From 6d197efd4ee244ba0965adbf356a381dbbfcfc6c Mon Sep 17 00:00:00 2001 From: Andrea Terzolo Date: Wed, 24 Jan 2024 11:37:06 +0100 Subject: [PATCH] fix(driver/bpf): decrease limits to support some GKE env Signed-off-by: Andrea Terzolo --- driver/bpf/fillers.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h index 27dac483d4..e611ecaf4e 100644 --- a/driver/bpf/fillers.h +++ b/driver/bpf/fillers.h @@ -5044,10 +5044,13 @@ FILLER(sched_drop, false) return bpf_push_u32_to_ring(data, data->settings->sampling_ratio); } -/* In this kernel version the instruction limit was bumped to 1000000 */ +/* In this kernel version the instruction limit was bumped to 1000000. + * We use these 2 values because they are the minimum required to run our eBPF probe + * on some GKE environments. See https://github.com/falcosecurity/libs/issues/1639 + */ #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 2, 0)) -#define MAX_THREADS_GROUPS 30 -#define MAX_HIERARCHY_TRAVERSE 60 +#define MAX_THREADS_GROUPS 25 +#define MAX_HIERARCHY_TRAVERSE 35 #else /* We need to find the right calibration here. On kernel 4.14 the limit * seems to be MAX_THREADS_GROUPS*MAX_HIERARCHY_TRAVERSE <= 100