Use bpf map to read the interface stats

With the support of xt_bpf module, the more accurate per interface
network traffic stats can be obtained from ifaceStatsMap under
sys/fs/bpf/. Change the framework NetworkStatsService native
implementation to read from map instead of /proc/net/dev. The
corresponding test is added and refactor the old test to be compatible.

Test: ./libbpf_test
      atest android.net.cts.TrafficStatsTest
Bug: 72111305

Change-Id: I2a6c6f82317bd9667c1b15e6b082fc9f153f6bf3
diff --git a/libbpf/BpfNetworkStats.cpp b/libbpf/BpfNetworkStats.cpp
index f43178c..e9ec0c9 100644
--- a/libbpf/BpfNetworkStats.cpp
+++ b/libbpf/BpfNetworkStats.cpp
@@ -37,10 +37,9 @@
 namespace android {
 namespace bpf {
 
-static const char* BPF_IFACE_STATS = "/proc/net/dev";
 
 // The limit for stats received by a unknown interface;
-static const uint64_t MAX_UNKNOWN_IFACE_BYTES = 100*1000;
+static const int64_t MAX_UNKNOWN_IFACE_BYTES = 100*1000;
 
 static constexpr uint32_t BPF_OPEN_FLAGS = BPF_F_RDONLY;
 
@@ -73,47 +72,51 @@
     return bpfGetUidStatsInternal(uid, stats, uidStatsMap);
 }
 
-// TODO: The iface stats read from proc/net/dev contains additional L2 header.
-// Need to adjust the byte length read depend on the packets number before
-// return.
-// Bug: b/72111305
-int bpfGetIfaceStatsInternal(const char* iface, Stats* stats, const char* file) {
-    std::string content;
-    if (!android::base::ReadFileToString(file, &content)) {
-        ALOGE("Cannot read iface stats from: %s", file);
-        return -errno;
-    }
-    std::istringstream stream(content);
-    for (std::string ifaceLine; std::getline(stream, ifaceLine);) {
-        const char* buffer = android::base::Trim(ifaceLine).c_str();
-        char cur_iface[IFNAMSIZ];
-        uint64_t rxBytes, rxPackets, txBytes, txPackets;
-        // Typical iface stats read to parse:
-        // interface rxbytes rxpackets errs drop fifo frame compressed multicast txbytes txpackets \
-        // errs drop fifo colls carrier compressed
-        // lo: 13470483181 57249790 0 0 0 0 0 0 13470483181 57249790 0 0 0 0 0 0
-        int matched = sscanf(buffer,
-                             "%[^ :]: %" SCNu64 " %" SCNu64
-                             " %*lu %*lu %*lu %*lu %*lu %*lu "
-                             "%" SCNu64 " %" SCNu64 "",
-                             cur_iface, &rxBytes, &rxPackets, &txBytes, &txPackets);
-        if (matched >= 5) {
-            if (!iface || !strcmp(iface, cur_iface)) {
-                stats->rxBytes += rxBytes;
-                stats->rxPackets += rxPackets;
-                stats->txBytes += txBytes;
-                stats->txPackets += txPackets;
-            }
-        }
-    }
+int bpfGetIfaceStatsInternal(const char* iface, Stats* stats,
+                             const base::unique_fd& ifaceStatsMapFd,
+                             const base::unique_fd& ifaceNameMapFd) {
+    uint32_t nonExistentKey = NONEXISTENT_IFACE_STATS_KEY;
+    struct StatsValue dummyValue;
+    int64_t unknownIfaceBytesTotal = 0;
     stats->tcpRxPackets = -1;
     stats->tcpTxPackets = -1;
-
-    return 0;
+    auto processIfaceStats = [iface, stats, &ifaceNameMapFd, &unknownIfaceBytesTotal](
+                              void* key, const base::unique_fd& ifaceStatsMapFd) {
+        char ifname[IFNAMSIZ];
+        int ifIndex = *(int *)key;
+        if (getIfaceNameFromMap(ifaceNameMapFd, ifaceStatsMapFd, ifIndex, ifname, &ifIndex,
+                                &unknownIfaceBytesTotal)) {
+            return 0;
+        }
+        if (!iface || !strcmp(iface, ifname)) {
+            StatsValue statsEntry;
+            int ret = bpf::findMapEntry(ifaceStatsMapFd, &ifIndex, &statsEntry);
+            if (ret) return -errno;
+            stats->rxPackets += statsEntry.rxPackets;
+            stats->txPackets += statsEntry.txPackets;
+            stats->rxBytes += statsEntry.rxBytes;
+            stats->txBytes += statsEntry.txBytes;
+        }
+        return 0;
+    };
+    return bpfIterateMap(nonExistentKey, dummyValue, ifaceStatsMapFd, processIfaceStats);
 }
 
