simplify eBPF telemetry and make it thread-safe (#21230)

* fixup ebpf telemetry

* make thread safe

* simplified ebpf telemetry

* remove map exclusion

* fix lint

* Use function names from instruction patching

* remove unused func

* ignore exist error

Author: brycekahle

go.mod

@@ -87,7 +87,7 @@ require (
 	github.com/DataDog/datadog-go/v5 v5.3.1-0.20231115110321-54ec306d83b2
 	// do not update datadog-operator to 1.2.1 because the indirect dependency github.com/DataDog/datadog-api-client-go/v2 v2.15.0 is trigger a huge Go heap memory increase.
 	github.com/DataDog/datadog-operator v1.1.0
-	github.com/DataDog/ebpf-manager v0.3.7
+	github.com/DataDog/ebpf-manager v0.3.8
 	github.com/DataDog/go-tuf v1.0.2-0.5.2
 	github.com/DataDog/gopsutil v1.2.2
 	github.com/DataDog/nikos v1.12.1

go.sum

@@ -18,9 +18,9 @@ static void *(*bpf_telemetry_update_patch)(unsigned long, ...) = (void *)PATCH_T
     ({                                                                             \
         long errno_ret, errno_slot;                                                \
         errno_ret = fn(&map, args);                                                \
-        if (errno_ret < 0) {                                                       \
-            unsigned long err_telemetry_key;                                       \
-            LOAD_CONSTANT(MK_KEY(map), err_telemetry_key);                         \
+        unsigned long err_telemetry_key;                                           \
+        LOAD_CONSTANT(MK_KEY(map), err_telemetry_key);                             \
+        if (errno_ret < 0 && err_telemetry_key > 0) {                              \
             map_err_telemetry_t *entry =                                           \
                 bpf_map_lookup_elem(&map_err_telemetry_map, &err_telemetry_key);   \
             if (entry) {                                                           \
@@ -35,7 +35,7 @@ static void *(*bpf_telemetry_update_patch)(unsigned long, ...) = (void *)PATCH_T
                 /* Patched instruction for 4.14+: __sync_fetch_and_add(target, 1);
                  * This patch point is placed here because the above instruction
                  * fails on the 4.4 verifier. On 4.4 this instruction is replaced
-                 * with a nop: r1 = r1 */ \
+                 * with a nop: r1 = r1 */                                          \
                 bpf_telemetry_update_patch((unsigned long)target, add);            \
             }                                                                      \
         }                                                                          \
@@ -60,9 +60,9 @@ static void *(*bpf_telemetry_update_patch)(unsigned long, ...) = (void *)PATCH_T
         int helper_indx = -1;                                                                   \
         long errno_slot;                                                                        \
         long errno_ret = fn(__VA_ARGS__);                                                       \
-        if (errno_ret < 0) {                                                                    \
-            unsigned long telemetry_program_id;                                                 \
-            LOAD_CONSTANT("telemetry_program_id_key", telemetry_program_id);                    \
+        unsigned long telemetry_program_id;                                                     \
+        LOAD_CONSTANT("telemetry_program_id_key", telemetry_program_id);                        \
+        if (errno_ret < 0 && telemetry_program_id > 0) {                                        \
             helper_err_telemetry_t *entry =                                                     \
                 bpf_map_lookup_elem(&helper_err_telemetry_map, &telemetry_program_id);          \
             if (entry) {                                                                        \
@@ -73,7 +73,7 @@ static void *(*bpf_telemetry_update_patch)(unsigned long, ...) = (void *)PATCH_T
                     /* This is duplicated below because on clang 14.0.6 the compiler
                      * concludes that this if-check will always force errno_slot in range
                      * (0, T_MAX_ERRNO-1], and removes the bounds check, causing the verifier
-                     * to trip. Duplicating this check forces clang not to omit the check */            \
+                     * to trip. Duplicating this check forces clang not to omit the check */    \
                     errno_slot &= (T_MAX_ERRNO - 1);                                            \
                 }                                                                               \
                 errno_slot &= (T_MAX_ERRNO - 1);                                                \
@@ -83,7 +83,7 @@ static void *(*bpf_telemetry_update_patch)(unsigned long, ...) = (void *)PATCH_T
                     /* Patched instruction for 4.14+: __sync_fetch_and_add(target, 1);
                      * This patch point is placed here because the above instruction
                      * fails on the 4.4 verifier. On 4.4 this instruction is replaced
-                     * with a nop: r1 = r1 */          \
+                     * with a nop: r1 = r1 */                                                   \
                     bpf_telemetry_update_patch((unsigned long)target, add);                     \
                 }                                                                               \
             }                                                                                   \

pkg/ebpf/c/bpf_telemetry.h

@@ -134,15 +134,16 @@ func newEBPFProgram(c *config.Config) (*manager.Manager, error) {
 	}
 	defer bc.Close()
 
-	m := &manager.Manager{
+	bpfTelemetry := bpftelemetry.NewEBPFTelemetry()
+	m := bpftelemetry.NewManager(&manager.Manager{
 		Probes: []*manager.Probe{
 			{
 				ProbeIdentificationPair: manager.ProbeIdentificationPair{
 					EBPFFuncName: "tracepoint__syscalls__sys_enter_write",
 				},
 			},
 		},
-	}
+	}, bpfTelemetry)
 	options := manager.Options{
 		RLimit: &unix.Rlimit{
 			Cur: math.MaxUint64,
@@ -163,14 +164,11 @@ func newEBPFProgram(c *config.Config) (*manager.Manager, error) {
 		},
 	}
 
-	Configure("test", m, &options)
-	m.InstructionPatcher = func(m *manager.Manager) error {
-		return bpftelemetry.PatchEBPFTelemetry(m, true, nil)
-	}
+	Configure("test", m.Manager, &options)
 	err = m.InitWithOptions(bc, options)
 	if err != nil {
 		return nil, err
 	}
 
-	return m, nil
+	return m.Manager, nil
 }