Ebpf apps memory usage (#11256)

collectors/ebpf.plugin/ebpf_cachestat.c

@@ -25,11 +25,20 @@ struct netdata_static_thread cachestat_threads = {"CACHESTAT KERNEL",
                                                   NULL, NULL, 1, NULL,
                                                   NULL,  NULL};
 
-static ebpf_local_maps_t cachestat_maps[] = {{.name = "cstat_pid", .internal_input = ND_EBPF_DEFAULT_PID_SIZE,
-                                             .user_input = 0},
-                                             {.name = NULL, .internal_input = 0, .user_input = 0}};
-
-static int *map_fd = NULL;
+static ebpf_local_maps_t cachestat_maps[] = {{.name = "cstat_global", .internal_input = NETDATA_CACHESTAT_END,
+                                              .user_input = 0, .type = NETDATA_EBPF_MAP_STATIC,
+                                              .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
+                                             {.name = "cstat_pid", .internal_input = ND_EBPF_DEFAULT_PID_SIZE,
+                                              .user_input = 0,
+                                              .type = NETDATA_EBPF_MAP_RESIZABLE | NETDATA_EBPF_MAP_PID,
+                                              .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
+                                             {.name = "cstat_ctrl", .internal_input = NETDATA_CONTROLLER_END,
+                                              .user_input = 0,
+                                              .type = NETDATA_EBPF_MAP_CONTROLLER,
+                                              .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
+                                             {.name = NULL, .internal_input = 0, .user_input = 0,
+                                              .type = NETDATA_EBPF_MAP_CONTROLLER,
+                                              .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED}};
 
 struct config cachestat_config = { .first_section = NULL,
     .last_section = NULL,
@@ -250,7 +259,7 @@ static void read_apps_table()
     netdata_cachestat_pid_t *cv = cachestat_vector;
     uint32_t key;
     struct pid_stat *pids = root_of_pids;
-    int fd = map_fd[NETDATA_CACHESTAT_PID_STATS];
+    int fd = cachestat_maps[NETDATA_CACHESTAT_PID_STATS].map_fd;
     size_t length = sizeof(netdata_cachestat_pid_t)*ebpf_nprocs;
     while (pids) {
         key = pids->pid;
@@ -335,7 +344,7 @@ static void read_global_table()
     uint32_t idx;
     netdata_idx_t *val = cachestat_hash_values;
     netdata_idx_t *stored = cachestat_values;
-    int fd = map_fd[NETDATA_CACHESTAT_GLOBAL_STATS];
+    int fd = cachestat_maps[NETDATA_CACHESTAT_GLOBAL_STATS].map_fd;
 
     for (idx = NETDATA_KEY_CALLS_ADD_TO_PAGE_CACHE_LRU; idx < NETDATA_CACHESTAT_END; idx++) {
         if (!bpf_map_lookup_elem(fd, &idx, stored)) {
@@ -503,8 +512,6 @@ static void cachestat_collector(ebpf_module_t *em)
     cachestat_threads.thread = mallocz(sizeof(netdata_thread_t));
     cachestat_threads.start_routine = ebpf_cachestat_read_hash;
 
-    map_fd = cachestat_data.map_fd;
-
     netdata_thread_create(cachestat_threads.thread, cachestat_threads.name, NETDATA_THREAD_OPTION_JOINABLE,
                           ebpf_cachestat_read_hash, em);
 
@@ -625,7 +632,7 @@ void *ebpf_cachestat_thread(void *ptr)
     em->maps = cachestat_maps;
     fill_ebpf_data(&cachestat_data);
 
-    ebpf_update_pid_table(&cachestat_maps[0], em);
+    ebpf_update_pid_table(&cachestat_maps[NETDATA_CACHESTAT_PID_STATS], em);
 
     if (!em->enabled)
         goto endcachestat;

collectors/ebpf.plugin/ebpf_dcstat.c

@@ -15,7 +15,6 @@ netdata_publish_dcstat_t **dcstat_pid = NULL;
 static struct bpf_link **probe_links = NULL;
 static struct bpf_object *objects = NULL;
 
-static int *map_fd = NULL;
 static netdata_idx_t dcstat_hash_values[NETDATA_DCSTAT_IDX_END];
 static netdata_idx_t *dcstat_values = NULL;
 
@@ -31,9 +30,20 @@ struct netdata_static_thread dcstat_threads = {"DCSTAT KERNEL",
                                                NULL, NULL, 1, NULL,
                                                NULL,  NULL};
 