 int bpfGetIfaceStats(const char* iface, Stats* stats) {
-    return bpfGetIfaceStatsInternal(iface, stats, BPF_IFACE_STATS);
+    base::unique_fd ifaceStatsMap(bpf::mapRetrieve(IFACE_STATS_MAP_PATH, BPF_OPEN_FLAGS));
+    int ret;
+    if (ifaceStatsMap < 0) {
+        ret = -errno;
+        ALOGE("get ifaceStats map fd failed: %s", strerror(errno));
+        return ret;
+    }
+    base::unique_fd ifaceIndexNameMap(bpf::mapRetrieve(IFACE_INDEX_NAME_MAP_PATH, BPF_OPEN_FLAGS));
+    if (ifaceIndexNameMap < 0) {
+        ret = -errno;
+        ALOGE("get ifaceIndexName map fd failed: %s", strerror(errno));
+        return ret;
+    }
+    return bpfGetIfaceStatsInternal(iface, stats, ifaceStatsMap, ifaceIndexNameMap);
 }
 
 stats_line populateStatsEntry(const StatsKey& statsKey, const StatsValue& statsEntry,
@@ -130,16 +133,33 @@
     return newLine;
 }
 
+void maybeLogUnknownIface(int ifaceIndex, const base::unique_fd& statsMapFd, void* curKey,
+                          int64_t* unknownIfaceBytesTotal) {
+    // Have we already logged an error?
+    if (*unknownIfaceBytesTotal == -1) {
+        return;
+    }
+
+    // Are we undercounting enough data to be worth logging?
+    StatsValue statsEntry;
+    if (bpf::findMapEntry(statsMapFd, curKey, &statsEntry) < 0) {
+        // No data is being undercounted.
+        return;
+    }
+
+    *unknownIfaceBytesTotal += (statsEntry.rxBytes + statsEntry.txBytes);
+    if (*unknownIfaceBytesTotal >= MAX_UNKNOWN_IFACE_BYTES) {
+            ALOGE("Unknown name for ifindex %d with more than %" PRId64 " bytes of traffic",
+                  ifaceIndex, *unknownIfaceBytesTotal);
+            *unknownIfaceBytesTotal = -1;
+    }
+}
+
 int getIfaceNameFromMap(const base::unique_fd& ifaceMapFd, const base::unique_fd& statsMapFd,
-                        char *ifname, StatsKey &curKey, uint64_t *unknownIfaceBytesTotal) {
-    if (bpf::findMapEntry(ifaceMapFd, &curKey.ifaceIndex, ifname) < 0) {
-        StatsValue statsEntry;
-        if (bpf::findMapEntry(statsMapFd, &curKey, &statsEntry) < 0) return -errno;
-        *unknownIfaceBytesTotal += (statsEntry.rxBytes + statsEntry.txBytes);
-        if (*unknownIfaceBytesTotal >= MAX_UNKNOWN_IFACE_BYTES) {
-            ALOGE("Unknown name for ifindex %d with more than %" PRIu64 " bytes of traffic",
-                  curKey.ifaceIndex, *unknownIfaceBytesTotal);
-        }
+                        uint32_t ifaceIndex, char* ifname, void* curKey,
+                        int64_t* unknownIfaceBytesTotal) {
+    if (bpf::findMapEntry(ifaceMapFd, &ifaceIndex, ifname) < 0) {
+        maybeLogUnknownIface(ifaceIndex, statsMapFd, curKey, unknownIfaceBytesTotal);
         return -ENODEV;
     }
     return 0;
@@ -149,7 +169,7 @@
                                        const std::vector<std::string>& limitIfaces, int limitTag,
                                        int limitUid, const base::unique_fd& statsMapFd,
                                        const base::unique_fd& ifaceMapFd) {
-    uint64_t unknownIfaceBytesTotal = 0;
+    int64_t unknownIfaceBytesTotal = 0;
     struct StatsKey nonExistentKey = NONEXISTENT_STATSKEY;
     struct StatsValue dummyValue;
     auto processDetailUidStats = [lines, &limitIfaces, limitTag, limitUid,
@@ -157,7 +177,8 @@
                                   (void* key, const base::unique_fd& statsMapFd) {
         struct StatsKey curKey = * (struct StatsKey*)key;
         char ifname[IFNAMSIZ];
-        if (getIfaceNameFromMap(ifaceMapFd, statsMapFd, ifname, curKey, &unknownIfaceBytesTotal)) {
+        if (getIfaceNameFromMap(ifaceMapFd, statsMapFd, curKey.ifaceIndex, ifname, &curKey,
+                                &unknownIfaceBytesTotal)) {
             return 0;
         }
         std::string ifnameStr(ifname);
diff --git a/libbpf/BpfNetworkStatsTest.cpp b/libbpf/BpfNetworkStatsTest.cpp
index 5075bc4..cd7a066 100644
--- a/libbpf/BpfNetworkStatsTest.cpp
+++ b/libbpf/BpfNetworkStatsTest.cpp
@@ -63,7 +63,12 @@
 constexpr uint64_t TEST_BYTES1 = 2000;
 constexpr uint64_t TEST_PACKET0 = 100;
 constexpr uint64_t TEST_PACKET1 = 200;
-constexpr const char* IFACE_NAME = "lo";
+constexpr const char* IFACE_NAME1 = "lo";
+constexpr const char* IFACE_NAME2 = "wlan0";
+constexpr const char* IFACE_NAME3 = "rmnet_data0";
+constexpr uint32_t IFACE_INDEX1 = 1;
+constexpr uint32_t IFACE_INDEX2 = 2;
+constexpr uint32_t IFACE_INDEX3 = 3;
 constexpr uint32_t UNKNOWN_IFACE = 0;
 
