pkg/sensors: reduce stack trace map memory footprint

[ upstream commit 22510d9 ]

[ This is a slightly adapted version since #2145 was merged after v1.0 ]

We stopped on a stack trace map that has a max_entries of 32768, which
is 64 bits pointers * PERF_MAX_STACK_DEPTH (which is fixed at 127 for
now), so 127*64/8=1016 bytes per entry + it's key_size of 32 bits (4
bytes) so 1020 bytes per entry. So 1020 * 32768 = 33,423,360 bytes.
From bpftool, this map has a total bytes_memlock of 34,079,040 bytes.
So for each stack trace map we load, we had 34MB of kernel memory, and
it happened to be loaded many times when we were loading any tracing
policy.

Since the map is used by the generic program, the loader will allocate
the memory needed for the map even if we don't create a reference from
the agent side and create an anonymous map. So we end up allocating a
small map of max_entries 1 by default and resize it when the tracing
policy actually specifies a matchAction containing a kernelStackTrace or
userStackTrace to true. This should drastically reduce the memory
footprint of this feature when it's unused.

Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>

bpf/process/types/basic.h

@@ -1986,7 +1986,7 @@ update_pid_tid_from_sock(struct msg_generic_kprobe *e, __u64 sockaddr)
 #define PERF_MAX_STACK_DEPTH 127
 struct {
 	__uint(type, BPF_MAP_TYPE_STACK_TRACE);
-	__uint(max_entries, 32768);
+	__uint(max_entries, 1); // Agent is resizing this if the feature is needed during kprobe load
 	__uint(key_size, sizeof(__u32));
 	__uint(value_size, sizeof(__u64) * PERF_MAX_STACK_DEPTH);
 } stack_trace_map SEC(".maps");

pkg/sensors/tracing/generickprobe.go

@@ -65,6 +65,8 @@ const (
 	CharBufErrorPageFault   = -2
 	CharBufErrorTooLarge    = -3
 	CharBufSavedForRetprobe = -4
+
+	stackTraceMapMaxEntries = 32768 // this value could be fine tuned
 )
 
 func kprobeCharBufErrorToString(e int32) string {
@@ -133,6 +135,9 @@ type genericKprobe struct {
 	// this is done in the sensor PostUnloadHook
 	stackTraceMapRef *ebpf.Map
 
+	// is there stacktrace defined in the kprobe
+	hasStackTrace bool
+
 	customHandler eventhandler.Handler
 }
 
@@ -211,6 +216,16 @@ func createMultiKprobeSensor(sensorPath string, multiIDs, multiRetIDs []idtable.
 	var progs []*program.Program
 	var maps []*program.Map
 
+	oneKprobeHasStackTrace := false
+	for _, id := range multiIDs {
+		gk, err := genericKprobeTableGet(id)
+		if err != nil {
+			logger.GetLogger().WithField("id", id).WithError(err).Warn("createMultiKprobeSensor: failed to retrieve generic kprobe from table, stacktrace could malfunction")
+			continue
+		}
+		oneKprobeHasStackTrace = oneKprobeHasStackTrace || gk.hasStackTrace
+	}
+
 	loadProgName := "bpf_multi_kprobe_v53.o"
 	loadProgRetName := "bpf_multi_retkprobe_v53.o"
 	if kernels.EnableV61Progs() {
@@ -285,6 +300,9 @@ func createMultiKprobeSensor(sensorPath string, multiIDs, multiRetIDs []idtable.
 	maps = append(maps, selNamesMap)
 
 	stackTraceMap := program.MapBuilderPin("stack_trace_map", sensors.PathJoin(pinPath, "stack_trace_map"), load)
+	if oneKprobeHasStackTrace {
+		stackTraceMap.SetMaxEntries(stackTraceMapMaxEntries)
+	}
 	maps = append(maps, stackTraceMap)
 
 	if kernels.EnableLargeProgs() {
@@ -787,6 +805,7 @@ func addKprobe(funcName string, f *v1alpha1.KProbeSpec, in *addKprobeIn, selMaps
 		policyName:        in.policyName,
 		hasOverride:       selectors.HasOverride(f),
 		customHandler:     in.customHandler,
+		hasStackTrace:     selectorsHaveStackTrace(f.Selectors),
 	}
 
 	// Parse Filters into kernel filter logic
@@ -915,7 +934,15 @@ func addKprobe(funcName string, f *v1alpha1.KProbeSpec, in *addKprobeIn, selMaps
 	selNamesMap := program.MapBuilderPin("sel_names_map", sensors.PathJoin(pinPath, "sel_names_map"), load)
 	out.maps = append(out.maps, selNamesMap)
 
+	// loading the stack trace map in any case so that it does not end up as an
+	// anonymous map (as it's always used by the BPF prog) and is clearly linked
+	// to tetragon
 	stackTraceMap := program.MapBuilderPin("stack_trace_map", sensors.PathJoin(pinPath, "stack_trace_map"), load)
+	if kprobeEntry.hasStackTrace {
+		// to reduce memory footprint however, the stack map is created with a
+		// max entry of 1, we need to expand that at loading.
+		stackTraceMap.SetMaxEntries(stackTraceMapMaxEntries)
+	}
 	out.maps = append(out.maps, stackTraceMap)
 
 	if kernels.EnableLargeProgs() {
@@ -1816,3 +1843,14 @@ func retprobeMerge(prev pendingEvent, curr pendingEvent) (*tracing.MsgGenericKpr
 func (k *observerKprobeSensor) LoadProbe(args sensors.LoadProbeArgs) error {
 	return loadGenericKprobeSensor(args.BPFDir, args.MapDir, args.Load, args.Verbose)
 }
+
+func selectorsHaveStackTrace(selectors []v1alpha1.KProbeSelector) bool {
+	for _, selector := range selectors {
+		for _, matchAction := range selector.MatchActions {
+			if matchAction.StackTrace {
+				return true
+			}
+		}
+	}
+	return false
+}