-static ebpf_local_maps_t dcstat_maps[] = {{.name = "dcstat_pid", .internal_input = ND_EBPF_DEFAULT_PID_SIZE,
-                                           .user_input = 0},
-                                          {.name = NULL, .internal_input = 0, .user_input = 0}};
+static ebpf_local_maps_t dcstat_maps[] = {{.name = "dcstat_global", .internal_input = NETDATA_DIRECTORY_CACHE_END,
+                                           .user_input = 0, .type = NETDATA_EBPF_MAP_STATIC,
+                                           .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
+                                          {.name = "dcstat_pid", .internal_input = ND_EBPF_DEFAULT_PID_SIZE,
+                                           .user_input = 0,
+                                           .type = NETDATA_EBPF_MAP_RESIZABLE | NETDATA_EBPF_MAP_PID,
+                                           .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
+                                          {.name = "dcstat_ctrl", .internal_input = NETDATA_CONTROLLER_END,
+                                           .user_input = 0,
+                                           .type = NETDATA_EBPF_MAP_CONTROLLER,
+                                           .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
+                                          {.name = NULL, .internal_input = 0, .user_input = 0,
+                                           .type = NETDATA_EBPF_MAP_CONTROLLER,
+                                           .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED}};
 
 static ebpf_specify_name_t dc_optional_name[] = { {.program_name = "netdata_lookup_fast",
                                                    .function_to_attach = "lookup_fast",
@@ -256,7 +266,7 @@ static void read_apps_table()
     netdata_dcstat_pid_t *cv = dcstat_vector;
     uint32_t key;
     struct pid_stat *pids = root_of_pids;
-    int fd = map_fd[NETDATA_DCSTAT_PID_STATS];
+    int fd = dcstat_maps[NETDATA_DCSTAT_PID_STATS].map_fd;
     size_t length = sizeof(netdata_dcstat_pid_t)*ebpf_nprocs;
     while (pids) {
         key = pids->pid;
@@ -287,7 +297,7 @@ static void read_global_table()
     uint32_t idx;
     netdata_idx_t *val = dcstat_hash_values;
     netdata_idx_t *stored = dcstat_values;
-    int fd = map_fd[NETDATA_DCSTAT_GLOBAL_STATS];
+    int fd = dcstat_maps[NETDATA_DCSTAT_GLOBAL_STATS].map_fd;
 
     for (idx = NETDATA_KEY_DC_REFERENCE; idx < NETDATA_DIRECTORY_CACHE_END; idx++) {
         if (!bpf_map_lookup_elem(fd, &idx, stored)) {
@@ -474,8 +484,6 @@ static void dcstat_collector(ebpf_module_t *em)
     dcstat_threads.thread = mallocz(sizeof(netdata_thread_t));
     dcstat_threads.start_routine = ebpf_dcstat_read_hash;
 
-    map_fd = dcstat_data.map_fd;
-
     netdata_thread_create(dcstat_threads.thread, dcstat_threads.name, NETDATA_THREAD_OPTION_JOINABLE,
                           ebpf_dcstat_read_hash, em);
 
@@ -576,7 +584,7 @@ void *ebpf_dcstat_thread(void *ptr)
     em->maps = dcstat_maps;
     fill_ebpf_data(&dcstat_data);
 
-    ebpf_update_pid_table(&dcstat_maps[0], em);
+    ebpf_update_pid_table(&dcstat_maps[NETDATA_DCSTAT_PID_STATS], em);
 
     ebpf_update_names(dc_optional_name, em);
 

collectors/ebpf.plugin/ebpf_process.c

@@ -18,8 +18,19 @@ static char *process_id_names[NETDATA_KEY_PUBLISH_PROCESS_END] = { "do_sys_open"
 static char *status[] = { "process", "zombie" };
 
 static ebpf_local_maps_t process_maps[] = {{.name = "tbl_pid_stats", .internal_input = ND_EBPF_DEFAULT_PID_SIZE,
-                                                 .user_input = 0},
-                                             {.name = NULL, .internal_input = 0, .user_input = 0}};
+                                            .user_input = 0,
+                                            .type = NETDATA_EBPF_MAP_RESIZABLE  | NETDATA_EBPF_MAP_PID,
+                                            .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
+                                           {.name = "tbl_total_stats", .internal_input = NETDATA_KEY_END_VECTOR,
+                                            .user_input = 0, .type = NETDATA_EBPF_MAP_STATIC,
+                                            .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
+                                           {.name = "process_ctrl", .internal_input = NETDATA_CONTROLLER_END,
+                                            .user_input = 0,
+                                            .type = NETDATA_EBPF_MAP_CONTROLLER,
+                                            .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
+                                           {.name = NULL, .internal_input = 0, .user_input = 0,
+                                            .type = NETDATA_EBPF_MAP_CONTROLLER,
+                                            .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED}};
 
