eBPF different improvements (#13624)

13 files changed, 27 insertions, 16 deletions

diff --git a/collectors/ebpf.plugin/ebpf.c b/collectors/ebpf.plugin/ebpf.c
index 0e05e24da2..382dc2c8d4 100644
--- a/collectors/ebpf.plugin/ebpf.c
+++ b/collectors/ebpf.plugin/ebpf.c
@@ -44,7 +44,7 @@ ebpf_module_t ebpf_modules[] = {
       .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL},
     { .thread_name = "socket", .config_name = "socket", .enabled = 0, .start_routine = ebpf_socket_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
-      .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
+      .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = ebpf_socket_create_apps_charts, .maps = NULL,
       .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &socket_config,
       .config_file = NETDATA_NETWORK_CONFIG_FILE,
@@ -137,15 +137,15 @@ ebpf_module_t ebpf_modules[] = {
       .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL},
     { .thread_name = "oomkill", .config_name = "oomkill", .enabled = 0, .start_routine = ebpf_oomkill_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
-      .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
+      .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = ebpf_oomkill_create_apps_charts, .maps = NULL,
       .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &oomkill_config,
       .config_file = NETDATA_OOMKILL_CONFIG_FILE,
-      .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
+      .kernels =  NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL},
     { .thread_name = "shm", .config_name = "shm", .enabled = 0, .start_routine = ebpf_shm_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
-      .apps_level = NETDATA_APPS_LEVEL_ALL, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
+      .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = ebpf_shm_create_apps_charts, .maps = NULL,
       .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &shm_config,
       .config_file = NETDATA_DIRECTORY_SHM_CONFIG_FILE,
diff --git a/collectors/ebpf.plugin/ebpf_oomkill.c b/collectors/ebpf.plugin/ebpf_oomkill.c
index 33f505b0e8..754261febe 100644
--- a/collectors/ebpf.plugin/ebpf_oomkill.c
+++ b/collectors/ebpf.plugin/ebpf_oomkill.c
@@ -367,11 +367,17 @@ void *ebpf_oomkill_thread(void *ptr)
     ebpf_module_t *em = (ebpf_module_t *)ptr;
     em->maps = oomkill_maps;
 
+#define NETDATA_DEFAULT_OOM_DISABLED_MSG "Disabling OOMKILL thread, because"
     if (unlikely(!all_pids || !em->apps_charts)) {
         // When we are not running integration with apps, we won't fill necessary variables for this thread to run, so
         // we need to disable it.
         if (em->enabled)
-            info("Disabling OOMKILL thread, because apps integration is completely disabled.");
+            info("%s apps integration is completely disabled.", NETDATA_DEFAULT_OOM_DISABLED_MSG);
+
+        em->enabled = 0;
+    } else if (running_on_kernel < NETDATA_EBPF_KERNEL_4_14) {
+        if (em->enabled)
+            info("%s kernel does not have necessary tracepoints.", NETDATA_DEFAULT_OOM_DISABLED_MSG);
 
         em->enabled = 0;
     }
diff --git a/collectors/ebpf.plugin/ebpf_socket.c b/collectors/ebpf.plugin/ebpf_socket.c
index 2d5f93bf7b..16fd32eff6 100644
--- a/collectors/ebpf.plugin/ebpf_socket.c
+++ b/collectors/ebpf.plugin/ebpf_socket.c
@@ -23,7 +23,7 @@ static char *socket_id_names[NETDATA_MAX_SOCKET_VECTOR] = { "tcp_cleanup_rbuf",
 static ebpf_local_maps_t socket_maps[] = {{.name = "tbl_bandwidth",
                                            .internal_input = NETDATA_COMPILED_CONNECTIONS_ALLOWED,
                                            .user_input = NETDATA_MAXIMUM_CONNECTIONS_ALLOWED,
-                                           .type = NETDATA_EBPF_MAP_STATIC,
+                                           .type = NETDATA_EBPF_MAP_RESIZABLE | NETDATA_EBPF_MAP_PID,
                                            .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
                                           {.name = "tbl_global_sock",
                                            .internal_input = NETDATA_SOCKET_COUNTER,
diff --git a/libnetdata/ebpf/ebpf.c b/libnetdata/ebpf/ebpf.c
index 7e113e8417..c6a10ebf82 100644
--- a/libnetdata/ebpf/ebpf.c
+++ b/libnetdata/ebpf/ebpf.c
@@ -696,6 +696,10 @@ struct bpf_link **ebpf_load_program(char *plugins_dir, ebpf_module_t *em, int kv
 
     ebpf_mount_name(lpath, 4095, plugins_dir, idx, em->thread_name, em->mode);
 
