support page fault

Signed-off-by: yaofighting <siyao@zju.edu.cn>

Author: yaofighting

driver/bpf/fillers.h

@@ -3898,6 +3898,13 @@ FILLER(sys_pagefault_e, false)
 	unsigned long error_code;
 	unsigned long address;
 	unsigned long ip;
+	struct task_struct *task;
+	unsigned long total_vm;
+	unsigned long maj_flt;
+	unsigned long min_flt;
+	struct mm_struct *mm;
+	long total_rss;
+	long swap;
 	u32 flags;
 	int res;
 
@@ -3914,17 +3921,61 @@ FILLER(sys_pagefault_e, false)
 	error_code = ctx->error_code;
 #endif
 
-	res = bpf_val_to_ring(data, address);
+
+
+	task = (struct task_struct *)bpf_get_current_task();
+
+
+	/*
+	 * pgft_maj
+	 */
+	maj_flt = _READ(task->maj_flt);
+	res = bpf_val_to_ring_type(data, maj_flt, PT_UINT64);
 	if (res != PPM_SUCCESS)
 		return res;
 
-	res = bpf_val_to_ring(data, ip);
+	/*
+	 * pgft_min
+	 */
+	min_flt = _READ(task->min_flt);
+	res = bpf_val_to_ring_type(data, min_flt, PT_UINT64);
 	if (res != PPM_SUCCESS)
 		return res;
 
-	flags = pf_flags_to_scap(error_code);
-	res = bpf_val_to_ring(data, flags);
+	total_vm = 0;
+	total_rss = 0;
+	swap = 0;
+
+	mm = _READ(task->mm);
+	if (mm) {
+		total_vm = _READ(mm->total_vm);
+		total_vm <<= (PAGE_SHIFT - 10);
+		total_rss = bpf_get_mm_rss(mm) << (PAGE_SHIFT - 10);
+		swap = bpf_get_mm_swap(mm) << (PAGE_SHIFT - 10);
+	}
+
+	/*
+	 * vm_size
+	 */
+	res = bpf_val_to_ring_type(data, total_vm, PT_UINT32);
+	if (res != PPM_SUCCESS)
+		return res;
+
+	/*
+	 * vm_rss
+	 */
+	res = bpf_val_to_ring_type(data, total_rss, PT_UINT32);
+	if (res != PPM_SUCCESS)
+		return res;
+
+	/*
+	 * vm_swap
+	 */
+	res = bpf_val_to_ring_type(data, swap, PT_UINT32);
 
+	pid_t tid = _READ(task->pid);
+	int map_res = bpf_map_update_elem(&pgft_major_map, &tid, &maj_flt, BPF_ANY);
+	if(map_res != 0) return PPM_MAP_FAILURE;
 	return res;
 }
 

driver/bpf/maps.h

@@ -90,14 +90,6 @@ struct bpf_map_def __bpf_section("maps") local_state_map = {
 	.max_entries = 0,
 };
 
-#ifndef BPF_SUPPORTS_RAW_TRACEPOINTS
-struct bpf_map_def __bpf_section("maps") stash_map = {
-	.type = BPF_MAP_TYPE_HASH,
-	.key_size = sizeof(u64),
-	.value_size = sizeof(struct sys_stash_args),
-	.max_entries = 65535,
-};
-#endif
 
 struct bpf_map_def __bpf_section("maps") rtt_static_map = {
         .type = BPF_MAP_TYPE_HASH,
@@ -113,6 +105,22 @@ struct bpf_map_def __bpf_section("maps") stash_tuple_map = {
 	.max_entries = 65535,
 };
 
+struct bpf_map_def __bpf_section("maps") pgft_major_map = {
+	.type = BPF_MAP_TYPE_HASH,
+	.key_size = sizeof(pid_t),
+	.value_size = sizeof(u64),
+	.max_entries = 1048576,
+};
+
+#ifndef BPF_SUPPORTS_RAW_TRACEPOINTS
+struct bpf_map_def __bpf_section("maps") stash_map = {
+	.type = BPF_MAP_TYPE_HASH,
+	.key_size = sizeof(u64),
+	.value_size = sizeof(struct sys_stash_args),
+	.max_entries = 65535,
+};
+#endif
+
 enum offcpu_type {
     ON, // 0
     DISK, // 1

driver/bpf/probe.c

@@ -409,6 +409,29 @@ static __always_inline int bpf_page_fault(struct page_fault_args *ctx)
 