 static netdata_idx_t *process_hash_values = NULL;
 static netdata_syscall_stat_t process_aggregated_data[NETDATA_KEY_PUBLISH_PROCESS_END];
@@ -32,7 +43,6 @@ ebpf_process_publish_apps_t **current_apps_data = NULL;
 
 int process_enabled = 0;
 
-static int *map_fd = NULL;
 static struct bpf_object *objects = NULL;
 static struct bpf_link **probe_links = NULL;
 
@@ -165,7 +175,7 @@ long long ebpf_process_sum_values_for_pids(struct pid_on_target *root, size_t of
 void ebpf_process_remove_pids()
 {
     struct pid_stat *pids = root_of_pids;
-    int pid_fd = map_fd[0];
+    int pid_fd = process_maps[NETDATA_PROCESS_PID_TABLE].map_fd;
     while (pids) {
         uint32_t pid = pids->pid;
         ebpf_process_stat_t *w = global_process_stats[pid];
@@ -280,8 +290,9 @@ static void read_hash_global_tables()
     netdata_idx_t res[NETDATA_KEY_END_VECTOR];
 
     netdata_idx_t *val = process_hash_values;
+    int fd = process_maps[NETDATA_PROCESS_GLOBAL_TABLE].map_fd;
     for (idx = 0; idx < NETDATA_KEY_END_VECTOR; idx++) {
-        if (!bpf_map_lookup_elem(map_fd[1], &idx, val)) {
+        if (!bpf_map_lookup_elem(fd, &idx, val)) {
             uint64_t total = 0;
             int i;
             int end = ebpf_nprocs;
@@ -601,7 +612,7 @@ static void process_collector(usec_t step, ebpf_module_t *em)
     heartbeat_init(&hb);
     int publish_global = em->global_charts;
     int apps_enabled = em->apps_charts;
-    int pid_fd = map_fd[0];
+    int pid_fd = process_maps[NETDATA_PROCESS_PID_TABLE].map_fd;
     while (!close_ebpf_plugin) {
         usec_t dt = heartbeat_next(&hb, step);
         (void)dt;
@@ -644,7 +655,7 @@ static void process_collector(usec_t step, ebpf_module_t *em)
  *****************************************************************/
 
 void clean_global_memory() {
-    int pid_fd = map_fd[0];
+    int pid_fd = process_maps[NETDATA_PROCESS_PID_TABLE].map_fd;
     struct pid_stat *pids = root_of_pids;
     while (pids) {
         uint32_t pid = pids->pid;
@@ -729,8 +740,6 @@ static void change_syscalls()
  */
 static void set_local_pointers()
 {
-    map_fd = process_data.map_fd;
-
     if (process_data.isrh >= NETDATA_MINIMUM_RH_VERSION && process_data.isrh < NETDATA_RH_8)
         change_syscalls();
 }

collectors/ebpf.plugin/ebpf_process.h

@@ -84,6 +84,12 @@ typedef struct ebpf_process_publish_apps {
     uint64_t ecall_sys_clone;
 } ebpf_process_publish_apps_t;
 
+enum ebpf_process_tables {
+    NETDATA_PROCESS_PID_TABLE,
+    NETDATA_PROCESS_GLOBAL_TABLE,
+    NETDATA_PROCESS_CTRL_TABLE
+};
+
 extern struct config process_config;
 
 #endif /* NETDATA_EBPF_PROCESS_H */

collectors/ebpf.plugin/ebpf_swap.c

@@ -8,7 +8,6 @@ static netdata_syscall_stat_t swap_aggregated_data[NETDATA_SWAP_END];
 static netdata_publish_syscall_t swap_publish_aggregated[NETDATA_SWAP_END];
 
 static int read_thread_closed = 1;
-static int *map_fd = NULL;
 netdata_publish_swap_t *swap_vector = NULL;
 
 static netdata_idx_t swap_hash_values[NETDATA_SWAP_END];
@@ -24,7 +23,17 @@ struct config swap_config = { .first_section = NULL,
         .rwlock = AVL_LOCK_INITIALIZER } };
 
