Two more commits to optimize installation footprint (#44327)

meson.build

@@ -838,10 +838,6 @@ message(f'gperf len type is @gperf_len_type@')
 conf.set('GPERF_LEN_TYPE', gperf_len_type,
          description : 'The type of gperf "len" parameter')
 
-# The default gperf search leaves most slots of a large hash table empty, and every empty slot takes up space
-# in the binary. More search iterations make the large tables about 25% smaller.
-gperf_cmdline = [gperf, '--multiple-iterations=10']
-
 #####################################################################
 
 foreach header : [
@@ -2001,6 +1997,15 @@ userspace_c_args += ['-include', 'config.h']
 
 jinja2_cmdline = [python, meson_render_jinja2_py, config_h]
 
+# The default gperf search leaves most slots of a large hash table empty, and every empty slot takes up space
+# in the binary. More search iterations make the large tables about 25% smaller. With --duplicates, gperf
+# no longer requires a collision-free hash function: the keyword table then holds only the keywords, and a
+# separate lookup table of 8- or 16-bit indices, one per hash slot, maps hash values to entries. An empty
+# slot costs one or two bytes instead of a whole keyword entry, which makes the large tables about four
+# times smaller again. But gperf then also accepts a keyword that appears twice and only warns about it on
+# stderr, so the wrapper turns any output on stderr into an error.
+gperf_cmdline = [python, meson_gperf_py, gperf, '--multiple-iterations=10', '--duplicates']
+
 userspace = declare_dependency(
         compile_args : userspace_c_args,
         link_args : userspace_c_ld_args,

src/basic/filesystem-sets.py

@@ -256,6 +256,7 @@ def generate_gperf():
     print('''\
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 %{
+_Pragma("GCC diagnostic ignored \\"-Wimplicit-fallthrough\\"")
 #if __GNUC__ >= 15
 _Pragma("GCC diagnostic ignored \\"-Wzero-as-null-pointer-constant\\"")
 #endif
@@ -264,9 +265,23 @@ _Pragma("GCC diagnostic ignored \\"-Wzero-as-null-pointer-constant\\"")
 #include "filesystems.h"
 #include "stat-util.h"
 
+/* The magic numbers of all filesystems, a zero-terminated run per filesystem. Most filesystems have a single
+ * magic number, hence each keyword entry only stores the index of its run instead of a fixed-size array. */
+static const statfs_f_type_t filesystem_magics[] = {''')
+
+    index = {}
+    n = 0
+    for name, magics in NAME_TO_MAGIC.items():
+        index[name] = n
+        n += len(magics) + 1
+        print(f'        /* {name} */ {", ".join(magics)}, 0,')
+
+    print('''\
+};
+
 struct FilesystemMagic {
         const char *name;
-        statfs_f_type_t magic[FILESYSTEM_MAGIC_MAX];
+        uint16_t magic_index; /* index into filesystem_magics */
 };
 %}
 struct FilesystemMagic;
@@ -279,8 +294,8 @@ struct FilesystemMagic;
 %struct-type
 %includes
 %%''')
-    for name, magics in NAME_TO_MAGIC.items():
-        print(f'{name + ",":16} {{{", ".join(magics)}}}')
+    for name in NAME_TO_MAGIC:
+        print(f'{name + ",":16} {index[name]}')
 
 
 def generate_fs_type_to_string():

src/basic/filesystems.c

@@ -14,7 +14,7 @@ int fs_type_from_string(const char *name, const statfs_f_type_t **ret) {
         if (!fs_magic)
                 return -EINVAL;
 
-        *ret = fs_magic->magic;
+        *ret = filesystem_magics + fs_magic->magic_index;
         return 0;
 }
 

src/basic/filesystems.h

@@ -4,8 +4,6 @@
 #include "forward.h"
 #include "stat-util.h"
 
