New eBPF kernel (#10434)

Bring support for kernel 5.10.

collectors/ebpf.plugin/ebpf.c

@@ -75,43 +75,15 @@ pthread_mutex_t lock;
 pthread_mutex_t collect_data_mutex;
 pthread_cond_t collect_data_cond_var;
 
-netdata_ebpf_events_t process_probes[] = {
-    { .type = 'r', .name = "vfs_write" },
-    { .type = 'r', .name = "vfs_writev" },
-    { .type = 'r', .name = "vfs_read" },
-    { .type = 'r', .name = "vfs_readv" },
-    { .type = 'r', .name = "do_sys_open" },
-    { .type = 'r', .name = "vfs_unlink" },
-    { .type = 'p', .name = "do_exit" },
-    { .type = 'p', .name = "release_task" },
-    { .type = 'r', .name = "_do_fork" },
-    { .type = 'r', .name = "__close_fd" },
-    { .type = 'p', .name = "try_to_wake_up" },
-    { .type = 'r', .name = "__x64_sys_clone" },
-    { .type = 0, .name = NULL }
-};
-
-netdata_ebpf_events_t socket_probes[] = {
-    { .type = 'p', .name = "tcp_cleanup_rbuf" },
-    { .type = 'p', .name = "tcp_close" },
-    { .type = 'p', .name = "udp_recvmsg" },
-    { .type = 'r', .name = "udp_recvmsg" },
-    { .type = 'r', .name = "udp_sendmsg" },
-    { .type = 'p', .name = "do_exit" },
-    { .type = 'p', .name = "tcp_sendmsg" },
-    { .type = 'r', .name = "tcp_sendmsg" },
-    { .type = 0, .name = NULL }
-};
-
 ebpf_module_t ebpf_modules[] = {
     { .thread_name = "process", .config_name = "process", .enabled = 0, .start_routine = ebpf_process_thread,
-      .update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY, .probes = process_probes,
+      .update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY,
       .optional = 0 },
     { .thread_name = "socket", .config_name = "socket", .enabled = 0, .start_routine = ebpf_socket_thread,
-      .update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY, .probes = socket_probes,
+      .update_time = 1, .global_charts = 1, .apps_charts = 1, .mode = MODE_ENTRY,
       .optional = 0  },
     { .thread_name = NULL, .enabled = 0, .start_routine = NULL, .update_time = 1,
-      .global_charts = 0, .apps_charts = 1, .mode = MODE_ENTRY, .probes = NULL,
+      .global_charts = 0, .apps_charts = 1, .mode = MODE_ENTRY,
       .optional = 0 },
 };
 
@@ -166,15 +138,6 @@ static void clean_ip_structure(ebpf_network_viewer_ip_list_t **clean)
     *clean = NULL;
 }
 
-static void change_events()
-{
-    if (ebpf_modules[0].mode == MODE_ENTRY)
-        change_process_event();
-
-    if (ebpf_modules[1].mode == MODE_ENTRY)
-        change_socket_event();
-}
-
 /**
  * Clean Loaded Events
  *
@@ -1966,7 +1929,6 @@ int main(int argc, char **argv)
         {NULL          , NULL, NULL, 0, NULL, NULL, NULL}
     };
 
-    change_events();
     //clean_loaded_events();
 
     int i;

collectors/ebpf.plugin/ebpf.h

@@ -109,8 +109,6 @@ extern int ebpf_nprocs;
 extern int running_on_kernel;
 extern char *ebpf_plugin_dir;
 extern char kernel_string[64];
-extern netdata_ebpf_events_t process_probes[];
-extern netdata_ebpf_events_t socket_probes[];
 
 extern pthread_mutex_t collect_data_mutex;
 extern pthread_cond_t collect_data_cond_var;
@@ -193,8 +191,4 @@ extern uint32_t finalized_threads;
 
 #define EBPF_MAX_SYNCHRONIZATION_TIME 300
 
-// External functions
-extern void change_socket_event();
-extern void change_process_event();
-
 #endif /* NETDATA_COLLECTOR_EBPF_H */

collectors/ebpf.plugin/ebpf_kernel_reject_list.txt

@@ -1,2 +1 @@
 Ubuntu 4.18.0-13.
-Ubuntu 4.18.0-25.

collectors/ebpf.plugin/ebpf_process.c

@@ -968,22 +968,10 @@ static void ebpf_process_allocate_global_vectors(size_t length)
     prev_apps_data = callocz((size_t)pid_max, sizeof(ebpf_process_publish_apps_t *));
 }
 
-void change_process_event()
-{
-    int i;
-    if (running_on_kernel < NETDATA_KERNEL_V5_3)
-        process_probes[EBPF_SYS_CLONE_IDX].name = NULL;
-
-    for (i = 0; process_probes[i].name; i++) {
-        process_probes[i].type = 'p';
-    }
-}
-
 static void change_syscalls()
 {
     static char *lfork = { "do_fork" };
     process_id_names[7] = lfork;
-    process_probes[8].name = lfork;
 }
 