 class BpfNetworkStatsHelperTest : public testing::Test {
@@ -73,6 +78,7 @@
     unique_fd mFakeUidStatsMap;
     unique_fd mFakeTagStatsMap;
     unique_fd mFakeIfaceIndexNameMap;
+    unique_fd mFakeIfaceStatsMap;
 
     void SetUp() {
         mFakeCookieTagMap = unique_fd(createMap(BPF_MAP_TYPE_HASH, sizeof(uint64_t),
@@ -90,12 +96,18 @@
         mFakeIfaceIndexNameMap =
             unique_fd(createMap(BPF_MAP_TYPE_HASH, sizeof(uint32_t), IFNAMSIZ, TEST_MAP_SIZE, 0));
         ASSERT_LE(0, mFakeIfaceIndexNameMap);
+
+        mFakeIfaceStatsMap = unique_fd(createMap(BPF_MAP_TYPE_HASH, sizeof(uint32_t),
+                                                 sizeof(struct StatsValue), TEST_MAP_SIZE, 0));
+        ASSERT_LE(0, mFakeIfaceStatsMap);
     }
 
     void TearDown() {
         mFakeCookieTagMap.reset();
         mFakeUidStatsMap.reset();
         mFakeTagStatsMap.reset();
+        mFakeIfaceIndexNameMap.reset();
+        mFakeIfaceStatsMap.reset();
     }
 
     void expectUidTag(uint64_t cookie, uid_t uid, uint32_t tag) {
@@ -112,13 +124,29 @@
         EXPECT_EQ(0, writeToMapEntry(map_fd, &key, value, BPF_ANY));
     }
 
-    uint32_t updateIfaceMap(const char* ifaceName) {
-        int ifaceIndex = if_nametoindex(ifaceName);
-        EXPECT_LT(0, ifaceIndex);
+    void updateIfaceMap(const char* ifaceName, uint32_t ifaceIndex) {
         char iface[IFNAMSIZ];
         strlcpy(iface, ifaceName, IFNAMSIZ);
         EXPECT_EQ(0, writeToMapEntry(mFakeIfaceIndexNameMap, &ifaceIndex, iface, BPF_ANY));
-        return ifaceIndex;
+    }
+
+    void expectStatsEqual(const StatsValue& target, const Stats& result) {
+        EXPECT_EQ(target.rxPackets, result.rxPackets);
+        EXPECT_EQ(target.rxBytes, result.rxBytes);
+        EXPECT_EQ(target.txPackets, result.txPackets);
+        EXPECT_EQ(target.txBytes, result.txBytes);
+    }
+
+    void expectStatsLineEqual(const StatsValue target, const char* iface, uint32_t uid,
+                              int counterSet, uint32_t tag, const stats_line& result) {
+        EXPECT_EQ(0, strcmp(iface, result.iface));
+        EXPECT_EQ(uid, (uint32_t)result.uid);
+        EXPECT_EQ(counterSet, result.set);
+        EXPECT_EQ(tag, (uint32_t)result.tag);
+        EXPECT_EQ(target.rxPackets, (uint64_t)result.rxPackets);
+        EXPECT_EQ(target.rxBytes, (uint64_t)result.rxBytes);
+        EXPECT_EQ(target.txPackets, (uint64_t)result.txPackets);
+        EXPECT_EQ(target.txBytes, (uint64_t)result.txBytes);
     }
 };
 
