301
return NULL;
302
} else {
libnetdata/ebpf/ebpf.h
+7
-7
@@ -31,6 +31,13 @@
31
*/
32
#define NETDATA_RH_8 2048
33
34
+/**
35
+ * Kernel 5.10
36
+ *
37
+ * 330240 = 5*65536 + 10*256
38
+ */
39
+#define NETDATA_EBPF_KERNEL_5_10 330240
40
+
41
/**
42
* Kernel 4.17
43
*
@@ -55,11 +62,6 @@
62
#define VERSION_STRING_LEN 256
63
#define EBPF_KERNEL_REJECT_LIST_FILE "ebpf_kernel_reject_list.txt"
64
58
-typedef struct netdata_ebpf_events {
59
- char type;
60
- char *name;
61
-} netdata_ebpf_events_t;
62
-
65
typedef struct ebpf_data {
66
int *map_fd;
67
@@ -83,14 +85,12 @@ typedef struct ebpf_module {
85
int global_charts;
86
int apps_charts;
87
netdata_run_mode_t mode;
86
- netdata_ebpf_events_t *probes;
88
uint32_t thread_id;
89
int optional;
90
} ebpf_module_t;
91
92
#define NETDATA_MAX_PROBES 64
93
93
-extern int clean_kprobe_events(FILE *out, int pid, netdata_ebpf_events_t *ptr);
94
extern int get_kernel_version(char *out, int size);
95
extern int get_redhat_release();
96
extern int has_condition_to_run(int version);
netdata-installer.sh
+8
@@ -1608,6 +1608,14 @@ remove_old_ebpf() {
1608
echo >&2 "Renaming eBPF configuration file."
1609
mv "${NETDATA_PREFIX}/etc/netdata/ebpf_process.conf" "${NETDATA_PREFIX}/etc/netdata/ebpf.conf"
1610
fi
1611
+
1612
+ # Added to remove eBPF programs with name pattern: NAME_VERSION.SUBVERSION.PATCH
1613
+ if [ -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/pnetdata_ebpf_process.3.10.0.o" ]; then
1614
+ echo >&2 "Removing old eBPF programs"
1615
+ rm -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/rnetdata_ebpf"*.?.*.*.o
1616
+ rm -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/pnetdata_ebpf"*.?.*.*.o
1617
+ fi
1618
+
1619
}
1620
1621
install_ebpf() {
packaging/ebpf.checksums
+3
-3
@@ -1,3 +1,3 @@
1
-723fecc3a74065f724d4af2780674f5aeb7f0b968899abc9e171fca1623ecd2a netdata-kernel-collector-glibc-v0.5.2.tar.xz
2
-f2110b1c149017c4a4f486e30d701731a5d12050345f9038c63c6dcc81d8e4d4 netdata-kernel-collector-musl-v0.5.2.tar.xz
3
-6587a4aedf4e0f17d725c4b8cee1f9b9fdbca41f9cd4fe85e4abbfdc03f27465 netdata-kernel-collector-static-v0.5.2.tar.xz
1
+bcc2e38754f277e84aefdb2760d7de2b32611576718234e1cecdb70a87e93497 netdata-kernel-collector-glibc-v0.5.4.tar.xz
2
+912675155f438c9fdccc1e91c1423fa4bb914a9c7e2d7b843f551e053f4374eb netdata-kernel-collector-musl-v0.5.4.tar.xz
3
+dd0f63895305c38669b512f9e95a75057340f04ea999c3ea3540cb18a893dc52 netdata-kernel-collector-static-v0.5.4.tar.xz
packaging/ebpf.version
+1
-1
@@ -1 +1 @@
1
-v0.5.2
1
+v0.5.4
web/gui/dashboard_info.js
+7
-7
@@ -1105,13 +1105,13 @@ netdataDashboard.context = {
1105
},
1106
1107
'apps.file_open': {
1108
- info: 'Calls to the internal function <code>do_sys_open</code>, which is the common function called from' +
1108
+ info: 'Calls to the internal function <code>do_sys_open</code> ( For kernels newer than <code>5.5.19</code> we add a kprobe to <code>do_sys_openat2</code>. ), which is the common function called from' +
1109
' <a href="https://www.man7.org/linux/man-pages/man2/open.2.html" target="_blank">open(2)</a> ' +
1110
' and <a href="https://www.man7.org/linux/man-pages/man2/openat.2.html" target="_blank">openat(2)</a>. '
1111
},
1112
1113
'apps.file_open_error': {
1114
- info: 'Failed calls to the internal function <code>do_sys_open</code>.'
