sched_process_free stuff

Author: umanwizard

support/ebpf/sched_monitor.ebpf.c

@@ -7,20 +7,25 @@
 #include "types.h"
 
 // See /sys/kernel/debug/tracing/events/sched/sched_process_free/format
-// for struct layout.
-struct sched_process_free_ctx {
+// for struct layout. This is pre-6.16 format which uses a fixed-size
+// (TASK_COMM_LEN) array for comm.
+struct sched_process_free_ctx_pre616 {
   unsigned char skip[24];
   pid_t pid;
   int prio;
 };
 
-// tracepoint__sched_process_free is a tracepoint attached to the scheduler that frees processes.
-// Every time a processes exits this hook is triggered.
-SEC("tracepoint/sched/sched_process_free")
-int tracepoint__sched_process_free(struct sched_process_free_ctx *ctx)
-{
-  u32 pid = ctx->pid;
+// This is the newer kernel version 6.16+ format.
+// The change was introduced upstream with
+// https://github.com/torvalds/linux/commit/155fd6c3e2f02efdc71a9b62888942efc217aff0
+struct sched_process_free_ctx {
+  unsigned char skip[12];
+  pid_t pid;
+  int prio;
+};
 
+static EBPF_INLINE int do_process_free(void *ctx, u32 pid)
+{
   if (!bpf_map_lookup_elem(&reported_pids, &pid) && !pid_information_exists(pid)) {
     // Only report PIDs that we explicitly track. This avoids sending kernel worker PIDs
     // to userspace.
@@ -33,3 +38,17 @@ int tracepoint__sched_process_free(struct sched_process_free_ctx *ctx)
 exit:
   return 0;
 }
+
+// tracepoint__sched_process_free is a tracepoint attached to the scheduler that frees processes.
+// Every time a processes exits this hook is triggered.
+SEC("tracepoint/sched/sched_process_free/v2")
+int tracepoint__sched_process_free(struct sched_process_free_ctx *ctx)
+{
+  return do_process_free(ctx, ctx->pid);
+}
+
+SEC("tracepoint/sched/sched_process_free/v1")
+int tracepoint__sched_process_free_pre616(struct sched_process_free_ctx_pre616 *ctx)
+{
+  return do_process_free(ctx, ctx->pid);
+}

support/ebpf/tracer.ebpf.amd64

@@ -34,8 +34,8 @@ func (t *Tracer) AttachSchedMonitor() error {
 	if err != nil {
 		return fmt.Errorf("failed to adjust rlimit: %v", err)
 	}
-	defer restoreRlimit()
 
-	prog := t.ebpfProgs["tracepoint__sched_process_free"]
-	return t.attachToTracepoint("sched", "sched_process_free", prog)
+	defer restoreRlimit()
+	name := schedProcessFreeHookName(libpf.MapKeysToSet(t.ebpfProgs))
+	return t.attachToTracepoint("sched", "sched_process_free", t.ebpfProgs[name])
 }

support/ebpf/tracer.ebpf.arm64

@@ -55,6 +55,13 @@ const (
 	probProfilingDisable = -1
 )
 
+// Names of tracepoint hooks for sched_process_free. There are two hooks
+// as the tracepoint format has changed for kernel versions 6.16+.
+const (
+	schedProcessFreeV1 = "tracepoint__sched_process_free_pre616"
+	schedProcessFreeV2 = "tracepoint__sched_process_free"
+)
+
 // Intervals is a subset of config.IntervalsAndTimers.
 type Intervals interface {
 	MonitorInterval() time.Duration
@@ -171,6 +178,16 @@ type progLoaderHelper struct {
 	noTailCallTarget bool
 }
 
+// schedProcessFreeHookName returns the name of the tracepoint hook to use.
+// This function requires that only one of (schedProcessFreeV1, schedProcessFreeV2)
+// be present in progNames.
+func schedProcessFreeHookName(progNames libpf.Set[string]) string {
+	if _, ok := progNames[schedProcessFreeV1]; ok {
+		return schedProcessFreeV1
+	}
+	return schedProcessFreeV2
+}
+
 // NewTracer loads eBPF code and map definitions from the ELF module at the configured path.
 func NewTracer(ctx context.Context, cfg *Config) (*Tracer, error) {
 	kernelSymbolizer, err := kallsyms.NewSymbolizer()
@@ -290,6 +307,13 @@ func initializeMapsAndPrograms(kmod *kallsyms.Module, cfg *Config) (ebpfMaps map
 		return nil, nil, nil, fmt.Errorf("failed to load specification for tracers: %v", err)
 	}
 
+	if major > 6 || (major == 6 && minor >= 16) {
+		// Tracepoint format for sched_process_free has changed in v6.16+.
+		delete(coll.Programs, schedProcessFreeV1)
+	} else {
+		delete(coll.Programs, schedProcessFreeV2)
+	}
+
 	if cfg.VerboseMode {
 		if err = coll.Variables["with_debug_output"].Set(uint32(1)); err != nil {
 			return nil, nil, nil, fmt.Errorf("failed to set debug output: %v", err)
@@ -546,9 +570,11 @@ func loadPerfUnwinders(coll *cebpf.CollectionSpec, ebpfProgs map[string]*cebpf.P
 
 	progs := make([]progLoaderHelper, len(tailCallProgs)+2)
 	copy(progs, tailCallProgs)
+
+	schedProcessFree := schedProcessFreeHookName(libpf.MapKeysToSet(coll.Programs))
 	progs = append(progs,
 		progLoaderHelper{
-			name:             "tracepoint__sched_process_free",
+			name:             schedProcessFree,
 			noTailCallTarget: true,
 			enable:           true,
 		},