bpf/acct.c - downsize initial flow_{cooldown,origin} max_entries

According to https://github.com/torvalds/linux/blob/master/tools/lib/bpf/hashmap.c#L85, hash maps get upsized at runtime when reaching 75% watermark. Seeing some failures on CI locking memory for these maps, even with unlimited ulimit.
ti-mo · Mar 31, 2020 · ebd6d61 · ebd6d61
1 parent cc1d4c8
commit ebd6d61
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/bpf/acct.c b/bpf/acct.c
@@ -58,7 +58,7 @@ struct bpf_map_def SEC("maps/flow_cooldown") flow_cooldown = {
   .type = BPF_MAP_TYPE_HASH,
   .key_size = sizeof(u64),
   .value_size = sizeof(u64),
-  .max_entries = 512000,
+  .max_entries = 65535,
 };
 
 // Hash that holds a timestamp per flow indicating when the flow
@@ -67,7 +67,7 @@ struct bpf_map_def SEC("maps/flow_origin") flow_origin = {
   .type = BPF_MAP_TYPE_HASH,
   .key_size = sizeof(struct nf_conn *),
   .value_size = sizeof(u64),
-  .max_entries = 512000,
+  .max_entries = 65535,
 };
 
 // Communication channel between the kprobe and the kretprobe.