@@ -152,26 +180,27 @@
 }
 
 TEST_F(BpfNetworkStatsHelperTest, TestGetUidStatsTotal) {
-    uint32_t ifaceIndex = updateIfaceMap(IFACE_NAME);
+    updateIfaceMap(IFACE_NAME1, IFACE_INDEX1);
     StatsValue value1 = {.rxBytes = TEST_BYTES0,
                          .rxPackets = TEST_PACKET0,
                          .txBytes = TEST_BYTES1,
                          .txPackets = TEST_PACKET1,};
-    populateFakeStats(TEST_UID1, 0, ifaceIndex, TEST_COUNTERSET0, &value1, mFakeUidStatsMap);
-    populateFakeStats(TEST_UID1, 0, ifaceIndex, TEST_COUNTERSET1, &value1, mFakeUidStatsMap);
-    populateFakeStats(TEST_UID2, 0, ifaceIndex, TEST_COUNTERSET1, &value1, mFakeUidStatsMap);
+    populateFakeStats(TEST_UID1, 0, IFACE_INDEX1, TEST_COUNTERSET0, &value1, mFakeUidStatsMap);
+    populateFakeStats(TEST_UID1, 0, IFACE_INDEX1, TEST_COUNTERSET1, &value1, mFakeUidStatsMap);
+    populateFakeStats(TEST_UID2, 0, IFACE_INDEX1, TEST_COUNTERSET1, &value1, mFakeUidStatsMap);
     Stats result1 = {};
     ASSERT_EQ(0, bpfGetUidStatsInternal(TEST_UID1, &result1, mFakeUidStatsMap));
-    ASSERT_EQ(TEST_PACKET0 * 2, result1.rxPackets);
-    ASSERT_EQ(TEST_BYTES0 * 2, result1.rxBytes);
-    ASSERT_EQ(TEST_PACKET1 * 2, result1.txPackets);
-    ASSERT_EQ(TEST_BYTES1 * 2, result1.txBytes);
+    StatsValue uid1Value = {
+        .rxBytes = TEST_BYTES0 * 2,
+        .rxPackets = TEST_PACKET0 * 2,
+        .txBytes = TEST_BYTES1 * 2,
+        .txPackets = TEST_PACKET1 * 2,
+    };
+    expectStatsEqual(uid1Value, result1);
+
     Stats result2 = {};
     ASSERT_EQ(0, bpfGetUidStatsInternal(TEST_UID2, &result2, mFakeUidStatsMap));
-    ASSERT_EQ(TEST_PACKET0, result2.rxPackets);
-    ASSERT_EQ(TEST_BYTES0, result2.rxBytes);
-    ASSERT_EQ(TEST_PACKET1, result2.txPackets);
-    ASSERT_EQ(TEST_BYTES1, result2.txBytes);
+    expectStatsEqual(value1, result2);
     std::vector<stats_line> lines;
     std::vector<std::string> ifaces;
     ASSERT_EQ(0, parseBpfNetworkStatsDetailInternal(&lines, ifaces, TAG_ALL, TEST_UID1,
@@ -181,110 +210,123 @@
     ASSERT_EQ(0, parseBpfNetworkStatsDetailInternal(&lines, ifaces, TAG_ALL, TEST_UID2,
                                                     mFakeUidStatsMap, mFakeIfaceIndexNameMap));
     ASSERT_EQ((unsigned long)1, lines.size());
+    expectStatsLineEqual(value1, IFACE_NAME1, TEST_UID2, TEST_COUNTERSET1, 0, lines.front());
 }
 
