Only the non-CRITICAL test@mainline.o is loaded from netbpfload
on T and U < QPR3, everything else is loaded by platform bpfloader
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ic07a57cf93851d3a1411b62c97d8ce057507360b
As requested by Patrick on http://go/aog/3132975
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ie49426c5e8c19bd0329e93c78a0918ca1120f164
it doesn't work due to sepolicy anyway:
I auditd : type=1400 audit(0.0:6): avc: denied { search } for comm="netbpfload" name="gsi" dev="sda8" ino=23 scontext=u:r:bpfloader:s0 tcontext=u:object_r:gsi_metadata_file:s0 tclass=dir permissive=0
Bug: 347309609
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ic8c56a096a89a89950585b939379634accb78e56
aosp/main is currently still sdk 34/U, and netbpfload
runs as root (like on U QPR3 and V) which makes us treat
it as U QPR3.
This change will make us treat it as 35/V.
This will also potentially result in us already seeing
sdk 36 in places (goog/main?), but this won't currently hurt
(because we don't distinguish anything >=35).
And indeed it likely won't ever hurt us, as too high
a version on dev branches (goog/main?) is unlikely
to be a practical problem.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I318df93e5b3a06af2ee2c6ab1cb40d8a8dffa212
Note that 'true iff U QPR3 or V+' comment is subtle.
netbpfload.35rc runs netbpfload as 'root' uid, so V+ is obvious.
However, netbpfload.33rc runs netbpfload as 'system' uid, so one
would think that this isn't true on T/U.
However the U QPR2 and U QPR3 'service bpfloader' actually run
platform netbpfload, and the U QPR3 platform netbpfload immediately
executes the apex provided netbpfload...
Once the apex netbpfload finishes mainline init is considered
'done', and thus we won't (need to) start service mdnsd_netbpfload.
As a result even on U QPR3, we never run netbpfload as system uid.
Test: TreeHugger
Change-Id: I02661dff07c317394a9d8ba3d48e4cb9cd694fd0
Signed-off-by: Maciej Żenczykowski <maze@google.com>
since this is dynamic, it seems like a useful thing to log
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I073e76ab54b4f2182c9b5c2b128425a5294ed50a
(and add a few more comments for what access is needed in general)
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I2aa596f4f2d34179bb36360ad1c9a795fbb97d0d
(perhaps a clearer name, especially once we switch what this does)
Test: TreeHugger
Change-Id: I99c811fc357ab0bb3b4065658c9e5e4733689728
Signed-off-by: Maciej Żenczykowski <maze@google.com>
(easier to realize what is happening, and clearer with the also
existing netbpfload.35rc)
Test: TreeHugger
Change-Id: I587aa3d8b846800c7fc93765ecb0acc9715b0521
Signed-off-by: Maciej Żenczykowski <maze@google.com>
This isn't actually useful as it is apparently always just 10000
Test: TreeHugger
Change-Id: Ibf625150ee8f964a386a5e9f15e0552d611ce927
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Mainline netbpfload is mandatory on V+, so it matters little
whether we perform the checks in it, or in BpfHandler
(which runs as part of netd startup via libnetd_updatable.so),
and this avoids the need to reimplement isTV() opt-out.
Bug: 333970930
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I599f2c9d6710f0caa2cd71f0946459d43ddbfc17
Android TV OEMs & vendors are more interested in keeping costs down
rather than keeping networking functional.
Considering this probably mostly affects more advanced networking,
like VPNs and/or network statistics, it may be an acceptable trade off.
Bug: 333970930
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I7bf8d1bbd87b7af4f7c98372b6c1d3d3be62a600
This reverts commit 75caacdd10.
Reason for revert: The policy is already checked in VTS. It seems delaying the boot is out-of-scope for NetBpfLoad.
Change-Id: I12cec43dc2efb90ae35ccda7203317d198054d0e
The previous code would emit these warnings:
packages/modules/Connectivity/netbpfload/loader.cpp:977:52: warning: format specifies type 'int' but the argument has type 'domain' [-Wformat]
976 | ALOGI("prog %s selinux_context [%-32s] -> %d -> '%s' (%s)", name.c_str(),
| ~~
977 | cs[i].prog_def->selinux_context, selinux_context,
| ^~~~~~~~~~~~~~~
| static_cast<int>(
packages/modules/Connectivity/netbpfload/loader.cpp:983:47: warning: format specifies type 'int' but the argument has type 'domain' [-Wformat]
982 | ALOGI("prog %s pin_subdir [%-32s] -> %d -> '%s'", name.c_str(),
| ~~
983 | cs[i].prog_def->pin_subdir, pin_subdir, lookupPinSubdir(pin_subdir));
| ^~~~~~~~~~
| static_cast<int>(
Change-Id: Id4856ad7835de8fea14be543ee0e198bb98f4d35
(such kernels are already in violation of VTS)
I don't quite want to break boot, but I figure a slow
boot will result in devices getting fixed rather than
released with ancient/unsupported/buggy kernels...