 static ebpf_local_maps_t swap_maps[] = {{.name = "tbl_pid_swap", .internal_input = ND_EBPF_DEFAULT_PID_SIZE,
-                                         .user_input = 0},
+                                         .user_input = 0,
+                                         .type = NETDATA_EBPF_MAP_RESIZABLE | NETDATA_EBPF_MAP_PID,
+                                         .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
+                                        {.name = "swap_ctrl", .internal_input = NETDATA_CONTROLLER_END,
+                                         .user_input = 0,
+                                         .type = NETDATA_EBPF_MAP_CONTROLLER,
+                                         .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
+                                        {.name = "tbl_swap", .internal_input = NETDATA_SWAP_END,
+                                         .user_input = 0,
+                                         .type = NETDATA_EBPF_MAP_STATIC,
+                                         .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
                                         {.name = NULL, .internal_input = 0, .user_input = 0}};
 
 static struct bpf_link **probe_links = NULL;
@@ -139,7 +148,7 @@ static void read_apps_table()
     netdata_publish_swap_t *cv = swap_vector;
     uint32_t key;
     struct pid_stat *pids = root_of_pids;
-    int fd = map_fd[NETDATA_PID_SWAP_TABLE];
+    int fd = swap_maps[NETDATA_PID_SWAP_TABLE].map_fd;
     size_t length = sizeof(netdata_publish_swap_t)*ebpf_nprocs;
     while (pids) {
         key = pids->pid;
@@ -183,7 +192,7 @@ static void read_global_table()
 {
     netdata_idx_t *stored = swap_values;
     netdata_idx_t *val = swap_hash_values;
-    int fd = map_fd[NETDATA_SWAP_GLOBAL_TABLE];
+    int fd = swap_maps[NETDATA_SWAP_GLOBAL_TABLE].map_fd;
 
     uint32_t i, end = NETDATA_SWAP_END;
     for (i = NETDATA_KEY_SWAP_READPAGE_CALL; i < end; i++) {
@@ -296,8 +305,6 @@ static void swap_collector(ebpf_module_t *em)
     swap_threads.thread = mallocz(sizeof(netdata_thread_t));
     swap_threads.start_routine = ebpf_swap_read_hash;
 
-    map_fd = swap_data.map_fd;
-
     netdata_thread_create(swap_threads.thread, swap_threads.name, NETDATA_THREAD_OPTION_JOINABLE,
                           ebpf_swap_read_hash, em);
 
@@ -416,7 +423,7 @@ void *ebpf_swap_thread(void *ptr)
     em->maps = swap_maps;
     fill_ebpf_data(&swap_data);
 
-    ebpf_update_pid_table(&swap_maps[0], em);
+    ebpf_update_pid_table(&swap_maps[NETDATA_PID_SWAP_TABLE], em);
 
     if (!em->enabled)
         goto endswap;

collectors/ebpf.plugin/ebpf_swap.h

@@ -21,6 +21,7 @@ typedef struct netdata_publish_swap {
 
 enum swap_tables {
     NETDATA_PID_SWAP_TABLE,
+    NETDATA_SWAP_CONTROLLER,
     NETDATA_SWAP_GLOBAL_TABLE
 };
 

collectors/ebpf.plugin/ebpf_vfs.c

@@ -19,7 +19,15 @@ netdata_publish_vfs_t *vfs_vector = NULL;
 static ebpf_data_t vfs_data;
 
 static ebpf_local_maps_t vfs_maps[] = {{.name = "tbl_vfs_pid", .internal_input = ND_EBPF_DEFAULT_PID_SIZE,
-                                        .user_input = 0},
+                                        .user_input = 0, .type = NETDATA_EBPF_MAP_RESIZABLE | NETDATA_EBPF_MAP_PID,
+                                        .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
+                                       {.name = "tbl_vfs_stats", .internal_input = NETDATA_VFS_COUNTER,
+                                        .user_input = 0, .type = NETDATA_EBPF_MAP_STATIC,
+                                        .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
+                                       {.name = "vfs_ctrl", .internal_input = NETDATA_CONTROLLER_END,
+                                        .user_input = 0,
+                                        .type = NETDATA_EBPF_MAP_CONTROLLER,
+                                        .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED},
                                        {.name = NULL, .internal_input = 0, .user_input = 0}};
 
 struct config vfs_config = { .first_section = NULL,
@@ -35,8 +43,6 @@ struct netdata_static_thread vfs_threads = {"VFS KERNEL",
                                             NULL, NULL, 1, NULL,
                                             NULL,  NULL};
 