 	if (!settings->capture_enabled)
 		return 0;
+	
+	if(settings->pgft_map_clear)
+		return 0;
+
+    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
+	unsigned long maj_flt = _READ(task->maj_flt);
+	if(maj_flt == 0){
+		return 0;
+	}
+	pid_t tid = _READ(task->pid);
+	unsigned long *last_maj = bpf_map_lookup_elem(&pgft_major_map, &tid);
+	if(last_maj && *last_maj == maj_flt){
+		return 0;
+	}
+
+	if(!last_maj){
+		int key = -1;
+		unsigned long *page_faults_threads_number = bpf_map_lookup_elem(&pgft_major_map, &key);
+		if(page_faults_threads_number){
+			(*page_faults_threads_number)++;
+			bpf_map_update_elem(&pgft_major_map, &key, page_faults_threads_number, BPF_ANY);
+		}
+	}
 
 	evt_type = PPME_PAGE_FAULT_E;
 

driver/bpf/types.h

@@ -261,10 +261,13 @@ enum sysdig_map_types {
 	SYSDIG_TMP_SCRATCH_MAP = 7,
 	SYSDIG_SETTINGS_MAP = 8,
 	SYSDIG_LOCAL_STATE_MAP = 9,
+	SYSDIG_RTT_STATISTICS = 10,
+	SYSDIG_STASH_TUPLE_MAP = 11,
+	SYSDIG_PAGEFAULT_MAJOR_MAP = 12, 
 #ifndef BPF_SUPPORTS_RAW_TRACEPOINTS
-	SYSDIG_STASH_MAP = 10,
-	SYSDIG_RTT_STATISTICS = 11,
+	SYSDIG_STASH_MAP = 13,
 #endif
+	
 };
 
 struct sysdig_bpf_settings {
@@ -275,6 +278,7 @@ struct sysdig_bpf_settings {
 	bool capture_enabled;
 	bool do_dynamic_snaplen;
 	bool page_faults;
+	bool pgft_map_clear;
 	bool dropping_mode;
 	bool is_dropping;
 	bool tracers_enabled;

driver/event_table.c

@@ -302,7 +302,7 @@ const struct ppm_event_info g_event_info[PPM_EVENT_MAX] = {
 	/* PPME_INFRASTRUCTURE_EVENT_X */{"NA4", EC_SYSTEM, EF_UNUSED, 0},
 	/* PPME_SYSCALL_EXECVE_18_E */{"execve", EC_PROCESS, EF_MODIFIES_STATE | EF_OLD_VERSION, 1, {{"filename", PT_FSPATH, PF_NA} } },
 	/* PPME_SYSCALL_EXECVE_18_X */{"execve", EC_PROCESS, EF_MODIFIES_STATE | EF_OLD_VERSION, 17, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_INT32, PF_DEC} } },
-	/* PPME_PAGE_FAULT_E */ {"page_fault", EC_OTHER, EF_SKIPPARSERESET | EF_DROP_SIMPLE_CONS, 3, {{"addr", PT_UINT64, PF_HEX}, {"ip", PT_UINT64, PF_HEX}, {"error", PT_FLAGS32, PF_HEX, pf_flags} } },
+	/* PPME_PAGE_FAULT_E */ {"page_fault", EC_OTHER, EF_SKIPPARSERESET | EF_DROP_SIMPLE_CONS, 5, {{"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC} } },
 	/* PPME_PAGE_FAULT_X */ {"NA5", EC_OTHER, EF_UNUSED, 0},
 	/* PPME_SYSCALL_EXECVE_19_E */{"execve", EC_PROCESS, EF_MODIFIES_STATE, 1, {{"filename", PT_FSPATH, PF_NA} } },
 	/* PPME_SYSCALL_EXECVE_19_X */{"execve", EC_PROCESS, EF_MODIFIES_STATE, 19, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_INT32, PF_DEC}, {"pgid", PT_PID, PF_DEC}, {"loginuid", PT_INT32, PF_DEC} } },

driver/ppm_events_public.h

@@ -1663,6 +1663,7 @@ struct ppm_event_entry {
 #define PPM_FAILURE_INVALID_USER_MEMORY -2
 #define PPM_FAILURE_BUG -3
 #define PPM_SKIP_EVENT -4
+#define PPM_MAP_FAILURE -5
 