 TEST_F(BpfNetworkStatsHelperTest, TestGetIfaceStatsInternal) {
-    const char* fakeFilePath = "/data/local/tmp/testIface.txt";
-    std::ofstream fakeProcFile(fakeFilePath);
-    ASSERT_TRUE(fakeProcFile.is_open());
-    fakeProcFile << "Inter-|   Receive                                                |  Transmit  "
-                    "                                            \n";
-    fakeProcFile << " face |bytes    packets errs drop fifo frame compressed multicast|bytes    "
-                    "packets errs drop fifo colls carrier compressed\n";
-    fakeProcFile << "    lo:    8308     116    0    0    0     0          0         0     8308    "
-                    " 116    0    0    0     0       0          0\n";
-    fakeProcFile << "rmnet0: 1507570    2205    0    0    0     0          0         0   489339    "
-                    "2237    0    0    0     0       0          0\n";
-    fakeProcFile << "  ifb0:   52454     151    0  151    0     0          0         0        0    "
-                    "   0    0    0    0     0       0          0\n";
-    fakeProcFile << "  ifb1:   52454     151    0  151    0     0          0         0        0    "
-                    "   0    0    0    0     0       0          0\n";
-    fakeProcFile << "  sit0:       0       0    0    0    0     0          0         0        0    "
-                    "   0  148    0    0     0       0          0\n";
-    fakeProcFile << "ip6tnl0:       0       0    0    0    0     0          0         0        0   "
-                    "    0  151  151    0     0       0          0\n";
-    fakeProcFile.close();
-    const char* iface = "lo";
+    updateIfaceMap(IFACE_NAME1, IFACE_INDEX1);
+    updateIfaceMap(IFACE_NAME2, IFACE_INDEX2);
+    updateIfaceMap(IFACE_NAME3, IFACE_INDEX3);
+    StatsValue value1 = {
+        .rxBytes = TEST_BYTES0,
+        .rxPackets = TEST_PACKET0,
+        .txBytes = TEST_BYTES1,
+        .txPackets = TEST_PACKET1,
+    };
+    StatsValue value2 = {
+        .rxBytes = TEST_BYTES1,
+        .rxPackets = TEST_PACKET1,
+        .txBytes = TEST_BYTES0,
+        .txPackets = TEST_PACKET0,
+    };
+    uint32_t ifaceStatsKey = IFACE_INDEX1;
+    EXPECT_EQ(0, writeToMapEntry(mFakeIfaceStatsMap, &ifaceStatsKey, &value1, BPF_ANY));
+    ifaceStatsKey = IFACE_INDEX2;
+    EXPECT_EQ(0, writeToMapEntry(mFakeIfaceStatsMap, &ifaceStatsKey, &value2, BPF_ANY));
+    ifaceStatsKey = IFACE_INDEX3;
+    EXPECT_EQ(0, writeToMapEntry(mFakeIfaceStatsMap, &ifaceStatsKey, &value1, BPF_ANY));
+
     Stats result1 = {};
-    ASSERT_EQ(0, bpfGetIfaceStatsInternal(iface, &result1, fakeFilePath));
-    EXPECT_EQ(116UL, result1.rxPackets);
-    EXPECT_EQ(8308UL, result1.rxBytes);
-    EXPECT_EQ(116UL, result1.txPackets);
-    EXPECT_EQ(8308UL, result1.txBytes);
+    ASSERT_EQ(0, bpfGetIfaceStatsInternal(IFACE_NAME1, &result1, mFakeIfaceStatsMap,
+                                          mFakeIfaceIndexNameMap));
+    expectStatsEqual(value1, result1);
     Stats result2 = {};
-    const char* iface2 = "rmnet0";
-    EXPECT_EQ(0, bpfGetIfaceStatsInternal(iface2, &result2, fakeFilePath));
-    EXPECT_EQ(2205UL, result2.rxPackets);
-    EXPECT_EQ(1507570UL, result2.rxBytes);
-    EXPECT_EQ(2237UL, result2.txPackets);
-    EXPECT_EQ(489339UL, result2.txBytes);
+    ASSERT_EQ(0, bpfGetIfaceStatsInternal(IFACE_NAME2, &result2, mFakeIfaceStatsMap,
+                                          mFakeIfaceIndexNameMap));
+    expectStatsEqual(value2, result2);
+    Stats totalResult = {};
+    ASSERT_EQ(0, bpfGetIfaceStatsInternal(NULL, &totalResult, mFakeIfaceStatsMap,
+                                          mFakeIfaceIndexNameMap));
+    StatsValue totalValue = {
+        .rxBytes = TEST_BYTES0 * 2 + TEST_BYTES1,
+        .rxPackets = TEST_PACKET0 * 2 + TEST_PACKET1,
+        .txBytes = TEST_BYTES1 * 2 + TEST_BYTES0,
+        .txPackets = TEST_PACKET1 * 2 + TEST_PACKET0,
+    };
+    expectStatsEqual(totalValue, totalResult);
 }
 