-static int *map_fd = NULL;
-
 static int read_thread_closed = 1;
 
 /*****************************************************************
@@ -162,7 +168,7 @@ static void read_global_table()
     netdata_idx_t res[NETDATA_VFS_COUNTER];
 
     netdata_idx_t *val = vfs_hash_values;
-    int fd = map_fd[NETDATA_VFS_ALL];
+    int fd = vfs_maps[NETDATA_VFS_ALL].map_fd;
     for (idx = 0; idx < NETDATA_VFS_COUNTER; idx++) {
         uint64_t total = 0;
         if (!bpf_map_lookup_elem(fd, &idx, val)) {
@@ -455,7 +461,7 @@ static void ebpf_vfs_read_apps()
 {
     struct pid_stat *pids = root_of_pids;
     netdata_publish_vfs_t *vv = vfs_vector;
-    int fd = map_fd[NETDATA_VFS_PID];
+    int fd = vfs_maps[NETDATA_VFS_PID].map_fd;
     size_t length = sizeof(netdata_publish_vfs_t) * ebpf_nprocs;
     while (pids) {
         uint32_t key = pids->pid;
@@ -519,8 +525,6 @@ static void vfs_collector(ebpf_module_t *em)
     vfs_threads.thread = mallocz(sizeof(netdata_thread_t));
     vfs_threads.start_routine = ebpf_vfs_read_hash;
 
-    map_fd = vfs_data.map_fd;
-
     netdata_thread_create(vfs_threads.thread, vfs_threads.name, NETDATA_THREAD_OPTION_JOINABLE,
                           ebpf_vfs_read_hash, em);
 
@@ -894,7 +898,7 @@ void *ebpf_vfs_thread(void *ptr)
     em->maps = vfs_maps;
     fill_ebpf_data(&vfs_data);
 
-    ebpf_update_pid_table(&vfs_maps[0], em);
+    ebpf_update_pid_table(&vfs_maps[NETDATA_VFS_PID], em);
 
     ebpf_vfs_allocate_global_vectors();
 

libnetdata/ebpf/ebpf.c

@@ -307,18 +307,27 @@ void ebpf_update_map_sizes(struct bpf_object *program, ebpf_module_t *em)
     if (!maps)
         return;
 
+    uint32_t apps_type = NETDATA_EBPF_MAP_PID | NETDATA_EBPF_MAP_RESIZABLE;
     bpf_map__for_each(map, program)
     {
         const char *map_name = bpf_map__name(map);
         int i = 0; ;
         while (maps[i].name) {
             ebpf_local_maps_t *w = &maps[i];
-            if (w->user_input != w->internal_input && !strcmp(w->name, map_name)) {
+            if (w->type & NETDATA_EBPF_MAP_RESIZABLE) {
+                if (!strcmp(w->name, map_name)) {
+                    if (w->user_input && w->user_input != w->internal_input) {
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("Changing map %s from size %u to %u ", map_name, w->internal_input, w->user_input);
+                        info("Changing map %s from size %u to %u ", map_name, w->internal_input, w->user_input);
 #endif
-                bpf_map__resize(map, w->user_input);
+                        bpf_map__resize(map, w->user_input);
+                    } else if (((w->type & apps_type) == apps_type) && (!em->apps_charts)) {
+                        w->user_input = ND_EBPF_DEFAULT_MIN_PID;
+                        bpf_map__resize(map, w->user_input);
+                    }
+                }
             }
+
             i++;
         }
     }
@@ -377,6 +386,60 @@ static struct bpf_link **ebpf_attach_programs(struct bpf_object *obj, size_t len
     return links;
 }
 
