Ebpf apps memory usage (#11256)

2 files changed, 86 insertions, 10 deletions

diff --git a/libnetdata/ebpf/ebpf.c b/libnetdata/ebpf/ebpf.c
index f568c407ad..fa959b8dfd 100644
--- a/libnetdata/ebpf/ebpf.c
+++ b/libnetdata/ebpf/ebpf.c
@@ -307,18 +307,27 @@ void ebpf_update_map_sizes(struct bpf_object *program, ebpf_module_t *em)
     if (!maps)
         return;
 
+    uint32_t apps_type = NETDATA_EBPF_MAP_PID | NETDATA_EBPF_MAP_RESIZABLE;
     bpf_map__for_each(map, program)
     {
         const char *map_name = bpf_map__name(map);
         int i = 0; ;
         while (maps[i].name) {
             ebpf_local_maps_t *w = &maps[i];
-            if (w->user_input != w->internal_input && !strcmp(w->name, map_name)) {
+            if (w->type & NETDATA_EBPF_MAP_RESIZABLE) {
+                if (!strcmp(w->name, map_name)) {
+                    if (w->user_input && w->user_input != w->internal_input) {
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("Changing map %s from size %u to %u ", map_name, w->internal_input, w->user_input);
+                        info("Changing map %s from size %u to %u ", map_name, w->internal_input, w->user_input);
 #endif
-                bpf_map__resize(map, w->user_input);
+                        bpf_map__resize(map, w->user_input);
+                    } else if (((w->type & apps_type) == apps_type) && (!em->apps_charts)) {
+                        w->user_input = ND_EBPF_DEFAULT_MIN_PID;
+                        bpf_map__resize(map, w->user_input);
+                    }
+                }
             }
+
             i++;
         }
     }
@@ -377,6 +386,60 @@ static struct bpf_link **ebpf_attach_programs(struct bpf_object *obj, size_t len
     return links;
 }
 
+static void ebpf_update_maps(ebpf_module_t *em, int *map_fd, struct bpf_object *obj)
+{
+    if (!map_fd)
+        return;
+
+    ebpf_local_maps_t *maps = em->maps;
+    struct bpf_map *map;
+    size_t i = 0;
+        bpf_map__for_each(map, obj)
+    {
+        int fd = bpf_map__fd(map);
+        if (maps) {
+            const char *map_name = bpf_map__name(map);
+            int j = 0; ;
+            while (maps[j].name) {
+                ebpf_local_maps_t *w = &maps[j];
+                if (w->map_fd == ND_EBPF_MAP_FD_NOT_INITIALIZED && !strcmp(map_name, w->name))
+                    w->map_fd = fd;
+
+                j++;
+            }
+        }
+        map_fd[i] = fd;
+        i++;
+    }
+}
+
+static void ebpf_update_controller(ebpf_module_t *em, struct bpf_object *obj)
+{
+    ebpf_local_maps_t *maps = em->maps;
+    if (!maps)
+        return;
+
+    struct bpf_map *map;
+        bpf_map__for_each(map, obj)
+    {
+        size_t i = 0;
+        while (maps[i].name) {
+            ebpf_local_maps_t *w = &maps[i];
+            if (w->map_fd != ND_EBPF_MAP_FD_NOT_INITIALIZED && (w->type & NETDATA_EBPF_MAP_CONTROLLER)) {
+                w->type &= ~NETDATA_EBPF_MAP_CONTROLLER;
+                w->type |= NETDATA_EBPF_MAP_CONTROLLER_UPDATED;
+
+                uint32_t key = NETDATA_CONTROLLER_APPS_ENABLED;
+                int value = em->apps_charts;
+                int ret = bpf_map_update_elem(w->map_fd, &key, &value, 0);
+                if (ret)
+                    error("Add key(%u) for controller table failed.", key);
+            }
+            i++;
+        }
+    }
+}
+
 struct bpf_link **ebpf_load_program(char *plugins_dir, ebpf_module_t *em, char *kernel_string,
                                     struct bpf_object **obj, int *map_fd)
 {
@@ -403,13 +466,8 @@ struct bpf_link **ebpf_load_program(char *plugins_dir, ebpf_module_t *em, char *
         return NULL;
     }
 
-    struct bpf_map *map;
-    size_t i = 0;
-    bpf_map__for_each(map, *obj)
-    {
-        map_fd[i] = bpf_map__fd(map);
-        i++;
-    }
+    ebpf_update_maps(em, map_fd, *obj);
+    ebpf_update_controller(em, *obj);
 
     size_t count_programs =  ebpf_count_programs(*obj);
 
diff --git a/libnetdata/ebpf/ebpf.h b/libnetdata/ebpf/ebpf.h
index 72d6aa111c..9896b1d616 100644
--- a/libnetdata/ebpf/ebpf.h
+++ b/libnetdata/ebpf/ebpf.h
@@ -88,6 +88,8 @@
 #define VERSION_STRING_LEN 256
 #define EBPF_KERNEL_REJECT_LIST_FILE "ebpf_kernel_reject_list.txt"
 
+#define ND_EBPF_DEFAULT_MIN_PID 1U
+#define ND_EBPF_MAP_FD_NOT_INITIALIZED (int)-1
 
 typedef struct ebpf_addresses {
     char *function;
@@ -115,10 +117,26 @@ typedef enum {
 
 #define ND_EBPF_DEFAULT_PID_SIZE 32768U
 
+enum netdata_ebpf_map_type {
+    NETDATA_EBPF_MAP_STATIC = 0,
+    NETDATA_EBPF_MAP_RESIZABLE = 1,
+    NETDATA_EBPF_MAP_CONTROLLER = 2,
+    NETDATA_EBPF_MAP_CONTROLLER_UPDATED = 4,
+    NETDATA_EBPF_MAP_PID = 8
+};
+
+enum netdata_controller {
+    NETDATA_CONTROLLER_APPS_ENABLED,
+
+    NETDATA_CONTROLLER_END
+};
+
 typedef struct ebpf_local_maps {
     char *name;
     uint32_t internal_input;
     uint32_t user_input;
+    uint32_t type;
+    int map_fd;
 } ebpf_local_maps_t;
 
 typedef struct ebpf_specify_name {