 TEST_F(BpfNetworkStatsHelperTest, TestGetStatsDetail) {
-    uint32_t ifaceIndex = updateIfaceMap(IFACE_NAME);
+    updateIfaceMap(IFACE_NAME1, IFACE_INDEX1);
+    updateIfaceMap(IFACE_NAME2, IFACE_INDEX2);
     StatsValue value1 = {.rxBytes = TEST_BYTES0,
                          .rxPackets = TEST_PACKET0,
                          .txBytes = TEST_BYTES1,
                          .txPackets = TEST_PACKET1,};
-    populateFakeStats(TEST_UID1, TEST_TAG, ifaceIndex, TEST_COUNTERSET0, &value1, mFakeTagStatsMap);
-    populateFakeStats(TEST_UID1, TEST_TAG, ifaceIndex + 1, TEST_COUNTERSET0, &value1,
+    populateFakeStats(TEST_UID1, TEST_TAG, IFACE_INDEX1, TEST_COUNTERSET0, &value1,
                       mFakeTagStatsMap);
-    populateFakeStats(TEST_UID1, TEST_TAG + 1, ifaceIndex, TEST_COUNTERSET0, &value1,
+    populateFakeStats(TEST_UID1, TEST_TAG, IFACE_INDEX2, TEST_COUNTERSET0, &value1,
                       mFakeTagStatsMap);
-    populateFakeStats(TEST_UID2, TEST_TAG, ifaceIndex, TEST_COUNTERSET0, &value1, mFakeTagStatsMap);
+    populateFakeStats(TEST_UID1, TEST_TAG + 1, IFACE_INDEX1, TEST_COUNTERSET0, &value1,
+                      mFakeTagStatsMap);
+    populateFakeStats(TEST_UID2, TEST_TAG, IFACE_INDEX1, TEST_COUNTERSET0, &value1,
+                      mFakeTagStatsMap);
     std::vector<stats_line> lines;
     std::vector<std::string> ifaces;
     ASSERT_EQ(0, parseBpfNetworkStatsDetailInternal(&lines, ifaces, TAG_ALL, UID_ALL,
                                                     mFakeTagStatsMap, mFakeIfaceIndexNameMap));
-    ASSERT_EQ((unsigned long)3, lines.size());
+    ASSERT_EQ((unsigned long)4, lines.size());
     lines.clear();
     ASSERT_EQ(0, parseBpfNetworkStatsDetailInternal(&lines, ifaces, TAG_ALL, TEST_UID1,
                                                     mFakeTagStatsMap, mFakeIfaceIndexNameMap));
+    ASSERT_EQ((unsigned long)3, lines.size());
+    lines.clear();
+    ASSERT_EQ(0, parseBpfNetworkStatsDetailInternal(&lines, ifaces, TEST_TAG, TEST_UID1,
+                                                    mFakeTagStatsMap, mFakeIfaceIndexNameMap));
     ASSERT_EQ((unsigned long)2, lines.size());
     lines.clear();
+    ifaces.push_back(std::string(IFACE_NAME1));
     ASSERT_EQ(0, parseBpfNetworkStatsDetailInternal(&lines, ifaces, TEST_TAG, TEST_UID1,
                                                     mFakeTagStatsMap, mFakeIfaceIndexNameMap));
     ASSERT_EQ((unsigned long)1, lines.size());
-    lines.clear();
-    ifaces.push_back(std::string(IFACE_NAME));
-    ASSERT_EQ(0, parseBpfNetworkStatsDetailInternal(&lines, ifaces, TEST_TAG, TEST_UID1,
-                                                    mFakeTagStatsMap, mFakeIfaceIndexNameMap));
-    ASSERT_EQ((unsigned long)1, lines.size());
+    expectStatsLineEqual(value1, IFACE_NAME1, TEST_UID1, TEST_COUNTERSET0, TEST_TAG, lines.front());
 }
 
