ROX-25477 Adjust ringbuffer to always be power of 2 (#1762)

Adjust the bpf ring buffer sizing to meet falco requirements

---------

Co-authored-by: JoukoVirtanen <jouko@stackrox.com>
Co-authored-by: Dmitrii Dolgov <9erthalion6@gmail.com>

Author: 3 people

collector/lib/CollectorConfig.cpp

@@ -440,16 +440,21 @@ unsigned int CollectorConfig::GetSinspBufferSize() const {
 
   max_buffer_size = std::ceil((float)sinsp_total_buffer_size_ / (float)n_buffers);
 
-  // It would be awkward to have a buffer size of e.g. 3.14159..., align by the
-  // highest level, e.g. MiB, KiB.
-  int magnitude = 0;
-  while (max_buffer_size >> 10) {
-    max_buffer_size = max_buffer_size >> 10;
-    magnitude++;
-  }
-
-  effective_buffer_size = std::min(sinsp_buffer_size_,
-                                   (max_buffer_size << magnitude * 10));
+  // Determine largest power of two that is not greater than max_buffer_size,
+  // is a multiple of the page size (4096), and greater than two pages to meet
+  // the requirements for ringbuffer dimensions in
+  // falcosecurity-libs/driver/ppm_ringbuffer.h
+  unsigned int maximum_power_of_two_exponent = static_cast<unsigned int>(std::log2(max_buffer_size));
+
+  // The max_buffer_size could be arbitrary small here, so verify that the
+  // resulting exponent value is large enough.
+  //
+  // A power of two is always a multiple of one page size if the exponent is
+  // larger than 12 (2^12 = 4096). Falco also requires this value to be greater
+  // than two pages, meaning that the exponent has to be at least 14.
+  maximum_power_of_two_exponent = std::max((unsigned int)14, maximum_power_of_two_exponent);
+
+  effective_buffer_size = std::min(sinsp_buffer_size_, (unsigned int)(1 << maximum_power_of_two_exponent));
 
   if (effective_buffer_size != sinsp_buffer_size_) {
     CLOG(INFO) << "Use modified ringbuf size of "

collector/test/CollectorConfigTest.cpp

@@ -69,15 +69,22 @@ TEST(CollectorConfigTest, TestSinspCpuPerBufferAdjusted) {
   config.MockSetHostConfig(&hconfig);
   EXPECT_EQ(8 * 1024 * 1024, config.GetSinspBufferSize());
 
-  // High number of CPUs, adjusted value, aligned to MiB
+  // High number of CPUs, adjusted value to power of 2
   hconfig.SetNumPossibleCPUs(150);
   config.MockSetHostConfig(&hconfig);
-  EXPECT_EQ(3 * 1024 * 1024, config.GetSinspBufferSize());
+  EXPECT_EQ(2 * 1024 * 1024, config.GetSinspBufferSize());
 
-  // Extreme number of CPUs, adjusted value, aligned to KiB
+  // Extreme number of CPUs, adjusted value to power of 2
   hconfig.SetNumPossibleCPUs(1024);
   config.MockSetHostConfig(&hconfig);
   EXPECT_EQ(512 * 1024, config.GetSinspBufferSize());
+
+  // Extreme number of CPUs and low total buffer size, adjusted value is not
+  // less than one page
+  config.MockSetSinspTotalBufferSize(512 * 1024);
+  hconfig.SetNumPossibleCPUs(1024);
+  config.MockSetHostConfig(&hconfig);
+  EXPECT_EQ(16384, config.GetSinspBufferSize());
 }
 
 }  // namespace collector

docs/references.md

@@ -67,7 +67,8 @@ special, it instructs sinsp to allocate only one buffer no matter how many CPUs
 are there. This parameter affects CO-RE BPF only.
 
 * `ROX_COLLECTOR_SINSP_BUFFER_SIZE`: Specifies the size of a sinsp buffer in
-bytes. The default value is 16 MB.
+bytes. The default value is 8MB. This value must be a power of 2, a multiple
+of the system page size and greater than `2 * page_size`.
 
 * `ROX_COLLECTOR_SINSP_TOTAL_BUFFER_SIZE`: Specifies the allowed total size of
 all sinsp buffer in bytes. If the actual value will be larger than that due to
@@ -87,7 +88,7 @@ is quite verbose. The default is true.
 
 * `ROX_COLLECTOR_INTROSPECTION_ENABLE`: Enable the introspection API and publish the
 corresponding endpoints. With this API, it is possible to dump some of the
-internal state of Collector. Refer to the 
+internal state of Collector. Refer to the
 [troubleshooting](troubleshooting.md#introspection-endpoints) section for more details.
 The default is false.