// SPDX-License-Identifier: GPL-3.0-or-later
#include <sys/resource.h>
#include "ebpf.h"
#include "ebpf_process.h"
/*****************************************************************
*
* GLOBAL VARIABLES
*
*****************************************************************/
static char *process_dimension_names[NETDATA_KEY_PUBLISH_PROCESS_END] = { "open", "close", "delete", "read", "write",
"process", "task", "process", "thread" };
static char *process_id_names[NETDATA_KEY_PUBLISH_PROCESS_END] = { "do_sys_open", "__close_fd", "vfs_unlink",
"vfs_read", "vfs_write", "do_exit",
"release_task", "_do_fork", "sys_clone" };
static char *status[] = { "process", "zombie" };
static netdata_idx_t *process_hash_values = NULL;
static netdata_syscall_stat_t *process_aggregated_data = NULL;
static netdata_publish_syscall_t *process_publish_aggregated = NULL;
static ebpf_data_t process_data;
ebpf_process_stat_t **global_process_stats = NULL;
ebpf_process_publish_apps_t **current_apps_data = NULL;
int process_enabled = 0;
static int *map_fd = NULL;
static struct bpf_object *objects = NULL;
static struct bpf_link **probe_links = NULL;
/*****************************************************************
*
* PROCESS DATA AND SEND TO NETDATA
*
*****************************************************************/
/**
* Update publish structure before to send data to Netdata.
*
* @param publish the first output structure with independent dimensions
* @param pvc the second output structure with correlated dimensions
* @param input the structure with the input data.
*/
static void ebpf_update_global_publish(
netdata_publish_syscall_t *publish, netdata_publish_vfs_common_t *pvc, netdata_syscall_stat_t *input)
{
netdata_publish_syscall_t *move = publish;
int selector = NETDATA_KEY_PUBLISH_PROCESS_OPEN;
while (move) {
// Until NETDATA_KEY_PUBLISH_PROCESS_READ we are creating accumulators, so it is possible
// to use incremental charts, but after this we will do some math with the values, so we are storing
// absolute values
if (selector < NETDATA_KEY_PUBLISH_PROCESS_READ) {
move->ncall = input->call;
move->nbyte = input->bytes;
move->nerr = input->ecall;
} else {
move->ncall = (input->call > move->pcall) ? input->call - move->pcall : move->pcall - input->call;
move->nbyte = (input->bytes > move->pbyte) ? input->bytes - move->pbyte : move->pbyte - input->bytes;
move->nerr = (input->ecall > move->nerr) ? input->ecall - move->perr : move->perr - input->ecall;
move->pcall = input->call;
move->pbyte = input->bytes;
move->perr = input->ecall;
}
input = input->next;
move = move->next;
selector++;
}
pvc->write = -((long)publish[NETDATA_KEY_PUBLISH_PROCESS_WRITE].nbyte);
pvc->read = (long)publish[NETDATA_KEY_PUBLISH_PROCESS_READ].nbyte;
pvc->running = (long)publish[NETDATA_KEY_PUBLISH_PROCESS_FORK].ncall - (long)publish[NETDATA_KEY_PUBLISH_PROCESS_CLONE