1 /* 2 * Copyright (C) 2018 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef NETDBPF_BPF_SHARED_H 18 #define NETDBPF_BPF_SHARED_H 19 20 #include <linux/in.h> 21 #include <linux/in6.h> 22 #include <netdutils/UidConstants.h> 23 // const values shared by bpf kernel program bpfloader and netd 24 25 26 // Since we cannot garbage collect the stats map since device boot, we need to make these maps as 27 // large as possible. The maximum size of number of map entries we can have is depend on the rlimit 28 // of MEM_LOCK granted to netd. The memory space needed by each map can be calculated by the 29 // following fomula: 30 // elem_size = 40 + roundup(key_size, 8) + roundup(value_size, 8) 31 // cost = roundup_pow_of_two(max_entries) * 16 + elem_size * max_entries + 32 // elem_size * number_of_CPU 33 // And the cost of each map currently used is(assume the device have 8 CPUs): 34 // cookie_tag_map: key: 8 bytes, value: 8 bytes, cost: 822592 bytes = 823Kbytes 35 // uid_counter_set_map: key: 4 bytes, value: 1 bytes, cost: 145216 bytes = 145Kbytes 36 // app_uid_stats_map: key: 4 bytes, value: 32 bytes, cost: 1062784 bytes = 1063Kbytes 37 // uid_stats_map: key: 16 bytes, value: 32 bytes, cost: 1142848 bytes = 1143Kbytes 38 // tag_stats_map: key: 16 bytes, value: 32 bytes, cost: 1142848 bytes = 1143Kbytes 39 // iface_index_name_map:key: 4 bytes, value: 16 bytes, cost: 80896 bytes = 81Kbytes 40 // iface_stats_map: key: 4 bytes, value: 32 bytes, cost: 97024 bytes = 97Kbytes 41 // dozable_uid_map: key: 4 bytes, value: 1 bytes, cost: 145216 bytes = 145Kbytes 42 // standby_uid_map: key: 4 bytes, value: 1 bytes, cost: 145216 bytes = 145Kbytes 43 // powersave_uid_map: key: 4 bytes, value: 1 bytes, cost: 145216 bytes = 145Kbytes 44 // total: 4930Kbytes 45 // It takes maximum 4.9MB kernel memory space if all maps are full, which requires any devices 46 // running this module to have a memlock rlimit to be larger then 5MB. In the old qtaguid module, 47 // we don't have a total limit for data entries but only have limitation of tags each uid can have. 48 // (default is 1024 in kernel); 49 50 const int COOKIE_UID_MAP_SIZE = 10000; 51 const int UID_COUNTERSET_MAP_SIZE = 2000; 52 const int APP_STATS_MAP_SIZE = 10000; 53 const int STATS_MAP_SIZE = 5000; 54 const int IFACE_INDEX_NAME_MAP_SIZE = 1000; 55 const int IFACE_STATS_MAP_SIZE = 1000; 56 const int CONFIGURATION_MAP_SIZE = 2; 57 const int UID_OWNER_MAP_SIZE = 2000; 58 59 #define BPF_PATH "/sys/fs/bpf" 60 61 #define BPF_EGRESS_PROG_PATH BPF_PATH "/prog_netd_cgroupskb_egress_stats" 62 #define BPF_INGRESS_PROG_PATH BPF_PATH "/prog_netd_cgroupskb_ingress_stats" 63 #define XT_BPF_INGRESS_PROG_PATH BPF_PATH "/prog_netd_skfilter_ingress_xtbpf" 64 #define XT_BPF_EGRESS_PROG_PATH BPF_PATH "/prog_netd_skfilter_egress_xtbpf" 65 #define XT_BPF_WHITELIST_PROG_PATH BPF_PATH "/prog_netd_skfilter_whitelist_xtbpf" 66 #define XT_BPF_BLACKLIST_PROG_PATH