Skip to content

Commit

Permalink
fix(driver/bpf): decrease limits to support some GKE env
Browse files Browse the repository at this point in the history
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
  • Loading branch information
Andreagit97 authored and poiana committed Jan 24, 2024
1 parent 7c4cb27 commit 1bd8c1b
Showing 1 changed file with 6 additions and 3 deletions.
9 changes: 6 additions & 3 deletions driver/bpf/fillers.h
Original file line number Diff line number Diff line change
Expand Up @@ -5044,10 +5044,13 @@ FILLER(sched_drop, false)
return bpf_push_u32_to_ring(data, data->settings->sampling_ratio);
}

/* In this kernel version the instruction limit was bumped to 1000000 */
/* In this kernel version the instruction limit was bumped to 1000000.
* We use these 2 values because they are the minimum required to run our eBPF probe
* on some GKE environments. See https://github.com/falcosecurity/libs/issues/1639
*/
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 2, 0))
#define MAX_THREADS_GROUPS 30
#define MAX_HIERARCHY_TRAVERSE 60
#define MAX_THREADS_GROUPS 25
#define MAX_HIERARCHY_TRAVERSE 35
#else
/* We need to find the right calibration here. On kernel 4.14 the limit
* seems to be MAX_THREADS_GROUPS*MAX_HIERARCHY_TRAVERSE <= 100
Expand Down

0 comments on commit 1bd8c1b

Please sign in to comment.