 #define RW_SNAPLEN 80
 #define RW_MAX_SNAPLEN PPM_MAX_ARG_SIZE

userspace/libscap/scap.c

@@ -35,6 +35,7 @@ limitations under the License.
 #endif // _WIN32
 
 #include "scap.h"
+#include "../../driver/bpf/types.h"
 #ifdef HAS_CAPTURE
 #if !defined(_WIN32) && !defined(CYGWING_AGENT)
 #include "driver_config.h"
@@ -1918,6 +1919,32 @@ int32_t scap_enable_tracers_capture(scap_t* handle)
 }
 #endif
 
+int scap_get_pagefaults_threads_number(scap_t *handle){
+	return scap_bpf_get_pagefault_threads_number(handle);
+}
+
+int32_t scap_update_pagefaults_thread_number(scap_t *handle, int tid, unsigned long val){
+	return scap_bpf_update_pagefaults_threads_number(handle, tid, val);
+}
+
+#if defined(HAS_CAPTURE) && ! defined(CYGWING_AGENT) && ! defined(_WIN32)
+int32_t scap_pagefaults_map_clear(scap_t *handle){
+	if(handle->m_mode != SCAP_MODE_LIVE)
+	{
+		snprintf(handle->m_lasterr, SCAP_LASTERR_SIZE, "scap_pagefaults_map_clear not supported on this scap mode");
+		ASSERT(false);
+		return SCAP_FAILURE;
+	}
+	if(handle->m_ndevs)
+	{
+		if(handle->m_bpf)
+		{
+			return scap_bpf_clear_pagefault_map(handle);
+		}
+	}
+}
+#endif
+
 #if defined(HAS_CAPTURE) && ! defined(CYGWING_AGENT) && ! defined(_WIN32)
 int32_t scap_enable_page_faults(scap_t *handle)
 {

userspace/libscap/scap.h

@@ -1068,6 +1068,9 @@ uint64_t scap_ftell(scap_t *handle);
 void scap_fseek(scap_t *handle, uint64_t off);
 int32_t scap_enable_tracers_capture(scap_t* handle);
 int32_t scap_enable_page_faults(scap_t *handle);
+int scap_get_pagefaults_threads_number(scap_t *handle);
+int32_t scap_update_pagefaults_thread_number(scap_t *handle, int tid, unsigned long val);
+int32_t scap_pagefaults_map_clear(scap_t *handle);
 int32_t scap_enable_skb_capture(scap_t *handle);
 int32_t scap_disable_skb_capture(scap_t *handle);
 uint64_t scap_get_unexpected_block_readsize(scap_t* handle);

userspace/libscap/scap_bpf.c

@@ -116,6 +116,30 @@ static int bpf_map_update_elem(int fd, const void *key, const void *value, uint6
 	return sys_bpf(BPF_MAP_UPDATE_ELEM, &attr, sizeof(attr));
 }
 
+static int bpf_map_get_next_key(int fd, void *key, void *next_key){
+	union bpf_attr attr;
+
+	bzero(&attr, sizeof(attr));
+
+	attr.map_fd = fd;
+	attr.key = (unsigned long) key;
+	attr.next_key = (unsigned long) next_key;
+
+	return sys_bpf(BPF_MAP_GET_NEXT_KEY, &attr, sizeof(attr));
+}
+
+static int bpf_map_delete_elem(int fd, const void *key)
+{
+	union bpf_attr attr;
+
+	bzero(&attr, sizeof(attr));
+
+	attr.map_fd = fd;
+	attr.key = (unsigned long) key;
+
+	return sys_bpf(BPF_MAP_DELETE_ELEM, &attr, sizeof(attr));
+}
+
 static int bpf_map_lookup_elem(int fd, const void *key, void *value)
 {
 	union bpf_attr attr;
@@ -1220,7 +1244,71 @@ int32_t scap_bpf_enable_dynamic_snaplen(scap_t* handle)
 
 	return SCAP_SUCCESS;
 }
+int32_t scap_bpf_clear_pagefault_map(scap_t* handle){
+	struct sysdig_bpf_settings settings;
+	int k = 0;
 