 TEST_F(BpfNetworkStatsHelperTest, TestGetStatsWithSkippedIface) {
-    uint32_t ifaceIndex = updateIfaceMap(IFACE_NAME);
+    updateIfaceMap(IFACE_NAME1, IFACE_INDEX1);
+    updateIfaceMap(IFACE_NAME2, IFACE_INDEX2);
     StatsValue value1 = {.rxBytes = TEST_BYTES0,
                          .rxPackets = TEST_PACKET0,
                          .txBytes = TEST_BYTES1,
                          .txPackets = TEST_PACKET1,};
     populateFakeStats(0, 0, 0, COUNTERSETS_LIMIT, &value1, mFakeUidStatsMap);
-    populateFakeStats(TEST_UID1, 0, ifaceIndex, TEST_COUNTERSET0, &value1, mFakeUidStatsMap);
-    populateFakeStats(TEST_UID1, 0, ifaceIndex + 1, TEST_COUNTERSET0, &value1, mFakeUidStatsMap);
-    populateFakeStats(TEST_UID1, 0, ifaceIndex, TEST_COUNTERSET1, &value1, mFakeUidStatsMap);
-    populateFakeStats(TEST_UID2, 0, ifaceIndex, TEST_COUNTERSET0, &value1, mFakeUidStatsMap);
+    populateFakeStats(TEST_UID1, 0, IFACE_INDEX1, TEST_COUNTERSET0, &value1, mFakeUidStatsMap);
+    populateFakeStats(TEST_UID1, 0, IFACE_INDEX2, TEST_COUNTERSET0, &value1, mFakeUidStatsMap);
+    populateFakeStats(TEST_UID1, 0, IFACE_INDEX1, TEST_COUNTERSET1, &value1, mFakeUidStatsMap);
+    populateFakeStats(TEST_UID2, 0, IFACE_INDEX1, TEST_COUNTERSET0, &value1, mFakeUidStatsMap);
     std::vector<stats_line> lines;
     std::vector<std::string> ifaces;
     ASSERT_EQ(0, parseBpfNetworkStatsDetailInternal(&lines, ifaces, TAG_ALL, UID_ALL,
                                                     mFakeUidStatsMap, mFakeIfaceIndexNameMap));
-    ASSERT_EQ((unsigned long)3, lines.size());
+    ASSERT_EQ((unsigned long)4, lines.size());
     lines.clear();
     ASSERT_EQ(0, parseBpfNetworkStatsDetailInternal(&lines, ifaces, TAG_ALL, TEST_UID1,
                                                     mFakeUidStatsMap, mFakeIfaceIndexNameMap));
-    ASSERT_EQ((unsigned long)2, lines.size());
+    ASSERT_EQ((unsigned long)3, lines.size());
     lines.clear();
     ASSERT_EQ(0, parseBpfNetworkStatsDetailInternal(&lines, ifaces, TAG_ALL, TEST_UID2,
                                                     mFakeUidStatsMap, mFakeIfaceIndexNameMap));
     ASSERT_EQ((unsigned long)1, lines.size());
+    expectStatsLineEqual(value1, IFACE_NAME1, TEST_UID2, TEST_COUNTERSET0, 0, lines.front());
     lines.clear();
-    ifaces.push_back(std::string(IFACE_NAME));
+    ifaces.push_back(std::string(IFACE_NAME1));
     ASSERT_EQ(0, parseBpfNetworkStatsDetailInternal(&lines, ifaces, TAG_ALL, TEST_UID1,
                                                     mFakeUidStatsMap, mFakeIfaceIndexNameMap));
     ASSERT_EQ((unsigned long)2, lines.size());
 }
 
 TEST_F(BpfNetworkStatsHelperTest, TestGetStatsWithNoExistKey) {
-    uint32_t ifaceIndex = updateIfaceMap(IFACE_NAME);
+    updateIfaceMap(IFACE_NAME1, IFACE_INDEX1);
     StatsValue value1 = {
         .rxBytes = TEST_BYTES0,
         .rxPackets = TEST_PACKET0,
@@ -292,7 +334,7 @@
         .txPackets = TEST_PACKET1,
     };
     populateFakeStats(DEFAULT_OVERFLOWUID, 0, 0, 0, &value1, mFakeUidStatsMap);
-    populateFakeStats(TEST_UID1, 0, ifaceIndex, TEST_COUNTERSET0, &value1, mFakeUidStatsMap);
+    populateFakeStats(TEST_UID1, 0, IFACE_INDEX1, TEST_COUNTERSET0, &value1, mFakeUidStatsMap);
     std::vector<stats_line> lines;
     std::vector<std::string> ifaces;
     ASSERT_EQ(-EUCLEAN,
@@ -301,21 +343,39 @@
 }
 
