From cee644f3323b1eff913c56923b90f746e95a7660 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Tue, 3 Feb 2026 00:27:28 +0000 Subject: [PATCH 01/34] improve: create macros --- includes/netdata_common.h | 44 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/includes/netdata_common.h b/includes/netdata_common.h index 90554f0e..6bfd10ce 100644 --- a/includes/netdata_common.h +++ b/includes/netdata_common.h @@ -224,5 +224,49 @@ static __always_inline __u32 monitor_apps(void *ctrl_tbl) return 1; } +#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) +#define NETDATA_BPF_MAP_DEF(NAME, TYPE, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ + struct { \ + __uint(type, TYPE); \ + __type(key, KEY_TYPE); \ + __type(value, VALUE_TYPE); \ + __uint(max_entries, MAX_ENTRIES); \ + } NAME SEC(".maps") + +#define NETDATA_BPF_HASH_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ + NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_HASH, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) + +#define NETDATA_BPF_PERCPU_HASH_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ + NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_PERCPU_HASH, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) + +#define NETDATA_BPF_ARRAY_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ + NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_ARRAY, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) + +#define NETDATA_BPF_PERCPU_ARRAY_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ + NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_PERCPU_ARRAY, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) + +#else +#define NETDATA_BPF_MAP_DEF(NAME, TYPE, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ + struct bpf_map_def SEC("maps") NAME = { \ + .type = TYPE, \ + .key_size = sizeof(KEY_TYPE), \ + .value_size = sizeof(VALUE_TYPE), \ + .max_entries = MAX_ENTRIES \ + } + +#define NETDATA_BPF_HASH_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ + NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_HASH, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) + +#define NETDATA_BPF_PERCPU_HASH_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ + NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_PERCPU_HASH, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) + +#define NETDATA_BPF_ARRAY_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ + NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_ARRAY, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) + +#define NETDATA_BPF_PERCPU_ARRAY_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ + NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_PERCPU_ARRAY, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) + +#endif + #endif /* _NETDATA_COMMON_ */ From a1edc2921b78d5c16fc75a24e5409e64219bf14a Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Tue, 3 Feb 2026 01:08:06 +0000 Subject: [PATCH 02/34] improve: Simplify codebase --- kernel/btrfs_kern.c | 66 ++--------------------------- kernel/cachestat_kern.c | 53 ++---------------------- kernel/dc_kern.c | 17 ++------ kernel/disk_kern.c | 61 ++------------------------- kernel/ext4_kern.c | 53 ++---------------------- kernel/fd_kern.c | 49 ++-------------------- kernel/fdatasync_kern.c | 16 +------ kernel/fsync_kern.c | 16 +------ kernel/hardirq_kern.c | 37 +---------------- kernel/mdflush_kern.c | 22 +--------- kernel/mount_kern.c | 16 +------ kernel/msync_kern.c | 19 +-------- kernel/network_viewer_kern.c | 32 +------------- kernel/nfs_kern.c | 17 ++------ kernel/oomkill_kern.c | 20 +-------- kernel/process_kern.c | 49 ++-------------------- kernel/shm_kern.c | 50 ++-------------------- kernel/socket_kern.c | 78 +++-------------------------------- kernel/softirq_kern.c | 17 +------- kernel/swap_kern.c | 50 ++-------------------- kernel/sync_file_range_kern.c | 16 +------ kernel/sync_kern.c | 16 +------ kernel/syncfs_kern.c | 16 +------ kernel/vfs_kern.c | 46 ++------------------- kernel/xfs_kern.c | 51 ++--------------------- kernel/zfs_kern.c | 51 ++--------------------- 26 files changed, 59 insertions(+), 875 deletions(-) diff --git a/kernel/btrfs_kern.c b/kernel/btrfs_kern.c index 3334f124..85ee6501 100644 --- a/kernel/btrfs_kern.c +++ b/kernel/btrfs_kern.c @@ -25,68 +25,10 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_FS_MAX_ELEMENTS); -} tbl_btrfs SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_HASH); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, 1); -} tbl_ext_addr SEC(".maps"); - -struct { -#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0)) - __uint(type, BPF_MAP_TYPE_HASH); -#else - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); -#endif - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, 4192); -} tmp_btrfs SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} btrfs_ctrl SEC(".maps"); -#else - -struct bpf_map_def SEC("maps") tbl_btrfs = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_FS_MAX_ELEMENTS -}; - -struct bpf_map_def SEC("maps") tbl_ext_addr = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = 1 -}; - -struct bpf_map_def SEC("maps") tmp_btrfs = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = 4192 -}; - -struct bpf_map_def SEC("maps") btrfs_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; -#endif +NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_btrfs, __u32, __u64, NETDATA_FS_MAX_ELEMENTS); +NETDATA_BPF_HASH_DEF(tbl_ext_addr, __u32, __u64, 1); +NETDATA_BPF_HASH_DEF(tmp_btrfs, __u32, __u64, 4192); +NETDATA_BPF_ARRAY_DEF(btrfs_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ * diff --git a/kernel/cachestat_kern.c b/kernel/cachestat_kern.c index 861d2e4a..c9c7c3ca 100644 --- a/kernel/cachestat_kern.c +++ b/kernel/cachestat_kern.c @@ -13,56 +13,9 @@ #include #include "netdata_ebpf.h" -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CACHESTAT_END); -} cstat_global SEC(".maps"); - -struct { -#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0)) - __uint(type, BPF_MAP_TYPE_HASH); -#else - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); -#endif - __type(key, __u32); - __type(value, netdata_cachestat_t); - __uint(max_entries, PID_MAX_DEFAULT); -} cstat_pid SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} cstat_ctrl SEC(".maps"); - -#else - -struct bpf_map_def SEC("maps") cstat_global = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CACHESTAT_END -}; - -struct bpf_map_def SEC("maps") cstat_pid = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(__u32), - .value_size = sizeof(netdata_cachestat_t), - .max_entries = PID_MAX_DEFAULT -}; - -struct bpf_map_def SEC("maps") cstat_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; - -#endif +NETDATA_BPF_PERCPU_ARRAY_DEF(cstat_global, __u32, __u64, NETDATA_CACHESTAT_END); +NETDATA_BPF_HASH_DEF(cstat_pid, __u32, netdata_cachestat_t, PID_MAX_DEFAULT); +NETDATA_BPF_ARRAY_DEF(cstat_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ * diff --git a/kernel/dc_kern.c b/kernel/dc_kern.c index d76b4683..d027bac8 100644 --- a/kernel/dc_kern.c +++ b/kernel/dc_kern.c @@ -15,20 +15,9 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_DIRECTORY_CACHE_END); -} dcstat_global SEC(".maps"); - -struct { -#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0)) - __uint(type, BPF_MAP_TYPE_HASH); -#else - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); -#endif +NETDATA_BPF_PERCPU_ARRAY_DEF(dcstat_global, __u32, __u64, NETDATA_DIRECTORY_CACHE_END); +NETDATA_BPF_HASH_DEF(dcstat_pid, __u32, netdata_dc_stat_t, PID_MAX_DEFAULT); +NETDATA_BPF_PERCPU_ARRAY_DEF(dcstat_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); __type(key, __u32); __type(value, netdata_dc_stat_t); __uint(max_entries, PID_MAX_DEFAULT); diff --git a/kernel/disk_kern.c b/kernel/disk_kern.c index c09fb941..bdcf81b8 100644 --- a/kernel/disk_kern.c +++ b/kernel/disk_kern.c @@ -23,64 +23,9 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -//Hardware -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); - __type(key, block_key_t); - __type(value, __u64); - __uint(max_entries, NETDATA_DISK_HISTOGRAM_LENGTH); -} tbl_disk_iocall SEC(".maps"); - -// Temporary use only -struct { -#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0)) - __uint(type, BPF_MAP_TYPE_HASH); -#else - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); -#endif - __type(key, netdata_disk_key_t); - __type(value, __u64); - __uint(max_entries, 8192); -} tmp_disk_tp_stat SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} disk_ctrl SEC(".maps"); - -#else - -//Hardware -struct bpf_map_def SEC("maps") tbl_disk_iocall = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(block_key_t), - .value_size = sizeof(__u64), - .max_entries = NETDATA_DISK_HISTOGRAM_LENGTH -}; - -// Temporary use only -struct bpf_map_def SEC("maps") tmp_disk_tp_stat = { -#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0)) - .type = BPF_MAP_TYPE_HASH, -#else - .type = BPF_MAP_TYPE_PERCPU_HASH, -#endif - .key_size = sizeof(netdata_disk_key_t), - .value_size = sizeof(__u64), - .max_entries = 8192 -}; - -struct bpf_map_def SEC("maps") disk_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; - -#endif +NETDATA_BPF_PERCPU_HASH_DEF(tbl_disk_iocall, block_key_t, __u64, NETDATA_DISK_HISTOGRAM_LENGTH); +NETDATA_BPF_HASH_DEF(tmp_disk_tp_stat, netdata_disk_key_t, __u64, 8192); +NETDATA_BPF_ARRAY_DEF(disk_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ * diff --git a/kernel/ext4_kern.c b/kernel/ext4_kern.c index 5dd0758a..abd1d22d 100644 --- a/kernel/ext4_kern.c +++ b/kernel/ext4_kern.c @@ -19,56 +19,9 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_FS_MAX_ELEMENTS); -} tbl_ext4 SEC(".maps"); - -struct { -#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0)) - __uint(type, BPF_MAP_TYPE_HASH); -#else - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); -#endif - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, 4192); -} tmp_ext4 SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} ext4_ctrl SEC(".maps"); - -#else - -struct bpf_map_def SEC("maps") tbl_ext4 = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_FS_MAX_ELEMENTS -}; - -struct bpf_map_def SEC("maps") tmp_ext4 = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = 4192 -}; - -struct bpf_map_def SEC("maps") ext4_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; - -#endif +NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_ext4, __u32, __u64, NETDATA_FS_MAX_ELEMENTS); +NETDATA_BPF_HASH_DEF(tmp_ext4, __u32, __u64, 4192); +NETDATA_BPF_ARRAY_DEF(ext4_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ * diff --git a/kernel/fd_kern.c b/kernel/fd_kern.c index a347110c..bcb44f11 100644 --- a/kernel/fd_kern.c +++ b/kernel/fd_kern.c @@ -23,52 +23,9 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_HASH); - __type(key, __u32); - __type(value, struct netdata_fd_stat_t); - __uint(max_entries, PID_MAX_DEFAULT); -} tbl_fd_pid SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_FD_COUNTER); -} tbl_fd_global SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} fd_ctrl SEC(".maps"); - -#else - -struct bpf_map_def SEC("maps") tbl_fd_pid = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(__u32), - .value_size = sizeof(struct netdata_fd_stat_t), - .max_entries = PID_MAX_DEFAULT -}; - -struct bpf_map_def SEC("maps") tbl_fd_global = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_FD_COUNTER -}; - -struct bpf_map_def SEC("maps") fd_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; - -#endif +NETDATA_BPF_HASH_DEF(tbl_fd_pid, __u32, struct netdata_fd_stat_t, PID_MAX_DEFAULT); +NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_fd_global, __u32, __u64, NETDATA_FD_COUNTER); +NETDATA_BPF_ARRAY_DEF(fd_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ * diff --git a/kernel/fdatasync_kern.c b/kernel/fdatasync_kern.c index 59f918c2..b970ba33 100644 --- a/kernel/fdatasync_kern.c +++ b/kernel/fdatasync_kern.c @@ -15,21 +15,7 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_SYNC_END); -} tbl_fdatasync SEC(".maps"); -#else -struct bpf_map_def SEC("maps") tbl_fdatasync = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_SYNC_END -}; -#endif +NETDATA_BPF_ARRAY_DEF(tbl_fdatasync, __u32, __u64, NETDATA_SYNC_END); /************************************************************************************ * diff --git a/kernel/fsync_kern.c b/kernel/fsync_kern.c index 4b2beb8d..cc5c0046 100644 --- a/kernel/fsync_kern.c +++ b/kernel/fsync_kern.c @@ -15,21 +15,7 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_SYNC_END); -} tbl_fsync SEC(".maps"); -#else -struct bpf_map_def SEC("maps") tbl_fsync = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_SYNC_END -}; -#endif +NETDATA_BPF_ARRAY_DEF(tbl_fsync, __u32, __u64, NETDATA_SYNC_END); /************************************************************************************ * diff --git a/kernel/hardirq_kern.c b/kernel/hardirq_kern.c index 1a4e6f26..8c97f780 100644 --- a/kernel/hardirq_kern.c +++ b/kernel/hardirq_kern.c @@ -15,41 +15,8 @@ * MAPS ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { -#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0)) - __uint(type, BPF_MAP_TYPE_HASH); -#else - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); -#endif - __type(key, hardirq_key_t); - __type(value, hardirq_val_t); - __uint(max_entries, NETDATA_HARDIRQ_MAX_IRQS); -} tbl_hardirq SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, hardirq_val_t); - __uint(max_entries, NETDATA_HARDIRQ_STATIC_END); -} tbl_hardirq_static SEC(".maps"); - -#else -struct bpf_map_def SEC("maps") tbl_hardirq = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(hardirq_key_t), - .value_size = sizeof(hardirq_val_t), - .max_entries = NETDATA_HARDIRQ_MAX_IRQS -}; - -// maps from enum index to latency. -struct bpf_map_def SEC("maps") tbl_hardirq_static = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(hardirq_val_t), - .max_entries = NETDATA_HARDIRQ_STATIC_END -}; -#endif +NETDATA_BPF_HASH_DEF(tbl_hardirq, hardirq_key_t, hardirq_val_t, NETDATA_HARDIRQ_MAX_IRQS); +NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_hardirq_static, __u32, hardirq_val_t, NETDATA_HARDIRQ_STATIC_END); /************************************************************************************ * HARDIRQ SECTION diff --git a/kernel/mdflush_kern.c b/kernel/mdflush_kern.c index 44d6de16..05133038 100644 --- a/kernel/mdflush_kern.c +++ b/kernel/mdflush_kern.c @@ -12,27 +12,7 @@ #include "bpf_helpers.h" #include "netdata_ebpf.h" -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { -#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0)) - __uint(type, BPF_MAP_TYPE_HASH); -#else - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); -#endif - __type(key, mdflush_key_t); - __type(value, mdflush_val_t); - __uint(max_entries, 1024); -} tbl_mdflush SEC(".maps"); - -#else - -struct bpf_map_def SEC("maps") tbl_mdflush = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(mdflush_key_t), - .value_size = sizeof(mdflush_val_t), - .max_entries = 1024 -}; -#endif +NETDATA_BPF_HASH_DEF(tbl_mdflush, mdflush_key_t, mdflush_val_t, 1024); SEC("kprobe/md_flush_request") int netdata_md_flush_request(struct pt_regs *ctx) diff --git a/kernel/mount_kern.c b/kernel/mount_kern.c index 1f938051..8d740571 100644 --- a/kernel/mount_kern.c +++ b/kernel/mount_kern.c @@ -15,21 +15,7 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_MOUNT_END); -} tbl_mount SEC(".maps"); -#else -struct bpf_map_def SEC("maps") tbl_mount = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_MOUNT_END -}; -#endif +NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_mount, __u32, __u64, NETDATA_MOUNT_END); /************************************************************************************ * diff --git a/kernel/msync_kern.c b/kernel/msync_kern.c index c4e2b46d..da549891 100644 --- a/kernel/msync_kern.c +++ b/kernel/msync_kern.c @@ -15,24 +15,7 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_SYNC_END); -} tbl_msync SEC(".maps"); - -#else - -struct bpf_map_def SEC("maps") tbl_msync = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_SYNC_END -}; - -#endif +NETDATA_BPF_ARRAY_DEF(tbl_msync, __u32, __u64, NETDATA_SYNC_END); /************************************************************************************ * diff --git a/kernel/network_viewer_kern.c b/kernel/network_viewer_kern.c index 59f8a86b..763e4246 100644 --- a/kernel/network_viewer_kern.c +++ b/kernel/network_viewer_kern.c @@ -25,36 +25,8 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_HASH); - __type(key, netdata_nv_idx_t); - __type(value, netdata_nv_data_t); - __uint(max_entries, PID_MAX_DEFAULT); -} tbl_nv_socket SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} nv_ctrl SEC(".maps"); - -#else -struct bpf_map_def SEC("maps") tbl_nv_socket = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(netdata_nv_idx_t), - .value_size = sizeof(netdata_nv_data_t), - .max_entries = PID_MAX_DEFAULT, -}; - -struct bpf_map_def SEC("maps") nv_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; -#endif +NETDATA_BPF_HASH_DEF(tbl_nv_socket, netdata_nv_idx_t, netdata_nv_data_t, PID_MAX_DEFAULT); +NETDATA_BPF_ARRAY_DEF(nv_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ * diff --git a/kernel/nfs_kern.c b/kernel/nfs_kern.c index 1f9e2d21..1aa18aef 100644 --- a/kernel/nfs_kern.c +++ b/kernel/nfs_kern.c @@ -19,20 +19,9 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_FS_MAX_ELEMENTS); -} tbl_nfs SEC(".maps"); - -struct { -#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0)) - __uint(type, BPF_MAP_TYPE_HASH); -#else - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); -#endif +NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_nfs, __u32, __u64, NETDATA_FS_MAX_ELEMENTS); +NETDATA_BPF_HASH_DEF(tmp_nfs, __u32, __u64, 4192); +NETDATA_BPF_ARRAY_DEF(nfs_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); __type(key, __u32); __type(value, __u64); __uint(max_entries, 4192); diff --git a/kernel/oomkill_kern.c b/kernel/oomkill_kern.c index 7026f242..61b6d8c2 100644 --- a/kernel/oomkill_kern.c +++ b/kernel/oomkill_kern.c @@ -12,25 +12,7 @@ #include "bpf_helpers.h" #include "netdata_ebpf.h" -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { -#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0)) - __uint(type, BPF_MAP_TYPE_HASH); -#else - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); -#endif - __type(key, int); - __type(value, __u8); - __uint(max_entries, NETDATA_OOMKILL_MAX_ENTRIES); -} tbl_oomkill SEC(".maps"); -#else -struct bpf_map_def SEC("maps") tbl_oomkill = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(int), - .value_size = sizeof(__u8), - .max_entries = NETDATA_OOMKILL_MAX_ENTRIES -}; -#endif +NETDATA_BPF_HASH_DEF(tbl_oomkill, int, __u8, NETDATA_OOMKILL_MAX_ENTRIES); SEC("tracepoint/oom/mark_victim") int netdata_oom_mark_victim(struct netdata_oom_mark_victim_entry *ptr) { diff --git a/kernel/process_kern.c b/kernel/process_kern.c index 3db8a7db..2e65c67a 100644 --- a/kernel/process_kern.c +++ b/kernel/process_kern.c @@ -22,52 +22,9 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_HASH); - __type(key, __u32); - __type(value, struct netdata_pid_stat_t); - __uint(max_entries, PID_MAX_DEFAULT); -} tbl_pid_stats SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_GLOBAL_COUNTER); -} tbl_total_stats SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} process_ctrl SEC(".maps"); - -#else - -struct bpf_map_def SEC("maps") tbl_pid_stats = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(__u32), - .value_size = sizeof(struct netdata_pid_stat_t), - .max_entries = PID_MAX_DEFAULT -}; - -struct bpf_map_def SEC("maps") tbl_total_stats = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_GLOBAL_COUNTER -}; - -struct bpf_map_def SEC("maps") process_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; - -#endif +NETDATA_BPF_HASH_DEF(tbl_pid_stats, __u32, struct netdata_pid_stat_t, PID_MAX_DEFAULT); +NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_total_stats, __u32, __u64, NETDATA_GLOBAL_COUNTER); +NETDATA_BPF_ARRAY_DEF(process_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ * diff --git a/kernel/shm_kern.c b/kernel/shm_kern.c index 7e684f5a..367713ac 100644 --- a/kernel/shm_kern.c +++ b/kernel/shm_kern.c @@ -11,53 +11,9 @@ #include "bpf_helpers.h" #include "netdata_ebpf.h" -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_SHM_END); -} tbl_shm