fix(ebpf): ignore kthreads, do full pids cleanup

grafana · Nov 29, 2023 · dd1c3a7 · dd1c3a7
1 parent 5b8ab0e
commit dd1c3a7
Show file tree

Hide file tree

Showing 4 changed files with 54 additions and 1 deletion.
diff --git a/ebpf/bpf/profile.bpf.c b/ebpf/bpf/profile.bpf.c
@@ -5,6 +5,9 @@
 #include "bpf_tracing.h"
 #include "profile.bpf.h"
 #include "pid.h"
+#include "ume.h"
+
+#define PF_KTHREAD 0x00200000
 
 SEC("perf_event")
 int do_perf_event(struct bpf_perf_event_data *ctx) {
@@ -14,9 +17,20 @@ int do_perf_event(struct bpf_perf_event_data *ctx) {
     struct sample_key key = {};
     u32 *val, one = 1;
 
-    if (tgid == 0) {
+    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
+    if (tgid == 0 || task == 0) {
+        return 0;
+    }
+    int flags = 0;
+    if (pyro_bpf_core_read(&flags, sizeof(flags), &task->flags)) {
+        bpf_dbg_printk("failed to read task->flags\n");
         return 0;
     }
+    if (flags & PF_KTHREAD) {
+        bpf_dbg_printk("skipping kthread %d\n", tgid);
+        return 0;
+    }
+
     struct pid_config *config = bpf_map_lookup_elem(&pids, &tgid);
     if (config == NULL) {
         struct pid_config unknown = {

diff --git a/ebpf/pyrobpf/profile_bpfel_arm64.o b/ebpf/pyrobpf/profile_bpfel_arm64.o
diff --git a/ebpf/pyrobpf/profile_bpfel_x86.o b/ebpf/pyrobpf/profile_bpfel_x86.o
diff --git a/ebpf/session.go b/ebpf/session.go
@@ -745,6 +745,45 @@ func (s *session) cleanup() {
 			}
 		}
 	}
+
+	if s.roundNumber%10 == 0 {
+		s.checkStalePids()
+	}
+}
+
+// iterate over all pids and check if they are alive
+// it is only needed in case disassociate_ctty hook somehow mises a process death
+func (s *session) checkStalePids() {
+	var (
+		m       = s.bpf.Pids
+		mapSize = m.MaxEntries()
+		nextKey = uint32(0)
+	)
+	keys := make([]uint32, mapSize)
+	values := make([]pyrobpf.ProfilePidConfig, mapSize)
+	n, err := m.BatchLookup(nil, &nextKey, keys, values, new(ebpf.BatchOptions))
+	level.Debug(s.logger).Log("msg", "check stale pids", "count", n)
+	for i := 0; i < n; i++ {
+		status, err := os.ReadFile(fmt.Sprintf("/proc/%d/status", keys[i]))
+		if err != nil {
+			if !errors.Is(err, os.ErrNotExist) {
+				_ = level.Error(s.logger).Log("msg", "check stale pids", "err", err)
+			}
+			if err := m.Delete(keys[i]); err != nil && !errors.Is(err, ebpf.ErrKeyNotExist) {
+				_ = level.Error(s.logger).Log("msg", "delete stale pid", "pid", keys[i], "err", err)
+			}
+			_ = level.Debug(s.logger).Log("msg", "stale pid deleted", "pid", keys[i])
+			continue
+		} else {
+			name := strings.Split(string(status), "\n")[0]
+			_ = level.Debug(s.logger).Log("msg", "stale pid check : alive", "name", name, "pid", keys[i], "config", fmt.Sprintf("%+v", values[i]))
+		}
+	}
+	if err != nil {
+		if !errors.Is(err, ebpf.ErrKeyNotExist) {
+			level.Error(s.logger).Log("msg", "check stale pids", "err", err)
+		}
+	}
 }
 
 type stackBuilder struct {