Katyusha's blog

1
package rca
2

3
import (
4
  "fmt"
5
  "strings"
6
  "time"
7

8
  "github.com/os2026/ebpf-rca/internal/detector"
9
  "github.com/os2026/ebpf-rca/internal/schema"
10
)
11

12
// 阻塞栈中出现这些符号片段，判定为锁/同步等待（而非纯 I/O 睡眠）。
13
var lockSymHints = []string{
14
  "futex", "mutex", "rwsem", "rt_mutex", "down_", "__lock", "semaphore", "rwlock",
15
}
16

17
// BuildLockReport 将一次锁竞争/长阻塞信号转换为结构化诊断报告。
18
// stack 为已符号化的阻塞内核栈（top-N），由 collector.ResolveStack 提供。
19
func BuildLockReport(sig detector.LockSignal, stack []string) schema.AnomalyReport {
20
  s := sig.Sample
21
  isLock := stackHasLock(stack)
22
  root, suggestion, confidence := classifyLock(isLock, s.LastWaker)
23

24
  evidence := []schema.Evidence{
25
    {
26
      Type: "metric", Name: "offcpu_ratio",
27
      Value: round2(s.OffcpuRatio), Threshold: 0.30,
28
      Desc: "阻塞型 off-CPU 时间占墙钟比例",
29
    },
30
    {
31
      Type: "metric", Name: "max_offcpu_ms",
32
      Value: round2(s.MaxOffcpuMs),
33
      Desc:  "单次最长阻塞时长(毫秒)",
34
    },
35
    {
36
      Type: "event", Name: "block_count",
37
      Value: s.BlockCount,
38
      Desc:  "窗口内阻塞切出次数",
39
    },
40
    {
41
      Type: "event", Name: "last_waker_tid",
42
      Value: s.LastWaker,
43
      Desc:  "最近唤醒该线程者(唤醒链上游，疑似持锁方)",
44
    },
45
  }
46
  // 阻塞栈作为"线程堆栈聚集"证据逐帧入链。
47
  for i, fr := range stack {
48
    evidence = append(evidence, schema.Evidence{
49
      Type: "stack", Name: fmt.Sprintf("frame_%d", i), Func: fr,
50
      Desc: "阻塞点内核调用栈",
51
    })
52
  }
53

54
  anomalyType := "锁竞争"
55
  if !isLock {
56
    anomalyType = "长时间阻塞等待"
57
  }
58

59
  return schema.AnomalyReport{
60
    AnomalyType: anomalyType,
61
    RelatedObject: schema.RelatedObject{
62
      Pid:  s.Pid,
63
      Tid:  s.Pid,
64
      Comm: s.Comm,
65
    },
66
    KeyMetrics: map[string]interface{}{
67
      "offcpu_ratio":   round2(s.OffcpuRatio),
68
      "max_offcpu_ms":  round2(s.MaxOffcpuMs),
69
      "block_count":    s.BlockCount,
70
      "last_waker_tid": s.LastWaker,
71
    },
72
    TimeWindow: schema.TimeWindow{
73
      Start: sig.WindowStart.UTC().Format(time.RFC3339),
74
      End:   sig.WindowEnd.UTC().Format(time.RFC3339),
75
    },
76
    SuspectedRootCause: root,
77
    Confidence:         confidence,
78
    EvidenceChain:      evidence,
79
    Suggestion:         suggestion,
80
  }
81
}
82

83
func stackHasLock(stack []string) bool {
84
  for _, fr := range stack {
85
    low := strings.ToLower(fr)
86
    for _, h := range lockSymHints {
87
      if strings.Contains(low, h) {
88
        return true
89
      }
90
    }
91
  }
92
  return false
93
}
94

95
func classifyLock(isLock bool, waker uint32) (root, suggestion string, confidence float64) {
96
  if isLock {
97
    root = "多线程争用同一锁资源导致阻塞（off-CPU 等锁，疑似临界区过大或锁粒度过粗）"
98
    suggestion = fmt.Sprintf("缩小临界区/细化锁粒度，排查唤醒链上游持锁线程 tid=%d；可改用读写锁或无锁结构", waker)
99
    return root, suggestion, 0.9
100
  }
101
  root = "线程长时间阻塞在内核等待（非计算型），疑似 I/O 或条件变量同步等待"
102
  suggestion = "结合 I/O 场景进一步确认阻塞来源；若为同步等待，检查唤醒时机与生产消费速率"
103
  return root, suggestion, 0.7
104
}