SEC(".maps"); - -struct { -#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0)) - __uint(type, BPF_MAP_TYPE_HASH); -#else - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); -#endif - __type(key, __u32); - __type(value, netdata_shm_t); - __uint(max_entries, PID_MAX_DEFAULT); -} tbl_pid_shm SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} shm_ctrl SEC(".maps"); -#else -struct bpf_map_def SEC("maps") tbl_shm = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_SHM_END -}; - -struct bpf_map_def SEC("maps") tbl_pid_shm = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(__u32), - .value_size = sizeof(netdata_shm_t), - .max_entries = PID_MAX_DEFAULT -}; - -struct bpf_map_def SEC("maps") shm_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; -#endif +NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_shm, __u32, __u64, NETDATA_SHM_END); +NETDATA_BPF_HASH_DEF(tbl_pid_shm, __u32, netdata_shm_t, PID_MAX_DEFAULT); +NETDATA_BPF_ARRAY_DEF(shm_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); #if defined(LIBBPF_MAJOR_VERSION) && (LIBBPF_MAJOR_VERSION >= 1) SEC("ksyscall/shmget") diff --git a/kernel/socket_kern.c b/kernel/socket_kern.c index 9f5bb435..9e112312 100644 --- a/kernel/socket_kern.c +++ b/kernel/socket_kern.c @@ -25,79 +25,11 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_SOCKET_COUNTER); -} tbl_global_sock SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); - __type(key, netdata_socket_idx_t); - __type(value, netdata_socket_t); - __uint(max_entries, PID_MAX_DEFAULT); -} tbl_nd_socket SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); - __type(key, __u64); - __type(value, void *); - __uint(max_entries, 4096); -} tbl_nv_udp SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_HASH); - __type(key, netdata_passive_connection_idx_t); - __type(value, netdata_passive_connection_t); - __uint(max_entries, 1024); -} tbl_lports SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} socket_ctrl SEC(".maps"); - -#else -struct bpf_map_def SEC("maps") tbl_global_sock = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_SOCKET_COUNTER -}; - -struct bpf_map_def SEC("maps") tbl_nd_socket = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(netdata_socket_idx_t), - .value_size = sizeof(netdata_socket_t), - .max_entries = PID_MAX_DEFAULT, -}; - -struct bpf_map_def SEC("maps") tbl_nv_udp = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(__u64), - .value_size = sizeof(void *), - .max_entries = 4096 -}; - -struct bpf_map_def SEC("maps") tbl_lports = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(netdata_passive_connection_idx_t), - .value_size = sizeof(netdata_passive_connection_t), - .max_entries = 1024 -}; - -struct bpf_map_def SEC("maps") socket_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; - -#endif +NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_global_sock, __u32, __u64, NETDATA_SOCKET_COUNTER); +NETDATA_BPF_PERCPU_HASH_DEF(tbl_nd_socket, netdata_socket_idx_t, netdata_socket_t, PID_MAX_DEFAULT); +NETDATA_BPF_PERCPU_HASH_DEF(tbl_nv_udp, __u64, void *, 4096); +NETDATA_BPF_HASH_DEF(tbl_lports, netdata_passive_connection_idx_t, netdata_passive_connection_t, 1024); +NETDATA_BPF_ARRAY_DEF(socket_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ * diff --git a/kernel/softirq_kern.c b/kernel/softirq_kern.c index 6c27ee11..f73d0418 100644 --- a/kernel/softirq_kern.c +++ b/kernel/softirq_kern.c @@ -14,22 +14,7 @@ * MAPS ***********************************************************************************/ -// maps from irq index to latency. -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, softirq_val_t); - __uint(max_entries, NETDATA_SOFTIRQ_MAX_IRQS); -} tbl_softirq SEC(".maps"); -#else -struct bpf_map_def SEC("maps") tbl_softirq = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(softirq_val_t), - .max_entries = NETDATA_SOFTIRQ_MAX_IRQS -}; -#endif +NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_softirq, __u32, softirq_val_t, NETDATA_SOFTIRQ_MAX_IRQS); /************************************************************************************ * SOFTIRQ SECTION diff --git a/kernel/swap_kern.c b/kernel/swap_kern.c index 82c73ba4..464917ea 100644 --- a/kernel/swap_kern.c +++ b/kernel/swap_kern.c @@ -17,53 +17,9 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_SWAP_END); -} tbl_swap SEC(".maps"); - -struct { -#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0)) - __uint(type, BPF_MAP_TYPE_HASH); -#else - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); -#endif - __type(key, __u32); - __type(value, netdata_swap_access_t); - __uint(max_entries, PID_MAX_DEFAULT); -} tbl_pid_swap SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} swap_ctrl SEC(".maps"); -#else -struct bpf_map_def SEC("maps") tbl_swap = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_SWAP_END -}; - -struct bpf_map_def SEC("maps") tbl_pid_swap = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(__u32), - .value_size = sizeof(netdata_swap_access_t), - .max_entries = PID_MAX_DEFAULT -}; - -struct bpf_map_def SEC("maps") swap_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; -#endif +NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_swap, __u32, __u64, NETDATA_SWAP_END); +NETDATA_BPF_HASH_DEF(tbl_pid_swap, __u32, netdata_swap_access_t, PID_MAX_DEFAULT); +NETDATA_BPF_ARRAY_DEF(swap_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ * diff --git a/kernel/sync_file_range_kern.c b/kernel/sync_file_range_kern.c index 67c4498e..08f191cd 100644 --- a/kernel/sync_file_range_kern.c +++ b/kernel/sync_file_range_kern.c @@ -15,21 +15,7 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_SYNC_END); -} tbl_syncfr SEC(".maps"); -#else -struct bpf_map_def SEC("maps") tbl_syncfr = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_SYNC_END -}; -#endif +NETDATA_BPF_ARRAY_DEF(tbl_syncfr, __u32, __u64, NETDATA_SYNC_END); /************************************************************************************ * diff --git a/kernel/sync_kern.c b/kernel/sync_kern.c index 99ea5937..b20d875a 100644 --- a/kernel/sync_kern.c +++ b/kernel/sync_kern.c @@ -15,21 +15,7 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_SYNC_END); -} tbl_sync SEC(".maps"); -#else -struct bpf_map_def SEC("maps") tbl_sync = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_SYNC_END -}; -#endif +NETDATA_BPF_ARRAY_DEF(tbl_sync, __u32, __u64, NETDATA_SYNC_END); /************************************************************************************ * diff --git a/kernel/syncfs_kern.c b/kernel/syncfs_kern.c index a32259d1..3aadbcef 100644 --- a/kernel/syncfs_kern.c +++ b/kernel/syncfs_kern.c @@ -15,21 +15,7 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_SYNC_END); -} tbl_syncfs SEC(".maps"); -#else -struct bpf_map_def SEC("maps") tbl_syncfs = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_SYNC_END -}; -#endif +NETDATA_BPF_ARRAY_DEF(tbl_syncfs, __u32, __u64, NETDATA_SYNC_END); /************************************************************************************ * diff --git a/kernel/vfs_kern.c b/kernel/vfs_kern.c index f9421514..193f7669 100644 --- a/kernel/vfs_kern.c +++ b/kernel/vfs_kern.c @@ -23,49 +23,9 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_HASH); - __type(key, __u32); - __type(value, struct netdata_vfs_stat_t); - __uint(max_entries, PID_MAX_DEFAULT); -} tbl_vfs_pid SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_VFS_COUNTER); -} tbl_vfs_stats SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} vfs_ctrl SEC(".maps"); -#else -struct bpf_map_def SEC("maps") tbl_vfs_pid = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(__u32), - .value_size = sizeof(struct netdata_vfs_stat_t), - .max_entries = PID_MAX_DEFAULT -}; - -struct bpf_map_def SEC("maps") tbl_vfs_stats = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_VFS_COUNTER -}; - -struct bpf_map_def SEC("maps") vfs_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; -#endif +NETDATA_BPF_HASH_DEF(tbl_vfs_pid, __u32, struct netdata_vfs_stat_t, PID_MAX_DEFAULT); +NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_vfs_stats, __u32, __u64, NETDATA_VFS_COUNTER); +NETDATA_BPF_ARRAY_DEF(vfs_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ * diff --git a/kernel/xfs_kern.c b/kernel/xfs_kern.c index e227f342..1328dede 100644 --- a/kernel/xfs_kern.c +++ b/kernel/xfs_kern.c @@ -20,54 +20,9 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_FS_MAX_ELEMENTS); -} tbl_xfs SEC(".maps"); - -struct { -#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0)) - __uint(type, BPF_MAP_TYPE_HASH); -#else - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); -#endif - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, 4192); -} tmp_xfs SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} xfs_ctrl SEC(".maps"); - -#else -struct bpf_map_def SEC("maps") tbl_xfs = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_FS_MAX_ELEMENTS -}; - -struct bpf_map_def SEC("maps") tmp_xfs = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = 4192 -}; - -struct bpf_map_def SEC("maps") xfs_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; -#endif +NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_xfs, __u32, __u64, NETDATA_FS_MAX_ELEMENTS); +NETDATA_BPF_HASH_DEF(tmp_xfs, __u32, __u64, 4192); +NETDATA_BPF_ARRAY_DEF(xfs_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ * diff --git a/kernel/zfs_kern.c b/kernel/zfs_kern.c index efefb782..33ae85f2 100644 --- a/kernel/zfs_kern.c +++ b/kernel/zfs_kern.c @@ -19,54 +19,9 @@ * ***********************************************************************************/ -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_FS_MAX_ELEMENTS); -} tbl_zfs SEC(".maps"); - -struct { -#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,15,0)) - __uint(type, BPF_MAP_TYPE_HASH); -#else - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); -#endif - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, 4192); -} tmp_zfs SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} zfs_ctrl SEC(".maps"); - -#else -struct bpf_map_def SEC("maps") tbl_zfs = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_FS_MAX_ELEMENTS -}; - -struct bpf_map_def SEC("maps") tmp_zfs = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = 4192 -}; - -struct bpf_map_def SEC("maps") zfs_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; -#endif +NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_zfs, __u32, __u64, NETDATA_FS_MAX_ELEMENTS); +NETDATA_BPF_HASH_DEF(tmp_zfs, __u32, __u64, 4192); +NETDATA_BPF_ARRAY_DEF(zfs_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ * From 95560ec2baba9ceca703346ad01bae5cd8833587 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Tue, 3 Feb 2026 16:23:43 +0000 Subject: [PATCH 03/34] improve: Fixes --- kernel/dc_kern.c | 36 ------------------------------------ kernel/nfs_kern.c | 36 ------------------------------------ 2 files changed, 72 deletions(-) diff --git a/kernel/dc_kern.c b/kernel/dc_kern.c index d027bac8..33d4b442 100644 --- a/kernel/dc_kern.c +++ b/kernel/dc_kern.c @@ -18,42 +18,6 @@ NETDATA_BPF_PERCPU_ARRAY_DEF(dcstat_global, __u32, __u64, NETDATA_DIRECTORY_CACHE_END); NETDATA_BPF_HASH_DEF(dcstat_pid, __u32, netdata_dc_stat_t, PID_MAX_DEFAULT); NETDATA_BPF_PERCPU_ARRAY_DEF(dcstat_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); - __type(key, __u32); - __type(value, netdata_dc_stat_t); - __uint(max_entries, PID_MAX_DEFAULT); -} dcstat_pid SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} dcstat_ctrl SEC(".maps"); - -#else - -struct bpf_map_def SEC("maps") dcstat_global = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_DIRECTORY_CACHE_END -}; - -struct bpf_map_def SEC("maps") dcstat_pid = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(__u32), - .value_size = sizeof(netdata_dc_stat_t), - .max_entries = PID_MAX_DEFAULT -}; - -struct bpf_map_def SEC("maps") dcstat_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; - -#endif /************************************************************************************ * diff --git a/kernel/nfs_kern.c b/kernel/nfs_kern.c index 1aa18aef..1114ece1 100644 --- a/kernel/nfs_kern.c +++ b/kernel/nfs_kern.c @@ -22,42 +22,6 @@ NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_nfs, __u32, __u64, NETDATA_FS_MAX_ELEMENTS); NETDATA_BPF_HASH_DEF(tmp_nfs, __u32, __u64, 4192); NETDATA_BPF_ARRAY_DEF(nfs_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, 4192); -} tmp_nfs SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_ARRAY); - __type(key, __u32); - __type(value, __u64); - __uint(max_entries, NETDATA_CONTROLLER_END); -} nfs_ctrl SEC(".maps"); - -#else - -struct bpf_map_def SEC("maps") tbl_nfs = { - .type = BPF_MAP_TYPE_PERCPU_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_FS_MAX_ELEMENTS -}; - -struct bpf_map_def SEC("maps") tmp_nfs = { - .type = BPF_MAP_TYPE_HASH, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = 4192 -}; - -struct bpf_map_def SEC("maps") nfs_ctrl = { - .type = BPF_MAP_TYPE_ARRAY, - .key_size = sizeof(__u32), - .value_size = sizeof(__u64), - .max_entries = NETDATA_CONTROLLER_END -}; - -#endif /************************************************************************************ * From 73d35ae5a75d4101b73fc9b66106ce17a60c15b5 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Tue, 3 Feb 2026 19:56:07 +0000 Subject: [PATCH 04/34] improve: Fixes (p2) --- includes/netdata_common.h | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/includes/netdata_common.h b/includes/netdata_common.h index 6bfd10ce..717b6894 100644 --- a/includes/netdata_common.h +++ b/includes/netdata_common.h @@ -233,6 +233,7 @@ static __always_inline __u32 monitor_apps(void *ctrl_tbl) __uint(max_entries, MAX_ENTRIES); \ } NAME SEC(".maps") +#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,12,0)) #define NETDATA_BPF_HASH_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_HASH, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) @@ -244,6 +245,19 @@ static __always_inline __u32 monitor_apps(void *ctrl_tbl) #define NETDATA_BPF_PERCPU_ARRAY_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_PERCPU_ARRAY, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) +#else +#define NETDATA_BPF_HASH_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ + NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_HASH, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) + +#define NETDATA_BPF_PERCPU_HASH_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ + NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_HASH, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) + +#define NETDATA_BPF_ARRAY_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ + NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_ARRAY, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) + +#define NETDATA_BPF_PERCPU_ARRAY_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ + NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_ARRAY, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) +#endif #else #define NETDATA_BPF_MAP_DEF(NAME, TYPE, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ @@ -258,13 +272,13 @@ static __always_inline __u32 monitor_apps(void *ctrl_tbl) NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_HASH, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) #define NETDATA_BPF_PERCPU_HASH_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ - NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_PERCPU_HASH, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) + NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_HASH, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) #define NETDATA_BPF_ARRAY_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_ARRAY, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) #define NETDATA_BPF_PERCPU_ARRAY_DEF(NAME, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) \ - NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_PERCPU_ARRAY, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) + NETDATA_BPF_MAP_DEF(NAME, BPF_MAP_TYPE_ARRAY, KEY_TYPE, VALUE_TYPE, MAX_ENTRIES) #endif From 00efe58a7d4aebd538dca00438b930aa21743bb6 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Tue, 3 Feb 2026 20:29:40 +0000 Subject: [PATCH 05/34] improve: Fixes (p3) --- kernel/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/Makefile b/kernel/Makefile index 8450e2f5..fdaaf1cd 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -6,6 +6,7 @@ LIBBPF_HEADERS = ../.local_libbpf ARCH := $(shell uname -m | sed 's/x86_64/x86/') EXTRA_CFLAGS += -fno-stack-protector +EXTRA_CFLAGS += -DCONFIG_CC_HAS_ASM_INLINE=0 LINUXINCLUDE += -I$(KERNELSOURCE)/arch/$(ARCH)/include/generated LINUXINCLUDE += -I$(KERNELSOURCE)/arch/$(ARCH)/include/generated/uapi @@ -114,7 +115,6 @@ libbpf: cd $(LIBBPF)/src && /bin/bash ../../.dockerfiles/change_libbpf.sh $(VER_MAJOR) $(VER_MINOR) && $(MAKE) CC=$(CC_LIBBPF) CFLAGS="-fPIE" BUILD_STATIC_ONLY=1 DESTDIR=../../.local_libbpf INCLUDEDIR= LIBDIR= UAPIDIR= install \ %_kern.o: %_kern.c libbpf - if [ -w $(KERNELSOURCE)/include/generated/autoconf.h ]; then if [ "$(CURRENT_KERNEL)" -ge 328448 ]; then sed -i -e 's/\(#define CONFIG_CC_HAS_ASM_INLINE 1\)/\/\/\1/' $(KERNELSOURCE)/include/generated/autoconf.h; fi ; fi $(CLANG) $(EXTRA_CFLAGS) -S -nostdinc $(LINUXINCLUDE) $(LLVM_INCLUDES) \ -D__KERNEL__ -D__ASM_SYSREG_H -Wno-unused-value -Wno-pointer-sign \ -Wno-compare-distinct-pointer-types \ From 930a3c80d71b48a05d727d5e86963a57661dd4c2 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Tue, 3 Feb 2026 21:07:40 +0000 Subject: [PATCH 06/34] improve: Cleanup warnings --- kernel/Makefile | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/kernel/Makefile b/kernel/Makefile index fdaaf1cd..720f1545 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -120,24 +120,30 @@ libbpf: -Wno-compare-distinct-pointer-types \ -Wno-gnu-variable-sized-type-not-at-end \ -Wno-tautological-compare \ - -fno-asynchronous-unwind-tables \ + -Wno-duplicate-decl-specifier \ + -Wno-address-of-packed-member \ + -Wno-macro-redefined \ + -fno-asynchronous-unwind-tables \ -DNETDATASEL=0 \ -D__BPF_TRACING__ \ -D__TARGET_ARCH_$(ARCH) \ -include ../includes/netdata_asm_goto.h \ - -O2 -g -emit-llvm -c $< + -O2 -g -emit-llvm $< -o $(<:.c=.ll) $(LLC) -march=bpf -filetype=obj -o r$@ $(<:.c=.ll) $(CLANG) $(EXTRA_CFLAGS) -S -nostdinc $(LINUXINCLUDE) $(LLVM_INCLUDES) \ -D__KERNEL__ -D__ASM_SYSREG_H -Wno-unused-value -Wno-pointer-sign \ - -Wno-compare-distinct-pointer-types \ - -Wno-gnu-variable-sized-type-not-at-end \ - -Wno-tautological-compare \ - -fno-asynchronous-unwind-tables \ + -Wno-compare-distinct-pointer-types \ + -Wno-gnu-variable-sized-type-not-at-end \ + -Wno-tautological-compare \ + -Wno-duplicate-decl-specifier \ + -Wno-address-of-packed-member \ + -Wno-macro-redefined \ + -fno-asynchronous-unwind-tables \ -DNETDATASEL=2 \ -D__BPF_TRACING__ \ -D__TARGET_ARCH_$(ARCH) \ -include ../includes/netdata_asm_goto.h \ - -O2 -g -emit-llvm -c $< + -O2 -g -emit-llvm $< -o $(<:.c=.ll) $(LLC) -march=bpf -filetype=obj -o p$@ $(<:.c=.ll) /bin/bash rename_binaries.sh "$(VER_MAJOR)" "$(VER_MINOR)" "$@" From 903866ddc9dfa607f71c2fc48c910e9f3aa5a6c4 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Tue, 3 Feb 2026 22:33:33 +0000 Subject: [PATCH 07/34] improve: Cachestat --- kernel/cachestat_kern.c | 165 ++++++++++++++++------------------------ 1 file changed, 64 insertions(+), 101 deletions(-) diff --git a/kernel/cachestat_kern.c b/kernel/cachestat_kern.c index c9c7c3ca..fa3fcbfd 100644 --- a/kernel/cachestat_kern.c +++ b/kernel/cachestat_kern.c @@ -17,6 +17,35 @@ NETDATA_BPF_PERCPU_ARRAY_DEF(cstat_global, __u32, __u64, NETDATA_CACHESTAT_END); NETDATA_BPF_HASH_DEF(cstat_pid, __u32, netdata_cachestat_t, PID_MAX_DEFAULT); NETDATA_BPF_ARRAY_DEF(cstat_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); +static __always_inline void netdata_cachestat_update_existing(__u32 global_key, __u32 *field) +{ + libnetdata_update_global(&cstat_global, global_key, 1); + if (field) + libnetdata_update_u32(field, 1); +} + +static __always_inline void netdata_cachestat_create_new_entry(__u32 global_key, __u32 *field, __u32 tgid) +{ + netdata_cachestat_t data = {}; + + data.ct = bpf_ktime_get_ns(); + libnetdata_update_uid_gid(&data.uid, &data.gid); + data.tgid = tgid; + +#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) + bpf_get_current_comm(&data.name, TASK_COMM_LEN); +#else + data.name[0] = '\0'; +#endif + + __u32 key = 0; + if (field) + *field = 1; + bpf_map_update_elem(&cstat_pid, &key, &data, BPF_ANY); + + libnetdata_update_global(&cstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); +} + /************************************************************************************ * * Probe Section @@ -26,80 +55,50 @@ NETDATA_BPF_ARRAY_DEF(cstat_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); SEC("kprobe/add_to_page_cache_lru") int netdata_add_to_page_cache_lru(struct pt_regs* ctx) { - netdata_cachestat_t *fill, data = {}; - libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_ADD_TO_PAGE_CACHE_LRU, 1); + if (!monitor_apps(&cstat_ctrl)) + return 0; + netdata_cachestat_t *fill, data = {}; __u32 key = 0; __u32 tgid = 0; - if (!monitor_apps(&cstat_ctrl)) - return 0; fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid); if (fill) { - libnetdata_update_u32(&fill->add_to_page_cache_lru, 1); - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - - data.add_to_page_cache_lru = 1; - bpf_map_update_elem(&cstat_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&cstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); + netdata_cachestat_update_existing(NETDATA_KEY_CALLS_ADD_TO_PAGE_CACHE_LRU, &fill->add_to_page_cache_lru); + return 0; } + netdata_cachestat_create_new_entry(NETDATA_KEY_CALLS_ADD_TO_PAGE_CACHE_LRU, &data.add_to_page_cache_lru, tgid); + return 0; } SEC("kprobe/mark_page_accessed") int netdata_mark_page_accessed(struct pt_regs* ctx) { - netdata_cachestat_t *fill, data = {}; - libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_MARK_PAGE_ACCESSED, 1); + if (!monitor_apps(&cstat_ctrl)) + return 0; + netdata_cachestat_t *fill, data = {}; __u32 key = 0; __u32 tgid = 0; - if (!monitor_apps(&cstat_ctrl)) - return 0; fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid); if (fill) { - libnetdata_update_u32(&fill->mark_page_accessed, 1); - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; - -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - - data.mark_page_accessed = 1; - bpf_map_update_elem(&cstat_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&cstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); + netdata_cachestat_update_existing(NETDATA_KEY_CALLS_MARK_PAGE_ACCESSED, &fill->mark_page_accessed); + return 0; } + netdata_cachestat_create_new_entry(NETDATA_KEY_CALLS_MARK_PAGE_ACCESSED, &data.mark_page_accessed, tgid); + return 0; } #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,15,0)) #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,16,0)) -// When kernel 5.16.0 was released, __set_page_dirty became a static inline function, -// so we are callging directly the __folio_mark_dirty. SEC("kprobe/__folio_mark_dirty") #else -// When kernel 5.15.0 was released the function account_page_dirtied became static -// https://elixir.bootlin.com/linux/v5.15/source/mm/page-writeback.c#L2441 -// as consequence of this, we are monitoring the function from caller. SEC("kprobe/__set_page_dirty") #endif int netdata_set_page_dirty(struct pt_regs* ctx) @@ -112,33 +111,21 @@ int netdata_set_page_dirty(struct pt_regs* ctx) return 0; #endif - netdata_cachestat_t *fill, data = {}; - libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED, 1); + if (!monitor_apps(&cstat_ctrl)) + return 0; + netdata_cachestat_t *fill, data = {}; __u32 key = 0; __u32 tgid = 0; - if (!monitor_apps(&cstat_ctrl)) - return 0; fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid); if (fill) { - libnetdata_update_u32(&fill->account_page_dirtied, 1); - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - - data.account_page_dirtied = 1; - bpf_map_update_elem(&cstat_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&cstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); + netdata_cachestat_update_existing(NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED, &fill->account_page_dirtied); + return 0; } + netdata_cachestat_create_new_entry(NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED, &data.account_page_dirtied, tgid); + return 0; } #else @@ -149,33 +136,21 @@ SEC("kprobe/account_page_dirtied") #endif int netdata_account_page_dirtied(struct pt_regs* ctx) { - netdata_cachestat_t *fill, data = {}; - libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED, 1); + if (!monitor_apps(&cstat_ctrl)) + return 0; + netdata_cachestat_t *fill, data = {}; __u32 key = 0; __u32 tgid = 0; - if (!monitor_apps(&cstat_ctrl)) - return 0; fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid); if (fill) { - libnetdata_update_u32(&fill->account_page_dirtied, 1); - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - - data.account_page_dirtied = 1; - bpf_map_update_elem(&cstat_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&cstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); + netdata_cachestat_update_existing(NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED, &fill->account_page_dirtied); + return 0; } + netdata_cachestat_create_new_entry(NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED, &data.account_page_dirtied, tgid); + return 0; } #endif @@ -183,33 +158,21 @@ int netdata_account_page_dirtied(struct pt_regs* ctx) SEC("kprobe/mark_buffer_dirty") int netdata_mark_buffer_dirty(struct pt_regs* ctx) { - netdata_cachestat_t *fill, data = {}; - libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_MARK_BUFFER_DIRTY, 1); + if (!monitor_apps(&cstat_ctrl)) + return 0; + netdata_cachestat_t *fill, data = {}; __u32 key = 0; __u32 tgid = 0; - if (!monitor_apps(&cstat_ctrl)) - return 0; fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid); if (fill) { - libnetdata_update_u32(&fill->mark_buffer_dirty, 1); - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - - data.mark_buffer_dirty = 1; - bpf_map_update_elem(&cstat_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&cstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); + netdata_cachestat_update_existing(NETDATA_KEY_CALLS_MARK_BUFFER_DIRTY, &fill->mark_buffer_dirty); + return 0; } + netdata_cachestat_create_new_entry(NETDATA_KEY_CALLS_MARK_BUFFER_DIRTY, &data.mark_buffer_dirty, tgid); + return 0; } From 5c10e9d0e25b0f6b41bcbb7fb6d7a7d9d426f2ad Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Wed, 4 Feb 2026 00:14:12 +0000 Subject: [PATCH 08/34] improve: Dcstat and fix Cache --- kernel/cachestat_kern.c | 35 ++++++++++------- kernel/dc_kern.c | 85 ++++++++++++++++++++++------------------- 2 files changed, 67 insertions(+), 53 deletions(-) diff --git a/kernel/cachestat_kern.c b/kernel/cachestat_kern.c index fa3fcbfd..6f2aa794 100644 --- a/kernel/cachestat_kern.c +++ b/kernel/cachestat_kern.c @@ -17,14 +17,13 @@ NETDATA_BPF_PERCPU_ARRAY_DEF(cstat_global, __u32, __u64, NETDATA_CACHESTAT_END); NETDATA_BPF_HASH_DEF(cstat_pid, __u32, netdata_cachestat_t, PID_MAX_DEFAULT); NETDATA_BPF_ARRAY_DEF(cstat_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); -static __always_inline void netdata_cachestat_update_existing(__u32 global_key, __u32 *field) +static __always_inline void netdata_cachestat_update_existing(__u32 *field) { - libnetdata_update_global(&cstat_global, global_key, 1); if (field) libnetdata_update_u32(field, 1); } -static __always_inline void netdata_cachestat_create_new_entry(__u32 global_key, __u32 *field, __u32 tgid) +static __always_inline void netdata_cachestat_create_new_entry(__u32 *field, __u32 tgid) { netdata_cachestat_t data = {}; @@ -55,6 +54,8 @@ static __always_inline void netdata_cachestat_create_new_entry(__u32 global_key, SEC("kprobe/add_to_page_cache_lru") int netdata_add_to_page_cache_lru(struct pt_regs* ctx) { + libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_ADD_TO_PAGE_CACHE_LRU, 1); + if (!monitor_apps(&cstat_ctrl)) return 0; @@ -64,11 +65,11 @@ int netdata_add_to_page_cache_lru(struct pt_regs* ctx) fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid); if (fill) { - netdata_cachestat_update_existing(NETDATA_KEY_CALLS_ADD_TO_PAGE_CACHE_LRU, &fill->add_to_page_cache_lru); + netdata_cachestat_update_existing(&fill->add_to_page_cache_lru); return 0; } - netdata_cachestat_create_new_entry(NETDATA_KEY_CALLS_ADD_TO_PAGE_CACHE_LRU, &data.add_to_page_cache_lru, tgid); + netdata_cachestat_create_new_entry(&data.add_to_page_cache_lru, tgid); return 0; } @@ -76,6 +77,8 @@ int netdata_add_to_page_cache_lru(struct pt_regs* ctx) SEC("kprobe/mark_page_accessed") int netdata_mark_page_accessed(struct pt_regs* ctx) { + libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_MARK_PAGE_ACCESSED, 1); + if (!monitor_apps(&cstat_ctrl)) return 0; @@ -85,11 +88,11 @@ int netdata_mark_page_accessed(struct pt_regs* ctx) fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid); if (fill) { - netdata_cachestat_update_existing(NETDATA_KEY_CALLS_MARK_PAGE_ACCESSED, &fill->mark_page_accessed); + netdata_cachestat_update_existing(&fill->mark_page_accessed); return 0; } - netdata_cachestat_create_new_entry(NETDATA_KEY_CALLS_MARK_PAGE_ACCESSED, &data.mark_page_accessed, tgid); + netdata_cachestat_create_new_entry(&data.mark_page_accessed, tgid); return 0; } @@ -111,6 +114,8 @@ int netdata_set_page_dirty(struct pt_regs* ctx) return 0; #endif + libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED, 1); + if (!monitor_apps(&cstat_ctrl)) return 0; @@ -120,11 +125,11 @@ int netdata_set_page_dirty(struct pt_regs* ctx) fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid); if (fill) { - netdata_cachestat_update_existing(NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED, &fill->account_page_dirtied); + netdata_cachestat_update_existing(&fill->account_page_dirtied); return 0; } - netdata_cachestat_create_new_entry(NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED, &data.account_page_dirtied, tgid); + netdata_cachestat_create_new_entry(&data.account_page_dirtied, tgid); return 0; } @@ -136,6 +141,8 @@ SEC("kprobe/account_page_dirtied") #endif int netdata_account_page_dirtied(struct pt_regs* ctx) { + libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED, 1); + if (!monitor_apps(&cstat_ctrl)) return 0; @@ -145,11 +152,11 @@ int netdata_account_page_dirtied(struct pt_regs* ctx) fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid); if (fill) { - netdata_cachestat_update_existing(NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED, &fill->account_page_dirtied); + netdata_cachestat_update_existing(&fill->account_page_dirtied); return 0; } - netdata_cachestat_create_new_entry(NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED, &data.account_page_dirtied, tgid); + netdata_cachestat_create_new_entry(&data.account_page_dirtied, tgid); return 0; } @@ -158,6 +165,8 @@ int netdata_account_page_dirtied(struct pt_regs* ctx) SEC("kprobe/mark_buffer_dirty") int netdata_mark_buffer_dirty(struct pt_regs* ctx) { + libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_MARK_BUFFER_DIRTY, 1); + if (!monitor_apps(&cstat_ctrl)) return 0; @@ -167,11 +176,11 @@ int netdata_mark_buffer_dirty(struct pt_regs* ctx) fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid); if (fill) { - netdata_cachestat_update_existing(NETDATA_KEY_CALLS_MARK_BUFFER_DIRTY, &fill->mark_buffer_dirty); + netdata_cachestat_update_existing(&fill->mark_buffer_dirty); return 0; } - netdata_cachestat_create_new_entry(NETDATA_KEY_CALLS_MARK_BUFFER_DIRTY, &data.mark_buffer_dirty, tgid); + netdata_cachestat_create_new_entry(&data.mark_buffer_dirty, tgid); return 0; } diff --git a/kernel/dc_kern.c b/kernel/dc_kern.c index 33d4b442..338c9629 100644 --- a/kernel/dc_kern.c +++ b/kernel/dc_kern.c @@ -19,6 +19,34 @@ NETDATA_BPF_PERCPU_ARRAY_DEF(dcstat_global, __u32, __u64, NETDATA_DIRECTORY_CACH NETDATA_BPF_HASH_DEF(dcstat_pid, __u32, netdata_dc_stat_t, PID_MAX_DEFAULT); NETDATA_BPF_PERCPU_ARRAY_DEF(dcstat_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); +static __always_inline void netdata_dc_update_existing(__u32 *field) +{ + if (field) + libnetdata_update_u32(field, 1); +} + +static __always_inline void netdata_dc_create_new_entry(__u32 *field, __u32 tgid) +{ + netdata_dc_stat_t data = {}; + + data.ct = bpf_ktime_get_ns(); + libnetdata_update_uid_gid(&data.uid, &data.gid); + data.tgid = tgid; + +#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) + bpf_get_current_comm(&data.name, TASK_COMM_LEN); +#else + data.name[0] = '\0'; +#endif + + __u32 key = 0; + if (field) + *field = 1; + bpf_map_update_elem(&dcstat_pid, &key, &data, BPF_ANY); + + libnetdata_update_global(&dcstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); +} + /************************************************************************************ * * Probe Section @@ -28,75 +56,52 @@ NETDATA_BPF_PERCPU_ARRAY_DEF(dcstat_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); SEC("kprobe/lookup_fast") int netdata_lookup_fast(struct pt_regs* ctx) { - netdata_dc_stat_t *fill, data = {}; libnetdata_update_global(&dcstat_global, NETDATA_KEY_DC_REFERENCE, 1); - __u32 key = 0; - __u32 tgid = 0; if (!monitor_apps(&dcstat_ctrl)) return 0; + netdata_dc_stat_t *fill, data = {}; + __u32 key = 0; + __u32 tgid = 0; + fill = netdata_get_pid_structure(&key, &tgid, &dcstat_ctrl, &dcstat_pid); if (fill) { - libnetdata_update_u32(&fill->references, 1); - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - - data.references = 1; - bpf_map_update_elem(&dcstat_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&dcstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); + netdata_dc_update_existing(&fill->references); + return 0; } + netdata_dc_create_new_entry(&data.references, tgid); + return 0; } SEC("kretprobe/d_lookup") int netdata_d_lookup(struct pt_regs* ctx) { - netdata_dc_stat_t *fill, data = {}; + int ret = PT_REGS_RC(ctx); + libnetdata_update_global(&dcstat_global, NETDATA_KEY_DC_SLOW, 1); - int ret = PT_REGS_RC(ctx); + if (!monitor_apps(&dcstat_ctrl)) + return 0; + netdata_dc_stat_t *fill, data = {}; __u32 key = 0; __u32 tgid = 0; - if (!monitor_apps(&dcstat_ctrl)) - return 0; fill = netdata_get_pid_structure(&key, &tgid, &dcstat_ctrl, &dcstat_pid); if (fill) { - libnetdata_update_u32(&fill->slow, 1); + netdata_dc_update_existing(&fill->slow); } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - - data.slow = 1; - bpf_map_update_elem(&dcstat_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&dcstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); + netdata_dc_create_new_entry(&data.slow, tgid); } - // file not found if (ret == 0) { libnetdata_update_global(&dcstat_global, NETDATA_KEY_DC_MISS, 1); fill = netdata_get_pid_structure(&key, &tgid, &dcstat_ctrl, &dcstat_pid); - if (fill) { - libnetdata_update_u32(&fill->missed, 1); - } + if (fill) + netdata_dc_update_existing(&fill->missed); } return 0; From 79fa06ef5e9d815389ff73b81c83de1fb03ca022 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Wed, 4 Feb 2026 00:35:06 +0000 Subject: [PATCH 09/34] improve: Tester --- kernel/tester_user.c | 56 ++++++++++++++++++++++++++++---------------- kernel/tester_user.h | 12 +++++----- 2 files changed, 42 insertions(+), 26 deletions(-) diff --git a/kernel/tester_user.c b/kernel/tester_user.c index 53f51e67..2ec0ac3e 100644 --- a/kernel/tester_user.c +++ b/kernel/tester_user.c @@ -18,10 +18,13 @@ #include "tester_user.h" static ebpf_specify_name_t dc_optional_name[] = { {.program_name = "netdata_lookup_fast", - .function_to_attach = "lookup_fast", - .optional = NULL, - .retprobe = 0}, - {.program_name = NULL}}; + .function_to_attach = "lookup_fast", + .optional = NULL, + .retprobe = 0}, + {.program_name = NULL, + .function_to_attach = NULL, + .optional = NULL, + .retprobe = 0}}; // Versions 3_10, 4_18 and 5_14 must be always present to keep compatibility with RH family // Version 4_14, 4_16 must be present for syscalls with old name convention @@ -600,6 +603,24 @@ static inline void ebpf_values_accumulator(ebpf_table_data_t *values) values->filled++; } +/** + * Check and update counter + * + * @param fd the file descriptor for the table. + * @param key the key to lookup. + * @param filled pointer to filled counter. + * @param zero pointer to zero counter. + */ +static inline void ebpf_check_and_update_counter(int fd, uint32_t key, uint32_t *filled, uint32_t *zero) +{ + uint32_t value[NETDATA_CONTROLLER_END]; + if (bpf_map_lookup_elem(fd, &key, value)) { + (*zero)++; + } else { + (*filled)++; + } +} + /** * Read Table * @@ -684,20 +705,16 @@ static void ebpf_write_common_json_vector(ebpf_table_data_t *values, int fd) static void ebpf_controller_json(ebpf_table_data_t *values, int fd) { uint32_t value = 0; - uint32_t zero = 0; + uint32_t zero = 0; - uint32_t key, read[nprocesses]; + uint32_t key; for (key = 0; key < NETDATA_CONTROLLER_END; key++) { - if (bpf_map_lookup_elem(fd, &key, read)) { - zero++; - } else { - value++; - } + ebpf_check_and_update_counter(fd, key, &value, &zero); } fprintf(stdlog, " " - "{ \"Iteration\" : 1, \"Total\" : %u, \"Filled\" : %u, \"Zero\" : %d }\n", - value + zero, value, zero); + "{ \"Iteration\" : 1, \"Total\" : %u, \"Filled\" : %u, \"Zero\" : %u }\n", + value + zero, value, zero); } /** @@ -766,7 +783,7 @@ static void ebpf_test_maps(struct bpf_object *obj, char *ctrl) } /** - * Fill Control table + * Fill Control table * * Fill control table with data allowing eBPF collectors to store specific data. * @@ -778,24 +795,23 @@ static void ebpf_fill_ctrl(struct bpf_object *obj, char *ctrl) struct bpf_map *map; bpf_object__for_each_map(map, obj) { - // We only few datas fro the controller const char *name = bpf_map__name(map); if (strcmp(name, ctrl)) continue; int fd = bpf_map__fd(map); - unsigned int i, end; + unsigned int end; #ifdef LIBBPF_MAJOR_VERSION end = bpf_map__max_entries(map); #else const struct bpf_map_def *def = bpf_map__def(map); end = def->max_entries; #endif - uint32_t values[NETDATA_CONTROLLER_END] = { 1, map_level, 0, 0, 0, 0}; + uint32_t values[NETDATA_CONTROLLER_END] = { 1, map_level, 0, 0, 0, 0 }; + unsigned int i; for (i = 0; i < end; i++) { - int ret = bpf_map_update_elem(fd, &i, &values[i], 0); - if (ret) + if (bpf_map_update_elem(fd, &i, &values[i], 0)) fprintf(stdlog, "\"error\" : \"Add key(%u) for controller table failed.\",", i); } } @@ -1208,7 +1224,7 @@ uint64_t ebpf_parse_arguments(int argc, char **argv, int kver) } // When user does not specify any flag, we will use common value - if (!(flags & (NETDATA_FLAG_ALL & ~(NETDATA_FLAG_CONTENT)))) + if (!