Fix SWAP pages (#17295)

8 files changed, 105 insertions, 17 deletions

diff --git a/packaging/ebpf-co-re.checksums b/packaging/ebpf-co-re.checksums
index b9e55d8755..f4a15e90bc 100644
--- a/packaging/ebpf-co-re.checksums
+++ b/packaging/ebpf-co-re.checksums
@@ -1 +1 @@
-208e843a1c981071bc84eeb2dba8d64947701e0624abf6669daac3f73feacf40  netdata-ebpf-co-re-glibc-v1.3.1.tar.xz
+c794d26a8aa505a95cf32c088deed394e4683ea43a1195fcb27c62f472c8d2fd  netdata-ebpf-co-re-glibc-v1.3.4.tar.xz
diff --git a/packaging/ebpf-co-re.version b/packaging/ebpf-co-re.version
index 7574079828..043ba4f603 100644
--- a/packaging/ebpf-co-re.version
+++ b/packaging/ebpf-co-re.version
@@ -1 +1 @@
-v1.3.1
+v1.3.4
diff --git a/packaging/ebpf.checksums b/packaging/ebpf.checksums
index f0c3db759b..8678976979 100644
--- a/packaging/ebpf.checksums
+++ b/packaging/ebpf.checksums
@@ -1,3 +1,3 @@
-3beba8ddcc0394324e1444dc239f87ba82f68f88b4446b37598e75584f0b8e5f  ./netdata-kernel-collector-glibc-v1.3.1.tar.xz
-945c511ad69eecf58d74b6d35b886cc9867e939bd1eca4e1cbe3f01181a3f036  ./netdata-kernel-collector-musl-v1.3.1.tar.xz
-5e0c7a230bcb54cbc51cb86518d2199fa6fb2344a02a88a467387dec537aa45a  ./netdata-kernel-collector-static-v1.3.1.tar.xz
+7d8e433b0362d0a2f0b94c8a15ca9bd04897c77c4048c8d286d078be051ca300  ./netdata-kernel-collector-glibc-v1.3.4.tar.xz
+fcd6949a88a162796e79db3ef9edcabda13e11d1127ca7c70157fe64f2a46d65  ./netdata-kernel-collector-musl-v1.3.4.tar.xz
+a35361a8c97cd300ae9cc51a0b1567ab47977dcb4aa5c4f50551eeeb83996f06  ./netdata-kernel-collector-static-v1.3.4.tar.xz
diff --git a/packaging/ebpf.version b/packaging/ebpf.version
index 7574079828..043ba4f603 100644
--- a/packaging/ebpf.version
+++ b/packaging/ebpf.version
@@ -1 +1 @@
-v1.3.1
+v1.3.4
diff --git a/src/collectors/ebpf.plugin/ebpf.c b/src/collectors/ebpf.plugin/ebpf.c
index 675ba68328..4539c7e629 100644
--- a/src/collectors/ebpf.plugin/ebpf.c
+++ b/src/collectors/ebpf.plugin/ebpf.c
@@ -136,7 +136,7 @@ ebpf_module_t ebpf_modules[] = {
       .maps = NULL,
       .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &swap_config,
       .config_file = NETDATA_DIRECTORY_SWAP_CONFIG_FILE,
-      .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
+      .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14 | NETDATA_V6_8,
       .load = EBPF_LOAD_LEGACY, .targets = swap_targets, .probe_links = NULL, .objects = NULL,
       .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
     { .info = {.thread_name = "vfs",
diff --git a/src/collectors/ebpf.plugin/ebpf_swap.c b/src/collectors/ebpf.plugin/ebpf_swap.c
index dfdb25c51b..7417db2040 100644
--- a/src/collectors/ebpf.plugin/ebpf_swap.c
+++ b/src/collectors/ebpf.plugin/ebpf_swap.c
@@ -48,10 +48,13 @@ static ebpf_local_maps_t swap_maps[] = {{.name = "tbl_pid_swap", .internal_input
 #endif
                                         }};
 
-netdata_ebpf_targets_t swap_targets[] = { {.name = "swap_readpage", .mode = EBPF_LOAD_TRAMPOLINE},
+netdata_ebpf_targets_t swap_targets[] = { {.name = NULL, .mode = EBPF_LOAD_TRAMPOLINE},
                                            {.name = "swap_writepage", .mode = EBPF_LOAD_TRAMPOLINE},
                                            {.name = NULL, .mode = EBPF_LOAD_TRAMPOLINE}};
 
+static char *swap_read[] ={ "swap_readpage", "swap_read_folio", NULL };
+
+
 struct netdata_static_thread ebpf_read_swap = {
     .name = "EBPF_READ_SWAP",
     .config_section = NULL,
@@ -74,9 +77,27 @@ struct netdata_static_thread ebpf_read_swap = {
 static void ebpf_swap_disable_probe(struct swap_bpf *obj)
 {
     bpf_program__set_autoload(obj->progs.netdata_swap_readpage_probe, false);
+    bpf_program__set_autoload(obj->progs.netdata_swap_read_folio_probe, false);
     bpf_program__set_autoload(obj->progs.netdata_swap_writepage_probe, false);
 }
 
