ebpf memory cleanup (#10096)

Fix memory cleanup when process exit.

2 files changed, 40 insertions, 16 deletions

diff --git a/libnetdata/ebpf/ebpf.c b/libnetdata/ebpf/ebpf.c
index 50454c77d2..dfcbd7fcf5 100644
--- a/libnetdata/ebpf/ebpf.c
+++ b/libnetdata/ebpf/ebpf.c
@@ -8,6 +8,7 @@
 
 #include "../libnetdata.h"
 
+/*
 static int clean_kprobe_event(FILE *out, char *filename, char *father_pid, netdata_ebpf_events_t *ptr)
 {
     int fd = open(filename, O_WRONLY | O_APPEND, 0);
@@ -56,6 +57,7 @@ int clean_kprobe_events(FILE *out, int pid, netdata_ebpf_events_t *ptr)
 
     return 0;
 }
+*/
 
 //----------------------------------------------------------------------------------------------------------------------
 
@@ -280,40 +282,40 @@ static int select_file(char *name, const char *program, size_t length, int mode,
     return ret;
 }
 
-int ebpf_load_program(char *plugins_dir, int event_id, int mode, char *kernel_string, const char *name, int *map_fd)
+struct bpf_link **ebpf_load_program(char *plugins_dir, ebpf_module_t *em, char *kernel_string, struct bpf_object **obj, int *map_fd)
 {
-    UNUSED(event_id);
-
     char lpath[4096];
     char lname[128];
-    struct bpf_object *obj;
     int prog_fd;
 
-    int test = select_file(lname, name, (size_t)127, mode, kernel_string);
+    int test = select_file(lname, em->thread_name, (size_t)127, em->mode, kernel_string);
     if (test < 0 || test > 127)
-        return -1;
+        return NULL;
 
     snprintf(lpath, 4096, "%s/%s", plugins_dir, lname);
-    if (bpf_prog_load(lpath, BPF_PROG_TYPE_KPROBE, &obj, &prog_fd)) {
+    if (bpf_prog_load(lpath, BPF_PROG_TYPE_KPROBE, obj, &prog_fd)) {
         info("Cannot load program: %s", lpath);
-        return -1;
+        return NULL;
     } else {
-        info("The eBPF program %s was loaded with success.", name);
+        info("The eBPF program %s was loaded with success.", em->thread_name);
     }
 
     struct bpf_map *map;
     size_t i = 0;
-    bpf_map__for_each(map, obj)
+    bpf_map__for_each(map, *obj)
     {
         map_fd[i] = bpf_map__fd(map);
         i++;
     }
 
     struct bpf_program *prog;
-    bpf_object__for_each_program(prog, obj)
+    struct bpf_link **links = callocz(NETDATA_MAX_PROBES , sizeof(struct bpf_link *));
+    i = 0;
+    bpf_object__for_each_program(prog, *obj)
     {
-        bpf_program__attach(prog);
+        links[i] = bpf_program__attach(prog);
+        i++;
     }
 
-    return 0;
+    return links;
 }
diff --git a/libnetdata/ebpf/ebpf.h b/libnetdata/ebpf/ebpf.h
index 029175dcb3..379f2be45e 100644
--- a/libnetdata/ebpf/ebpf.h
+++ b/libnetdata/ebpf/ebpf.h
@@ -68,16 +68,38 @@ typedef struct ebpf_data {
     int isrh;
 } ebpf_data_t;
 
+typedef enum {
+    MODE_RETURN = 0, // This attaches kprobe when the function returns
+    MODE_DEVMODE,    // This stores log given description about the errors raised
+    MODE_ENTRY       // This attaches kprobe when the function is called
+} netdata_run_mode_t;
+
+typedef struct ebpf_module {
+    const char *thread_name;
+    const char *config_name;
+    int enabled;
+    void *(*start_routine)(void *);
+    int update_time;
+    int global_charts;
+    int apps_charts;
+    netdata_run_mode_t mode;
+    netdata_ebpf_events_t *probes;
+    uint32_t thread_id;
+    int optional;
+} ebpf_module_t;
+
+#define NETDATA_MAX_PROBES 64
+
 extern int clean_kprobe_events(FILE *out, int pid, netdata_ebpf_events_t *ptr);
 extern int get_kernel_version(char *out, int size);
 extern int get_redhat_release();
 extern int has_condition_to_run(int version);
 extern char *ebpf_kernel_suffix(int version, int isrh);
 extern int ebpf_update_kernel(ebpf_data_t *ef);
-extern int ebpf_load_program(char *plugins_dir,
-                             int event_id, int mode,
+extern struct bpf_link **ebpf_load_program(char *plugins_dir,
+                             ebpf_module_t *em,
                              char *kernel_string,
-                             const char *name,
+                             struct bpf_object **obj,
                              int *map_fd);
 
 #endif /* NETDATA_EBPF_H */