(flags & (NETDATA_FLAG_ALL & ~NETDATA_FLAG_CONTENT))) flags |= ebpf_set_common_flag(); // The necessary tracepoint was made in kernel 4.14, so we cannot diff --git a/kernel/tester_user.h b/kernel/tester_user.h index 57a5c716..fcf7b3c1 100644 --- a/kernel/tester_user.h +++ b/kernel/tester_user.h @@ -39,19 +39,19 @@ * */ enum netdata_ebpf_kernel_versions { - NETDATA_EBPF_KERNEL_4_11 = 264960, // 264960 = 4 * 65536 + 15 * 256 - NETDATA_EBPF_KERNEL_4_14 = 265728, // 264960 = 4 * 65536 + 14 * 256 + NETDATA_EBPF_KERNEL_4_11 = 264960, // 264960 = 4 * 65536 + 11 * 256 + NETDATA_EBPF_KERNEL_4_14 = 265728, // 265728 = 4 * 65536 + 14 * 256 NETDATA_EBPF_KERNEL_4_15 = 265984, // 265984 = 4 * 65536 + 15 * 256 NETDATA_EBPF_KERNEL_4_17 = 266496, // 266496 = 4 * 65536 + 17 * 256 NETDATA_EBPF_KERNEL_5_0 = 327680, // 327680 = 5 * 65536 + 0 * 256 - NETDATA_EBPF_KERNEL_5_2 = 328192, // 327680 = 5 * 65536 + 2 * 256 - NETDATA_EBPF_KERNEL_5_4 = 328704, // 327680 = 5 * 65536 + 4 * 256 + NETDATA_EBPF_KERNEL_5_2 = 328192, // 328192 = 5 * 65536 + 2 * 256 + NETDATA_EBPF_KERNEL_5_4 = 328704, // 328704 = 5 * 65536 + 4 * 256 NETDATA_EBPF_KERNEL_5_10 = 330240, // 330240 = 5 * 65536 + 10 * 256 - NETDATA_EBPF_KERNEL_5_11 = 330496, // 330240 = 5 * 65536 + 11 * 256 + NETDATA_EBPF_KERNEL_5_11 = 330496, // 330496 = 5 * 65536 + 11 * 256 NETDATA_EBPF_KERNEL_5_14 = 331264, // 331264 = 5 * 65536 + 14 * 256 NETDATA_EBPF_KERNEL_5_15 = 331520, // 331520 = 5 * 65536 + 15 * 256 NETDATA_EBPF_KERNEL_5_16 = 331776, // 331776 = 5 * 65536 + 16 * 256 - NETDATA_EBPF_KERNEL_6_8 = 395264 // 395264 = 5 * 65536 + 8 * 256 + NETDATA_EBPF_KERNEL_6_8 = 395264 // 395264 = 6 * 65536 + 8 * 256 }; /** From 96ee4de3c47da203896af45d15080b3ae96b5c97 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Wed, 4 Feb 2026 01:55:07 +0000 Subject: [PATCH 10/34] improve: Simplify alorithm --- kernel/cachestat_kern.c | 15 ++++++++++----- kernel/dc_kern.c | 6 ++++-- 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/kernel/cachestat_kern.c b/kernel/cachestat_kern.c index 6f2aa794..3ad32c65 100644 --- a/kernel/cachestat_kern.c +++ b/kernel/cachestat_kern.c @@ -59,7 +59,7 @@ int netdata_add_to_page_cache_lru(struct pt_regs* ctx) if (!monitor_apps(&cstat_ctrl)) return 0; - netdata_cachestat_t *fill, data = {}; + netdata_cachestat_t *fill; __u32 key = 0; __u32 tgid = 0; @@ -69,6 +69,7 @@ int netdata_add_to_page_cache_lru(struct pt_regs* ctx) return 0; } + netdata_cachestat_t data = {}; netdata_cachestat_create_new_entry(&data.add_to_page_cache_lru, tgid); return 0; @@ -82,7 +83,7 @@ int netdata_mark_page_accessed(struct pt_regs* ctx) if (!monitor_apps(&cstat_ctrl)) return 0; - netdata_cachestat_t *fill, data = {}; + netdata_cachestat_t *fill; __u32 key = 0; __u32 tgid = 0; @@ -92,6 +93,7 @@ int netdata_mark_page_accessed(struct pt_regs* ctx) return 0; } + netdata_cachestat_t data = {}; netdata_cachestat_create_new_entry(&data.mark_page_accessed, tgid); return 0; @@ -119,7 +121,7 @@ int netdata_set_page_dirty(struct pt_regs* ctx) if (!monitor_apps(&cstat_ctrl)) return 0; - netdata_cachestat_t *fill, data = {}; + netdata_cachestat_t *fill; __u32 key = 0; __u32 tgid = 0; @@ -129,6 +131,7 @@ int netdata_set_page_dirty(struct pt_regs* ctx) return 0; } + netdata_cachestat_t data = {}; netdata_cachestat_create_new_entry(&data.account_page_dirtied, tgid); return 0; @@ -146,7 +149,7 @@ int netdata_account_page_dirtied(struct pt_regs* ctx) if (!monitor_apps(&cstat_ctrl)) return 0; - netdata_cachestat_t *fill, data = {}; + netdata_cachestat_t *fill; __u32 key = 0; __u32 tgid = 0; @@ -156,6 +159,7 @@ int netdata_account_page_dirtied(struct pt_regs* ctx) return 0; } + netdata_cachestat_t data = {}; netdata_cachestat_create_new_entry(&data.account_page_dirtied, tgid); return 0; @@ -170,7 +174,7 @@ int netdata_mark_buffer_dirty(struct pt_regs* ctx) if (!monitor_apps(&cstat_ctrl)) return 0; - netdata_cachestat_t *fill, data = {}; + netdata_cachestat_t *fill; __u32 key = 0; __u32 tgid = 0; @@ -180,6 +184,7 @@ int netdata_mark_buffer_dirty(struct pt_regs* ctx) return 0; } + netdata_cachestat_t data = {}; netdata_cachestat_create_new_entry(&data.mark_buffer_dirty, tgid); return 0; diff --git a/kernel/dc_kern.c b/kernel/dc_kern.c index 338c9629..a2f9c6c3 100644 --- a/kernel/dc_kern.c +++ b/kernel/dc_kern.c @@ -61,7 +61,7 @@ int netdata_lookup_fast(struct pt_regs* ctx) if (!monitor_apps(&dcstat_ctrl)) return 0; - netdata_dc_stat_t *fill, data = {}; + netdata_dc_stat_t *fill; __u32 key = 0; __u32 tgid = 0; @@ -71,6 +71,7 @@ int netdata_lookup_fast(struct pt_regs* ctx) return 0; } + netdata_dc_stat_t data = {}; netdata_dc_create_new_entry(&data.references, tgid); return 0; @@ -86,7 +87,7 @@ int netdata_d_lookup(struct pt_regs* ctx) if (!monitor_apps(&dcstat_ctrl)) return 0; - netdata_dc_stat_t *fill, data = {}; + netdata_dc_stat_t *fill; __u32 key = 0; __u32 tgid = 0; @@ -94,6 +95,7 @@ int netdata_d_lookup(struct pt_regs* ctx) if (fill) { netdata_dc_update_existing(&fill->slow); } else { + netdata_dc_stat_t data = {}; netdata_dc_create_new_entry(&data.slow, tgid); } From 8bf9df2d0693580382209de89cc69f959d794d7b Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Wed, 4 Feb 2026 16:36:59 +0000 Subject: [PATCH 11/34] improve: Fix/Simplify disk --- kernel/disk_kern.c | 53 +++++++++++++--------------------------------- 1 file changed, 15 insertions(+), 38 deletions(-) diff --git a/kernel/disk_kern.c b/kernel/disk_kern.c index bdcf81b8..b7ef769d 100644 --- a/kernel/disk_kern.c +++ b/kernel/disk_kern.c @@ -17,40 +17,22 @@ #include "bpf_helpers.h" #include "netdata_ebpf.h" -/************************************************************************************ - * - * MAPS - * - ***********************************************************************************/ - NETDATA_BPF_PERCPU_HASH_DEF(tbl_disk_iocall, block_key_t, __u64, NETDATA_DISK_HISTOGRAM_LENGTH); NETDATA_BPF_HASH_DEF(tmp_disk_tp_stat, netdata_disk_key_t, __u64, 8192); NETDATA_BPF_ARRAY_DEF(disk_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); -/************************************************************************************ - * - * DISK SECTION - * - ***********************************************************************************/ - -// Probably it is available after 4.13 only - SEC("tracepoint/block/block_rq_issue") int netdata_block_rq_issue(struct netdata_block_rq_issue *ptr) { - // blkid generates these and we're not interested in them if (!ptr->dev) return 0; - netdata_disk_key_t key = {}; - key.dev = ptr->dev; - key.sector = ptr->sector; - - if (key.sector < 0) - key.sector = 0; + netdata_disk_key_t key = { + .dev = ptr->dev, + .sector = (ptr->sector < 0) ? 0 : ptr->sector + }; __u64 value = bpf_ktime_get_ns(); - bpf_map_update_elem(&tmp_disk_tp_stat, &key, &value, BPF_ANY); libnetdata_update_global(&disk_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); @@ -61,34 +43,29 @@ int netdata_block_rq_issue(struct netdata_block_rq_issue *ptr) SEC("tracepoint/block/block_rq_complete") int netdata_block_rq_complete(struct netdata_block_rq_complete *ptr) { - __u64 *fill; - netdata_disk_key_t key = {}; - block_key_t blk = {}; - key.dev = ptr->dev; - key.sector = ptr->sector; - - if (key.sector < 0) - key.sector = 0; + netdata_disk_key_t key = { + .dev = ptr->dev, + .sector = (ptr->sector < 0) ? 0 : ptr->sector + }; - fill = bpf_map_lookup_elem(&tmp_disk_tp_stat ,&key); + __u64 *fill = bpf_map_lookup_elem(&tmp_disk_tp_stat, &key); if (!fill) return 0; - // calculate and convert to microsecond u64 curr = bpf_ktime_get_ns(); - __u64 data, *update; curr -= *fill; curr /= 1000; - blk.bin = libnetdata_select_idx(curr, NETDATA_FS_MAX_BINS_POS); - blk.dev = new_encode_dev(ptr->dev); + block_key_t blk = { + .bin = libnetdata_select_idx(curr, NETDATA_FS_MAX_BINS_POS), + .dev = netdata_new_encode_dev(ptr->dev) + }; - // Update IOPS - update = bpf_map_lookup_elem(&tbl_disk_iocall ,&blk); + __u64 data = 1; + __u64 *update = bpf_map_lookup_elem(&tbl_disk_iocall, &blk); if (update) { libnetdata_update_u64(update, 1); } else { - data = 1; bpf_map_update_elem(&tbl_disk_iocall, &blk, &data, BPF_ANY); } From 5b6b1a3c0c77e73978dee5f6aab5ca2809399c44 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Wed, 4 Feb 2026 21:33:36 +0000 Subject: [PATCH 12/34] improve: Fix/Simplify FD --- kernel/fd_kern.c | 78 ++++++++++++++++++++++-------------------------- 1 file changed, 35 insertions(+), 43 deletions(-) diff --git a/kernel/fd_kern.c b/kernel/fd_kern.c index bcb44f11..3313ac9a 100644 --- a/kernel/fd_kern.c +++ b/kernel/fd_kern.c @@ -6,7 +6,6 @@ #endif #include -#include #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) #include @@ -18,9 +17,9 @@ #include "netdata_ebpf.h" /************************************************************************************ - * + * * MAPS Section - * + * ***********************************************************************************/ NETDATA_BPF_HASH_DEF(tbl_fd_pid, __u32, struct netdata_fd_stat_t, PID_MAX_DEFAULT); @@ -28,9 +27,9 @@ NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_fd_global, __u32, __u64, NETDATA_FD_COUNTER); NETDATA_BPF_ARRAY_DEF(fd_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ - * + * * Probe Section - * + * ***********************************************************************************/ #if (LINUX_VERSION_CODE <= KERNEL_VERSION(5,5,19)) @@ -44,21 +43,21 @@ SEC("kprobe/do_sys_open") SEC("kretprobe/do_sys_openat2") #else SEC("kprobe/do_sys_openat2") -#endif // Endif NETDATASEL -#endif //ENDIF KERNEL VERSION +#endif +#endif int netdata_sys_open(struct pt_regs* ctx) { #if NETDATASEL < 2 int ret = (ssize_t)PT_REGS_RC(ctx); #endif struct netdata_fd_stat_t *fill; - struct netdata_fd_stat_t data = { }; + struct netdata_fd_stat_t data = {0}; libnetdata_update_global(&tbl_fd_global, NETDATA_KEY_CALLS_DO_SYS_OPEN, 1); #if NETDATASEL < 2 if (ret < 0) { libnetdata_update_global(&tbl_fd_global, NETDATA_KEY_ERROR_DO_SYS_OPEN, 1); - } + } #endif __u32 key = 0; @@ -68,17 +67,17 @@ int netdata_sys_open(struct pt_regs* ctx) fill = netdata_get_pid_structure(&key, &tgid, &fd_ctrl, &tbl_fd_pid); if (fill) { - libnetdata_update_u32(&fill->open_call, 1) ; + libnetdata_update_u32(&fill->open_call, 1); #if NETDATASEL < 2 - if (ret < 0) { - libnetdata_update_u32(&fill->open_err, 1) ; - } + if (ret < 0) + libnetdata_update_u32(&fill->open_err, 1); #endif } else { data.ct = bpf_ktime_get_ns(); libnetdata_update_uid_gid(&data.uid, &data.gid); data.tgid = tgid; + #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) bpf_get_current_comm(&data.name, TASK_COMM_LEN); #else @@ -86,14 +85,11 @@ int netdata_sys_open(struct pt_regs* ctx) #endif #if NETDATASEL < 2 - if (ret < 0) { + if (ret < 0) data.open_err = 1; - } else { + else #endif data.open_err = 0; -#if NETDATASEL < 2 - } -#endif data.open_call = 1; bpf_map_update_elem(&tbl_fd_pid, &key, &data, BPF_ANY); @@ -104,40 +100,38 @@ int netdata_sys_open(struct pt_regs* ctx) return 0; } -#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,11,0)) -# if NETDATASEL < 2 +#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,11,0)) +#if NETDATASEL < 2 SEC("kretprobe/close_fd") -# else +#else SEC("kprobe/close_fd") -# endif /* NETDATASEL < 2 */ -#else /* KERNEL > 5.11 */ -# if NETDATASEL < 2 -# if defined(RHEL_MAJOR) && (LINUX_VERSION_CODE >= KERNEL_VERSION(4,18,0)) && (LINUX_VERSION_CODE <= KERNEL_VERSION(4,19,0)) +#endif +#elif defined(RHEL_MAJOR) && (LINUX_VERSION_CODE >= KERNEL_VERSION(4,18,0)) && (LINUX_VERSION_CODE <= KERNEL_VERSION(4,19,0)) +#if NETDATASEL < 2 SEC("kretprobe/close_fd") -# else /* RHEL_MAJOR */ -SEC("kretprobe/__close_fd") -# endif /* RHEL_MAJOR */ -# else /* NETDATASEL < 2 */ -# if defined(RHEL_MAJOR) && (LINUX_VERSION_CODE >= KERNEL_VERSION(4,18,0)) && (LINUX_VERSION_CODE <= KERNEL_VERSION(4,19,0)) +#else SEC("kprobe/close_fd") -# else /* RHEL_MAJOR */ +#endif +#else +#if NETDATASEL < 2 +SEC("kretprobe/__close_fd") +#else SEC("kprobe/__close_fd") -# endif /* RHEL_MAJOR */ -# endif /* NETDATASEL < 2 */ -#endif /* KERNEL > 5.11 */ +#endif +#endif int netdata_close(struct pt_regs* ctx) { #if NETDATASEL < 2 int ret = (int)PT_REGS_RC(ctx); #endif - struct netdata_fd_stat_t data = { }; + struct netdata_fd_stat_t data = {0}; struct netdata_fd_stat_t *fill; libnetdata_update_global(&tbl_fd_global, NETDATA_KEY_CALLS_CLOSE_FD, 1); #if NETDATASEL < 2 if (ret < 0) { libnetdata_update_global(&tbl_fd_global, NETDATA_KEY_ERROR_CLOSE_FD, 1); - } + } #endif __u32 key = 0; @@ -147,17 +141,17 @@ int netdata_close(struct pt_regs* ctx) fill = netdata_get_pid_structure(&key, &tgid, &fd_ctrl, &tbl_fd_pid); if (fill) { - libnetdata_update_u32(&fill->close_call, 1) ; + libnetdata_update_u32(&fill->close_call, 1); #if NETDATASEL < 2 - if (ret < 0) { - libnetdata_update_u32(&fill->close_err, 1) ; - } + if (ret < 0) + libnetdata_update_u32(&fill->close_err, 1); #endif } else { data.ct = bpf_ktime_get_ns(); libnetdata_update_uid_gid(&data.uid, &data.gid); data.tgid = tgid; + #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) bpf_get_current_comm(&data.name, TASK_COMM_LEN); #else @@ -166,9 +160,8 @@ int netdata_close(struct pt_regs* ctx) data.close_call = 1; #if NETDATASEL < 2 - if (ret < 0) { + if (ret < 0) data.close_err = 1; - } #endif bpf_map_update_elem(&tbl_fd_pid, &key, &data, BPF_ANY); @@ -180,4 +173,3 @@ int netdata_close(struct pt_regs* ctx) } char _license[] SEC("license") = "GPL"; - From e508dec8dbc40468d00396433ca1a18ad0db6d04 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Wed, 4 Feb 2026 22:41:02 +0000 Subject: [PATCH 13/34] improve: Fix/Simplify EXT4 --- kernel/ext4_kern.c | 193 ++++++++++++++++----------------------------- 1 file changed, 68 insertions(+), 125 deletions(-) diff --git a/kernel/ext4_kern.c b/kernel/ext4_kern.c index abd1d22d..adc7dfc9 100644 --- a/kernel/ext4_kern.c +++ b/kernel/ext4_kern.c @@ -14,9 +14,9 @@ #include "netdata_ebpf.h" /************************************************************************************ - * + * * MAP Section - * + * ***********************************************************************************/ NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_ext4, __u32, __u64, NETDATA_FS_MAX_ELEMENTS); @@ -24,176 +24,119 @@ NETDATA_BPF_HASH_DEF(tmp_ext4, __u32, __u64, 4192); NETDATA_BPF_ARRAY_DEF(ext4_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ - * - * ENTRY Section - * + * + * Helper Functions + * ***********************************************************************************/ -static __always_inline int netdata_ext4_entry() +static __always_inline void netdata_ext4_store_bin(__u32 bin, __u32 selection) +{ + __u32 idx = selection * NETDATA_FS_MAX_BINS + bin; + if (idx >= NETDATA_FS_MAX_ELEMENTS) + return; + + __u64 *fill = bpf_map_lookup_elem(&tbl_ext4, &idx); + if (fill) { + libnetdata_update_u64(fill, 1); + return; + } + + bpf_map_update_elem(&tbl_ext4, &idx, &(unsigned long long){1}, BPF_ANY); + libnetdata_update_global(&ext4_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_DEL, 1); +} + +static __always_inline int netdata_ext4_ret(struct pt_regs *ctx, __u32 selector) { __u64 pid_tgid = bpf_get_current_pid_tgid(); __u32 pid = (__u32)(pid_tgid >> 32); - __u64 ts = bpf_ktime_get_ns(); - bpf_map_update_elem(&tmp_ext4, &pid, &ts, BPF_ANY); + __u64 *fill = bpf_map_lookup_elem(&tmp_ext4, &pid); + if (!fill) + return 0; + + __u64 data = bpf_ktime_get_ns() - *fill; + bpf_map_delete_elem(&tmp_ext4, &pid); - libnetdata_update_global(&ext4_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + if ((s64)data < 0) + return 0; + + data /= 1000; + __u32 bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); + netdata_ext4_store_bin(bin, selector); return 0; } +/************************************************************************************ + * + * ENTRY Section + * + ***********************************************************************************/ + SEC("kprobe/ext4_file_read_iter") -int netdata_ext4_file_read_iter(struct pt_regs *ctx) +int netdata_ext4_file_read_iter(struct pt_regs *ctx) { - return netdata_ext4_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_ext4, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&ext4_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } SEC("kprobe/ext4_file_write_iter") -int netdata_ext4_file_write_iter(struct pt_regs *ctx) +int netdata_ext4_file_write_iter(struct pt_regs *ctx) { - return netdata_ext4_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_ext4, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&ext4_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } SEC("kprobe/ext4_file_open") -int netdata_ext4_file_open(struct pt_regs *ctx) +int netdata_ext4_file_open(struct pt_regs *ctx) { - return netdata_ext4_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_ext4, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&ext4_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } SEC("kprobe/ext4_sync_file") -int netdata_ext4_sync_file(struct pt_regs *ctx) +int netdata_ext4_sync_file(struct pt_regs *ctx) { - return netdata_ext4_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_ext4, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&ext4_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } /************************************************************************************ - * + * * END Section - * + * ***********************************************************************************/ -static void netdata_ext4_store_bin(__u32 bin, __u32 selection) -{ - __u64 *fill, data; - __u32 idx = selection * NETDATA_FS_MAX_BINS + bin; - if (idx >= NETDATA_FS_MAX_ELEMENTS) - return; - - fill = bpf_map_lookup_elem(&tbl_ext4, &idx); - if (fill) { - libnetdata_update_u64(fill, 1); - return; - } - - data = 1; - bpf_map_update_elem(&tbl_ext4, &idx, &data, BPF_ANY); - - libnetdata_update_global(&ext4_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_DEL, 1); -} - SEC("kretprobe/ext4_file_read_iter") -int netdata_ret_ext4_ext4_file_read_iter(struct pt_regs *ctx) +int netdata_ret_ext4_file_read_iter(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_ext4, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_ext4, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_ext4_store_bin(bin, NETDATA_KEY_CALLS_READ); - - return 0; + return netdata_ext4_ret(ctx, NETDATA_KEY_CALLS_READ); } SEC("kretprobe/ext4_file_write_iter") int netdata_ret_ext4_file_write_iter(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_ext4, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_ext4, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_ext4_store_bin(bin, NETDATA_KEY_CALLS_WRITE); - - return 0; + return netdata_ext4_ret(ctx, NETDATA_KEY_CALLS_WRITE); } SEC("kretprobe/ext4_file_open") int netdata_ret_ext4_file_open(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_ext4, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_ext4, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_ext4_store_bin(bin, NETDATA_KEY_CALLS_OPEN); - - return 0; + return netdata_ext4_ret(ctx, NETDATA_KEY_CALLS_OPEN); } SEC("kretprobe/ext4_sync_file") -int netdata_ret_ext4_sync_file(struct pt_regs *ctx) +int netdata_ret_ext4_sync_file(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_ext4, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_ext4, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_ext4_store_bin(bin, NETDATA_KEY_CALLS_SYNC); - - return 0; + return netdata_ext4_ret(ctx, NETDATA_KEY_CALLS_SYNC); } char _license[] SEC("license") = "GPL"; - From 624f51d54c67944550c35fb735aa3d8f70b30728 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Wed, 4 Feb 2026 23:07:28 +0000 Subject: [PATCH 14/34] improve: Fix/Simplify NFS --- kernel/nfs_kern.c | 220 +++++++++++++++------------------------------- 1 file changed, 73 insertions(+), 147 deletions(-) diff --git a/kernel/nfs_kern.c b/kernel/nfs_kern.c index 1114ece1..56d3bf4e 100644 --- a/kernel/nfs_kern.c +++ b/kernel/nfs_kern.c @@ -14,9 +14,9 @@ #include "netdata_ebpf.h" /************************************************************************************ - * + * * MAP Section - * + * ***********************************************************************************/ NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_nfs, __u32, __u64, NETDATA_FS_MAX_ELEMENTS); @@ -24,208 +24,134 @@ NETDATA_BPF_HASH_DEF(tmp_nfs, __u32, __u64, 4192); NETDATA_BPF_ARRAY_DEF(nfs_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ - * - * ENTRY Section - * + * + * Helper Functions + * ***********************************************************************************/ -static __always_inline int netdata_nfs_entry() +static __always_inline void netdata_nfs_store_bin(__u32 bin, __u32 selection) +{ + __u32 idx = selection * NETDATA_FS_MAX_BINS + bin; + if (idx >= NETDATA_FS_MAX_ELEMENTS) + return; + + __u64 *fill = bpf_map_lookup_elem(&tbl_nfs, &idx); + if (fill) { + libnetdata_update_u64(fill, 1); + return; + } + + bpf_map_update_elem(&tbl_nfs, &idx, &(unsigned long long){1}, BPF_ANY); + libnetdata_update_global(&nfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_DEL, 1); +} + +static __always_inline int netdata_nfs_ret(struct pt_regs *ctx, __u32 selector) { __u64 pid_tgid = bpf_get_current_pid_tgid(); __u32 pid = (__u32)(pid_tgid >> 32); - __u64 ts = bpf_ktime_get_ns(); - bpf_map_update_elem(&tmp_nfs, &pid, &ts, BPF_ANY); + __u64 *fill = bpf_map_lookup_elem(&tmp_nfs, &pid); + if (!fill) + return 0; - libnetdata_update_global(&nfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + __u64 data = bpf_ktime_get_ns() - *fill; + bpf_map_delete_elem(&tmp_nfs, &pid); + + if ((s64)data < 0) + return 0; + + data /= 1000; + __u32 bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); + netdata_nfs_store_bin(bin, selector); return 0; } +/************************************************************************************ + * + * ENTRY Section + * + ***********************************************************************************/ + SEC("kprobe/nfs_file_read") -int netdata_nfs_file_read(struct pt_regs *ctx) +int netdata_nfs_file_read(struct pt_regs *ctx) { - return netdata_nfs_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_nfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&nfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } SEC("kprobe/nfs_file_write") -int netdata_nfs_file_write(struct pt_regs *ctx) +int netdata_nfs_file_write(struct pt_regs *ctx) { - return netdata_nfs_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_nfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&nfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } SEC("kprobe/nfs_file_open") -int