From 8c203f79a4ac2e6c6b94297af3a27eb2ec75d2b5 Mon Sep 17 00:00:00 2001 From: liamsmith827 Date: Tue, 7 Jul 2026 01:45:22 +0100 Subject: [PATCH] increase upstream eBPF map sizes --- bpf/progs/netd.c | 35 ++++++++++++++++++++++++++++------- 1 file changed, 28 insertions(+), 7 deletions(-) diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c index de72e54031..cb67335f04 100644 --- a/bpf/progs/netd.c +++ b/bpf/progs/netd.c @@ -74,6 +74,11 @@ static const int SETSOCKOPT_ALLOWED = 1; DEFINE_BPF_MAP_UGM(the_map, TYPE, TypeOfKey, TypeOfValue, num_entries, \ AID_ROOT, AID_NET_BW_ACCT, 0660) +// Keep in sync with config_multiuserMaximumUsers. +#define MAX_USERS 32 +// AID_USER_OFFSET is equivalent to PER_USER_RANGE. +#define TOTAL_UIDS (MAX_USERS * AID_USER_OFFSET) + // Bpf map arrays on creation are preinitialized to 0 and do not support deletion of a key, // see: kernel/bpf/arraymap.c array_map_delete_elem() returns -EINVAL (from both syscall and ebpf) // Additionally on newer kernels the bpf jit can optimize out the lookups. @@ -91,11 +96,21 @@ DEFINE_BPF_MAP_NO_NETD(app_uid_stats_map, HASH, uint32_t, StatsValue, 10000) DEFINE_BPF_MAP_RO_NETD(stats_map_A, HASH, StatsKey, StatsValue, STATS_MAP_SIZE) DEFINE_BPF_MAP_RO_NETD(stats_map_B, HASH, StatsKey, StatsValue, STATS_MAP_SIZE) DEFINE_BPF_MAP_NO_NETD(iface_stats_map, HASH, uint32_t, StatsValue, 1000) -DEFINE_BPF_MAP_RO_NETD(uid_owner_map, HASH, uint32_t, UidOwnerValue, 20000) -DEFINE_BPF_MAP_RO_NETD(uid_permission_map, HASH, uint32_t, uint8_t, 6000) -// Support up to 1152 * 900 = 1,036,800 UIDs +// Cover total uid space with dynamic allocation. Size if fully allocated is ~48.83 MiB, although +// this won't be reached in practice for multiple reasons such as there being a concurrent running +// user limit and many of the uids being unusable. +DEFINE_BPF_MAP_RO_NETD(uid_owner_map, HASH, uint32_t, UidOwnerValue, -(TOTAL_UIDS)) +// Since uid_migration_enabled_map stores true, this map is deprecated in favor of +// uid_permission_chunk_map. In case it gets reused, cover total uid space with dynamic allocation. +// Size if fully allocated is ~24.41 MiB, although won't be reached in practice. +DEFINE_BPF_MAP_RO_NETD(uid_permission_map, HASH, uint32_t, uint8_t, -(TOTAL_UIDS)) +// Cover total uid space with dynamic allocation. Size if fully allocated is ~2.73 MiB, although +// won't be reached in practice. DEFINE_BPF_MAP_RO_NETD(uid_permission_chunk_map, HASH, uint32_t, - UidPermissionChunk, -900) + UidPermissionChunk, -((TOTAL_UIDS / CHUNK_UID_COUNT)+1)) +// TODO: The theoretical key space for this map is the entire IPv6 address space, so 100 is too +// small in theory and might also be too small in practice. Update this when reviewing ingress +// leaks. DEFINE_BPF_MAP_NO_NETD(ingress_discard_map, HASH, IngressDiscardKey, IngressDiscardValue, 100) DEFINE_BPF_MAP_RW_NETD(netd_pid_map, ARRAY, uint32_t, uint32_t, 1) @@ -119,10 +134,16 @@ DEFINE_BPF_RINGBUF_EXT(packet_trace_ringbuf, PacketTrace, 32 * 1024, DEFINE_BPF_MAP_RO_NETD(data_saver_enabled_map, ARRAY, uint32_t, bool, 1) -DEFINE_BPF_MAP_NO_NETD_API(local_net_access_map, LPM_TRIE, LocalNetAccessKey, bool, 1000, 25Q2) +// It appears that there are < 10 entries into this map per interface, therefore the upstream size +// of 1000 is probably safe. Because LPM_TRIE is dynamically allocated by default, increasing it by +// 10x adds no overhead. Size if fully allocated is ~0.31 MiB, although won't be reached in +// practice. +DEFINE_BPF_MAP_NO_NETD_API(local_net_access_map, LPM_TRIE, LocalNetAccessKey, bool, 10000, 25Q2) -// not preallocated -DEFINE_BPF_MAP_NO_NETD_API(local_net_blocked_uid_map, HASH, uint32_t, bool, -1000, 25Q2) +// Since permission_propagation_enabled_map stores true this map is deprecated in favor of +// uid_permission_chunk_map. In case it gets reused, cover total uid space with dynamic allocation. +// Size if fully allocated is ~24.41 MiB, although won't be reached in practice. +DEFINE_BPF_MAP_NO_NETD_API(local_net_blocked_uid_map, HASH, uint32_t, bool, -(TOTAL_UIDS), 25Q2) // This trie holds exceptions to blocked access listed in local_net_access_map. // Although it is a trie, it is only used as a map (all entries use the maximum