Conditionalize sched_process_free hook (#737) (#738)

Co-authored-by: Roger Coll <roger.coll@elastic.co>
Co-authored-by: Florian Lehner <florianl@users.noreply.github.com>
Co-authored-by: Timo Teräs <timo.teras@iki.fi>

Author: 4 people

.github/workflows/unit-test-on-pull-request.yml

@@ -179,12 +179,16 @@ jobs:
           - { target_arch: amd64, kernel: 6.8.10 }
           - { target_arch: amd64, kernel: 6.9.1 }
           - { target_arch: amd64, kernel: 6.12.16 }
+          - { target_arch: amd64, kernel: 6.16 }
 
           # ARM64 (NOTE: older ARM64 kernels are not available in Cilium repos)
           - { target_arch: arm64, kernel: 6.6.31 }
           - { target_arch: arm64, kernel: 6.8.4 }
           - { target_arch: arm64, kernel: 6.9.1 }
           - { target_arch: arm64, kernel: 6.12.16 }
+          # qemu has a bug that prevents booting the following kernel on ARM,
+          # fixed in qemu 9.2
+          #- { target_arch: arm64, kernel: 6.16 }
     steps:
       - name: Clone code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

libpf/generics.go

@@ -24,6 +24,15 @@ func MapKeysToSlice[K comparable, V any](m map[K]V) []K {
 	return slice
 }
 
+// MapKeysToSet creates a set from a map's keys.
+func MapKeysToSet[K comparable, V any](m map[K]V) Set[K] {
+	set := make(Set[K], len(m))
+	for key := range m {
+		set[key] = Void{}
+	}
+	return set
+}
+
 // SliceAllEqual checks whether all items in a slice have a given value.
 func SliceAllEqual[T comparable](s []T, value T) bool {
 	for _, item := range s {

support/ebpf/sched_monitor.ebpf.c

@@ -7,20 +7,25 @@
 #include "types.h"
 
 // See /sys/kernel/debug/tracing/events/sched/sched_process_free/format
-// for struct layout.
-struct sched_process_free_ctx {
+// for struct layout. This is pre-6.16 format which uses a fixed-size
+// (TASK_COMM_LEN) array for comm.
+struct sched_process_free_ctx_pre616 {
   unsigned char skip[24];
   pid_t pid;
   int prio;
 };
 
-// tracepoint__sched_process_free is a tracepoint attached to the scheduler that frees processes.
-// Every time a processes exits this hook is triggered.
-SEC("tracepoint/sched/sched_process_free")
-int tracepoint__sched_process_free(struct sched_process_free_ctx *ctx)
-{
-  u32 pid = ctx->pid;
+// This is the newer kernel version 6.16+ format.
+// The change was introduced upstream with
+// https://github.com/torvalds/linux/commit/155fd6c3e2f02efdc71a9b62888942efc217aff0
+struct sched_process_free_ctx {
+  unsigned char skip[12];
+  pid_t pid;
+  int prio;
+};
 
+static EBPF_INLINE int do_process_free(void *ctx, u32 pid)
+{
   if (!bpf_map_lookup_elem(&reported_pids, &pid) && !pid_information_exists(pid)) {
     // Only report PIDs that we explicitly track. This avoids sending kernel worker PIDs
     // to userspace.
@@ -33,3 +38,17 @@ int tracepoint__sched_process_free(struct sched_process_free_ctx *ctx)
 exit:
   return 0;
 }
+
+// tracepoint__sched_process_free is a tracepoint attached to the scheduler that frees processes.
+// Every time a processes exits this hook is triggered.
+SEC("tracepoint/sched/sched_process_free/v2")
+int tracepoint__sched_process_free(struct sched_process_free_ctx *ctx)
+{
+  return do_process_free(ctx, ctx->pid);
+}
+
+SEC("tracepoint/sched/sched_process_free/v1")
+int tracepoint__sched_process_free_pre616(struct sched_process_free_ctx_pre616 *ctx)
+{
+  return do_process_free(ctx, ctx->pid);
+}

support/ebpf/tracer.ebpf.amd64

@@ -8,6 +8,7 @@ import (
 
 	"github.com/cilium/ebpf"
 	"github.com/cilium/ebpf/link"
+	"go.opentelemetry.io/ebpf-profiler/libpf"
 	"go.opentelemetry.io/ebpf-profiler/rlimit"
 )
 