netdata_nfs_file_open(struct pt_regs *ctx) +int netdata_nfs_file_open(struct pt_regs *ctx) { - return netdata_nfs_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_nfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&nfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } SEC("kprobe/nfs4_file_open") -int netdata_nfs4_file_open(struct pt_regs *ctx) +int netdata_nfs4_file_open(struct pt_regs *ctx) { - return netdata_nfs_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_nfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&nfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } SEC("kprobe/nfs_getattr") -int netdata_nfs_getattr(struct pt_regs *ctx) +int netdata_nfs_getattr(struct pt_regs *ctx) { - return netdata_nfs_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_nfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&nfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } /************************************************************************************ - * + * * END Section - * + * ***********************************************************************************/ -static void netdata_nfs_store_bin(__u32 bin, __u32 selection) -{ - __u64 *fill, data; - __u32 idx = selection * NETDATA_FS_MAX_BINS + bin; - if (idx >= NETDATA_FS_MAX_ELEMENTS) - return; - - fill = bpf_map_lookup_elem(&tbl_nfs, &idx); - if (fill) { - libnetdata_update_u64(fill, 1); - return; - } - - data = 1; - bpf_map_update_elem(&tbl_nfs, &idx, &data, BPF_ANY); - - libnetdata_update_global(&nfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_DEL, 1); -} - SEC("kretprobe/nfs_file_read") int netdata_ret_nfs_file_read(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_nfs, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_nfs, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_nfs_store_bin(bin, NETDATA_KEY_CALLS_READ); - - return 0; + return netdata_nfs_ret(ctx, NETDATA_KEY_CALLS_READ); } SEC("kretprobe/nfs_file_write") int netdata_ret_nfs_file_write(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_nfs, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_nfs, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_nfs_store_bin(bin, NETDATA_KEY_CALLS_WRITE); - - return 0; + return netdata_nfs_ret(ctx, NETDATA_KEY_CALLS_WRITE); } SEC("kretprobe/nfs_file_open") int netdata_ret_nfs_file_open(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_nfs, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_nfs, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_nfs_store_bin(bin, NETDATA_KEY_CALLS_OPEN); - - return 0; + return netdata_nfs_ret(ctx, NETDATA_KEY_CALLS_OPEN); } SEC("kretprobe/nfs4_file_open") int netdata_ret_nfs4_file_open(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_nfs, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_nfs, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_nfs_store_bin(bin, NETDATA_KEY_CALLS_OPEN); - - return 0; + return netdata_nfs_ret(ctx, NETDATA_KEY_CALLS_OPEN); } SEC("kretprobe/nfs_getattr") -int netdata_ret_nfs_getattr(struct pt_regs *ctx) +int netdata_ret_nfs_getattr(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_nfs, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_nfs, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_nfs_store_bin(bin, NETDATA_KEY_CALLS_SYNC); - - return 0; + return netdata_nfs_ret(ctx, NETDATA_KEY_CALLS_SYNC); } char _license[] SEC("license") = "GPL"; - From fd0b485357ff80b1703de77a44c435fd999c0867 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Wed, 4 Feb 2026 23:21:10 +0000 Subject: [PATCH 15/34] improve: Fix/Simplify XFS --- kernel/xfs_kern.c | 191 ++++++++++++++++------------------------------ 1 file changed, 67 insertions(+), 124 deletions(-) diff --git a/kernel/xfs_kern.c b/kernel/xfs_kern.c index 1328dede..56ca68e6 100644 --- a/kernel/xfs_kern.c +++ b/kernel/xfs_kern.c @@ -15,9 +15,9 @@ #include "netdata_ebpf.h" /************************************************************************************ - * + * * MAP Section - * + * ***********************************************************************************/ NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_xfs, __u32, __u64, NETDATA_FS_MAX_ELEMENTS); @@ -25,176 +25,119 @@ NETDATA_BPF_HASH_DEF(tmp_xfs, __u32, __u64, 4192); NETDATA_BPF_ARRAY_DEF(xfs_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ - * - * ENTRY Section - * + * + * Helper Functions + * ***********************************************************************************/ -static __always_inline int netdata_xfs_entry() +static __always_inline void netdata_xfs_store_bin(__u32 bin, __u32 selection) +{ + __u32 idx = selection * NETDATA_FS_MAX_BINS + bin; + if (idx >= NETDATA_FS_MAX_ELEMENTS) + return; + + __u64 *fill = bpf_map_lookup_elem(&tbl_xfs, &idx); + if (fill) { + libnetdata_update_u64(fill, 1); + return; + } + + bpf_map_update_elem(&tbl_xfs, &idx, &(unsigned long long){1}, BPF_ANY); + libnetdata_update_global(&xfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_DEL, 1); +} + +static __always_inline int netdata_xfs_ret(struct pt_regs *ctx, __u32 selector) { __u64 pid_tgid = bpf_get_current_pid_tgid(); __u32 pid = (__u32)(pid_tgid >> 32); - __u64 ts = bpf_ktime_get_ns(); - bpf_map_update_elem(&tmp_xfs, &pid, &ts, BPF_ANY); + __u64 *fill = bpf_map_lookup_elem(&tmp_xfs, &pid); + if (!fill) + return 0; + + __u64 data = bpf_ktime_get_ns() - *fill; + bpf_map_delete_elem(&tmp_xfs, &pid); - libnetdata_update_global(&xfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + if ((s64)data < 0) + return 0; + + data /= 1000; + __u32 bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); + netdata_xfs_store_bin(bin, selector); return 0; } +/************************************************************************************ + * + * ENTRY Section + * + ***********************************************************************************/ + SEC("kprobe/xfs_file_read_iter") -int netdata_xfs_file_read_iter(struct pt_regs *ctx) +int netdata_xfs_file_read_iter(struct pt_regs *ctx) { - return netdata_xfs_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_xfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&xfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } SEC("kprobe/xfs_file_write_iter") -int netdata_xfs_file_write_iter(struct pt_regs *ctx) +int netdata_xfs_file_write_iter(struct pt_regs *ctx) { - return netdata_xfs_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_xfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&xfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } SEC("kprobe/xfs_file_open") -int netdata_xfs_file_open(struct pt_regs *ctx) +int netdata_xfs_file_open(struct pt_regs *ctx) { - return netdata_xfs_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_xfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&xfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } SEC("kprobe/xfs_file_fsync") -int netdata_xfs_file_fsync(struct pt_regs *ctx) +int netdata_xfs_file_fsync(struct pt_regs *ctx) { - return netdata_xfs_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_xfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&xfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } /************************************************************************************ - * + * * END Section - * + * ***********************************************************************************/ -static void netdata_xfs_store_bin(__u32 bin, __u32 selection) -{ - __u64 *fill, data; - __u32 idx = selection * NETDATA_FS_MAX_BINS + bin; - if (idx >= NETDATA_FS_MAX_ELEMENTS) - return; - - fill = bpf_map_lookup_elem(&tbl_xfs, &idx); - if (fill) { - libnetdata_update_u64(fill, 1); - return; - } - - data = 1; - bpf_map_update_elem(&tbl_xfs, &idx, &data, BPF_ANY); - - libnetdata_update_global(&xfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_DEL, 1); -} - SEC("kretprobe/xfs_file_read_iter") int netdata_ret_xfs_file_read_iter(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_xfs, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_xfs, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_xfs_store_bin(bin, NETDATA_KEY_CALLS_READ); - - return 0; + return netdata_xfs_ret(ctx, NETDATA_KEY_CALLS_READ); } SEC("kretprobe/xfs_file_write_iter") int netdata_ret_xfs_file_write_iter(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_xfs, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_xfs, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_xfs_store_bin(bin, NETDATA_KEY_CALLS_WRITE); - - return 0; + return netdata_xfs_ret(ctx, NETDATA_KEY_CALLS_WRITE); } SEC("kretprobe/xfs_file_open") int netdata_ret_xfs_file_open(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_xfs, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_xfs, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_xfs_store_bin(bin, NETDATA_KEY_CALLS_OPEN); - - return 0; + return netdata_xfs_ret(ctx, NETDATA_KEY_CALLS_OPEN); } SEC("kretprobe/xfs_file_fsync") -int netdata_ret_xfs_file_fsync(struct pt_regs *ctx) +int netdata_ret_xfs_file_fsync(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_xfs, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_xfs, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_xfs_store_bin(bin, NETDATA_KEY_CALLS_SYNC); - - return 0; + return netdata_xfs_ret(ctx, NETDATA_KEY_CALLS_SYNC); } char _license[] SEC("license") = "GPL"; - From 5d8ea78ce360d7c6a3ba92ea10000fbc20636a9c Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Wed, 4 Feb 2026 23:34:54 +0000 Subject: [PATCH 16/34] improve: Fix/Simplify ZFS --- kernel/zfs_kern.c | 191 ++++++++++++++++------------------------------ 1 file changed, 67 insertions(+), 124 deletions(-) diff --git a/kernel/zfs_kern.c b/kernel/zfs_kern.c index 33ae85f2..b743d851 100644 --- a/kernel/zfs_kern.c +++ b/kernel/zfs_kern.c @@ -14,9 +14,9 @@ #include "netdata_ebpf.h" /************************************************************************************ - * + * * MAP Section - * + * ***********************************************************************************/ NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_zfs, __u32, __u64, NETDATA_FS_MAX_ELEMENTS); @@ -24,176 +24,119 @@ NETDATA_BPF_HASH_DEF(tmp_zfs, __u32, __u64, 4192); NETDATA_BPF_ARRAY_DEF(zfs_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); /************************************************************************************ - * - * ENTRY Section - * + * + * Helper Functions + * ***********************************************************************************/ -static __always_inline int netdata_zfs_entry() +static __always_inline void netdata_zfs_store_bin(__u32 bin, __u32 selection) +{ + __u32 idx = selection * NETDATA_FS_MAX_BINS + bin; + if (idx >= NETDATA_FS_MAX_ELEMENTS) + return; + + __u64 *fill = bpf_map_lookup_elem(&tbl_zfs, &idx); + if (fill) { + libnetdata_update_u64(fill, 1); + return; + } + + bpf_map_update_elem(&tbl_zfs, &idx, &(unsigned long long){1}, BPF_ANY); + libnetdata_update_global(&zfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_DEL, 1); +} + +static __always_inline int netdata_zfs_ret(struct pt_regs *ctx, __u32 selector) { __u64 pid_tgid = bpf_get_current_pid_tgid(); __u32 pid = (__u32)(pid_tgid >> 32); - __u64 ts = bpf_ktime_get_ns(); - bpf_map_update_elem(&tmp_zfs, &pid, &ts, BPF_ANY); + __u64 *fill = bpf_map_lookup_elem(&tmp_zfs, &pid); + if (!fill) + return 0; + + __u64 data = bpf_ktime_get_ns() - *fill; + bpf_map_delete_elem(&tmp_zfs, &pid); - libnetdata_update_global(&zfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + if ((s64)data < 0) + return 0; + + data /= 1000; + __u32 bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); + netdata_zfs_store_bin(bin, selector); return 0; } +/************************************************************************************ + * + * ENTRY Section + * + ***********************************************************************************/ + SEC("kprobe/zpl_iter_read") -int netdata_zpl_iter_read(struct pt_regs *ctx) +int netdata_zpl_iter_read(struct pt_regs *ctx) { - return netdata_zfs_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_zfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&zfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } SEC("kprobe/zpl_iter_write") -int netdata_zpl_iter_write(struct pt_regs *ctx) +int netdata_zpl_iter_write(struct pt_regs *ctx) { - return netdata_zfs_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_zfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&zfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } SEC("kprobe/zpl_open") -int netdata_zpl_open(struct pt_regs *ctx) +int netdata_zpl_open(struct pt_regs *ctx) { - return netdata_zfs_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_zfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&zfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } SEC("kprobe/zpl_fsync") -int netdata_zpl_fsync(struct pt_regs *ctx) +int netdata_zpl_fsync(struct pt_regs *ctx) { - return netdata_zfs_entry(); + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_zfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&zfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + return 0; } /************************************************************************************ - * + * * END Section - * + * ***********************************************************************************/ -static void netdata_zfs_store_bin(__u32 bin, __u32 selection) -{ - __u64 *fill, data; - __u32 idx = selection * NETDATA_FS_MAX_BINS + bin; - if (idx >= NETDATA_FS_MAX_ELEMENTS) - return; - - fill = bpf_map_lookup_elem(&tbl_zfs, &idx); - if (fill) { - libnetdata_update_u64(fill, 1); - return; - } - - data = 1; - bpf_map_update_elem(&tbl_zfs, &idx, &data, BPF_ANY); - - libnetdata_update_global(&zfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_DEL, 1); -} - SEC("kretprobe/zpl_iter_read") int netdata_ret_zpl_iter_read(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_zfs, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_zfs, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_zfs_store_bin(bin, NETDATA_KEY_CALLS_READ); - - return 0; + return netdata_zfs_ret(ctx, NETDATA_KEY_CALLS_READ); } SEC("kretprobe/zpl_iter_write") int netdata_ret_zpl_iter_write(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_zfs, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_zfs, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_zfs_store_bin(bin, NETDATA_KEY_CALLS_WRITE); - - return 0; + return netdata_zfs_ret(ctx, NETDATA_KEY_CALLS_WRITE); } SEC("kretprobe/zpl_open") int netdata_ret_zpl_open(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_zfs, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_zfs, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_zfs_store_bin(bin, NETDATA_KEY_CALLS_OPEN); - - return 0; + return netdata_zfs_ret(ctx, NETDATA_KEY_CALLS_OPEN); } SEC("kretprobe/zpl_fsync") -int netdata_ret_zpl_fsync(struct pt_regs *ctx) +int netdata_ret_zpl_fsync(struct pt_regs *ctx) { - __u64 *fill, data; - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 bin, pid = (__u32)(pid_tgid >> 32); - - fill = bpf_map_lookup_elem(&tmp_zfs, &pid); - if (!fill) - return 0; - - data = bpf_ktime_get_ns() - *fill; - bpf_map_delete_elem(&tmp_zfs, &pid); - - // Skip entries with backward time - if ( (s64)data < 0) - return 0; - - // convert to microseconds - data /= 1000; - bin = libnetdata_select_idx(data, NETDATA_FS_MAX_BINS_POS); - netdata_zfs_store_bin(bin, NETDATA_KEY_CALLS_SYNC); - - return 0; + return netdata_zfs_ret(ctx, NETDATA_KEY_CALLS_SYNC); } char _license[] SEC("license") = "GPL"; - From e419b93e73781c9fe58b63913e0a610fd563da12 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Thu, 5 Feb 2026 00:06:58 +0000 Subject: [PATCH 17/34] improve: Fix/Simplify Disk --- kernel/disk_kern.c | 38 +++++++++++++++++++++++++------------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/kernel/disk_kern.c b/kernel/disk_kern.c index b7ef769d..f0e4750d 100644 --- a/kernel/disk_kern.c +++ b/kernel/disk_kern.c @@ -21,16 +21,34 @@ NETDATA_BPF_PERCPU_HASH_DEF(tbl_disk_iocall, block_key_t, __u64, NETDATA_DISK_HI NETDATA_BPF_HASH_DEF(tmp_disk_tp_stat, netdata_disk_key_t, __u64, 8192); NETDATA_BPF_ARRAY_DEF(disk_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); +/************************************************************************************ + * + * Helper Functions + * + ***********************************************************************************/ + +static __always_inline netdata_disk_key_t netdata_disk_key(struct netdata_block_rq_issue *ptr) +{ + netdata_disk_key_t key = { + .dev = ptr->dev, + .sector = (ptr->sector < 0) ? 0 : ptr->sector + }; + return key; +} + +/************************************************************************************ + * + * Tracepoints + * + ***********************************************************************************/ + SEC("tracepoint/block/block_rq_issue") int netdata_block_rq_issue(struct netdata_block_rq_issue *ptr) { if (!ptr->dev) return 0; - netdata_disk_key_t key = { - .dev = ptr->dev, - .sector = (ptr->sector < 0) ? 0 : ptr->sector - }; + netdata_disk_key_t key = netdata_disk_key(ptr); __u64 value = bpf_ktime_get_ns(); bpf_map_update_elem(&tmp_disk_tp_stat, &key, &value, BPF_ANY); @@ -43,17 +61,13 @@ int netdata_block_rq_issue(struct netdata_block_rq_issue *ptr) SEC("tracepoint/block/block_rq_complete") int netdata_block_rq_complete(struct netdata_block_rq_complete *ptr) { - netdata_disk_key_t key = { - .dev = ptr->dev, - .sector = (ptr->sector < 0) ? 0 : ptr->sector - }; + netdata_disk_key_t key = netdata_disk_key(ptr); __u64 *fill = bpf_map_lookup_elem(&tmp_disk_tp_stat, &key); if (!fill) return 0; - u64 curr = bpf_ktime_get_ns(); - curr -= *fill; + __u64 curr = bpf_ktime_get_ns() - *fill; curr /= 1000; block_key_t blk = { @@ -61,12 +75,11 @@ int netdata_block_rq_complete(struct netdata_block_rq_complete *ptr) .dev = netdata_new_encode_dev(ptr->dev) }; - __u64 data = 1; __u64 *update = bpf_map_lookup_elem(&tbl_disk_iocall, &blk); if (update) { libnetdata_update_u64(update, 1); } else { - bpf_map_update_elem(&tbl_disk_iocall, &blk, &data, BPF_ANY); + bpf_map_update_elem(&tbl_disk_iocall, &blk, &(__u64){1}, BPF_ANY); } bpf_map_delete_elem(&tmp_disk_tp_stat, &key); @@ -77,4 +90,3 @@ int netdata_block_rq_complete(struct netdata_block_rq_complete *ptr) } char _license[] SEC("license") = "GPL"; - From ee2629f6fdfbe8845c2261dfcb0c73ee3c40ad4f Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Thu, 5 Feb 2026 01:55:05 +0000 Subject: [PATCH 18/34] improve: Fix/Simplify Disk and Hardirq --- kernel/disk_kern.c | 7 +- kernel/hardirq_kern.c | 186 ++++++++++++------------------------------ 2 files changed, 57 insertions(+), 136 deletions(-) diff --git a/kernel/disk_kern.c b/kernel/disk_kern.c index f0e4750d..d84764dd 100644 --- a/kernel/disk_kern.c +++ b/kernel/disk_kern.c @@ -27,11 +27,12 @@ NETDATA_BPF_ARRAY_DEF(disk_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); * ***********************************************************************************/ -static __always_inline netdata_disk_key_t netdata_disk_key(struct netdata_block_rq_issue *ptr) +static __always_inline netdata_disk_key_t netdata_disk_key(void *ptr) { + struct netdata_block_rq_issue *issue = ptr; netdata_disk_key_t key = { - .dev = ptr->dev, - .sector = (ptr->sector < 0) ? 0 : ptr->sector + .dev = issue->dev, + .sector = (issue->sector < 0) ? 