iovisor / bcc

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
Apache License 2.0
20.54k stars 3.88k forks source link

[question] I guess up to the size limit of eBPF Maps. #5085

Open Bobcat-yang opened 2 months ago

Bobcat-yang commented 2 months ago

Hello, I would like to know what is the size limit of eBPF Maps in Linux? How much data can I store when using it? I did not find the answer in the documentation, so I asked this question here. Hope to get your reply.

Thank you.

yonghong-song commented 2 months ago

There is no documentation. You can see the source code, e.g., https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/tree/kernel/bpf/hashtab.c

if ((u64)attr->key_size + attr->value_size >= KMALLOC_MAX_SIZE -
       sizeof(struct htab_elem))
        /* if key_size + value_size is bigger, the user space won't be
         * able to access the elements via bpf syscall. This check
         * also makes sure that the elem_size doesn't overflow and it's
         * kmalloc-able later in htab_map_update_elem()
         */
        return -E2BIG;

or

    /* hash table size must be power of 2; roundup_pow_of_two() can overflow
     * into UB on 32-bit arches, so check that first
     */
    err = -E2BIG;
    if (htab->map.max_entries > 1UL << 31)
        goto free_htab;

Similarly you can check other files for other map types.