 TEST_F(BpfNetworkStatsHelperTest, TestUnkownIfaceError) {
+    updateIfaceMap(IFACE_NAME1, IFACE_INDEX1);
     StatsValue value1 = {.rxBytes = TEST_BYTES0 * 20,
                          .rxPackets = TEST_PACKET0,
                          .txBytes = TEST_BYTES1 * 20,
                          .txPackets = TEST_PACKET1,};
     uint32_t ifaceIndex = UNKNOWN_IFACE;
     populateFakeStats(TEST_UID1, 0, ifaceIndex, TEST_COUNTERSET0, &value1, mFakeUidStatsMap);
+    populateFakeStats(TEST_UID1, 0, IFACE_INDEX1, TEST_COUNTERSET0, &value1, mFakeUidStatsMap);
+    StatsValue value2 = {.rxBytes = TEST_BYTES0 * 40,
+                         .rxPackets = TEST_PACKET0,
+                         .txBytes = TEST_BYTES1 * 40,
+                         .txPackets = TEST_PACKET1,};
+    populateFakeStats(TEST_UID1, 0, IFACE_INDEX2, TEST_COUNTERSET0, &value2, mFakeUidStatsMap);
     StatsKey curKey = {.uid = TEST_UID1,
                        .tag = 0,
                        .ifaceIndex = ifaceIndex,
                        .counterSet = TEST_COUNTERSET0};
     char ifname[IFNAMSIZ];
-    uint64_t unknownIfaceBytesTotal = 0;
-    ASSERT_EQ(-ENODEV, getIfaceNameFromMap(mFakeIfaceIndexNameMap, mFakeUidStatsMap, ifname, curKey,
-                                     &unknownIfaceBytesTotal));
-    ASSERT_LE((TEST_BYTES0 * 20 + TEST_BYTES1 * 20), unknownIfaceBytesTotal);
+    int64_t unknownIfaceBytesTotal = 0;
+    ASSERT_EQ(-ENODEV, getIfaceNameFromMap(mFakeIfaceIndexNameMap, mFakeUidStatsMap, ifaceIndex,
+                                           ifname, &curKey, &unknownIfaceBytesTotal));
+    ASSERT_EQ(((int64_t)(TEST_BYTES0 * 20 + TEST_BYTES1 * 20)), unknownIfaceBytesTotal);
+    curKey.ifaceIndex = IFACE_INDEX2;
+    ASSERT_EQ(-ENODEV, getIfaceNameFromMap(mFakeIfaceIndexNameMap, mFakeUidStatsMap, ifaceIndex,
+                                           ifname, &curKey, &unknownIfaceBytesTotal));
+    ASSERT_EQ(-1, unknownIfaceBytesTotal);
+    std::vector<stats_line> lines;
+    std::vector<std::string> ifaces;
+    // TODO: find a way to test the total of unknown Iface Bytes go above limit.
+    ASSERT_EQ(0, parseBpfNetworkStatsDetailInternal(&lines, ifaces, TAG_ALL, UID_ALL,
+                                                    mFakeUidStatsMap, mFakeIfaceIndexNameMap));
+    ASSERT_EQ((unsigned long)1, lines.size());
+    expectStatsLineEqual(value1, IFACE_NAME1, TEST_UID1, TEST_COUNTERSET0, 0, lines.front());
 }
 
 }  // namespace bpf
diff --git a/libbpf/include/bpf/BpfNetworkStats.h b/libbpf/include/bpf/BpfNetworkStats.h
index 4a9241f..db0c185 100644
--- a/libbpf/include/bpf/BpfNetworkStats.h
+++ b/libbpf/include/bpf/BpfNetworkStats.h
@@ -39,7 +39,9 @@
 // For test only
 int bpfGetUidStatsInternal(uid_t uid, struct Stats* stats, const base::unique_fd& map_fd);
 // For test only
-int bpfGetIfaceStatsInternal(const char* iface, struct Stats* stats, const char* file);
+int bpfGetIfaceStatsInternal(const char* iface, Stats* stats,
+                             const base::unique_fd& ifaceStatsMapFd,
+                             const base::unique_fd& ifaceNameMapFd);
 // For test only
 int parseBpfNetworkStatsDetailInternal(std::vector<stats_line>* lines,
                                        const std::vector<std::string>& limitIfaces, int limitTag,
@@ -49,7 +51,8 @@
 int cleanStatsMapInternal(const base::unique_fd& cookieTagMap, const base::unique_fd& tagStatsMap);
 // For test only
 int getIfaceNameFromMap(const base::unique_fd& ifaceMapFd, const base::unique_fd& statsMapFd,
-                        char *ifname, struct StatsKey &curKey, uint64_t *unknownIfaceBytesTotal);
+                        uint32_t ifaceIndex, char* ifname, void* curKey,
+                        int64_t* unknownIfaceBytesTotal);
 
 int bpfGetUidStats(uid_t uid, struct Stats* stats);
 int bpfGetIfaceStats(const char* iface, struct Stats* stats);