0 : issue->sector }; return key; } diff --git a/kernel/hardirq_kern.c b/kernel/hardirq_kern.c index 8c97f780..668f68d1 100644 --- a/kernel/hardirq_kern.c +++ b/kernel/hardirq_kern.c @@ -10,7 +10,6 @@ #include "bpf_helpers.h" #include "netdata_ebpf.h" - /************************************************************************************ * MAPS ***********************************************************************************/ @@ -25,17 +24,16 @@ NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_hardirq_static, __u32, hardirq_val_t, NETDATA_H SEC("tracepoint/irq/irq_handler_entry") int netdata_irq_handler_entry(struct netdata_irq_handler_entry *ptr) { - hardirq_key_t key = {}; - hardirq_val_t *valp, val = {}; + hardirq_key_t key = {0}; + hardirq_val_t val = {0}; key.irq = ptr->irq; - valp = bpf_map_lookup_elem(&tbl_hardirq, &key); + hardirq_val_t *valp = bpf_map_lookup_elem(&tbl_hardirq, &key); if (valp) { valp->ts = bpf_ktime_get_ns(); } else { val.latency = 0; val.ts = bpf_ktime_get_ns(); - // TP_DATA_LOC_READ_CONST(val.name, ptr, ptr->data_loc_name, NETDATA_HARDIRQ_NAME_LEN); bpf_map_update_elem(&tbl_hardirq, &key, &val, BPF_ANY); } @@ -45,17 +43,15 @@ int netdata_irq_handler_entry(struct netdata_irq_handler_entry *ptr) SEC("tracepoint/irq/irq_handler_exit") int netdata_irq_handler_exit(struct netdata_irq_handler_exit *ptr) { - hardirq_key_t key = {}; - hardirq_val_t *valp; + hardirq_key_t key = {0}; key.irq = ptr->irq; - valp = bpf_map_lookup_elem(&tbl_hardirq, &key); + hardirq_val_t *valp = bpf_map_lookup_elem(&tbl_hardirq, &key); if (!valp) { return 0; } - // get time diff and convert to microseconds. - u64 latency = (bpf_ktime_get_ns() - valp->ts) / 1000; + __u64 latency = (bpf_ktime_get_ns() - valp->ts) / 1000; libnetdata_update_u64(&valp->latency, latency); return 0; @@ -65,164 +61,88 @@ int netdata_irq_handler_exit(struct netdata_irq_handler_exit *ptr) * HARDIRQ STATIC ***********************************************************************************/ -#define HARDIRQ_STATIC_GEN_ENTRY(__type, __enum_idx) \ -int netdata_irq_ ##__type(struct netdata_irq_vectors_entry *ptr) \ -{ \ - u32 idx; \ - hardirq_val_t *valp, val = {}; \ - \ - idx = __enum_idx; \ - valp = bpf_map_lookup_elem(&tbl_hardirq_static, &idx); \ - if (valp) { \ - valp->ts = bpf_ktime_get_ns(); \ - } else { \ - val.latency = 0; \ - val.ts = bpf_ktime_get_ns(); \ - bpf_map_update_elem(&tbl_hardirq_static, &idx, &val, BPF_ANY); \ - } \ - \ - return 0; \ +#define HARDIRQ_STATIC_GEN_ENTRY(__type, __enum_idx) \ +int netdata_irq_ ##__type(struct netdata_irq_vectors_entry *ptr) \ +{ \ + __u32 key = __enum_idx; \ + hardirq_val_t val = {0}; \ + hardirq_val_t *valp = bpf_map_lookup_elem(&tbl_hardirq_static, &key); \ + if (valp) { \ + valp->ts = bpf_ktime_get_ns(); \ + } else { \ + val.latency = 0; \ + val.ts = bpf_ktime_get_ns(); \ + bpf_map_update_elem(&tbl_hardirq_static, &key, &val, BPF_ANY); \ + } \ + return 0; \ } -#define HARDIRQ_STATIC_GEN_EXIT(__type, __enum_idx) \ -int netdata_irq_ ##__type(struct netdata_irq_vectors_exit *ptr) \ -{ \ - u32 idx; \ - hardirq_val_t *valp; \ - \ - idx = __enum_idx; \ - valp = bpf_map_lookup_elem(&tbl_hardirq_static, &idx); \ - if (!valp) { \ - return 0; \ - } \ - \ - /* get time diff and convert to microseconds. */ \ - u64 latency = (bpf_ktime_get_ns() - valp->ts) / 1000; \ - libnetdata_update_u64(&valp->latency, latency); \ - \ - return 0; \ +#define HARDIRQ_STATIC_GEN_EXIT(__type, __enum_idx) \ +int netdata_irq_ ##__type(struct netdata_irq_vectors_exit *ptr) \ +{ \ + __u32 key = __enum_idx; \ + hardirq_val_t *valp = bpf_map_lookup_elem(&tbl_hardirq_static, &key); \ + if (!valp) { \ + return 0; \ + } \ + __u64 latency = (bpf_ktime_get_ns() - valp->ts) / 1000; \ + libnetdata_update_u64(&valp->latency, latency); \ + return 0; \ } SEC("tracepoint/irq_vectors/thermal_apic_entry") -HARDIRQ_STATIC_GEN_ENTRY( - thermal_apic_entry, - NETDATA_HARDIRQ_STATIC_APIC_THERMAL -) +HARDIRQ_STATIC_GEN_ENTRY(thermal_apic_entry, NETDATA_HARDIRQ_STATIC_APIC_THERMAL) SEC("tracepoint/irq_vectors/thermal_apic_exit") -HARDIRQ_STATIC_GEN_EXIT( - thermal_apic_exit, - NETDATA_HARDIRQ_STATIC_APIC_THERMAL -) +HARDIRQ_STATIC_GEN_EXIT(thermal_apic_exit, NETDATA_HARDIRQ_STATIC_APIC_THERMAL) SEC("tracepoint/irq_vectors/threshold_apic_entry") -HARDIRQ_STATIC_GEN_ENTRY( - threshold_apic_entry, - NETDATA_HARDIRQ_STATIC_APIC_THRESHOLD -) +HARDIRQ_STATIC_GEN_ENTRY(threshold_apic_entry, NETDATA_HARDIRQ_STATIC_APIC_THRESHOLD) SEC("tracepoint/irq_vectors/threshold_apic_exit") -HARDIRQ_STATIC_GEN_EXIT( - threshold_apic_exit, - NETDATA_HARDIRQ_STATIC_APIC_THRESHOLD -) +HARDIRQ_STATIC_GEN_EXIT(threshold_apic_exit, NETDATA_HARDIRQ_STATIC_APIC_THRESHOLD) SEC("tracepoint/irq_vectors/error_apic_entry") -HARDIRQ_STATIC_GEN_ENTRY( - error_apic_entry, - NETDATA_HARDIRQ_STATIC_APIC_ERROR -) +HARDIRQ_STATIC_GEN_ENTRY(error_apic_entry, NETDATA_HARDIRQ_STATIC_APIC_ERROR) SEC("tracepoint/irq_vectors/error_apic_exit") -HARDIRQ_STATIC_GEN_EXIT( - error_apic_exit, - NETDATA_HARDIRQ_STATIC_APIC_ERROR -) +HARDIRQ_STATIC_GEN_EXIT(error_apic_exit, NETDATA_HARDIRQ_STATIC_APIC_ERROR) SEC("tracepoint/irq_vectors/deferred_error_apic_entry") -HARDIRQ_STATIC_GEN_ENTRY( - deferred_error_apic_entry, - NETDATA_HARDIRQ_STATIC_APIC_DEFERRED_ERROR -) +HARDIRQ_STATIC_GEN_ENTRY(deferred_error_apic_entry, NETDATA_HARDIRQ_STATIC_APIC_DEFERRED_ERROR) SEC("tracepoint/irq_vectors/deferred_error_apic_exit") -HARDIRQ_STATIC_GEN_EXIT( - deferred_error_apic_exit, - NETDATA_HARDIRQ_STATIC_APIC_DEFERRED_ERROR -) +HARDIRQ_STATIC_GEN_EXIT(deferred_error_apic_exit, NETDATA_HARDIRQ_STATIC_APIC_DEFERRED_ERROR) SEC("tracepoint/irq_vectors/spurious_apic_entry") -HARDIRQ_STATIC_GEN_ENTRY( - spurious_apic_entry, - NETDATA_HARDIRQ_STATIC_APIC_SPURIOUS -) +HARDIRQ_STATIC_GEN_ENTRY(spurious_apic_entry, NETDATA_HARDIRQ_STATIC_APIC_SPURIOUS) SEC("tracepoint/irq_vectors/spurious_apic_exit") -HARDIRQ_STATIC_GEN_EXIT( - spurious_apic_exit, - NETDATA_HARDIRQ_STATIC_APIC_SPURIOUS -) +HARDIRQ_STATIC_GEN_EXIT(spurious_apic_exit, NETDATA_HARDIRQ_STATIC_APIC_SPURIOUS) SEC("tracepoint/irq_vectors/call_function_entry") -HARDIRQ_STATIC_GEN_ENTRY( - call_function_entry, - NETDATA_HARDIRQ_STATIC_FUNC_CALL -) +HARDIRQ_STATIC_GEN_ENTRY(call_function_entry, NETDATA_HARDIRQ_STATIC_FUNC_CALL) SEC("tracepoint/irq_vectors/call_function_exit") -HARDIRQ_STATIC_GEN_EXIT( - call_function_exit, - NETDATA_HARDIRQ_STATIC_FUNC_CALL -) +HARDIRQ_STATIC_GEN_EXIT(call_function_exit, NETDATA_HARDIRQ_STATIC_FUNC_CALL) SEC("tracepoint/irq_vectors/call_function_single_entry") -HARDIRQ_STATIC_GEN_ENTRY( - call_function_single_entry, - NETDATA_HARDIRQ_STATIC_FUNC_CALL_SINGLE -) +HARDIRQ_STATIC_GEN_ENTRY(call_function_single_entry, NETDATA_HARDIRQ_STATIC_FUNC_CALL_SINGLE) SEC("tracepoint/irq_vectors/call_function_single_exit") -HARDIRQ_STATIC_GEN_EXIT( - call_function_single_exit, - NETDATA_HARDIRQ_STATIC_FUNC_CALL_SINGLE -) +HARDIRQ_STATIC_GEN_EXIT(call_function_single_exit, NETDATA_HARDIRQ_STATIC_FUNC_CALL_SINGLE) SEC("tracepoint/irq_vectors/reschedule_entry") -HARDIRQ_STATIC_GEN_ENTRY( - reschedule_entry, - NETDATA_HARDIRQ_STATIC_RESCHEDULE -) +HARDIRQ_STATIC_GEN_ENTRY(reschedule_entry, NETDATA_HARDIRQ_STATIC_RESCHEDULE) SEC("tracepoint/irq_vectors/reschedule_exit") -HARDIRQ_STATIC_GEN_EXIT( - reschedule_exit, - NETDATA_HARDIRQ_STATIC_RESCHEDULE -) +HARDIRQ_STATIC_GEN_EXIT(reschedule_exit, NETDATA_HARDIRQ_STATIC_RESCHEDULE) SEC("tracepoint/irq_vectors/local_timer_entry") -HARDIRQ_STATIC_GEN_ENTRY( - local_timer_entry, - NETDATA_HARDIRQ_STATIC_LOCAL_TIMER -) +HARDIRQ_STATIC_GEN_ENTRY(local_timer_entry, NETDATA_HARDIRQ_STATIC_LOCAL_TIMER) SEC("tracepoint/irq_vectors/local_timer_exit") -HARDIRQ_STATIC_GEN_EXIT( - local_timer_exit, - NETDATA_HARDIRQ_STATIC_LOCAL_TIMER -) +HARDIRQ_STATIC_GEN_EXIT(local_timer_exit, NETDATA_HARDIRQ_STATIC_LOCAL_TIMER) SEC("tracepoint/irq_vectors/irq_work_entry") -HARDIRQ_STATIC_GEN_ENTRY( - irq_work_entry, - NETDATA_HARDIRQ_STATIC_IRQ_WORK -) +HARDIRQ_STATIC_GEN_ENTRY(irq_work_entry, NETDATA_HARDIRQ_STATIC_IRQ_WORK) SEC("tracepoint/irq_vectors/irq_work_exit") -HARDIRQ_STATIC_GEN_EXIT( - irq_work_exit, - NETDATA_HARDIRQ_STATIC_IRQ_WORK -) +HARDIRQ_STATIC_GEN_EXIT(irq_work_exit, NETDATA_HARDIRQ_STATIC_IRQ_WORK) SEC("tracepoint/irq_vectors/x86_platform_ipi_entry") -HARDIRQ_STATIC_GEN_ENTRY( - x86_platform_ipi_entry, - NETDATA_HARDIRQ_STATIC_X86_PLATFORM_IPI -) +HARDIRQ_STATIC_GEN_ENTRY(x86_platform_ipi_entry, NETDATA_HARDIRQ_STATIC_X86_PLATFORM_IPI) SEC("tracepoint/irq_vectors/x86_platform_ipi_exit") -HARDIRQ_STATIC_GEN_EXIT( - x86_platform_ipi_exit, - NETDATA_HARDIRQ_STATIC_X86_PLATFORM_IPI -) +HARDIRQ_STATIC_GEN_EXIT(x86_platform_ipi_exit, NETDATA_HARDIRQ_STATIC_X86_PLATFORM_IPI) char _license[] SEC("license") = "GPL"; - From 43fe1a3619a20b79907037e1faa50f590465ce83 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Fri, 6 Feb 2026 01:42:27 +0000 Subject: [PATCH 19/34] update_libbpf: Improve/fix oomkill --- kernel/oomkill_kern.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/kernel/oomkill_kern.c b/kernel/oomkill_kern.c index 61b6d8c2..361aa9e5 100644 --- a/kernel/oomkill_kern.c +++ b/kernel/oomkill_kern.c @@ -16,9 +16,8 @@ NETDATA_BPF_HASH_DEF(tbl_oomkill, int, __u8, NETDATA_OOMKILL_MAX_ENTRIES); SEC("tracepoint/oom/mark_victim") int netdata_oom_mark_victim(struct netdata_oom_mark_victim_entry *ptr) { - int key = ptr->pid; - u8 val = 0; - bpf_map_update_elem(&tbl_oomkill, &key, &val, BPF_ANY); + u8 zero = 0; + bpf_map_update_elem(&tbl_oomkill, &ptr->pid, &zero, BPF_ANY); return 0; } From 7c17cada4edb2d2c1dad9c0a56de618d27ab858b Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Fri, 6 Feb 2026 02:15:59 +0000 Subject: [PATCH 20/34] update_libbpf: Improve/fix process --- kernel/process_kern.c | 46 +++++++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 24 deletions(-) diff --git a/kernel/process_kern.c b/kernel/process_kern.c index 2e65c67a..1ba5c61a 100644 --- a/kernel/process_kern.c +++ b/kernel/process_kern.c @@ -35,7 +35,7 @@ NETDATA_BPF_ARRAY_DEF(process_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); static inline void netdata_fill_common_process_data(struct netdata_pid_stat_t *data) { __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 tgid = (__u32)pid_tgid >>32; + __u32 tgid = (__u32)(pid_tgid >> 32); __u32 pid = (__u32)pid_tgid; data->ct = bpf_ktime_get_ns(); @@ -62,14 +62,14 @@ int netdata_tracepoint_sched_process_exit(struct netdata_sched_process_exit *ptr struct netdata_pid_stat_t *fill; libnetdata_update_global(&tbl_total_stats, NETDATA_KEY_CALLS_DO_EXIT, 1); - __u32 key = 0; - __u32 tgid = 0; if (!monitor_apps(&process_ctrl)) return 0; + __u32 key = 0; + __u32 tgid = 0; fill = netdata_get_pid_structure(&key, &tgid, &process_ctrl, &tbl_pid_stats); if (fill) { - libnetdata_update_u32(&fill->exit_call, 1) ; + libnetdata_update_u32(&fill->exit_call, 1); } return 0; @@ -81,14 +81,14 @@ int netdata_release_task(struct pt_regs* ctx) struct netdata_pid_stat_t *fill; libnetdata_update_global(&tbl_total_stats, NETDATA_KEY_CALLS_RELEASE_TASK, 1); - __u32 key = 0; - __u32 tgid = 0; if (!monitor_apps(&process_ctrl)) return 0; + __u32 key = 0; + __u32 tgid = 0; fill = netdata_get_pid_structure(&key, &tgid, &process_ctrl, &tbl_pid_stats); if (fill) { - libnetdata_update_u32(&fill->release_call, 1) ; + libnetdata_update_u32(&fill->release_call, 1); libnetdata_update_global(&process_ctrl, NETDATA_CONTROLLER_PID_TABLE_DEL, 1); } @@ -101,18 +101,17 @@ int netdata_tracepoint_sched_process_exec(struct netdata_sched_process_exec *ptr { struct netdata_pid_stat_t data = { }; struct netdata_pid_stat_t *fill; - // This is necessary, because it represents the main function to start a thread libnetdata_update_global(&tbl_total_stats, NETDATA_KEY_CALLS_PROCESS, 1); - __u32 key = 0; - __u32 tgid = 0; if (!monitor_apps(&process_ctrl)) return 0; + __u32 key = 0; + __u32 tgid = 0; fill = netdata_get_pid_structure(&key, &tgid, &process_ctrl, &tbl_pid_stats); if (fill) { fill->release_call = 0; - libnetdata_update_u32(&fill->create_process, 1) ; + libnetdata_update_u32(&fill->create_process, 1); } else { netdata_fill_common_process_data(&data); data.create_process = 1; @@ -137,18 +136,17 @@ int netdata_tracepoint_sched_process_fork(struct netdata_sched_process_fork *ptr libnetdata_update_global(&tbl_total_stats, NETDATA_KEY_CALLS_PROCESS, 1); - // Parent ID = 1 means that init called process/thread creation int thread = 0; if (ptr->parent_pid != ptr->child_pid && ptr->parent_pid != 1) { thread = 1; libnetdata_update_global(&tbl_total_stats, NETDATA_KEY_CALLS_THREAD, 1); } - __u32 key = 0; - __u32 tgid = 0; if (!monitor_apps(&process_ctrl)) return 0; + __u32 key = 0; + __u32 tgid = 0; fill = netdata_get_pid_structure(&key, &tgid, &process_ctrl, &tbl_pid_stats); if (fill) { fill->release_call = 0; @@ -196,22 +194,22 @@ int netdata_fork(struct pt_regs* ctx) #if NETDATASEL < 2 if (ret < 0) { libnetdata_update_global(&tbl_total_stats, NETDATA_KEY_ERROR_PROCESS, 1); - } + } #endif - __u32 key = 0; - __u32 tgid = 0; if (!monitor_apps(&process_ctrl)) return 0; + __u32 key = 0; + __u32 tgid = 0; fill = netdata_get_pid_structure(&key, &tgid, &process_ctrl, &tbl_pid_stats); if (fill) { fill->release_call = 0; #if NETDATASEL < 2 if (ret < 0) { - libnetdata_update_u32(&fill->task_err, 1) ; - } + libnetdata_update_u32(&fill->task_err, 1); + } #endif } else { netdata_fill_common_process_data(&data); @@ -247,22 +245,22 @@ int netdata_sys_clone(struct pt_regs *ctx) #if NETDATASEL < 2 if (ret < 0) { libnetdata_update_global(&tbl_total_stats, NETDATA_KEY_ERROR_PROCESS, 1); - } + } #endif - __u32 key = 0; - __u32 tgid = 0; if (!monitor_apps(&process_ctrl)) return 0; + __u32 key = 0; + __u32 tgid = 0; fill = netdata_get_pid_structure(&key, &tgid, &process_ctrl, &tbl_pid_stats); if (fill) { fill->release_call = 0; #if NETDATASEL < 2 if (ret < 0) { - libnetdata_update_u32(&fill->task_err, 1) ; - } + libnetdata_update_u32(&fill->task_err, 1); + } #endif } else { netdata_fill_common_process_data(&data); From e1f560a91fd2203013accc955609fc6a80e1581f Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Fri, 6 Feb 2026 03:17:45 +0000 Subject: [PATCH 21/34] update_libbpf: Improve/fix network_viewer --- kernel/network_viewer_kern.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/kernel/network_viewer_kern.c b/kernel/network_viewer_kern.c index 763e4246..6bbdf96d 100644 --- a/kernel/network_viewer_kern.c +++ b/kernel/network_viewer_kern.c @@ -77,7 +77,7 @@ static __always_inline __u16 set_nv_idx_value(netdata_nv_idx_t *nvi, struct sock #if (LINUX_VERSION_CODE < KERNEL_VERSION(5,6,0)) static __always_inline u8 select_protocol(struct sock *sk) { - u8 protocol = 0; + u8 protocol; int gso_max_segs_offset = offsetof(struct sock, sk_gso_max_segs); int sk_lingertime_offset = offsetof(struct sock, sk_lingertime); @@ -95,7 +95,7 @@ static __always_inline u8 select_protocol(struct sock *sk) return protocol; } -#endif // Kernel version 5.6.0 +#endif static __always_inline __s32 am_i_monitoring_protocol(struct sock *sk) { @@ -104,7 +104,6 @@ static __always_inline __s32 am_i_monitoring_protocol(struct sock *sk) return 0; #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,6,0)) - protocol = 0; bpf_probe_read(&protocol, sizeof(u16), &sk->sk_protocol); #else protocol = (u16) select_protocol(sk); @@ -196,7 +195,7 @@ static __always_inline void set_common_udp_nv_data(netdata_nv_data_t *data, data->protocol = IPPROTO_UDP; data->family = family; unsigned char state; - bpf_probe_read(&state, sizeof(state), &sk->sk_state); + bpf_probe_read(&state, sizeof(state), (void *)&sk->sk_state); data->state = (int)state; #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) bpf_get_current_comm(&data->name, TASK_COMM_LEN); From 9dbbca41c11c27d1258fedc5822df6a13b372efc Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Wed, 11 Feb 2026 19:11:57 +0000 Subject: [PATCH 22/34] improve: Adjust kern files --- kernel/oomkill_kern.c | 4 +++- kernel/shm_kern.c | 36 ++++++++++++------------------------ 2 files changed, 15 insertions(+), 25 deletions(-) diff --git a/kernel/oomkill_kern.c b/kernel/oomkill_kern.c index 361aa9e5..571d5f43 100644 --- a/kernel/oomkill_kern.c +++ b/kernel/oomkill_kern.c @@ -17,7 +17,9 @@ NETDATA_BPF_HASH_DEF(tbl_oomkill, int, __u8, NETDATA_OOMKILL_MAX_ENTRIES); SEC("tracepoint/oom/mark_victim") int netdata_oom_mark_victim(struct netdata_oom_mark_victim_entry *ptr) { u8 zero = 0; - bpf_map_update_elem(&tbl_oomkill, &ptr->pid, &zero, BPF_ANY); + int pid; + bpf_probe_read(&pid, sizeof(pid), &ptr->pid); + bpf_map_update_elem(&tbl_oomkill, &pid, &zero, BPF_ANY); return 0; } diff --git a/kernel/shm_kern.c b/kernel/shm_kern.c index 367713ac..806cbb2e 100644 --- a/kernel/shm_kern.c +++ b/kernel/shm_kern.c @@ -22,20 +22,18 @@ SEC("kprobe/" NETDATA_SYSCALL(shmget)) #endif int netdata_syscall_shmget(struct pt_regs *ctx) { - netdata_shm_t data = {}; - libnetdata_update_global(&tbl_shm, NETDATA_KEY_SHMGET_CALL, 1); - // check if apps is enabled; if not, don't record apps data. - __u32 key = 0; - __u32 tgid = 0; if (!monitor_apps(&shm_ctrl)) return 0; + __u32 key = 0; + __u32 tgid = 0; netdata_shm_t *fill = netdata_get_pid_structure(&key, &tgid, &shm_ctrl, &tbl_pid_shm); if (fill) { libnetdata_update_u32(&fill->get, 1); } else { + netdata_shm_t data = {}; data.ct = bpf_ktime_get_ns(); libnetdata_update_uid_gid(&data.uid, &data.gid); data.tgid = tgid; @@ -44,7 +42,6 @@ int netdata_syscall_shmget(struct pt_regs *ctx) #else data.name[0] = '\0'; #endif - data.get = 1; bpf_map_update_elem(&tbl_pid_shm, &key, &data, BPF_ANY); @@ -61,20 +58,18 @@ SEC("kprobe/" NETDATA_SYSCALL(shmat)) #endif int netdata_syscall_shmat(struct pt_regs *ctx) { - netdata_shm_t data = {}; - libnetdata_update_global(&tbl_shm, NETDATA_KEY_SHMAT_CALL, 1); - // check if apps is enabled; if not, don't record apps data. - __u32 key = 0; - __u32 tgid = 0; if (!monitor_apps(&shm_ctrl)) return 0; + __u32 key = 0; + __u32 tgid = 0; netdata_shm_t *fill = netdata_get_pid_structure(&key, &tgid, &shm_ctrl, &tbl_pid_shm); if (fill) { libnetdata_update_u32(&fill->at, 1); } else { + netdata_shm_t data = {}; data.ct = bpf_ktime_get_ns(); libnetdata_update_uid_gid(&data.uid, &data.gid); data.tgid = tgid; @@ -83,7 +78,6 @@ int netdata_syscall_shmat(struct pt_regs *ctx) #else data.name[0] = '\0'; #endif - data.at = 1; bpf_map_update_elem(&tbl_pid_shm, &key, &data, BPF_ANY); @@ -100,20 +94,18 @@ SEC("kprobe/" NETDATA_SYSCALL(shmdt)) #endif int netdata_syscall_shmdt(struct pt_regs *ctx) { - netdata_shm_t data = {}; - libnetdata_update_global(&tbl_shm, NETDATA_KEY_SHMDT_CALL, 1); - // check if apps is enabled; if not, don't record apps data. - __u32 key = 0; - __u32 tgid = 0; if (!monitor_apps(&shm_ctrl)) return 0; + __u32 key = 0; + __u32 tgid = 0; netdata_shm_t *fill = netdata_get_pid_structure(&key, &tgid, &shm_ctrl, &tbl_pid_shm); if (fill) { libnetdata_update_u32(&fill->dt, 1); } else { + netdata_shm_t data = {}; data.ct = bpf_ktime_get_ns(); libnetdata_update_uid_gid(&data.uid, &data.gid); data.tgid = tgid; @@ -122,7 +114,6 @@ int netdata_syscall_shmdt(struct pt_regs *ctx) #else data.name[0] = '\0'; #endif - data.dt = 1; bpf_map_update_elem(&tbl_pid_shm, &key, &data, BPF_ANY); @@ -139,20 +130,18 @@ SEC("kprobe/" NETDATA_SYSCALL(shmctl)) #endif int netdata_syscall_shmctl(struct pt_regs *ctx) { - netdata_shm_t data = {}; - libnetdata_update_global(&tbl_shm, NETDATA_KEY_SHMCTL_CALL, 1); - // check if apps is enabled; if not, don't record apps data. - __u32 key = 0; - __u32 tgid = 0; if (!monitor_apps(&shm_ctrl)) return 0; + __u32 key = 0; + __u32 tgid = 0; netdata_shm_t *fill = netdata_get_pid_structure(&key, &tgid, &shm_ctrl, &tbl_pid_shm); if (fill) { libnetdata_update_u32(&fill->ctl, 1); } else { + netdata_shm_t data = {}; data.ct = bpf_ktime_get_ns(); libnetdata_update_uid_gid(&data.uid, &data.gid); data.tgid = tgid; @@ -161,7 +150,6 @@ int netdata_syscall_shmctl(struct pt_regs *ctx) #else data.name[0] = '\0'; #endif - data.ctl = 1; bpf_map_update_elem(&tbl_pid_shm, &key, &data, BPF_ANY); From ac2e735491b639890c5abaaa03a9b8c79df4001d Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Wed, 11 Feb 2026 20:11:37 +0000 Subject: [PATCH 23/34] improve: Fix socket --- kernel/socket_kern.c | 37 +++++++++++++------------------------ 1 file changed, 13 insertions(+), 24 deletions(-) diff --git a/kernel/socket_kern.c b/kernel/socket_kern.c index 9e112312..47492ce8 100644 --- a/kernel/socket_kern.c +++ b/kernel/socket_kern.c @@ -56,12 +56,11 @@ static __always_inline __u16 set_idx_value(netdata_socket_idx_t *nsi, struct ine // Check necessary according https://elixir.bootlin.com/linux/v5.6.14/source/include/net/sock.h#L199 #if IS_ENABLED(CONFIG_IPV6) else if ( family == AF_INET6 ) { - // struct in6_addr *addr6 = &is->sk.sk_v6_rcv_saddr; // bind to local address - struct in6_addr *addr6 = &is->sk.__sk_common.skc_v6_rcv_saddr.s6_addr; - bpf_probe_read(&nsi->saddr.addr8, sizeof(__u8)*16, &addr6->s6_addr); + __u8 (*addr6)[16] = &is->sk.__sk_common.skc_v6_rcv_saddr.s6_addr; + bpf_probe_read(&nsi->saddr.addr8, sizeof(__u8)*16, addr6); addr6 = &is->sk.