@@ -34,8 +35,8 @@ func (t *Tracer) AttachSchedMonitor() error {
 	if err != nil {
 		return fmt.Errorf("failed to adjust rlimit: %v", err)
 	}
-	defer restoreRlimit()
 
-	prog := t.ebpfProgs["tracepoint__sched_process_free"]
-	return t.attachToTracepoint("sched", "sched_process_free", prog)
+	defer restoreRlimit()
+	name := schedProcessFreeHookName(libpf.MapKeysToSet(t.ebpfProgs))
+	return t.attachToTracepoint("sched", "sched_process_free", t.ebpfProgs[name])
 }

support/ebpf/tracer.ebpf.arm64

@@ -56,6 +56,13 @@ const (
 	probProfilingDisable = -1
 )
 
+// Names of tracepoint hooks for sched_process_free. There are two hooks
+// as the tracepoint format has changed for kernel versions 6.16+.
+const (
+	schedProcessFreeV1 = "tracepoint__sched_process_free_pre616"
+	schedProcessFreeV2 = "tracepoint__sched_process_free"
+)
+
 // Intervals is a subset of config.IntervalsAndTimers.
 type Intervals interface {
 	MonitorInterval() time.Duration
@@ -174,6 +181,16 @@ func goString(cstr []byte) string {
 	return strings.Clone(pfunsafe.ToString(cstr[:index]))
 }
 
+// schedProcessFreeHookName returns the name of the tracepoint hook to use.
+// This function requires that only one of (schedProcessFreeV1, schedProcessFreeV2)
+// be present in progNames.
+func schedProcessFreeHookName(progNames libpf.Set[string]) string {
+	if _, ok := progNames[schedProcessFreeV1]; ok {
+		return schedProcessFreeV1
+	}
+	return schedProcessFreeV2
+}
+
 // NewTracer loads eBPF code and map definitions from the ELF module at the configured path.
 func NewTracer(ctx context.Context, cfg *Config) (*Tracer, error) {
 	kernelSymbolizer, err := kallsyms.NewSymbolizer()
@@ -282,11 +299,23 @@ func initializeMapsAndPrograms(kmod *kallsyms.Module, cfg *Config) (
 	// References to eBPF maps in the eBPF programs are just placeholders that need to be
 	// replaced by the actual loaded maps later on with RewriteMaps before loading the
 	// programs into the kernel.
+	major, minor, patch, err := GetCurrentKernelVersion()
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to get kernel version: %v", err)
+	}
+
 	coll, err := support.LoadCollectionSpec()
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to load specification for tracers: %v", err)
 	}
 
+	if major > 6 || (major == 6 && minor >= 16) {
+		// Tracepoint format for sched_process_free has changed in v6.16+.
+		delete(coll.Programs, schedProcessFreeV1)
+	} else {
+		delete(coll.Programs, schedProcessFreeV2)
+	}
+
 	if cfg.VerboseMode {
 		if err = coll.Variables["with_debug_output"].Set(uint32(1)); err != nil {
 			return nil, nil, fmt.Errorf("failed to set debug output: %v", err)
@@ -316,11 +345,6 @@ func initializeMapsAndPrograms(kmod *kallsyms.Module, cfg *Config) (
 	}
 
 	if cfg.KernelVersionCheck {
-		var major, minor, patch uint32
-		major, minor, patch, err = GetCurrentKernelVersion()
-		if err != nil {
-			return nil, nil, fmt.Errorf("failed to get kernel version: %v", err)
-		}
 		if hasProbeReadBug(major, minor, patch) {
 			if err = checkForMaccessPatch(coll, ebpfMaps, kmod); err != nil {
 				return nil, nil, fmt.Errorf("your kernel version %d.%d.%d may be "+
@@ -540,9 +564,11 @@ func loadPerfUnwinders(coll *cebpf.CollectionSpec, ebpfProgs map[string]*cebpf.P
 
 	progs := make([]progLoaderHelper, len(tailCallProgs)+2)
 	copy(progs, tailCallProgs)
+
+	schedProcessFree := schedProcessFreeHookName(libpf.MapKeysToSet(coll.Programs))
 	progs = append(progs,
 		progLoaderHelper{
-			name:             "tracepoint__sched_process_free",
+			name:             schedProcessFree,
 			noTailCallTarget: true,
 			enable:           true,
 		},