+	if(bpf_map_lookup_elem(handle->m_bpf_map_fds[SYSDIG_SETTINGS_MAP], &k, &settings) != 0)
+	{
+		snprintf(handle->m_lasterr, SCAP_LASTERR_SIZE, "SYSDIG_SETTINGS_MAP bpf_map_lookup_elem < 0");
+		return SCAP_FAILURE;
+	}
+
+	// start to clear map & set the mutex 
+	settings.pgft_map_clear = true;
+	if(bpf_map_update_elem(handle->m_bpf_map_fds[SYSDIG_SETTINGS_MAP], &k, &settings, BPF_ANY) != 0)
+	{
+		snprintf(handle->m_lasterr, SCAP_LASTERR_SIZE, "SYSDIG_SETTINGS_MAP bpf_map_update_elem < 0");
+		return SCAP_FAILURE;
+	}
+
+
+	int next_key, lookup_key;
+	lookup_key = -1;
+	while(bpf_map_get_next_key(handle->m_bpf_map_fds[SYSDIG_PAGEFAULT_MAJOR_MAP], &lookup_key, &next_key) == 0){
+		bpf_map_delete_elem(handle->m_bpf_map_fds[SYSDIG_PAGEFAULT_MAJOR_MAP], &next_key);
+		lookup_key = next_key;
+	}
+
+	// end up to clear map & clear the mutex
+	settings.pgft_map_clear = false;
+	if(bpf_map_update_elem(handle->m_bpf_map_fds[SYSDIG_SETTINGS_MAP], &k, &settings, BPF_ANY) != 0)
+	{
+		snprintf(handle->m_lasterr, SCAP_LASTERR_SIZE, "SYSDIG_SETTINGS_MAP bpf_map_update_elem < 0");
+		return SCAP_FAILURE;
+	}
+
+	
+	k = -1;
+	unsigned long val = 0;
+
+	if(bpf_map_update_elem(handle->m_bpf_map_fds[SYSDIG_PAGEFAULT_MAJOR_MAP], &k, &val, BPF_ANY) != 0)
+	{
+		snprintf(handle->m_lasterr, SCAP_LASTERR_SIZE, "SYSDIG_PAGEFAULT_MAJOR_MAP bpf_map_update_elem < 0");
+		return SCAP_FAILURE;
+	}
+
+	return SCAP_SUCCESS;
+}
+int scap_bpf_get_pagefault_threads_number(scap_t* handle){
+	int k = -1;
+	unsigned long val = 0;
+
+	if(bpf_map_lookup_elem(handle->m_bpf_map_fds[SYSDIG_PAGEFAULT_MAJOR_MAP], &k, &val) != 0)
+	{
+		snprintf(handle->m_lasterr, SCAP_LASTERR_SIZE, "SYSDIG_PAGEFAULT_MAJOR_MAP bpf_map_lookup_elem < 0");
+		return -1;
+	}
+	return val;
+}
+int32_t scap_bpf_update_pagefaults_threads_number(scap_t* handle, int tid, unsigned long val){
+	if(bpf_map_update_elem(handle->m_bpf_map_fds[SYSDIG_PAGEFAULT_MAJOR_MAP], &tid, &val, BPF_ANY) != 0)
+	{
+		snprintf(handle->m_lasterr, SCAP_LASTERR_SIZE, "SYSDIG_PAGEFAULT_MAJOR_MAP bpf_map_update_elem < 0");
+		return SCAP_FAILURE;
+	}
+	return SCAP_SUCCESS;
+}
 int32_t scap_bpf_enable_page_faults(scap_t* handle)
 {
 	struct sysdig_bpf_settings settings;
@@ -1443,6 +1531,7 @@ static int32_t set_default_settings(scap_t *handle)
 	settings.is_dropping = false;
 	settings.tracers_enabled = false;
 	settings.skb_capture = false;
+	settings.pgft_map_clear = false;
 	settings.fullcapture_port_range_start = 0;
 	settings.fullcapture_port_range_end = 0;
 	settings.statsd_port = 8125;

userspace/libscap/scap_bpf.h

@@ -40,7 +40,10 @@ int32_t scap_bpf_set_fullcapture_port_range(scap_t* handle, uint16_t range_start
 int32_t scap_bpf_set_statsd_port(scap_t* handle, uint16_t port);
 int32_t scap_bpf_enable_dynamic_snaplen(scap_t* handle);
 int32_t scap_bpf_disable_dynamic_snaplen(scap_t* handle);
+int32_t scap_bpf_clear_pagefault_map(scap_t* handle);
 int32_t scap_bpf_enable_page_faults(scap_t* handle);
+int scap_bpf_get_pagefault_threads_number(scap_t* handle);
+int32_t scap_bpf_update_pagefaults_threads_number(scap_t* handle, int tid, unsigned long val);
 int32_t scap_bpf_start_dropping_mode(scap_t* handle, uint32_t sampling_ratio);
 int32_t scap_bpf_stop_dropping_mode(scap_t* handle);
 int32_t scap_bpf_enable_tracers_capture(scap_t* handle);