Bring flexible adjust for eBPF hash tables (#10962)

Give possibility for users to set hash table size.

2 files changed, 55 insertions, 8 deletions

diff --git a/libnetdata/ebpf/ebpf.c b/libnetdata/ebpf/ebpf.c
index 8619ae26fc..0e580733aa 100644
--- a/libnetdata/ebpf/ebpf.c
+++ b/libnetdata/ebpf/ebpf.c
@@ -295,25 +295,58 @@ static int select_file(char *name, const char *program, size_t length, int mode,
     return ret;
 }
 
+void ebpf_update_pid_table(ebpf_local_maps_t *pid, ebpf_module_t *em)
+{
+    pid->user_input = em->pid_map_size;
+}
+
+void ebpf_update_map_sizes(struct bpf_object *program, ebpf_module_t *em)
+{
+    struct bpf_map *map;
+    ebpf_local_maps_t *maps = em->maps;
+    if (!maps)
+        return;
+
+    bpf_map__for_each(map, program)
+    {
+        const char *map_name = bpf_map__name(map);
+        int i = 0; ;
+        while (maps[i].name) {
+            ebpf_local_maps_t *w = &maps[i];
+            if (w->user_input != w->internal_input && !strcmp(w->name, map_name)) {
+#ifdef NETDATA_INTERNAL_CHECKS
+                info("Changing map %s from size %u to %u ", map_name, w->internal_input, w->user_input);
+#endif
+                bpf_map__resize(map, w->user_input);
+            }
+            i++;
+        }
+    }
+}
+
 struct bpf_link **ebpf_load_program(char *plugins_dir, ebpf_module_t *em, char *kernel_string, struct bpf_object **obj, int *map_fd)
 {
     char lpath[4096];
     char lname[128];
-    int prog_fd;
 
     int test = select_file(lname, em->thread_name, (size_t)127, em->mode, kernel_string);
     if (test < 0 || test > 127)
         return NULL;
 
     snprintf(lpath, 4096, "%s/ebpf.d/%s", plugins_dir, lname);
-    // We are using BPF_PROG_TYPE_UNSPEC instead a specific type for bpf_prog_load to define the type
-    // according the eBPF program loaded
-    if (bpf_prog_load(lpath, BPF_PROG_TYPE_UNSPEC, obj, &prog_fd)) {
-        em->enabled = CONFIG_BOOLEAN_NO;
-        info("Cannot load program: %s", lpath);
+    *obj = bpf_object__open_file(lpath, NULL);
+    if (libbpf_get_error(obj)) {
+        error("Cannot open BPF object %s", lpath);
+        bpf_object__close(*obj);
+        return NULL;
+    }
+
+    ebpf_update_map_sizes(*obj, em);
+
+    if (bpf_object__load(*obj)) {
+        error("ERROR: loading BPF object file failed %s\n", lpath);
+        bpf_object__close(*obj);
         return NULL;
-    } else {
-        info("The eBPF program %s was loaded with success.", em->thread_name);
     }
 
     struct bpf_map *map;
@@ -368,6 +401,9 @@ void ebpf_update_module_using_config(ebpf_module_t *modules, struct config *cfg)
 
     modules->apps_charts = appconfig_get_boolean(cfg, EBPF_GLOBAL_SECTION, EBPF_CFG_APPLICATION,
                                                  CONFIG_BOOLEAN_YES);
+
+    modules->pid_map_size = (uint32_t)appconfig_get_number(cfg, EBPF_GLOBAL_SECTION, EBPF_CFG_PID_SIZE,
+                                                           modules->pid_map_size);
 }
 
 
diff --git a/libnetdata/ebpf/ebpf.h b/libnetdata/ebpf/ebpf.h
index ac3a1a2fc9..27d5b2c08f 100644
--- a/libnetdata/ebpf/ebpf.h
+++ b/libnetdata/ebpf/ebpf.h
@@ -15,6 +15,7 @@
 #define EBPF_CFG_LOAD_MODE_RETURN "return"
 
 #define EBPF_CFG_UPDATE_EVERY "update every"
+#define EBPF_CFG_PID_SIZE "pid table size"
 #define EBPF_CFG_APPLICATION "apps"
 
 /**
@@ -95,6 +96,14 @@ typedef enum {
     MODE_ENTRY       // This attaches kprobe when the function is called
 } netdata_run_mode_t;
 
+#define ND_EBPF_DEFAULT_PID_SIZE 32768U
+
+typedef struct ebpf_local_maps {
+    char *name;
+    uint32_t internal_input;
+    uint32_t user_input;
+} ebpf_local_maps_t;
+
 typedef struct ebpf_module {
     const char *thread_name;
     const char *config_name;
@@ -107,6 +116,8 @@ typedef struct ebpf_module {
     uint32_t thread_id;
     int optional;
     void (*apps_routine)(struct ebpf_module *em, void *ptr);
+    ebpf_local_maps_t *maps;
+    uint32_t pid_map_size;
 } ebpf_module_t;
 
 #define NETDATA_MAX_PROBES 64