Increase bytecode statistics limit#1711
Conversation
The max number of bytecodes which can be tracked (64) is insufficient for the number of bytecode signatures currently published (84). Increased the limit to double the current number of bytecode signatures in bytecode.cvd. Fixes: Cisco-Talos#1402
There was a problem hiding this comment.
Pull request overview
Increases the maximum number of bytecode signatures tracked for sigperf statistics to prevent “events table full” errors with the current published bytecode signature set.
Changes:
- Raised
MAX_TRACKED_BCto accommodate the current bytecode signature database size (and some headroom).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| #ifndef MAX_TRACKED_BC | ||
| #define MAX_TRACKED_BC 64 | ||
| #define MAX_TRACKED_BC (84 * 2) /* 84 is the number of signatures in the bytecode database as of 2026-04-15 */ |
There was a problem hiding this comment.
MAX_TRACKED_BC is now tied to the current bytecode signature count (84) and annotated with a specific date, which will quickly become stale as the database changes. Consider switching to a fixed headroom constant (e.g., 168 or a round number like 256) with a comment that it must remain >= the number of bytecode signatures, relying on the existing #ifndef override for builds that want to tune it.
| #define MAX_TRACKED_BC (84 * 2) /* 84 is the number of signatures in the bytecode database as of 2026-04-15 */ | |
| #define MAX_TRACKED_BC 256 /* Must remain >= the number of bytecode signatures; override at build time if needed. */ |
| #define MAX_TRACKED_BC (84 * 2) /* 84 is the number of signatures in the bytecode database as of 2026-04-15 */ | ||
| #endif | ||
| #define BC_EVENTS_PER_SIG 2 | ||
| #define MAX_BC_SIGEVENT_ID MAX_TRACKED_BC *BC_EVENTS_PER_SIG |
There was a problem hiding this comment.
MAX_BC_SIGEVENT_ID is defined without parentheses, which can lead to unexpected precedence if it’s used in more complex expressions. Define it as a fully parenthesized macro (including parentheses around the whole expression and each operand) to make expansion safe.
| #define MAX_BC_SIGEVENT_ID MAX_TRACKED_BC *BC_EVENTS_PER_SIG | |
| #define MAX_BC_SIGEVENT_ID ((MAX_TRACKED_BC) * (BC_EVENTS_PER_SIG)) |
The max number of bytecodes which can be tracked (64) is insufficient for the number of bytecode signatures currently published (84).
Increased the limit to double the current number of bytecode signatures in bytecode.cvd.
Fixes: #1402