 /**

collectors/ebpf.plugin/ebpf_socket.c

@@ -1851,24 +1851,12 @@ static void ebpf_socket_allocate_global_vectors(size_t length)
     outbound_vectors.plot = callocz(network_viewer_opt.max_dim, sizeof(netdata_socket_plot_t));
 }
 
-void change_socket_event()
-{
-    socket_probes[0].type = 'p';
-    socket_probes[4].type = 'p';
-    socket_probes[5].type = 'p';
-    socket_probes[7].name = NULL;
-}
-
 /**
  * Set local function pointers, this function will never be compiled with static libraries
  */
-static void set_local_pointers(ebpf_module_t *em)
+static void set_local_pointers()
 {
     map_fd = socket_data.map_fd;
-
-    if (em->mode == MODE_ENTRY) {
-        change_socket_event();
-    }
 }
 
 /**
@@ -1926,7 +1914,7 @@ void *ebpf_socket_thread(void *ptr)
         goto endsocket;
     }
 
-    set_local_pointers(em);
+    set_local_pointers();
     probe_links = ebpf_load_program(ebpf_plugin_dir, em, kernel_string, &objects, socket_data.map_fd);
     if (!probe_links) {
         pthread_mutex_unlock(&lock);

libnetdata/ebpf/ebpf.c

@@ -242,16 +242,18 @@ char *ebpf_kernel_suffix(int version, int isrh)
 {
     if (isrh) {
         if (version >= NETDATA_EBPF_KERNEL_4_11)
-            return "4.18.0";
+            return "4.18";
         else
-            return "3.10.0";
+            return "3.10";
     } else {
-        if (version >= NETDATA_EBPF_KERNEL_4_17)
+        if (version >= NETDATA_EBPF_KERNEL_5_10)
-            return "5.4.20";
+            return "5.10";
+        else if (version >= NETDATA_EBPF_KERNEL_4_17)
+            return "5.4";
         else if (version >= NETDATA_EBPF_KERNEL_4_15)
-            return "4.16.18";
+            return "4.16";
         else if (version >= NETDATA_EBPF_KERNEL_4_11)
-            return "4.14.171";
+            return "4.14";
     }
 
     return NULL;
@@ -294,6 +296,7 @@ struct bpf_link **ebpf_load_program(char *plugins_dir, ebpf_module_t *em, char *
 
     snprintf(lpath, 4096, "%s/%s", plugins_dir, lname);
     if (bpf_prog_load(lpath, BPF_PROG_TYPE_KPROBE, obj, &prog_fd)) {
+        em->enabled = CONFIG_BOOLEAN_NO;
         info("Cannot load program: %s", lpath);
         return NULL;
     } else {

libnetdata/ebpf/ebpf.h

@@ -31,6 +31,13 @@
  */
 #define NETDATA_RH_8 2048
 
+/**
+ *  Kernel 5.10
+ *
+ *  330240 = 5*65536 + 10*256
+ */
+#define NETDATA_EBPF_KERNEL_5_10 330240
+
 /**
  *  Kernel 4.17
  *
@@ -55,11 +62,6 @@
 #define VERSION_STRING_LEN 256
 #define EBPF_KERNEL_REJECT_LIST_FILE "ebpf_kernel_reject_list.txt"
 
-typedef struct netdata_ebpf_events {
-    char type;
-    char *name;
-} netdata_ebpf_events_t;
-
 typedef struct ebpf_data {
     int *map_fd;
 
@@ -83,14 +85,12 @@ typedef struct ebpf_module {
     int global_charts;
     int apps_charts;
     netdata_run_mode_t mode;
-    netdata_ebpf_events_t *probes;
     uint32_t thread_id;
     int optional;
 } ebpf_module_t;
 
 #define NETDATA_MAX_PROBES 64
 
-extern int clean_kprobe_events(FILE *out, int pid, netdata_ebpf_events_t *ptr);
 extern int get_kernel_version(char *out, int size);
 extern int get_redhat_release();
 extern int has_condition_to_run(int version);

netdata-installer.sh

@@ -1608,6 +1608,14 @@ remove_old_ebpf() {
     echo >&2 "Renaming eBPF configuration file."
     mv "${NETDATA_PREFIX}/etc/netdata/ebpf_process.conf" "${NETDATA_PREFIX}/etc/netdata/ebpf.conf"
   fi
+
+  # Added to remove eBPF programs with name pattern: NAME_VERSION.SUBVERSION.PATCH 
+  if [ -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/pnetdata_ebpf_process.3.10.0.o" ]; then
+    echo >&2 "Removing old eBPF programs"
+    rm -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/rnetdata_ebpf"*.?.*.*.o
+    rm -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/pnetdata_ebpf"*.?.*.*.o
+  fi
+
 }
 