__sk_common.skc_v6_daddr.s6_addr; - bpf_probe_read(&nsi->daddr.addr8, sizeof(__u8)*16, &addr6->s6_addr); + bpf_probe_read(&nsi->daddr.addr8, sizeof(__u8)*16, addr6); if (((nsi->saddr.addr64[0] == 0) && (nsi->saddr.addr64[1] == 72057594037927936)) || // Loopback ((nsi->daddr.addr64[0] == 0) && (nsi->daddr.addr64[1] == 72057594037927936))) @@ -86,7 +85,6 @@ static __always_inline __u16 set_idx_value(netdata_socket_idx_t *nsi, struct ine if (nsi->dport == 0) return AF_UNSPEC; - __u32 tgid = 0; nsi->pid = netdata_get_pid(&socket_ctrl, &tgid); @@ -160,14 +158,12 @@ static __always_inline void update_socket_table(struct pt_regs* ctx, if (family == AF_UNSPEC) return; - netdata_socket_t *val; - netdata_socket_t data = { }; - - val = (netdata_socket_t *) bpf_map_lookup_elem(&tbl_nd_socket, &idx); + netdata_socket_t *val = (netdata_socket_t *) bpf_map_lookup_elem(&tbl_nd_socket, &idx); if (val) { update_socket_stats(val, sent, received, retransmitted, protocol); val->tcp.state = state; } else { + netdata_socket_t data = { }; update_socket_common(&data, protocol, family); data.tcp.state = state; update_socket_stats(&data, sent, received, retransmitted, protocol); @@ -205,16 +201,12 @@ static __always_inline void update_pid_connection(struct pt_regs* ctx) { netdata_socket_idx_t idx = { }; - netdata_socket_t *stored; - netdata_socket_t data = { }; - struct inet_sock *is = inet_sk((struct sock *)PT_REGS_PARM1(ctx)); - __u16 family = set_idx_value(&idx, is); if (family == AF_UNSPEC) return; - stored = (netdata_socket_t *) bpf_map_lookup_elem(&tbl_nd_socket, &idx); + netdata_socket_t *stored = (netdata_socket_t *) bpf_map_lookup_elem(&tbl_nd_socket, &idx); if (stored) { stored->ct = bpf_ktime_get_ns(); @@ -223,6 +215,7 @@ static __always_inline void update_pid_connection(struct pt_regs* ctx) else libnetdata_update_u32(&stored->tcp.ipv6_connect, 1); } else { + netdata_socket_t data = { }; update_socket_common(&data, IPPROTO_TCP, family); if (family == AF_INET) data.tcp.ipv4_connect = 1; @@ -244,15 +237,12 @@ static __always_inline void update_pid_connection(struct pt_regs* ctx) SEC("kretprobe/inet_csk_accept") int netdata_inet_csk_accept(struct pt_regs* ctx) { - netdata_passive_connection_t data = { }; - netdata_passive_connection_idx_t idx = { }; struct sock *sk = (struct sock *)PT_REGS_RC(ctx); - u16 protocol; if (!sk) return 0; + u16 protocol; #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,6,0)) - protocol = 0; bpf_probe_read(&protocol, sizeof(u16), &sk->sk_protocol); #else protocol = (u16) select_protocol(sk); @@ -261,20 +251,21 @@ int netdata_inet_csk_accept(struct pt_regs* ctx) if (protocol != IPPROTO_TCP && protocol != IPPROTO_UDP) return 0; + netdata_passive_connection_idx_t idx = { }; idx.protocol = protocol; bpf_probe_read(&idx.port, sizeof(u16), &sk->__sk_common.skc_num); __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u32 tgid = (__u32)pid_tgid >>32; + __u32 tgid = pid_tgid >> 32; __u32 pid = (__u32)pid_tgid; netdata_passive_connection_t *value = (netdata_passive_connection_t *)bpf_map_lookup_elem(&tbl_lports, &idx); if (value) { - // Update PID, because process can die. value->tgid = tgid; value->pid = pid; libnetdata_update_u64(&value->counter, 1); } else { + netdata_passive_connection_t data = { }; data.tgid = tgid; data.pid = pid; data.counter = 1; @@ -289,13 +280,11 @@ int netdata_inet_csk_accept(struct pt_regs* ctx) if (family == AF_UNSPEC) return 0; - netdata_socket_t *val; - netdata_socket_t nv_data = { }; - - val = (netdata_socket_t *) bpf_map_lookup_elem(&tbl_nd_socket, &nv_idx); + netdata_socket_t *val = (netdata_socket_t *) bpf_map_lookup_elem(&tbl_nd_socket, &nv_idx); if (val) { libnetdata_update_u32(&val->external_origin, 1); } else { + netdata_socket_t nv_data = { }; update_socket_common(&nv_data, protocol, family); nv_data.external_origin = 1; From 54fa5bf28dafaa4bb32b1c04cb0c03c418c904e6 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Wed, 11 Feb 2026 21:41:51 +0000 Subject: [PATCH 24/34] improve: Fix softirq --- kernel/softirq_kern.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/kernel/softirq_kern.c b/kernel/softirq_kern.c index f73d0418..97085709 100644 --- a/kernel/softirq_kern.c +++ b/kernel/softirq_kern.c @@ -23,19 +23,17 @@ NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_softirq, __u32, softirq_val_t, NETDATA_SOFTIRQ_ SEC("tracepoint/irq/softirq_entry") int netdata_softirq_entry(struct netdata_softirq_entry *ptr) { - softirq_val_t *valp, val = {}; u32 vec = ptr->vec; - // out-of-range index. if (vec > NETDATA_SOFTIRQ_MAX_IRQS-1) { return 0; } - valp = bpf_map_lookup_elem(&tbl_softirq, &vec); + softirq_val_t *valp = bpf_map_lookup_elem(&tbl_softirq, &vec); if (valp) { valp->ts = bpf_ktime_get_ns(); } else { - val.latency = 0; + softirq_val_t val = {}; val.ts = bpf_ktime_get_ns(); bpf_map_update_elem(&tbl_softirq, &vec, &val, BPF_ANY); } @@ -46,20 +44,17 @@ int netdata_softirq_entry(struct netdata_softirq_entry *ptr) SEC("tracepoint/irq/softirq_exit") int netdata_softirq_exit(struct netdata_softirq_exit *ptr) { - softirq_val_t *valp; u32 vec = ptr->vec; - // out-of-range index. if (vec > NETDATA_SOFTIRQ_MAX_IRQS-1) { return 0; } - valp = bpf_map_lookup_elem(&tbl_softirq, &vec); + softirq_val_t *valp = bpf_map_lookup_elem(&tbl_softirq, &vec); if (!valp) { return 0; } - // get time diff and convert to microseconds. u64 latency = (bpf_ktime_get_ns() - valp->ts) / 1000; libnetdata_update_u64(&valp->latency, latency); From 282bd0668d76ba616d54bfe3763a4a3b791ea294 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Thu, 12 Feb 2026 01:24:13 +0000 Subject: [PATCH 25/34] improve: Swap --- kernel/swap_kern.c | 85 +++++++++++++++++----------------------------- 1 file changed, 32 insertions(+), 53 deletions(-) diff --git a/kernel/swap_kern.c b/kernel/swap_kern.c index 464917ea..a44c77be 100644 --- a/kernel/swap_kern.c +++ b/kernel/swap_kern.c @@ -11,42 +11,19 @@ #include "bpf_helpers.h" #include "netdata_ebpf.h" -/************************************************************************************ - * - * MAPS - * - ***********************************************************************************/ - NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_swap, __u32, __u64, NETDATA_SWAP_END); NETDATA_BPF_HASH_DEF(tbl_pid_swap, __u32, netdata_swap_access_t, PID_MAX_DEFAULT); NETDATA_BPF_ARRAY_DEF(swap_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); -/************************************************************************************ - * - * SWAP SECTION - * - ***********************************************************************************/ - -#if (LINUX_VERSION_CODE > KERNEL_VERSION(6,7,255)) -SEC("kprobe/swap_read_folio") -#else -SEC("kprobe/swap_readpage") -#endif -int netdata_swap_readpage(struct pt_regs* ctx) +static __always_inline void netdata_update_swap_access(netdata_swap_access_t *fill, __u32 *key, __u32 tgid, int is_write) { - netdata_swap_access_t data = {}; - - libnetdata_update_global(&tbl_swap, NETDATA_KEY_SWAP_READPAGE_CALL, 1); - - __u32 key = 0; - __u32 tgid = 0; - if (!monitor_apps(&swap_ctrl)) - return 0; - - netdata_swap_access_t *fill = netdata_get_pid_structure(&key, &tgid, &swap_ctrl, &tbl_pid_swap); if (fill) { - libnetdata_update_u32(&fill->read, 1); + if (is_write) + libnetdata_update_u32(&fill->write, 1); + else + libnetdata_update_u32(&fill->read, 1); } else { + netdata_swap_access_t data = {}; data.ct = bpf_ktime_get_ns(); libnetdata_update_uid_gid(&data.uid, &data.gid); data.tgid = tgid; @@ -56,11 +33,32 @@ int netdata_swap_readpage(struct pt_regs* ctx) data.name[0] = '\0'; #endif - data.read = 1; - bpf_map_update_elem(&tbl_pid_swap, &key, &data, BPF_ANY); + if (is_write) + data.write = 1; + else + data.read = 1; + bpf_map_update_elem(&tbl_pid_swap, key, &data, BPF_ANY); libnetdata_update_global(&swap_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); } +} + +#if (LINUX_VERSION_CODE > KERNEL_VERSION(6,7,255)) +SEC("kprobe/swap_read_folio") +#else +SEC("kprobe/swap_readpage") +#endif +int netdata_swap_readpage(struct pt_regs* ctx) +{ + libnetdata_update_global(&tbl_swap, NETDATA_KEY_SWAP_READPAGE_CALL, 1); + + if (!monitor_apps(&swap_ctrl)) + return 0; + + __u32 key = 0; + __u32 tgid = 0; + netdata_swap_access_t *fill = netdata_get_pid_structure(&key, &tgid, &swap_ctrl, &tbl_pid_swap); + netdata_update_swap_access(fill, &key, tgid, 0); return 0; } @@ -72,36 +70,17 @@ SEC("kprobe/swap_writepage") #endif int netdata_swap_writepage(struct pt_regs* ctx) { - netdata_swap_access_t data = {}; - libnetdata_update_global(&tbl_swap, NETDATA_KEY_SWAP_WRITEPAGE_CALL, 1); - __u32 key = 0; - __u32 tgid = 0; if (!monitor_apps(&swap_ctrl)) return 0; + __u32 key = 0; + __u32 tgid = 0; netdata_swap_access_t *fill = netdata_get_pid_structure(&key, &tgid, &swap_ctrl, &tbl_pid_swap); - if (fill) { - libnetdata_update_u32(&fill->write, 1); - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - - data.write = 1; - bpf_map_update_elem(&tbl_pid_swap, &key, &data, BPF_ANY); - - libnetdata_update_global(&swap_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); - } + netdata_update_swap_access(fill, &key, tgid, 1); return 0; } char _license[] SEC("license") = "GPL"; - From c97a348450c28c4ccefb40a555df5a8e74772aaf Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Thu, 12 Feb 2026 01:57:14 +0000 Subject: [PATCH 26/34] improve: Sync_file_range --- kernel/sync_file_range_kern.c | 21 ++------------------- 1 file changed, 2 insertions(+), 19 deletions(-) diff --git a/kernel/sync_file_range_kern.c b/kernel/sync_file_range_kern.c index 08f191cd..777d66d5 100644 --- a/kernel/sync_file_range_kern.c +++ b/kernel/sync_file_range_kern.c @@ -9,35 +9,18 @@ #include "bpf_helpers.h" #include "netdata_ebpf.h" -/************************************************************************************ - * - * MAPS - * - ***********************************************************************************/ - NETDATA_BPF_ARRAY_DEF(tbl_syncfr, __u32, __u64, NETDATA_SYNC_END); -/************************************************************************************ - * - * SYNC_FILE_RANGE SECTION - * - ***********************************************************************************/ - #if defined(LIBBPF_MAJOR_VERSION) && (LIBBPF_MAJOR_VERSION >= 1) SEC("ksyscall/sync_file_range") #else SEC("kprobe/" NETDATA_SYSCALL(sync_file_range)) #endif -int netdata_syscall_sync(struct pt_regs* ctx) +int netdata_syscall_sync_file_range(struct pt_regs* ctx) { libnetdata_update_global(&tbl_syncfr, NETDATA_KEY_SYNC_CALL, 1); return 0; } -/************************************************************************************ - * - * END SYNC_FILE_RANGE SECTION - * - ***********************************************************************************/ - +char _license[] SEC("license") = "GPL"; From 0309762b99610d8219dc6e3186d656177aab5019 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Thu, 12 Feb 2026 02:01:26 +0000 Subject: [PATCH 27/34] improve: Sync --- kernel/sync_kern.c | 21 ++------------------- 1 file changed, 2 insertions(+), 19 deletions(-) diff --git a/kernel/sync_kern.c b/kernel/sync_kern.c index b20d875a..8dd04505 100644 --- a/kernel/sync_kern.c +++ b/kernel/sync_kern.c @@ -9,35 +9,18 @@ #include "bpf_helpers.h" #include "netdata_ebpf.h" -/************************************************************************************ - * - * MAPS - * - ***********************************************************************************/ - NETDATA_BPF_ARRAY_DEF(tbl_sync, __u32, __u64, NETDATA_SYNC_END); -/************************************************************************************ - * - * SYNC SECTION - * - ***********************************************************************************/ - #if defined(LIBBPF_MAJOR_VERSION) && (LIBBPF_MAJOR_VERSION >= 1) SEC("ksyscall/sync") #else SEC("kprobe/" NETDATA_SYSCALL(sync)) #endif -int netdata_syscall_sync(struct pt_regs* ctx) +int netdata_syscall_sync_syscall(struct pt_regs* ctx) { libnetdata_update_global(&tbl_sync, NETDATA_KEY_SYNC_CALL, 1); return 0; } -/************************************************************************************ - * - * END SYNC SECTION - * - ***********************************************************************************/ - +char _license[] SEC("license") = "GPL"; From 9446bdda777a70857e1cc1fa5890b96d59d5c0da Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Thu, 12 Feb 2026 02:09:39 +0000 Subject: [PATCH 28/34] improve: Syncfs --- kernel/syncfs_kern.c | 21 +-------------------- 1 file changed, 1 insertion(+), 20 deletions(-) diff --git a/kernel/syncfs_kern.c b/kernel/syncfs_kern.c index 3aadbcef..f52c0593 100644 --- a/kernel/syncfs_kern.c +++ b/kernel/syncfs_kern.c @@ -9,37 +9,18 @@ #include "bpf_helpers.h" #include "netdata_ebpf.h" -/************************************************************************************ - * - * MAPS - * - ***********************************************************************************/ - NETDATA_BPF_ARRAY_DEF(tbl_syncfs, __u32, __u64, NETDATA_SYNC_END); -/************************************************************************************ - * - * SYNCFS SECTION - * - ***********************************************************************************/ - #if defined(LIBBPF_MAJOR_VERSION) && (LIBBPF_MAJOR_VERSION >= 1) SEC("ksyscall/syncfs") #else SEC("kprobe/" NETDATA_SYSCALL(syncfs)) #endif -int netdata_syscall_sync(struct pt_regs* ctx) +int netdata_syscall_syncfs(struct pt_regs* ctx) { libnetdata_update_global(&tbl_syncfs, NETDATA_KEY_SYNC_CALL, 1); return 0; } -/************************************************************************************ - * - * END SYNCFS SECTION - * - ***********************************************************************************/ - char _license[] SEC("license") = "GPL"; - From 5f59b53cde1ca2305ff86131f0b0416d102a7cb9 Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Thu, 12 Feb 2026 02:43:27 +0000 Subject: [PATCH 29/34] improve: vfs --- kernel/vfs_kern.c | 484 ++++++++++++---------------------------------- 1 file changed, 123 insertions(+), 361 deletions(-) diff --git a/kernel/vfs_kern.c b/kernel/vfs_kern.c index 193f7669..3d621b19 100644 --- a/kernel/vfs_kern.c +++ b/kernel/vfs_kern.c @@ -5,7 +5,6 @@ #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,10,17)) # include #endif - #include #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) @@ -17,21 +16,73 @@ #include "bpf_helpers.h" #include "netdata_ebpf.h" -/************************************************************************************ - * - * MAPS Section - * - ***********************************************************************************/ - NETDATA_BPF_HASH_DEF(tbl_vfs_pid, __u32, struct netdata_vfs_stat_t, PID_MAX_DEFAULT); NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_vfs_stats, __u32, __u64, NETDATA_VFS_COUNTER); NETDATA_BPF_ARRAY_DEF(vfs_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); -/************************************************************************************ - * - * FILE Section - * - ***********************************************************************************/ +static __always_inline void netdata_update_vfs_err(__u32 *err_field, int is_error) +{ +#if NETDATASEL < 2 + if (is_error) + libnetdata_update_u32(err_field, 1); +#endif +} + +static __always_inline void netdata_update_vfs_bytes(__u64 *byte_field, __u64 bytes, int has_bytes) +{ +#if NETDATASEL < 2 + if (has_bytes) + libnetdata_update_u64(byte_field, bytes); +#endif +} + +static __always_inline void netdata_init_vfs_data(struct netdata_vfs_stat_t *data, __u32 tgid) +{ + data->ct = bpf_ktime_get_ns(); + libnetdata_update_uid_gid(&data->uid, &data->gid); + data->tgid = tgid; +#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) + bpf_get_current_comm(&data->name, TASK_COMM_LEN); +#else + data->name[0] = '\0'; +#endif +} + +static __always_inline void netdata_update_vfs_entry(struct netdata_vfs_stat_t *fill, + struct netdata_vfs_stat_t *data, + __u32 *key, + __u32 tgid, + __u32 *call_field, + __u32 *err_field, + __u64 *byte_field, + __u64 tot, + int has_error, + int is_error, + int has_bytes) +{ + if (fill) { + libnetdata_update_u32(call_field, 1); + if (has_error && is_error) + libnetdata_update_u32(err_field, 1); + if (has_bytes) + libnetdata_update_u64(byte_field, tot); + } else { + netdata_init_vfs_data(data, tgid); + data->write_call = 0; + data->writev_call = 0; + data->read_call = 0; + data->readv_call = 0; + data->unlink_call = 0; + data->fsync_call = 0; + data->open_call = 0; + data->create_call = 0; + libnetdata_update_u32(call_field, 1); + netdata_update_vfs_err(err_field, is_error); + netdata_update_vfs_bytes(byte_field, tot, has_bytes); + bpf_map_update_elem(&tbl_vfs_pid, key, data, BPF_ANY); + libnetdata_update_global(&vfs_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); + } +} #if NETDATASEL < 2 SEC("kretprobe/vfs_write") @@ -40,69 +91,31 @@ SEC("kprobe/vfs_write") #endif int netdata_sys_write(struct pt_regs* ctx) { - ssize_t ret; + ssize_t ret = 0; #if NETDATASEL < 2 ret = (ssize_t)PT_REGS_RC(ctx); #endif - struct netdata_vfs_stat_t *fill; struct netdata_vfs_stat_t data = { }; - __u64 tot; - - __u32 key = 0; - __u32 tgid = 0; - if (!monitor_apps(&vfs_ctrl)) - return 0; + __u64 tot = 0; libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_CALLS_VFS_WRITE, 1); #if NETDATASEL < 2 - if (ret < 0) { + if (ret < 0) libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_ERROR_VFS_WRITE, 1); - } #endif - ret = (ssize_t)PT_REGS_PARM3(ctx); tot = libnetdata_log2l(ret); libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_BYTES_VFS_WRITE, tot); - fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); - if (fill) { - libnetdata_update_u32(&fill->write_call, 1) ; - -#if NETDATASEL < 2 - if (ret < 0) { - libnetdata_update_u32(&fill->write_err, 1) ; - } else { -#endif - libnetdata_update_u64(&fill->write_bytes, tot); -#if NETDATASEL < 2 - } -#endif - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - -#if NETDATASEL < 2 - if (ret < 0) { - data.write_err = 1; - } else { -#endif - data.write_bytes = tot; -#if NETDATASEL < 2 - } -#endif - data.write_call = 1; - - bpf_map_update_elem(&tbl_vfs_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&vfs_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); - } + __u32 key = 0; + __u32 tgid = 0; + if (!monitor_apps(&vfs_ctrl)) + return 0; + struct netdata_vfs_stat_t *fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); + netdata_update_vfs_entry(fill, &data, &key, tgid, + &fill->write_call, &fill->write_err, &fill->write_bytes, tot, + 1, ret < 0, 1); return 0; } @@ -113,22 +126,18 @@ SEC("kprobe/vfs_writev") #endif int netdata_sys_writev(struct pt_regs* ctx) { - ssize_t ret; + ssize_t ret = 0; #if NETDATASEL < 2 ret = (ssize_t)PT_REGS_RC(ctx); #endif - struct netdata_vfs_stat_t *fill; struct netdata_vfs_stat_t data = { }; - __u64 tot; + __u64 tot = 0; libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_CALLS_VFS_WRITEV, 1); - #if NETDATASEL < 2 - if (ret < 0) { + if (ret < 0) libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_ERROR_VFS_WRITEV, 1); - } #endif - ret = (ssize_t)PT_REGS_PARM3(ctx); tot = libnetdata_log2l(ret); libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_BYTES_VFS_WRITEV, tot); @@ -138,45 +147,10 @@ int netdata_sys_writev(struct pt_regs* ctx) if (!monitor_apps(&vfs_ctrl)) return 0; - fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); - if (fill) { - libnetdata_update_u32(&fill->writev_call, 1) ; - -#if NETDATASEL < 2 - if (ret < 0) { - libnetdata_update_u32(&fill->writev_err, 1) ; - } else { -#endif - libnetdata_update_u64(&fill->writev_bytes, tot); -#if NETDATASEL < 2 - } -#endif - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - -#if NETDATASEL < 2 - if (ret < 0) { - data.writev_err = 1; - } else { -#endif - data.writev_bytes = (unsigned long)tot; -#if NETDATASEL < 2 - } -#endif - data.writev_call = 1; - - bpf_map_update_elem(&tbl_vfs_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&vfs_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); - } - + struct netdata_vfs_stat_t *fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); + netdata_update_vfs_entry(fill, &data, &key, tgid, + &fill->writev_call, &fill->writev_err, &fill->writev_bytes, tot, + 1, ret < 0, 1); return 0; } @@ -187,22 +161,18 @@ SEC("kprobe/vfs_read") #endif int netdata_sys_read(struct pt_regs* ctx) { - ssize_t ret; + ssize_t ret = 0; #if NETDATASEL < 2 ret = (ssize_t)PT_REGS_RC(ctx); #endif - struct netdata_vfs_stat_t *fill; struct netdata_vfs_stat_t data = { }; - __u64 