Merging upstream version 1.35.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

2 files changed, 78 insertions, 3 deletions

diff --git a/libnetdata/ebpf/ebpf.c b/libnetdata/ebpf/ebpf.c
index dde6d57fc..ffb602307 100644
--- a/libnetdata/ebpf/ebpf.c
+++ b/libnetdata/ebpf/ebpf.c
@@ -843,9 +843,13 @@ void ebpf_adjust_thread_load(ebpf_module_t *mod, struct btf *file)
 }
 
 /**
+ * Parse BTF file
  *
- * @param filename
- * @return
+ * Parse a specific BTF file present on filesystem
+ *
+ * @param filename  the file that will be parsed.
+ *
+ * @return It returns a pointer for the file on success and NULL otherwise.
  */
 struct btf *ebpf_parse_btf_file(const char *filename)
 {
@@ -858,6 +862,71 @@ struct btf *ebpf_parse_btf_file(const char *filename)
 
     return bf;
 }
+
+/**
+ * Load default btf file
+ *
+ * Load the default BTF file on environment.
+ *
+ * @param path     is the fullpath
+ * @param filename is the file inside BTF path.
+ */
+struct btf *ebpf_load_btf_file(char *path, char *filename)
+{
+    char fullpath[PATH_MAX + 1];
+    snprintfz(fullpath, PATH_MAX, "%s/%s", path, filename);
+    struct btf *ret = ebpf_parse_btf_file(fullpath);
+    if (!ret)
+        info("Your environment does not have BTF file %s/%s. The plugin will work with 'legacy' code.",
+             path, filename);
+
+    return ret;
+}
+
+/**
+ * Find BTF attach type
+ *
+ * Search type fr current btf file.
+ *
+ * @param file     is the structure for the btf file already parsed.
+ */
+static inline const struct btf_type *ebpf_find_btf_attach_type(struct btf *file)
+{
+    int id = btf__find_by_name_kind(file, "bpf_attach_type", BTF_KIND_ENUM);
+    if (id < 0) {
+        fprintf(stderr, "Cannot find 'bpf_attach_type'");
+
+        return NULL;
+    }
+
+    return btf__type_by_id(file, id);
+}
+
+/**
+ * Is function inside BTF
+ *
+ * Look for a specific function inside the given BTF file.
+ *
+ * @param file     is the structure for the btf file already parsed.
+ * @param function is the function that we want to find.
+ */
+int ebpf_is_function_inside_btf(struct btf *file, char *function)
+{
+    const struct btf_type *type = ebpf_find_btf_attach_type(file);
+    if (!type)
+        return -1;
+
+    const struct btf_enum *e = btf_enum(type);
+    int i, id;
+    for (id = -1, i = 0; i < btf_vlen(type); i++, e++) {
+        if (!strcmp(btf__name_by_offset(file, e->name_off), "BPF_TRACE_FENTRY")) {
+            id = btf__find_by_name_kind(file, function, BTF_KIND_FUNC);
+            break;
+        }
+    }
+
+    return (id > 0) ? 1 : 0;
+}
 #endif
 
 /**
@@ -902,6 +971,9 @@ void ebpf_update_module_using_config(ebpf_module_t *modules)
     modules->apps_charts = appconfig_get_boolean(modules->cfg, EBPF_GLOBAL_SECTION, EBPF_CFG_APPLICATION,
                                                  modules->apps_charts);
 
+    modules->cgroup_charts = appconfig_get_boolean(modules->cfg, EBPF_GLOBAL_SECTION, EBPF_CFG_CGROUP,
+                                                   modules->cgroup_charts);
+
     modules->pid_map_size = (uint32_t)appconfig_get_number(modules->cfg, EBPF_GLOBAL_SECTION, EBPF_CFG_PID_SIZE,
                                                            modules->pid_map_size);
 
diff --git a/libnetdata/ebpf/ebpf.h b/libnetdata/ebpf/ebpf.h
index f701e1d4d..ec486b59a 100644
--- a/libnetdata/ebpf/ebpf.h
+++ b/libnetdata/ebpf/ebpf.h
@@ -275,7 +275,8 @@ extern int ebpf_enable_tracing_values(char *subsys, char *eventname);
 extern int ebpf_disable_tracing_values(char *subsys, char *eventname);
 
 // BTF Section
-#define EBPF_DEFAULT_BTF_FILE "/sys/kernel/btf"
+#define EBPF_DEFAULT_BTF_FILE "vmlinux"
+#define EBPF_DEFAULT_BTF_PATH "/sys/kernel/btf"
 #define EBPF_DEFAULT_ERROR_MSG "Cannot open or load BPF file for thread"
 
 // BTF helpers
@@ -287,6 +288,8 @@ extern void ebpf_select_host_prefix(char *output, size_t length, char *syscall,
 #ifdef LIBBPF_MAJOR_VERSION
 extern void ebpf_adjust_thread_load(ebpf_module_t *mod, struct btf *file);
 extern struct btf *ebpf_parse_btf_file(const char *filename);
+extern struct btf *ebpf_load_btf_file(char *path, char *filename);
+extern int ebpf_is_function_inside_btf(struct btf *file, char *function);
 #endif
 
 #endif /* NETDATA_EBPF_H */