kext: sysfs: count VFS_GETATTR and vnode operations

sysfs.live_nodes reports how many nodes exist, not how hard they are worked, and
VFS_GETATTR creates no vnodes at all - so a filesystem being hammered by statfs,
or serving heavy traffic on a single cached path, registered as completely idle.
That blind spot cost several wrong diagnoses.

Add sysfs.vfs_getattr and sysfs.vnops so activity is visible independently of
node count.

Author: somestupidgirl

kext/sysfs.c

@@ -49,6 +49,8 @@ extern vfstable_t sysfs_vfs_table_ref;
  * Sample them a few times a minute apart with /sys mounted: whichever one grows
  * without bound identifies the subsystem at fault.
  */
+extern int64_t sysfs_stat_vfs_getattr;
+extern int64_t sysfs_stat_vnops;
 extern int64_t sysfs_stat_snap_builds;
 extern int64_t sysfs_stat_snap_bytes;
 extern int64_t sysfs_stat_live_nodes;
@@ -118,10 +120,38 @@ static struct sysctl_oid sysfs_sysctl_live_nodes = {
     .oid_version = SYSCTL_OID_VERSION,
 };
 
+static struct sysctl_oid sysfs_sysctl_vfs_getattr = {
+    .oid_parent  = &sysfs_sysctl_children,
+    .oid_number  = OID_AUTO,
+    .oid_kind    = CTLTYPE_QUAD | CTLFLAG_RD | CTLFLAG_LOCKED | CTLFLAG_OID2,
+    .oid_arg1    = &sysfs_stat_vfs_getattr,
+    .oid_arg2    = 0,
+    .oid_name    = "vfs_getattr",
+    .oid_handler = sysctl_handle_quad,
+    .oid_fmt     = "Q",
+    .oid_descr   = "VFS_GETATTR (statfs) calls served for this mount",
+    .oid_version = SYSCTL_OID_VERSION,
+};
+
+static struct sysctl_oid sysfs_sysctl_vnops = {
+    .oid_parent  = &sysfs_sysctl_children,
+    .oid_number  = OID_AUTO,
+    .oid_kind    = CTLTYPE_QUAD | CTLFLAG_RD | CTLFLAG_LOCKED | CTLFLAG_OID2,
+    .oid_arg1    = &sysfs_stat_vnops,
+    .oid_arg2    = 0,
+    .oid_name    = "vnops",
+    .oid_handler = sysctl_handle_quad,
+    .oid_fmt     = "Q",
+    .oid_descr   = "vnode operations served (lookup/getattr/readdir/read)",
+    .oid_version = SYSCTL_OID_VERSION,
+};
+
 STATIC void
 sysfs_sysctl_register(void)
 {
     sysctl_register_oid(&sysfs_sysctl_node);   /* parent first */
+    sysctl_register_oid(&sysfs_sysctl_vfs_getattr);
+    sysctl_register_oid(&sysfs_sysctl_vnops);
     sysctl_register_oid(&sysfs_sysctl_snap_builds);
     sysctl_register_oid(&sysfs_sysctl_snap_bytes);
     sysctl_register_oid(&sysfs_sysctl_live_nodes);
@@ -133,6 +163,8 @@ sysfs_sysctl_unregister(void)
     sysctl_unregister_oid(&sysfs_sysctl_live_nodes);
     sysctl_unregister_oid(&sysfs_sysctl_snap_bytes);
     sysctl_unregister_oid(&sysfs_sysctl_snap_builds);
+    sysctl_unregister_oid(&sysfs_sysctl_vnops);
+    sysctl_unregister_oid(&sysfs_sysctl_vfs_getattr);
     sysctl_unregister_oid(&sysfs_sysctl_node);
 }
 

kext/sysfs_vfsops.c

@@ -305,9 +305,19 @@ sysfs_root(struct mount *mp, vnode_t *vpp, __unused vfs_context_t context)
  * sysfs. Most of them are dummy values and none of them change once the
  * file system has been mounted.
  */
+/*
+ * Counts VFS_GETATTR (statfs) calls against this mount. These create no vnodes,
+ * so they are invisible to sysfs.live_nodes - yet statfs-on-every-mount is
+ * exactly what Finder, Disk Arbitration, Spotlight and the Dock do constantly.
+ * Without this counter a storm of them would look like the filesystem was
+ * completely idle. Exposed as sysfs.vfs_getattr.
+ */
+int64_t sysfs_stat_vfs_getattr = 0;
+
 STATIC int
 sysfs_getattr(struct mount *mp, struct vfs_attr *fsap, __unused vfs_context_t context)
 {
+    OSAddAtomic64(1, &sysfs_stat_vfs_getattr);
     populate_vfs_attr(mp, fsap);
     return 0;
 }

kext/sysfs_vnops.c

@@ -15,6 +15,7 @@
  * process/thread markers.
  */
 #include <libkern/libkern.h>
+#include <libkern/OSAtomic.h>
 
 #include <sys/dirent.h>
 #include <sys/errno.h>
@@ -134,6 +135,14 @@ STATIC size_t sysfs_device_attr_size(sfsnode_t *snp);
  */
 int (**sysfs_vnodeop_p)(void *);
 
+/*
+ * Counts every vnode operation this filesystem services. sysfs.live_nodes shows
+ * how many nodes exist, not how hard they are being worked - a caller that
+ * repeatedly stats or reads one already-cached path drives no new nodes at all.
+ * Exposed as sysfs.vnops.
+ */
+int64_t sysfs_stat_vnops = 0;
+
 /*
  * Entries for the vnode operations that this file system supports. This table is
  * converted to a fully-populated vnode operations vector when sysfs is
@@ -295,6 +304,7 @@ sysfs_vnop_getattrlistbulk(__unused struct vnop_getattrlistbulk_args *ap)
 STATIC int
 sysfs_vnop_lookup(struct vnop_lookup_args *ap)
 {
+    OSAddAtomic64(1, &sysfs_stat_vnops);
     char name[NAME_MAX + 1];
     int error = 0;
     struct componentname *cnp = ap->a_cnp;
@@ -504,6 +514,7 @@ sysfs_vnop_lookup(struct vnop_lookup_args *ap)
 STATIC int
 sysfs_vnop_readdir(struct vnop_readdir_args *ap)
 {
+    OSAddAtomic64(1, &sysfs_stat_vnops);
     vnode_t vp = ap->a_vp;
     if (vnode_vtype(vp) != VDIR) {
         return ENOTDIR;
@@ -798,6 +809,7 @@ sysfs_copyout_dirent(int type, uint64_t file_id, const char *name, uio_t uio, in
 STATIC int
 sysfs_vnop_getattr(struct vnop_getattr_args *ap)
 {
+    OSAddAtomic64(1, &sysfs_stat_vnops);
     vnode_t vp = ap->a_vp;
     sfsnode_t *sysfs_node = VTOSFS(vp);
     sfssnode_t *snode = sysfs_node->node_structure_node;
@@ -889,6 +901,7 @@ sysfs_vnop_readlink(struct vnop_readlink_args *ap)
 STATIC int
 sysfs_vnop_read(struct vnop_read_args *ap)
 {
+    OSAddAtomic64(1, &sysfs_stat_vnops);
     vnode_t vp = ap->a_vp;
     sfsnode_t *snp = VTOSFS(vp);
     sfssnode_t *snode = snp->node_structure_node;