+/**
+ * Disable specific probe
+ *
+ * Disable specific probes according to available functions
+ *
+ * @param obj is the main structure for bpf objects
+ */
+static inline void ebpf_swap_disable_specific_probe(struct swap_bpf *obj)
+{
+    if (!strcmp(swap_targets[NETDATA_KEY_SWAP_READPAGE_CALL].name,
+                swap_read[NETDATA_KEY_SWAP_READPAGE_CALL])) {
+        bpf_program__set_autoload(obj->progs.netdata_swap_readpage_probe, false);
+    } else  {
+        bpf_program__set_autoload(obj->progs.netdata_swap_read_folio_probe, false);
+    }
+}
+
 /*
  * Disable trampoline
  *
@@ -87,10 +108,28 @@ static void ebpf_swap_disable_probe(struct swap_bpf *obj)
 static void ebpf_swap_disable_trampoline(struct swap_bpf *obj)
 {
     bpf_program__set_autoload(obj->progs.netdata_swap_readpage_fentry, false);
+    bpf_program__set_autoload(obj->progs.netdata_swap_read_folio_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_swap_writepage_fentry, false);
 }
 
 /**
+ * Disable specific trampoline
+ *
+ * Disable specific trampolines according to available functions
+ *
+ * @param obj is the main structure for bpf objects
+ */
+static inline void ebpf_swap_disable_specific_trampoline(struct swap_bpf *obj)
+{
+    if (!strcmp(swap_targets[NETDATA_KEY_SWAP_READPAGE_CALL].name,
+                swap_read[NETDATA_KEY_SWAP_READPAGE_CALL])) {
+        bpf_program__set_autoload(obj->progs.netdata_swap_readpage_fentry, false);
+    } else  {
+        bpf_program__set_autoload(obj->progs.netdata_swap_read_folio_fentry, false);
+    }
+}
+
+/**
  * Set trampoline target
  *
  * Set the targets we will monitor.
@@ -117,10 +156,19 @@ static void ebpf_swap_set_trampoline_target(struct swap_bpf *obj)
  */
 static int ebpf_swap_attach_kprobe(struct swap_bpf *obj)
 {
-    obj->links.netdata_swap_readpage_probe = bpf_program__attach_kprobe(obj->progs.netdata_swap_readpage_probe,
-                                                                        false,
-                                                                        swap_targets[NETDATA_KEY_SWAP_READPAGE_CALL].name);
-    int ret = libbpf_get_error(obj->links.netdata_swap_readpage_probe);
+    int ret;
+    if (!strcmp(swap_targets[NETDATA_KEY_SWAP_READPAGE_CALL].name,
+                swap_read[NETDATA_KEY_SWAP_READPAGE_CALL])) {
+        obj->links.netdata_swap_readpage_probe = bpf_program__attach_kprobe(obj->progs.netdata_swap_readpage_probe,
+                                                                            false,
+                                                                            swap_targets[NETDATA_KEY_SWAP_READPAGE_CALL].name);
+        ret = libbpf_get_error(obj->links.netdata_swap_readpage_probe);
+    } else {
+        obj->links.netdata_swap_read_folio_probe = bpf_program__attach_kprobe(obj->progs.netdata_swap_read_folio_probe,
+                                                                            false,
+                                                                            swap_targets[NETDATA_KEY_SWAP_READPAGE_CALL].name);
+        ret = libbpf_get_error(obj->links.netdata_swap_read_folio_probe);
+    }
     if (ret)
         return -1;
 
@@ -183,10 +231,12 @@ static inline int ebpf_swap_load_and_attach(struct swap_bpf *obj, ebpf_module_t
 
     if (test == EBPF_LOAD_TRAMPOLINE) {
         ebpf_swap_disable_probe(obj);
+	ebpf_swap_disable_specific_trampoline(obj);
 
         ebpf_swap_set_trampoline_target(obj);
     } else {
         ebpf_swap_disable_trampoline(obj);
+	ebpf_swap_disable_specific_probe(obj);
     }
 
     ebpf_swap_adjust_map(obj, em);
@@ -1043,6 +1093,34 @@ static int ebpf_swap_load_bpf(ebpf_module_t *em)
 }
 
 /**
+ * Update Internal value
+ *
+ * Update values used during runtime.
+ *
+ * @return It returns 0 when one of the functions is present and -1 otherwise.
+ */
+static int ebpf_swap_set_internal_value()
+{
+    ebpf_addresses_t address = {.function = NULL, .hash = 0, .addr = 0};
+    int i;
+    for (i = 0; swap_read[i] ; i++) {
+        address.function = swap_read[i];
+        ebpf_load_addresses(&address, -1);
+        if (address.addr)
+            break;
+    }
+
+    if (!address.addr) {
+        netdata_log_error("%s swap.", NETDATA_EBPF_DEFAULT_FNT_NOT_FOUND);
+        return -1;
+    }
+
+    swap_targets[NETDATA_KEY_SWAP_READPAGE_CALL].name = address.function;
+
+    return 0;
+}
+
+/**
  * SWAP thread
  *
  * Thread used to make swap thread
@@ -1060,6 +1138,10 @@ void *ebpf_swap_thread(void *ptr)
 
     ebpf_update_pid_table(&swap_maps[NETDATA_PID_SWAP_TABLE], em);
 
