Merge branch '2430-ebpf' into 'dev'

Resolve "ebpf 采集器资源高占用问题"

See merge request cloudcare-tools/datakit!3256

internal/export/doc/en/inputs/ebpf.md

@@ -123,6 +123,11 @@ Configuration items:
     - Environment variable: `ENV_INPUT_EBPF_L7NET_ENABLED`
     - Example: `httpflow`
 
+- `interval`
+    - Description: Set the sampling time interval
+    - Environment variable: `ENV_INPUT_EBPF_INTERVAL`
+    - Example: `1m30s`
+
 - `ipv6_disabled`
     - Description: Whether the system does not support IPv6
     - Environment variable: `ENV_INPUT_EBPF_IPV6_DISABLED`

internal/export/doc/zh/inputs/ebpf.md

@@ -120,6 +120,11 @@ setenforce 0
     - 环境变量：`ENV_INPUT_EBPF_L7NET_ENABLED`
     - 示例：`httpflow`
 
+- `interval`
+    - 描述：设置采样时间间隔
+    - 环境变量：`ENV_INPUT_EBPF_INTERVAL`
+    - 示例：`1m30s`
+
 - `ipv6_disabled`
     - 描述：系统是否不支持 IPv6
     - 环境变量：`ENV_INPUT_EBPF_IPV6_DISABLED`

internal/plugins/externals/ebpf/internal/c/apiflow/apiflow.c

@@ -98,6 +98,8 @@ FN_KPROBE(tcp_close)
         return 0;
     }
 
+    clean_protocol_filter(sk);
+
     net_data_t *dst = get_net_data_percpu();
     if (dst == NULL)
     {
@@ -123,8 +125,6 @@ FN_KPROBE(tcp_close)
 
     try_upload_net_events(ctx, dst);
 
-    clean_protocol_filter(pid_tgid, sk);
-
     return 0;
 }
 
@@ -166,18 +166,17 @@ FN_UPROBE(SSL_shutdown)
 FN_KPROBE(sched_getaffinity)
 {
     __u64 cpu = bpf_get_smp_processor_id();
-    __s32 index = 0;
-    network_events_t *events = bpf_map_lookup_elem(&mp_network_events, &index);
+    network_events_t *events = get_net_events();
     if (events == NULL)
     {
         return 0;
     }
 
-    if (events->pos.num > 0)
+    if (events->rec.num > 0)
     {
         bpf_perf_event_output(ctx, &mp_upload_netwrk_events, cpu, events, sizeof(network_events_t));
-        events->pos.len = 0;
-        events->pos.num = 0;
+        events->rec.bytes = 0;
+        events->rec.num = 0;
     }
 
     return 0;

internal/plugins/externals/ebpf/internal/c/apiflow/bpfmap_l7.h

@@ -11,32 +11,39 @@
 // ------------------------------------------------------
 // ---------------------- BPF MAP -----------------------
 
-BPF_HASH_MAP(mp_syscall_rw_arg, __u64, syscall_rw_arg_t, 1024)
-BPF_HASH_MAP(mp_syscall_rw_v_arg, __u64, syscall_rw_v_arg_t, 1024)
+BPF_HASH_MAP(mp_syscall_rw_arg, __u64, syscall_rw_arg_t, 2048)
+BPF_HASH_MAP(mp_syscall_rw_v_arg, __u64, syscall_rw_v_arg_t, 2048)
 
-BPF_HASH_MAP(mp_sk_inf, void *, sk_inf_t, 65535)
+// Limit the number of connections tracked to 4k conns
+BPF_HASH_MAP(mp_sk_inf, void *, sk_inf_t, 40960)
 
 BPF_PERCPU_ARRAY(mp_uni_id_per_cpu, id_generator_t)
 
-BPF_PERCPU_ARRAY(mp_network_data, net_data_t)
+BPF_PERCPU_ARRAY(mp_network_data_per_cpu, net_data_t)
 
-BPF_PERCPU_ARRAY(mp_network_events, network_events_t)
+BPF_PERCPU_ARRAY(mp_network_events_per_cpu, network_events_t)
+
+static __always_inline network_events_t *get_net_events()
+{
+    __s32 index = 0;
+    network_events_t *events = bpf_map_lookup_elem(&mp_network_events_per_cpu, &index);
+    return events;
+}
 