-#define FILESYSTEM_MAGIC_MAX 10
-
 typedef enum FilesystemGroups {
         /* Please leave BASIC_API first and KNOWN last, but sort the rest alphabetically */
         FILESYSTEM_SET_BASIC_API,
@@ -34,6 +32,7 @@ extern const FilesystemSet filesystem_sets[];
 const FilesystemSet *filesystem_set_find(const char *name);
 
 const char* fs_type_to_string(statfs_f_type_t magic);
+/* Returns the zero-terminated list of magic numbers of the filesystem with the specified name. */
 int fs_type_from_string(const char *name, const statfs_f_type_t **ret);
 bool fs_in_group(const struct statfs *s, enum FilesystemGroups fs_group);
 

src/core/bpf-restrict-fs.c

@@ -122,10 +122,7 @@ int bpf_restrict_fs_update(const Set *filesystems, uint64_t cgroup_id, int outer
 
                 log_debug("bpf-restrict-fs: Restricting filesystem access to '%s'", fs);
 
-                for (int i = 0; i < FILESYSTEM_MAGIC_MAX; i++) {
-                        if (magic[i] == 0)
-                                break;
-
+                for (size_t i = 0; magic[i] != 0; i++) {
                         /* The map key is uint32_t but statfs_f_type_t may be 64-bit, pass a truncated copy
                          * to avoid breaking on big endian arches. */
                         uint32_t key = magic[i];

tools/generate-gperfs.py

@@ -13,18 +13,15 @@ if __name__ == '__main__':
         sys.exit(f'Usage: {sys.argv[0]} name prefix file [includes...]')
 
     name, prefix, file, *includes = sys.argv[1:]
-    includes = [f'#include {i}' for i in includes]
+    includes = '\n'.join(f'#include {i}' for i in includes)
 
-    # Older versions of python don't allow backslashes
-    # in f-strings so use chr(10) for newlines and chr(92)
-    # for backslashes instead as a workaround.
     print(f'''\
 %{{
-_Pragma("GCC diagnostic ignored {chr(92)}"-Wimplicit-fallthrough{chr(92)}"")
+_Pragma("GCC diagnostic ignored \\"-Wimplicit-fallthrough\\"")
 #if __GNUC__ >= 15
-_Pragma("GCC diagnostic ignored {chr(92)}"-Wzero-as-null-pointer-constant{chr(92)}"")
+_Pragma("GCC diagnostic ignored \\"-Wzero-as-null-pointer-constant\\"")
 #endif
-{chr(10).join(includes)}
+{includes}
 %}}''')
     print(f'''\
 struct {name}_name {{ const char* name; int id; }};

tools/meson-gperf.py

@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+"""Run gperf and fail if it writes anything to stderr.
+
+With --duplicates, gperf accepts a keyword that appears twice: it only warns about it on stderr and keeps
+the first entry, silently dropping the second one. Our keyword tables have no hash collisions, so gperf is
+otherwise silent, and any output on stderr indicates a duplicate keyword.
+"""
+
+import subprocess
+import sys
+
+result = subprocess.run(sys.argv[1:], stderr=subprocess.PIPE, text=True, errors='replace')
+sys.stderr.write(result.stderr)
+if result.returncode == 0 and result.stderr:
+    sys.exit(f'{sys.argv[1]} wrote to stderr, see above. Does a keyword appear twice?')
+sys.exit(result.returncode)

tools/meson.build

@@ -17,6 +17,7 @@ make_directive_index_py        = files('make-directive-index.py')
 make_man_index_py              = files('make-man-index.py')
 meson_build_sh                 = files('meson-build.sh')
 meson_extract_unit_files_py    = files('meson-extract-unit-files.py')
+meson_gperf_py                 = files('meson-gperf.py')
 meson_render_jinja2_py         = files('meson-render-jinja2.py')
 msgmerge_no_fuzzy_py           = files('msgmerge-no-fuzzy.py')
 sync_docs_py                   = files('sync-docs.py')