+    // When this function is called ebpf.plugin is using legacy code, so we should reset the variable
+    em->load &= ~ NETDATA_EBPF_LOAD_METHODS;
+    em->load |= EBPF_LOAD_LEGACY;
+
     *obj = bpf_object__open_file(lpath, NULL);
     if (libbpf_get_error(obj)) {
         error("Cannot open BPF object %s", lpath);
diff --git a/libnetdata/ebpf/ebpf.h b/libnetdata/ebpf/ebpf.h
index 7b06750048..280fde6288 100644
--- a/libnetdata/ebpf/ebpf.h
+++ b/libnetdata/ebpf/ebpf.h
@@ -77,6 +77,7 @@
  */
 enum netdata_ebpf_kernel_versions {
     NETDATA_EBPF_KERNEL_4_11 = 264960,  //  264960 = 4 * 65536 + 15 * 256
+    NETDATA_EBPF_KERNEL_4_14 = 265728,  //  264960 = 4 * 65536 + 14 * 256
     NETDATA_EBPF_KERNEL_4_15 = 265984,  //  265984 = 4 * 65536 + 15 * 256
     NETDATA_EBPF_KERNEL_4_17 = 266496,  //  266496 = 4 * 65536 + 17 * 256
     NETDATA_EBPF_KERNEL_5_0  = 327680,  //  327680 = 5 * 65536 +  0 * 256
diff --git a/packaging/current_libbpf.checksums b/packaging/current_libbpf.checksums
index 143e4039d8..bb1fe41785 100644
--- a/packaging/current_libbpf.checksums
+++ b/packaging/current_libbpf.checksums
@@ -1 +1 @@
-1b4708f22af0e38ec29f01c9948ec2d436e8e06781ad6ad4a231ef62352a4736  v0.8.1_netdata.tar.gz
+9c49cfdc04201172ca6953877ce44bb24a0b56ac6e896deaf66820192d31be37  v1.0.0_netdata.tar.gz
diff --git a/packaging/current_libbpf.version b/packaging/current_libbpf.version
index b22b373e10..1d5ff5004b 100644
--- a/packaging/current_libbpf.version
+++ b/packaging/current_libbpf.version
@@ -1 +1 @@
-0.8.1_netdata
+1.0.0_netdata
diff --git a/packaging/ebpf-co-re.checksums b/packaging/ebpf-co-re.checksums
index a0bd28b4f3..01a866f1fc 100644
--- a/packaging/ebpf-co-re.checksums
+++ b/packaging/ebpf-co-re.checksums
@@ -1 +1 @@
-ab36f617b045d4740536769f84b7a527714431c02e80e15aa7fa2fe84c64d0cc  netdata-ebpf-co-re-glibc-v0.9.5.tar.xz
+798c792af0a82a0397c258b089a4a807004ebee493d79d12dee9dbf7adee2cce  netdata-ebpf-co-re-glibc-v1.0.0.tar.xz
diff --git a/packaging/ebpf-co-re.version b/packaging/ebpf-co-re.version
index 06769c1caa..0ec25f7505 100644
--- a/packaging/ebpf-co-re.version
+++ b/packaging/ebpf-co-re.version
@@ -1 +1 @@
-v0.9.5
+v1.0.0
diff --git a/packaging/ebpf.checksums b/packaging/ebpf.checksums
index 7dfc84e17c..7e2f80765b 100644
--- a/packaging/ebpf.checksums
+++ b/packaging/ebpf.checksums
@@ -1,3 +1,3 @@
-e7408cbfe77d570edea4c562efd631e914827a5d5ad51dab0638d7aa3e999a99  ./netdata-kernel-collector-glibc-v0.9.5.tar.xz
-8a0f5117d71d3b1975ad31fe51c1e2a887d66e676aa53cd5939d22192cb581a6  ./netdata-kernel-collector-musl-v0.9.5.tar.xz
-472e2b6cb473cea69efd1645a35589904db4eddc162a372833bde156b53ec44b  ./netdata-kernel-collector-static-v0.9.5.tar.xz
+914c0fd53d346b2bd94130582e9154e7219988800f7e1d5edd857e29b2acbf50  ./netdata-kernel-collector-glibc-v1.0.0.tar.xz
+490da694325a4c04a01fd9149d15344b354bb7336ad014fdeb80b3ee4b8fc2cf  ./netdata-kernel-collector-musl-v1.0.0.tar.xz
+101c51698207630f758d42a81f28929e3b69c05739234d8b3baffa59d968b4f7  ./netdata-kernel-collector-static-v1.0.0.tar.xz
diff --git a/packaging/ebpf.version b/packaging/ebpf.version
index 06769c1caa..0ec25f7505 100644
--- a/packaging/ebpf.version
+++ b/packaging/ebpf.version
@@ -1 +1 @@
-v0.9.5
+v1.0.0
diff --git a/packaging/libbpf.checksums b/packaging/libbpf.checksums
index 143e4039d8..bb1fe41785 100644
--- a/packaging/libbpf.checksums
+++ b/packaging/libbpf.checksums
@@ -1 +1 @@
-1b4708f22af0e38ec29f01c9948ec2d436e8e06781ad6ad4a231ef62352a4736  v0.8.1_netdata.tar.gz
+9c49cfdc04201172ca6953877ce44bb24a0b56ac6e896deaf66820192d31be37  v1.0.0_netdata.tar.gz
diff --git a/packaging/libbpf.version b/packaging/libbpf.version
index b22b373e10..1d5ff5004b 100644
--- a/packaging/libbpf.version
+++ b/packaging/libbpf.version
@@ -1 +1 @@
-0.8.1_netdata
+1.0.0_netdata