 BPF_PERF_EVENT_MAP(mp_upload_netwrk_events)
 
-BPF_HASH_MAP(bpfmap_ssl_read_args, __u64, ssl_read_args_t, 1024)
+BPF_HASH_MAP(bpfmap_ssl_read_args, __u64, ssl_read_args_t, 2048)
 
-BPF_HASH_MAP(bpfmap_bio_new_socket_args, __u64, __u32, 1024) // k: pid_tgid v: sockfd
+BPF_HASH_MAP(bpfmap_bio_new_socket_args, __u64, __u32, 2048) // k: pid_tgid v: sockfd
 
-BPF_HASH_MAP(bpfmap_ssl_ctx_sockfd, void *, __u64, 1024)
+BPF_HASH_MAP(bpfmap_ssl_ctx_sockfd, void *, __u64, 2048)
 
-BPF_HASH_MAP(bpfmap_ssl_bio_fd, void *, __u32, 1024)
+BPF_HASH_MAP(bpfmap_ssl_bio_fd, void *, __u32, 2048)
 
-BPF_HASH_MAP(bpfmap_ssl_pidtgid_ctx, __u64, void *, 1024)
+BPF_HASH_MAP(bpfmap_ssl_pidtgid_ctx, __u64, void *, 2048)
 
-BPF_HASH_MAP(bpfmap_syscall_sendfile_arg, __u64, syscall_sendfile_arg_t, 1024)
+BPF_HASH_MAP(bpfmap_syscall_sendfile_arg, __u64, syscall_sendfile_arg_t, 2048)
 
-// TODO: use it
-BPF_HASH_MAP(mp_protocol_filter, pid_skptr_t, __u8, 65536)
+BPF_HASH_MAP(mp_protocol_filter, void *, __u8, 65536)
 
 #endif // !__BPFMAP_L7_H

internal/plugins/externals/ebpf/internal/c/apiflow/l7_stats.h

@@ -74,6 +74,7 @@ typedef struct sk_inf
 {
     id_generator_t uni_id;
     __u64 index;
+    __u64 skptr;
     conn_inf_t conn;
 } sk_inf_t;
 
@@ -105,67 +106,32 @@ typedef struct netwrk_data
 typedef struct event_rec
 {
     __u32 num;
-    __u32 len;
+    __u32 bytes;
 } event_rec_t;
 
 enum
 {
-    L7_EVENT_SIZE = (L7_BUFFER_SIZE * 2 - sizeof(event_rec_t)),
+    L7_EVENT_SIZE = (L7_BUFFER_SIZE * 4 - sizeof(event_rec_t)),
 #define L7_EVENT_SIZE L7_EVENT_SIZE
 };
 
 typedef struct network_events
 {
-    event_rec_t pos;
+    event_rec_t rec;
     __u8 payload[L7_EVENT_SIZE];
 } network_events_t;
 
-typedef enum
-{
-    BUF_DIV8 = L7_BUFFER_SIZE / 8,
-#define BUF_DIV8 BUF_DIV8
-
-    BUF_DIV4 = L7_BUFFER_SIZE / 4,
-#define BUF_DIV4 BUF_DIV4
-
-    BUF_DIV2 = L7_BUFFER_SIZE / 2,
-#define BUF_DIV2 BUF_DIV2
-
-    BUF_DIV1 = L7_BUFFER_SIZE,
-#define BUF_DIV1 BUF_DIV1
-} buf_div_t;
-
 typedef struct net_event_comm
 {
-    __u32 idx;
-    __u32 len;
-
+    event_rec_t rec;
     netdata_meta_t meta;
 } net_event_comm_t;
 
 typedef struct
 {
     net_event_comm_t event_comm;
-    __u8 payload[BUF_DIV8];
-} net_event_div8_t;
-
-typedef struct
-{
-    net_event_comm_t event_comm;
-    __u8 payload[BUF_DIV4];
-} net_event_div4_t;
-
-typedef struct
-{
-    net_event_comm_t event_comm;
-    __u8 payload[BUF_DIV2];
-} net_event_div2_t;
-
-typedef struct
-{
-    net_event_comm_t event_comm;
-    __u8 payload[BUF_DIV1];
-} net_event_div1_t;
+    __u8 payload[L7_BUFFER_SIZE];
+} net_event_t;
 
 typedef struct ssl_read_args
 {