tot; + __u64 tot = 0; libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_CALLS_VFS_READ, 1); - #if NETDATASEL < 2 - if (ret < 0) { + if (ret < 0) libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_ERROR_VFS_READ, 1); - } #endif - ret = (ssize_t)PT_REGS_PARM3(ctx); tot = libnetdata_log2l(ret); libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_BYTES_VFS_READ, tot); @@ -212,45 +182,10 @@ int netdata_sys_read(struct pt_regs* ctx) if (!monitor_apps(&vfs_ctrl)) return 0; - fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); - if (fill) { - libnetdata_update_u32(&fill->read_call, 1) ; - -#if NETDATASEL < 2 - if (ret < 0) { - libnetdata_update_u32(&fill->read_err, 1) ; - } else { -#endif - libnetdata_update_u64(&fill->read_bytes, tot); -#if NETDATASEL < 2 - } -#endif - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - -#if NETDATASEL < 2 - if (ret < 0) { - data.read_err = 1; - } else { -#endif - data.read_bytes = (unsigned long)tot; -#if NETDATASEL < 2 - } -#endif - data.read_call = 1; - - bpf_map_update_elem(&tbl_vfs_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&vfs_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); - } - + struct netdata_vfs_stat_t *fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); + netdata_update_vfs_entry(fill, &data, &key, tgid, + &fill->read_call, &fill->read_err, &fill->read_bytes, tot, + 1, ret < 0, 1); return 0; } @@ -261,22 +196,18 @@ SEC("kprobe/vfs_readv") #endif int netdata_sys_readv(struct pt_regs* ctx) { - ssize_t ret; + ssize_t ret = 0; #if NETDATASEL < 2 ret = (ssize_t)PT_REGS_RC(ctx); #endif - struct netdata_vfs_stat_t *fill; struct netdata_vfs_stat_t data = { }; - __u64 tot; + __u64 tot = 0; libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_CALLS_VFS_READV, 1); - #if NETDATASEL < 2 - if (ret < 0) { + if (ret < 0) libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_ERROR_VFS_READV, 1); - } #endif - ret = (ssize_t)PT_REGS_PARM3(ctx); tot = libnetdata_log2l(ret); libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_BYTES_VFS_READV, tot); @@ -286,46 +217,10 @@ int netdata_sys_readv(struct pt_regs* ctx) if (!monitor_apps(&vfs_ctrl)) return 0; - fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); - if (fill) { - libnetdata_update_u32(&fill->readv_call, 1) ; - -#if NETDATASEL < 2 - if (ret < 0) { - libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_ERROR_VFS_READV, 1); - libnetdata_update_u32(&fill->readv_err, 1) ; - } else { -#endif - libnetdata_update_u64(&fill->readv_bytes, tot); -#if NETDATASEL < 2 - } -#endif - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - -#if NETDATASEL < 2 - if (ret < 0) { - data.readv_err = 1; - } else { -#endif - data.readv_bytes = (unsigned long)tot; -#if NETDATASEL < 2 - } -#endif - data.readv_call = 1; - - bpf_map_update_elem(&tbl_vfs_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&vfs_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); - } - + struct netdata_vfs_stat_t *fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); + netdata_update_vfs_entry(fill, &data, &key, tgid, + &fill->readv_call, &fill->readv_err, &fill->readv_bytes, tot, + 1, ret < 0, 1); return 0; } @@ -336,18 +231,16 @@ SEC("kprobe/vfs_unlink") #endif int netdata_sys_unlink(struct pt_regs* ctx) { + int ret = 0; #if NETDATASEL < 2 - int ret = (int)PT_REGS_RC(ctx); + ret = (int)PT_REGS_RC(ctx); #endif struct netdata_vfs_stat_t data = { }; - struct netdata_vfs_stat_t *fill; libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_CALLS_VFS_UNLINK, 1); - #if NETDATASEL < 2 - if (ret < 0) { + if (ret < 0) libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_ERROR_VFS_UNLINK, 1); - } #endif __u32 key = 0; @@ -355,41 +248,10 @@ int netdata_sys_unlink(struct pt_regs* ctx) if (!monitor_apps(&vfs_ctrl)) return 0; - fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); - if (fill) { - libnetdata_update_u32(&fill->unlink_call, 1) ; - -#if NETDATASEL < 2 - if (ret < 0) { - libnetdata_update_u32(&fill->unlink_err, 1) ; - } -#endif - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - -#if NETDATASEL < 2 - if (ret < 0) { - data.unlink_err = 1; - } else { -#endif - data.unlink_err = 0; -#if NETDATASEL < 2 - } -#endif - data.unlink_call = 1; - - bpf_map_update_elem(&tbl_vfs_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&vfs_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); - } - + struct netdata_vfs_stat_t *fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); + netdata_update_vfs_entry(fill, &data, &key, tgid, + &fill->unlink_call, &fill->unlink_err, NULL, 0, + 1, ret < 0, 0); return 0; } @@ -400,18 +262,16 @@ SEC("kprobe/vfs_fsync") #endif int netdata_vfs_fsync(struct pt_regs* ctx) { + int ret = 0; #if NETDATASEL < 2 - int ret = (int)PT_REGS_RC(ctx); + ret = (int)PT_REGS_RC(ctx); #endif struct netdata_vfs_stat_t data = { }; - struct netdata_vfs_stat_t *fill; libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_CALLS_VFS_FSYNC, 1); - #if NETDATASEL < 2 - if (ret < 0) { + if (ret < 0) libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_ERROR_VFS_FSYNC, 1); - } #endif __u32 key = 0; @@ -419,41 +279,10 @@ int netdata_vfs_fsync(struct pt_regs* ctx) if (!monitor_apps(&vfs_ctrl)) return 0; - fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); - if (fill) { - libnetdata_update_u32(&fill->fsync_call, 1) ; - -#if NETDATASEL < 2 - if (ret < 0) { - libnetdata_update_u32(&fill->fsync_err, 1) ; - } -#endif - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - -#if NETDATASEL < 2 - if (ret < 0) { - data.fsync_err = 1; - } else { -#endif - data.fsync_err = 0; -#if NETDATASEL < 2 - } -#endif - data.fsync_call = 1; - - bpf_map_update_elem(&tbl_vfs_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&vfs_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); - } - + struct netdata_vfs_stat_t *fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); + netdata_update_vfs_entry(fill, &data, &key, tgid, + &fill->fsync_call, &fill->fsync_err, NULL, 0, + 1, ret < 0, 0); return 0; } @@ -464,18 +293,16 @@ SEC("kprobe/vfs_open") #endif int netdata_vfs_open(struct pt_regs* ctx) { + int ret = 0; #if NETDATASEL < 2 - int ret = (int)PT_REGS_RC(ctx); + ret = (int)PT_REGS_RC(ctx); #endif struct netdata_vfs_stat_t data = { }; - struct netdata_vfs_stat_t *fill; libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_CALLS_VFS_OPEN, 1); - #if NETDATASEL < 2 - if (ret < 0) { + if (ret < 0) libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_ERROR_VFS_OPEN, 1); - } #endif __u32 key = 0; @@ -483,41 +310,10 @@ int netdata_vfs_open(struct pt_regs* ctx) if (!monitor_apps(&vfs_ctrl)) return 0; - fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); - if (fill) { - libnetdata_update_u32(&fill->open_call, 1) ; - -#if NETDATASEL < 2 - if (ret < 0) { - libnetdata_update_u32(&fill->open_err, 1) ; - } -#endif - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - -#if NETDATASEL < 2 - if (ret < 0) { - data.open_err = 1; - } else { -#endif - data.open_err = 0; -#if NETDATASEL < 2 - } -#endif - data.open_call = 1; - - bpf_map_update_elem(&tbl_vfs_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&vfs_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); - } - + struct netdata_vfs_stat_t *fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); + netdata_update_vfs_entry(fill, &data, &key, tgid, + &fill->open_call, &fill->open_err, NULL, 0, + 1, ret < 0, 0); return 0; } @@ -528,18 +324,16 @@ SEC("kprobe/vfs_create") #endif int netdata_vfs_create(struct pt_regs* ctx) { + int ret = 0; #if NETDATASEL < 2 - int ret = (int)PT_REGS_RC(ctx); + ret = (int)PT_REGS_RC(ctx); #endif struct netdata_vfs_stat_t data = { }; - struct netdata_vfs_stat_t *fill; libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_CALLS_VFS_CREATE, 1); - #if NETDATASEL < 2 - if (ret < 0) { + if (ret < 0) libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_ERROR_VFS_CREATE, 1); - } #endif __u32 key = 0; @@ -547,43 +341,11 @@ int netdata_vfs_create(struct pt_regs* ctx) if (!monitor_apps(&vfs_ctrl)) return 0; - fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); - if (fill) { - libnetdata_update_u32(&fill->create_call, 1) ; - -#if NETDATASEL < 2 - if (ret < 0) { - libnetdata_update_u32(&fill->create_err, 1) ; - } -#endif - } else { - data.ct = bpf_ktime_get_ns(); - libnetdata_update_uid_gid(&data.uid, &data.gid); - data.tgid = tgid; -#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0)) - bpf_get_current_comm(&data.name, TASK_COMM_LEN); -#else - data.name[0] = '\0'; -#endif - -#if NETDATASEL < 2 - if (ret < 0) { - data.create_err = 1; - } else { -#endif - data.create_err = 0; -#if NETDATASEL < 2 - } -#endif - data.create_call = 1; - - bpf_map_update_elem(&tbl_vfs_pid, &key, &data, BPF_ANY); - - libnetdata_update_global(&vfs_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1); - } - + struct netdata_vfs_stat_t *fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid); + netdata_update_vfs_entry(fill, &data, &key, tgid, + &fill->create_call, &fill->create_err, NULL, 0, + 1, ret < 0, 0); return 0; } char _license[] SEC("license") = "GPL"; - From 359f718c7b4a5bd9cdcbe0aa1f9aead9903d7c5e Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Thu, 12 Feb 2026 02:53:45 +0000 Subject: [PATCH 30/34] improve: last fs --- kernel/xfs_kern.c | 45 ++++++++++----------------------------------- kernel/zfs_kern.c | 23 +++++++++++------------ 2 files changed, 21 insertions(+), 47 deletions(-) diff --git a/kernel/xfs_kern.c b/kernel/xfs_kern.c index 56ca68e6..65512af9 100644 --- a/kernel/xfs_kern.c +++ b/kernel/xfs_kern.c @@ -14,21 +14,16 @@ #include "bpf_helpers.h" #include "netdata_ebpf.h" -/************************************************************************************ - * - * MAP Section - * - ***********************************************************************************/ - NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_xfs, __u32, __u64, NETDATA_FS_MAX_ELEMENTS); NETDATA_BPF_HASH_DEF(tmp_xfs, __u32, __u64, 4192); NETDATA_BPF_ARRAY_DEF(xfs_ctrl, __u32, __u64, NETDATA_CONTROLLER_END); -/************************************************************************************ - * - * Helper Functions - * - ***********************************************************************************/ +static __always_inline void netdata_xfs_entry(struct pt_regs *ctx) +{ + __u32 pid = bpf_get_current_pid_tgid() >> 32; + bpf_map_update_elem(&tmp_xfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + libnetdata_update_global(&xfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); +} static __always_inline void netdata_xfs_store_bin(__u32 bin, __u32 selection) { @@ -68,54 +63,34 @@ static __always_inline int netdata_xfs_ret(struct pt_regs *ctx, __u32 selector) return 0; } -/************************************************************************************ - * - * ENTRY Section - * - ***********************************************************************************/ - SEC("kprobe/xfs_file_read_iter") int netdata_xfs_file_read_iter(struct pt_regs *ctx) { - __u32 pid = bpf_get_current_pid_tgid() >> 32; - bpf_map_update_elem(&tmp_xfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); - libnetdata_update_global(&xfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + netdata_xfs_entry(ctx); return 0; } SEC("kprobe/xfs_file_write_iter") int netdata_xfs_file_write_iter(struct pt_regs *ctx) { - __u32 pid = bpf_get_current_pid_tgid() >> 32; - bpf_map_update_elem(&tmp_xfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); - libnetdata_update_global(&xfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + netdata_xfs_entry(ctx); return 0; } SEC("kprobe/xfs_file_open") int netdata_xfs_file_open(struct pt_regs *ctx) { - __u32 pid = bpf_get_current_pid_tgid() >> 32; - bpf_map_update_elem(&tmp_xfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); - libnetdata_update_global(&xfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + netdata_xfs_entry(ctx); return 0; } SEC("kprobe/xfs_file_fsync") int netdata_xfs_file_fsync(struct pt_regs *ctx) { - __u32 pid = bpf_get_current_pid_tgid() >> 32; - bpf_map_update_elem(&tmp_xfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); - libnetdata_update_global(&xfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + netdata_xfs_entry(ctx); return 0; } -/************************************************************************************ - * - * END Section - * - ***********************************************************************************/ - SEC("kretprobe/xfs_file_read_iter") int netdata_ret_xfs_file_read_iter(struct pt_regs *ctx) { diff --git a/kernel/zfs_kern.c b/kernel/zfs_kern.c index b743d851..14359c3d 100644 --- a/kernel/zfs_kern.c +++ b/kernel/zfs_kern.c @@ -73,39 +73,38 @@ static __always_inline int netdata_zfs_ret(struct pt_regs *ctx, __u32 selector) * ***********************************************************************************/ -SEC("kprobe/zpl_iter_read") -int netdata_zpl_iter_read(struct pt_regs *ctx) +static __always_inline void netdata_zfs_start(struct pt_regs *ctx) { __u32 pid = bpf_get_current_pid_tgid() >> 32; - bpf_map_update_elem(&tmp_zfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); + bpf_map_update_elem(&tmp_zfs, &pid, &(__u64){bpf_ktime_get_ns()}, BPF_ANY); libnetdata_update_global(&zfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); +} + +SEC("kprobe/zpl_iter_read") +int netdata_zpl_iter_read(struct pt_regs *ctx) +{ + netdata_zfs_start(ctx); return 0; } SEC("kprobe/zpl_iter_write") int netdata_zpl_iter_write(struct pt_regs *ctx) { - __u32 pid = bpf_get_current_pid_tgid() >> 32; - bpf_map_update_elem(&tmp_zfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); - libnetdata_update_global(&zfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + netdata_zfs_start(ctx); return 0; } SEC("kprobe/zpl_open") int netdata_zpl_open(struct pt_regs *ctx) { - __u32 pid = bpf_get_current_pid_tgid() >> 32; - bpf_map_update_elem(&tmp_zfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); - libnetdata_update_global(&zfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + netdata_zfs_start(ctx); return 0; } SEC("kprobe/zpl_fsync") int netdata_zpl_fsync(struct pt_regs *ctx) { - __u32 pid = bpf_get_current_pid_tgid() >> 32; - bpf_map_update_elem(&tmp_zfs, &pid, &(unsigned long long){bpf_ktime_get_ns()}, BPF_ANY); - libnetdata_update_global(&zfs_ctrl, NETDATA_CONTROLLER_TEMP_TABLE_ADD, 1); + netdata_zfs_start(ctx); return 0; } From 6a682e5367250292e824c01d75beeb8ab1f6073a Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Tue, 17 Mar 2026 03:00:41 +0000 Subject: [PATCH 31/34] improve: Fix hardirq (P1) --- kernel/hardirq_kern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/hardirq_kern.c b/kernel/hardirq_kern.c index 668f68d1..c8091ebb 100644 --- a/kernel/hardirq_kern.c +++ b/kernel/hardirq_kern.c @@ -15,7 +15,7 @@ ***********************************************************************************/ NETDATA_BPF_HASH_DEF(tbl_hardirq, hardirq_key_t, hardirq_val_t, NETDATA_HARDIRQ_MAX_IRQS); -NETDATA_BPF_PERCPU_ARRAY_DEF(tbl_hardirq_static, __u32, hardirq_val_t, NETDATA_HARDIRQ_STATIC_END); +NETDATA_BPF_ARRAY_DEF(tbl_hardirq_static, __u32, hardirq_val_t, NETDATA_HARDIRQ_STATIC_END); /************************************************************************************ * HARDIRQ SECTION From 10d117536b5a0a3de9c8dfa76b0a407f09f67fde Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Tue, 17 Mar 2026 15:21:38 +0000 Subject: [PATCH 32/34] improve: Update libbpf --- libbpf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libbpf b/libbpf index 85d9be97..f5dcbae7 160000 --- a/libbpf +++ b/libbpf @@ -1 +1 @@ -Subproject commit 85d9be97ebb59d14072d4dd222bc055f85f7ba15 +Subproject commit f5dcbae736e5d7f83a35718e01be1a8e3010fa39 From 2da739d39e3d6d284b986d0a992f5fc96d5be2eb Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Tue, 17 Mar 2026 18:37:25 +0000 Subject: [PATCH 33/34] improve: Fix HARDIRQ load --- kernel/hardirq_kern.c | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/kernel/hardirq_kern.c b/kernel/hardirq_kern.c index c8091ebb..594f8c11 100644 --- a/kernel/hardirq_kern.c +++ b/kernel/hardirq_kern.c @@ -21,13 +21,27 @@ NETDATA_BPF_ARRAY_DEF(tbl_hardirq_static, __u32, hardirq_val_t, NETDATA_HARDIRQ_ * HARDIRQ SECTION ***********************************************************************************/ +static __always_inline int netdata_hardirq_ctx_irq(void *ctx) +{ + int irq = 0; + + /* + * Read only the IRQ identifier from the tracepoint payload. + * This keeps hardirq independent from unused context fields that can + * interfere with user-ring metadata consumers. + */ + bpf_probe_read(&irq, sizeof(irq), (char *)ctx + sizeof(__u64)); + + return irq; +} + SEC("tracepoint/irq/irq_handler_entry") -int netdata_irq_handler_entry(struct netdata_irq_handler_entry *ptr) +int netdata_irq_handler_entry(void *ctx) { hardirq_key_t key = {0}; hardirq_val_t val = {0}; - key.irq = ptr->irq; + key.irq = netdata_hardirq_ctx_irq(ctx); hardirq_val_t *valp = bpf_map_lookup_elem(&tbl_hardirq, &key); if (valp) { valp->ts = bpf_ktime_get_ns(); @@ -41,11 +55,11 @@ int netdata_irq_handler_entry(struct netdata_irq_handler_entry *ptr) } SEC("tracepoint/irq/irq_handler_exit") -int netdata_irq_handler_exit(struct netdata_irq_handler_exit *ptr) +int netdata_irq_handler_exit(void *ctx) { hardirq_key_t key = {0}; - key.irq = ptr->irq; + key.irq = netdata_hardirq_ctx_irq(ctx); hardirq_val_t *valp = bpf_map_lookup_elem(&tbl_hardirq, &key); if (!valp) { return 0; @@ -62,8 +76,9 @@ int netdata_irq_handler_exit(struct netdata_irq_handler_exit *ptr) ***********************************************************************************/ #define HARDIRQ_STATIC_GEN_ENTRY(__type, __enum_idx) \ -int netdata_irq_ ##__type(struct netdata_irq_vectors_entry *ptr) \ +int netdata_irq_ ##__type(void *ctx) \ { \ + (void)ctx; \ __u32 key = __enum_idx; \ hardirq_val_t val = {0}; \ hardirq_val_t *valp = bpf_map_lookup_elem(&tbl_hardirq_static, &key); \ @@ -78,8 +93,9 @@ int netdata_irq_ ##__type(struct netdata_irq_vectors_entry *ptr) \ } #define HARDIRQ_STATIC_GEN_EXIT(__type, __enum_idx) \ -int netdata_irq_ ##__type(struct netdata_irq_vectors_exit *ptr) \ +int netdata_irq_ ##__type(void *ctx) \ { \ + (void)ctx; \ __u32 key = __enum_idx; \ hardirq_val_t *valp = bpf_map_lookup_elem(&tbl_hardirq_static, &key); \ if (!valp) { \ From 975baa4ea0e8075f5d0b50b1eeafbe9feb568e9d Mon Sep 17 00:00:00 2001 From: thiagoftsm Date: Tue, 17 Mar 2026 19:06:20 +0000 Subject: [PATCH 34/34] improve: Adjust code --- kernel/process_kern.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/kernel/process_kern.c b/kernel/process_kern.c index 1ba5c61a..3ed4cef1 100644 --- a/kernel/process_kern.c +++ b/kernel/process_kern.c @@ -125,19 +125,31 @@ int netdata_tracepoint_sched_process_exec(struct netdata_sched_process_exec *ptr } SEC("tracepoint/sched/sched_process_fork") -#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6,16,0)) -int netdata_tracepoint_sched_process_fork(struct netdata_sched_process_fork_v2 *ptr) -#else -int netdata_tracepoint_sched_process_fork(struct netdata_sched_process_fork *ptr) -#endif +int netdata_tracepoint_sched_process_fork(void *ctx) { struct netdata_pid_stat_t data = { }; struct netdata_pid_stat_t *fill; libnetdata_update_global(&tbl_total_stats, NETDATA_KEY_CALLS_PROCESS, 1); + /* + * Read parent_pid and child_pid via byte offsets to avoid direct typed-context + * dereference, which can interfere with user-ring metadata consumers on newer kernels. + * Offsets come from /sys/kernel/tracing/events/sched/sched_process_fork/format. + */ + int parent_pid = 0, child_pid = 0; +#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6,16,0)) + /* fork_v2: u64 pad(0) + char[4](8) + int parent_pid(12) + char[4](16) + int child_pid(20) */ + bpf_probe_read(&parent_pid, sizeof(parent_pid), (char *)ctx + 12); + bpf_probe_read(&child_pid, sizeof(child_pid), (char *)ctx + 20); +#else + /* fork_v1: u64 pad(0) + char[16](8) + int parent_pid(24) + char[16](28) + int child_pid(44) */ + bpf_probe_read(&parent_pid, sizeof(parent_pid), (char *)ctx + 24); + bpf_probe_read(&child_pid, sizeof(child_pid), (char *)ctx + 44); +#endif + int thread = 0; - if (ptr->parent_pid != ptr->child_pid && ptr->parent_pid != 1) { + if (parent_pid != child_pid && parent_pid != 1) { thread = 1; libnetdata_update_global(&tbl_total_stats, NETDATA_KEY_CALLS_THREAD, 1); }