1114
+ info: 'Failed calls to the internal function <code>do_sys_open</code> ( For kernels newer than <code>5.5.19</code> we add a kprobe to <code>do_sys_openat2</code>. ).'
1115
},
1116
1117
'apps.file_closed': {
@@ -1152,11 +1152,11 @@ netdataDashboard.context = {
1152
},
1153
1154
'apps.process_create': {
1155
- info: 'Calls to the function <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a> to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the process by counting the number of calls to <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that do not have the flag <code>CLONE_THREAD</code> set.'
1155
+ info: 'Calls to either <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the process by counting the number of calls to <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that do not have the flag <code>CLONE_THREAD</code> set.'
1156
},
1157
1158
'apps.thread_create': {
1159
- info: 'Calls to the function <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a> to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by counting the number of calls to <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that have the flag <code>CLONE_THREAD</code> set.'
1159
+ info: 'Calls to either <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by counting the number of calls to <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that have the flag <code>CLONE_THREAD</code> set.'
1160
},
1161
1162
'apps.task_close': {
@@ -3297,7 +3297,7 @@ netdataDashboard.context = {
3297
3298
'ebpf.file_descriptor': {
3299
title : 'File access',
3300
- info: 'Calls for internal functions on Linux kernel. The open dimension is attached to the kernel internal function <code>do_sys_open</code>, which is the common function called from'+
3300
+ info: 'Calls for internal functions on Linux kernel. The open dimension is attached to the kernel internal function <code>do_sys_open</code> ( For kernels newer than <code>5.5.19</code> we add a kprobe to <code>do_sys_openat2</code>. ), which is the common function called from'+
3301
' <a href="https://www.man7.org/linux/man-pages/man2/open.2.html" target="_blank">open(2)</a> ' +
3302
' and <a href="https://www.man7.org/linux/man-pages/man2/openat.2.html" target="_blank">openat(2)</a>. ' +
3303
' The close dimension is attached to the function <code>__close_fd</code>, which is called from system call' +
@@ -3306,7 +3306,7 @@ netdataDashboard.context = {
3306
3307
'ebpf.file_error': {
3308
title : 'File access error',
3309
- info: 'Failed calls to the kernel internal function <code>do_sys_open</code>, which is the common function called from'+
3309
+ info: 'Failed calls to the kernel internal function <code>do_sys_open</code> ( For kernels newer than <code>5.5.19</code> we add a kprobe to <code>do_sys_openat2</code>. ), which is the common function called from'+
3310
' <a href="https://www.man7.org/linux/man-pages/man2/open.2.html" target="_blank">open(2)</a> ' +
3311
' and <a href="https://www.man7.org/linux/man-pages/man2/openat.2.html" target="_blank">openat(2)</a>. ' +
3312
' The close dimension is attached to the function <code>__close_fd</code>, which is called from system call' +
@@ -3335,7 +3335,7 @@ netdataDashboard.context = {
3335
3336
'ebpf.process_thread': {
3337
title : 'Task creation',
3338
- info: 'Number of times that the function <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a> is called to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by couting the number of calls for <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that has the flag <code>CLONE_THREAD</code> set.'
3338
+ info: 'Number of times that either <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, is called to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by couting the number of calls for <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that has the flag <code>CLONE_THREAD</code> set.'
3339
},
3340
3341
'ebpf.exit': {