BPF_PATH "/prog_netd_skfilter_blacklist_xtbpf" 67 #define CGROUP_SOCKET_PROG_PATH BPF_PATH "/prog_netd_cgroupsock_inet_create" 68 69 #define COOKIE_TAG_MAP_PATH BPF_PATH "/map_netd_cookie_tag_map" 70 #define UID_COUNTERSET_MAP_PATH BPF_PATH "/map_netd_uid_counterset_map" 71 #define APP_UID_STATS_MAP_PATH BPF_PATH "/map_netd_app_uid_stats_map" 72 #define STATS_MAP_A_PATH BPF_PATH "/map_netd_stats_map_A" 73 #define STATS_MAP_B_PATH BPF_PATH "/map_netd_stats_map_B" 74 #define IFACE_INDEX_NAME_MAP_PATH BPF_PATH "/map_netd_iface_index_name_map" 75 #define IFACE_STATS_MAP_PATH BPF_PATH "/map_netd_iface_stats_map" 76 #define CONFIGURATION_MAP_PATH BPF_PATH "/map_netd_configuration_map" 77 #define UID_OWNER_MAP_PATH BPF_PATH "/map_netd_uid_owner_map" 78 #define UID_PERMISSION_MAP_PATH BPF_PATH "/map_netd_uid_permission_map" 79 80 enum UidOwnerMatchType { 81 NO_MATCH = 0, 82 HAPPY_BOX_MATCH = (1 << 0), 83 PENALTY_BOX_MATCH = (1 << 1), 84 DOZABLE_MATCH = (1 << 2), 85 STANDBY_MATCH = (1 << 3), 86 POWERSAVE_MATCH = (1 << 4), 87 IIF_MATCH = (1 << 5), 88 }; 89 90 enum BpfPemissionMatch { 91 BPF_PERMISSION_INTERNET = 1 << 2, 92 BPF_PERMISSION_UPDATE_DEVICE_STATS = 1 << 3, 93 }; 94 // In production we use two identical stats maps to record per uid stats and 95 // do swap and clean based on the configuration specified here. The statsMapType 96 // value in configuration map specified which map is currently in use. 97 enum StatsMapType { 98 SELECT_MAP_A, 99 SELECT_MAP_B, 100 }; 101 102 // TODO: change the configuration object from an 8-bit bitmask to an object with clearer 103 // semantics, like a struct. 104 typedef uint8_t BpfConfig; 105 const BpfConfig DEFAULT_CONFIG = 0; 106 107 typedef struct { 108 // Allowed interface index. Only applicable if IIF_MATCH is set in the rule bitmask above. 109 uint32_t iif; 110 // A bitmask of enum values in UidOwnerMatchType. 111 uint8_t rule; 112 } UidOwnerValue; 113 114 #define UID_RULES_CONFIGURATION_KEY 1 115 #define CURRENT_STATS_MAP_CONFIGURATION_KEY 2 116 117 #define CLAT_INGRESS_PROG_RAWIP_NAME "prog_clatd_schedcls_ingress_clat_rawip" 118 #define CLAT_INGRESS_PROG_ETHER_NAME "prog_clatd_schedcls_ingress_clat_ether" 119 120 #define CLAT_INGRESS_PROG_RAWIP_PATH BPF_PATH "/" CLAT_INGRESS_PROG_RAWIP_NAME 121 #define CLAT_INGRESS_PROG_ETHER_PATH BPF_PATH "/" CLAT_INGRESS_PROG_ETHER_NAME 122 123 #define CLAT_INGRESS_MAP_PATH BPF_PATH "/map_clatd_clat_ingress_map" 124 125 typedef struct { 126 uint32_t iif; // The input interface index 127 struct in6_addr pfx96; // The source /96 nat64 prefix, bottom 32 bits must be 0 128 struct in6_addr local6; // The full 128-bits of the destination IPv6 address 129 } ClatIngressKey; 130 131 typedef struct { 132 uint32_t oif; // The output interface to redirect to (0 means don't redirect) 133 struct in_addr local4; // The destination IPv4 address 134 } ClatIngressValue; 135 136 #endif // NETDBPF_BPF_SHARED_H 137