+    if (ebpf_swap_set_internal_value()) {
+        goto endswap;
+    }
+
 #ifdef LIBBPF_MAJOR_VERSION
     ebpf_adjust_thread_load(em, default_btf);
 #endif
diff --git a/src/libnetdata/ebpf/ebpf.c b/src/libnetdata/ebpf/ebpf.c
index 087454dbaf..5479130354 100644
--- a/src/libnetdata/ebpf/ebpf.c
+++ b/src/libnetdata/ebpf/ebpf.c
@@ -344,7 +344,7 @@ static char *ebpf_select_kernel_name(uint32_t selector)
     static char *kernel_names[] = { NETDATA_IDX_STR_V3_10, NETDATA_IDX_STR_V4_14, NETDATA_IDX_STR_V4_16,
                                     NETDATA_IDX_STR_V4_18, NETDATA_IDX_STR_V5_4,  NETDATA_IDX_STR_V5_10,
                                     NETDATA_IDX_STR_V5_11, NETDATA_IDX_STR_V5_14, NETDATA_IDX_STR_V5_15,
-                                    NETDATA_IDX_STR_V5_16
+                                    NETDATA_IDX_STR_V5_16, NETDATA_IDX_STR_V6_8
                                   };
 
     return kernel_names[selector];
@@ -370,7 +370,9 @@ static int ebpf_select_max_index(int is_rhf, uint32_t kver)
         else if (kver >= NETDATA_EBPF_KERNEL_4_11)
             return NETDATA_IDX_V4_18;
     } else { // Kernels from kernel.org
-        if (kver >= NETDATA_EBPF_KERNEL_5_16)
+        if (kver >= NETDATA_EBPF_KERNEL_6_8)
+            return NETDATA_IDX_V6_8;
+	else if (kver >= NETDATA_EBPF_KERNEL_5_16)
             return NETDATA_IDX_V5_16;
         else if (kver >= NETDATA_EBPF_KERNEL_5_15)
             return NETDATA_IDX_V5_15;
diff --git a/src/libnetdata/ebpf/ebpf.h b/src/libnetdata/ebpf/ebpf.h
index 50eb696302..1c612ad32b 100644
--- a/src/libnetdata/ebpf/ebpf.h
+++ b/src/libnetdata/ebpf/ebpf.h
@@ -94,7 +94,8 @@ enum netdata_ebpf_kernel_versions {
     NETDATA_EBPF_KERNEL_5_11 = 330496,  //  330240 = 5 * 65536 + 11 * 256
     NETDATA_EBPF_KERNEL_5_14 = 331264,  //  331264 = 5 * 65536 + 14 * 256
     NETDATA_EBPF_KERNEL_5_15 = 331520,  //  331520 = 5 * 65536 + 15 * 256
-    NETDATA_EBPF_KERNEL_5_16 = 331776   //  331776 = 5 * 65536 + 16 * 256
+    NETDATA_EBPF_KERNEL_5_16 = 331776,  //  331776 = 5 * 65536 + 16 * 256
+    NETDATA_EBPF_KERNEL_6_8  = 395264   //  395264 = 5 * 65536 +  8 * 256
 };
 
 enum netdata_kernel_flag {
@@ -107,7 +108,8 @@ enum netdata_kernel_flag {
     NETDATA_V5_11 = 1 << 6,
     NETDATA_V5_14 = 1 << 7,
     NETDATA_V5_15 = 1 << 8,
-    NETDATA_V5_16 = 1 << 9
+    NETDATA_V5_16 = 1 << 9,
+    NETDATA_V6_8  = 1 << 10
 };
 
 enum netdata_kernel_idx {
@@ -120,7 +122,8 @@ enum netdata_kernel_idx {
     NETDATA_IDX_V5_11,
     NETDATA_IDX_V5_14,
     NETDATA_IDX_V5_15,
-    NETDATA_IDX_V5_16
+    NETDATA_IDX_V5_16,
+    NETDATA_IDX_V6_8
 };
 
 #define NETDATA_IDX_STR_V3_10 "3.10"
@@ -133,6 +136,7 @@ enum netdata_kernel_idx {
 #define NETDATA_IDX_STR_V5_14 "5.14"
 #define NETDATA_IDX_STR_V5_15 "5.15"
 #define NETDATA_IDX_STR_V5_16 "5.16"
+#define NETDATA_IDX_STR_V6_8  "6.8"
 
 /**
  * Minimum value has relationship with libbpf support.