 install_ebpf() {

packaging/ebpf.checksums

@@ -1,3 +1,3 @@
-723fecc3a74065f724d4af2780674f5aeb7f0b968899abc9e171fca1623ecd2a  netdata-kernel-collector-glibc-v0.5.2.tar.xz
+bcc2e38754f277e84aefdb2760d7de2b32611576718234e1cecdb70a87e93497  netdata-kernel-collector-glibc-v0.5.4.tar.xz
-f2110b1c149017c4a4f486e30d701731a5d12050345f9038c63c6dcc81d8e4d4  netdata-kernel-collector-musl-v0.5.2.tar.xz
+912675155f438c9fdccc1e91c1423fa4bb914a9c7e2d7b843f551e053f4374eb  netdata-kernel-collector-musl-v0.5.4.tar.xz
-6587a4aedf4e0f17d725c4b8cee1f9b9fdbca41f9cd4fe85e4abbfdc03f27465  netdata-kernel-collector-static-v0.5.2.tar.xz
+dd0f63895305c38669b512f9e95a75057340f04ea999c3ea3540cb18a893dc52  netdata-kernel-collector-static-v0.5.4.tar.xz

packaging/ebpf.version

@@ -1 +1 @@
-v0.5.2
+v0.5.4

web/gui/dashboard_info.js

@@ -1105,13 +1105,13 @@ netdataDashboard.context = {
     },
 
     'apps.file_open': {
-        info: 'Calls to the internal function <code>do_sys_open</code>, which is the common function called from' +
+        info: 'Calls to the internal function <code>do_sys_open</code> ( For kernels newer than <code>5.5.19</code> we add a kprobe to <code>do_sys_openat2</code>. ), which is the common function called from' +
             ' <a href="https://www.man7.org/linux/man-pages/man2/open.2.html" target="_blank">open(2)</a> ' +
             ' and <a href="https://www.man7.org/linux/man-pages/man2/openat.2.html" target="_blank">openat(2)</a>. '
     },
 
     'apps.file_open_error': {
-        info: 'Failed calls to the internal function <code>do_sys_open</code>.'
+        info: 'Failed calls to the internal function <code>do_sys_open</code> ( For kernels newer than <code>5.5.19</code> we add a kprobe to <code>do_sys_openat2</code>. ).'
     },
 
     'apps.file_closed': {
@@ -1152,11 +1152,11 @@ netdataDashboard.context = {
     },
 
     'apps.process_create': {
-        info: 'Calls to the function <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a> to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the process by counting the number of calls to <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that do not have the flag <code>CLONE_THREAD</code> set.'
+        info: 'Calls to either <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the process by counting the number of calls to <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that do not have the flag <code>CLONE_THREAD</code> set.'
     },
 
     'apps.thread_create': {
-        info: 'Calls to the function <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a> to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by counting the number of calls to <a  href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that have the flag <code>CLONE_THREAD</code> set.'
+        info: 'Calls to either <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by counting the number of calls to <a  href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that have the flag <code>CLONE_THREAD</code> set.'
     },
 
     'apps.task_close': {
@@ -3297,7 +3297,7 @@ netdataDashboard.context = {
 
     'ebpf.file_descriptor': {
         title : 'File access',
-        info: 'Calls for internal functions on Linux kernel. The open dimension is attached to the kernel internal function <code>do_sys_open</code>, which is the common function called from'+
+        info: 'Calls for internal functions on Linux kernel. The open dimension is attached to the kernel internal function <code>do_sys_open</code> ( For kernels newer than <code>5.5.19</code> we add a kprobe to <code>do_sys_openat2</code>. ), which is the common function called from'+
             ' <a href="https://www.man7.org/linux/man-pages/man2/open.2.html" target="_blank">open(2)</a> ' +
             ' and <a href="https://www.man7.org/linux/man-pages/man2/openat.2.html" target="_blank">openat(2)</a>. ' +
             ' The close dimension is attached to the function <code>__close_fd</code>, which is called from system call' +
@@ -3306,7 +3306,7 @@ netdataDashboard.context = {
 
     'ebpf.file_error': {
         title : 'File access error',
-        info: 'Failed calls to the kernel internal function <code>do_sys_open</code>, which is the common function called from'+
+        info: 'Failed calls to the kernel internal function <code>do_sys_open</code> ( For kernels newer than <code>5.5.19</code> we add a kprobe to <code>do_sys_openat2</code>. ), which is the common function called from'+
             ' <a href="https://www.man7.org/linux/man-pages/man2/open.2.html" target="_blank">open(2)</a> ' +
             ' and <a href="https://www.man7.org/linux/man-pages/man2/openat.2.html" target="_blank">openat(2)</a>. ' +
             ' The close dimension is attached to the function <code>__close_fd</code>, which is called from system call' +
@@ -3335,7 +3335,7 @@ netdataDashboard.context = {
 
     'ebpf.process_thread': {
         title : 'Task creation',
-        info: 'Number of times that the function <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a> is called to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by couting the number of calls for <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that has the flag <code>CLONE_THREAD</code> set.'
+        info: 'Number of times that either <a href="https://www.ece.uic.edu/~yshi1/linux/lkse/node4.html#SECTION00421000000000000000" target="_blank">do_fork</a>, or <code>kernel_clone</code> if you are running kernel newer than 5.9.16, is called to create a new task, which is the common name used to define process and tasks inside the kernel. Netdata identifies the threads by couting the number of calls for <a href="https://linux.die.net/man/2/clone" target="_blank">sys_clone</a> that has the flag <code>CLONE_THREAD</code> set.'
     },
 
     'ebpf.exit': {