+static void ebpf_update_maps(ebpf_module_t *em, int *map_fd, struct bpf_object *obj)
+{
+    if (!map_fd)
+        return;
+
+    ebpf_local_maps_t *maps = em->maps;
+    struct bpf_map *map;
+    size_t i = 0;
+        bpf_map__for_each(map, obj)
+    {
+        int fd = bpf_map__fd(map);
+        if (maps) {
+            const char *map_name = bpf_map__name(map);
+            int j = 0; ;
+            while (maps[j].name) {
+                ebpf_local_maps_t *w = &maps[j];
+                if (w->map_fd == ND_EBPF_MAP_FD_NOT_INITIALIZED && !strcmp(map_name, w->name))
+                    w->map_fd = fd;
+
+                j++;
+            }
+        }
+        map_fd[i] = fd;
+        i++;
+    }
+}
+
+static void ebpf_update_controller(ebpf_module_t *em, struct bpf_object *obj)
+{
+    ebpf_local_maps_t *maps = em->maps;
+    if (!maps)
+        return;
+
+    struct bpf_map *map;
+        bpf_map__for_each(map, obj)
+    {
+        size_t i = 0;
+        while (maps[i].name) {
+            ebpf_local_maps_t *w = &maps[i];
+            if (w->map_fd != ND_EBPF_MAP_FD_NOT_INITIALIZED && (w->type & NETDATA_EBPF_MAP_CONTROLLER)) {
+                w->type &= ~NETDATA_EBPF_MAP_CONTROLLER;
+                w->type |= NETDATA_EBPF_MAP_CONTROLLER_UPDATED;
+
+                uint32_t key = NETDATA_CONTROLLER_APPS_ENABLED;
+                int value = em->apps_charts;
+                int ret = bpf_map_update_elem(w->map_fd, &key, &value, 0);
+                if (ret)
+                    error("Add key(%u) for controller table failed.", key);
+            }
+            i++;
+        }
+    }
+}
+
 struct bpf_link **ebpf_load_program(char *plugins_dir, ebpf_module_t *em, char *kernel_string,
                                     struct bpf_object **obj, int *map_fd)
 {
@@ -403,13 +466,8 @@ struct bpf_link **ebpf_load_program(char *plugins_dir, ebpf_module_t *em, char *
         return NULL;
     }
 
-    struct bpf_map *map;
-    size_t i = 0;
-    bpf_map__for_each(map, *obj)
-    {
-        map_fd[i] = bpf_map__fd(map);
-        i++;
-    }
+    ebpf_update_maps(em, map_fd, *obj);
+    ebpf_update_controller(em, *obj);
 
     size_t count_programs =  ebpf_count_programs(*obj);
 

libnetdata/ebpf/ebpf.h

@@ -88,6 +88,8 @@
 #define VERSION_STRING_LEN 256
 #define EBPF_KERNEL_REJECT_LIST_FILE "ebpf_kernel_reject_list.txt"
 
+#define ND_EBPF_DEFAULT_MIN_PID 1U
+#define ND_EBPF_MAP_FD_NOT_INITIALIZED (int)-1
 
 typedef struct ebpf_addresses {
     char *function;
@@ -115,10 +117,26 @@ typedef enum {
 
 #define ND_EBPF_DEFAULT_PID_SIZE 32768U
 
+enum netdata_ebpf_map_type {
+    NETDATA_EBPF_MAP_STATIC = 0,
+    NETDATA_EBPF_MAP_RESIZABLE = 1,
+    NETDATA_EBPF_MAP_CONTROLLER = 2,
+    NETDATA_EBPF_MAP_CONTROLLER_UPDATED = 4,
+    NETDATA_EBPF_MAP_PID = 8
+};
+
+enum netdata_controller {
+    NETDATA_CONTROLLER_APPS_ENABLED,
+
+    NETDATA_CONTROLLER_END
+};
+
 typedef struct ebpf_local_maps {
     char *name;
     uint32_t internal_input;
     uint32_t user_input;
+    uint32_t type;
+    int map_fd;
 } ebpf_local_maps_t;
 
 typedef struct ebpf_specify_name {

packaging/ebpf.checksums

@@ -1,3 +1,3 @@
-eb017acc8d05047190c385412b2e17b63d7ea07d7521ac043d32d14802a9c185  netdata-kernel-collector-glibc-v0.7.0.1.tar.xz
-72bbcb55342a162ab3eab27034e52820dd2a4e5d77dd8b1317f6a6b26904ecb8  netdata-kernel-collector-musl-v0.7.0.1.tar.xz
-d70fc36d09b0e49f4db1c8e328a4b516f21f353eb3bfdd190beae5e403f81aa2  netdata-kernel-collector-static-v0.7.0.1.tar.xz
+a2849a54f43f9419419298a0e06de7da52b1ecb74e3c5e788540f7fdd380862a  netdata-kernel-collector-glibc-v0.7.1.1.tar.xz
+15fb92966fef3fe8b6f6f08f15c57270b5b37071b52834073097076c4897c0e1  netdata-kernel-collector-musl-v0.7.1.1.tar.xz
+bdfa64cfc9a9d457252dd824435ac5e7f107c9a30fc6d915b294ae9fb1cd5205  netdata-kernel-collector-static-v0.7.1.1.tar.xz