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia2cf550f661ce468acbc5ecff0ce5b6fa16b0e3a
Move most spamy logs from ALOGD to ALOGV.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I04d472c363ab77de438ffb9b1227c69aa161f613
Not actually needed, we already log the result.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I8391825cb5171162afb9bdf8fdf695d9f85693cb
The following commit is only in 4.15:
commit cb4d2b3f03d8eed90be3a194e5b54b734ec4bbe9
Author: Martin KaFai Lau <kafai@fb.com>
Date: Wed Sep 27 14:37:52 2017 -0700
bpf: Add name, load_time, uid and map_ids to bpf_prog_info
$ git describe cb4d2b3f03d8eed90be3a194e5b54b734ec4bbe9
v4.14-rc1-661-gcb4d2b3f03d8
Bug: 335390828
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I246a7a8640bea1e939f12f3ffd3fedc25a0a6422
instead of using 'NetBpfLoad' from NetBpfLoad.cpp
and 'NetBpfLoader' from loader.cpp
This will make it easier to filter logcat.
Test: N/A
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ibd4e0b04592e8b41cde651c5596ce84bd8893c19
r.android.com/3005052 changed the user id of the bpfloader service to
system, which cut off its access to /dev/kmsg, resulting in its logs
silently being dropped. Give back its access to /dev/kmsg.
See //system/core/init/README.md:
file <path> <type>
Open a file path and pass its fd to the launched process. type must be "r", "w" or "rw". For native executables see libcutils android_get_control_file().
and //system/libbase/logging.cpp's OpenKmsg()
Test: boot sdk_phone64_x86_64, check logs
Change-Id: I65f00545400140983737f3ff92e2c912eebce1fd
(for now for better testing we don't make V special)
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Id2835bd393c0ec9e1710644681bc5aab0d7d2aae
Note:
2 == BPFLOADER_S_VERSION
19 == BPFLOADER_T_VERSION
25 == BPFLOADER_OBJ_AT_VER_VERSION
33 == BPFLOADER_IGNORED_ON_VERSION
37 == BPFLOADER_U_VERSION [*]
41 == BPFLOADER_V_VERSION [**]
and currently we have:
42 == BPFLOADER_MAINLINE_VERSION
43 == BPFLOADER_MAINLINE_T_VERSION
44 == BPFLOADER_MAINLINE_U_VERSION
45 == BPFLOADER_MAINLINE_V_VERSION
[*] udc-dev/udc-release are actually 38, as 37 was some earlier
udc beta2 (2.1 ifirc), and beta3+ switched to 38
[**] 24Q{1,2}-release (ie. U QPR2+) are technically actually 41,
but their platform bpfloader no longer even looks in /apex/com.android.tethering/etc/bpf/...
so it doesn't really matter (although 24Q1's platform
netbpfload still does, however that is obsoleted by
this change)
Thus we need to (as minimum for NetBpfLoad):
BPFLOADER_T_VERSION -> BPFLOADER_MAINLINE_T_VERSION
BPFLOADER_IGNORED_ON_VERSION -> BPFLOADER_MAINLINE_U_VERSION
to cause these to load appropriately from mainline.
One would perhaps also expect (as minimum for NetBpfLoad):
BPFLOADER_OBJ_AT_VERSION -> BPFLOADER_MAINLINE_U_VERSION
but (as maximum for platform bpfloader):
BPFLOADER_OBJ_AT_VERSION -> BPFLOADER_MAINLINE_U_VERSION
However, since the goal is actually for those to load via mainline on T+,
(with the 'old' version of the .o's loading on S via platform bpfloader)
thus one actually needs (as minimum for NetBpfLoad):
BPFLOADER_OBJ_AT_VERSION -> BPFLOADER_MAINLINE_T_VERSION
and (as maximum for platform bpfloader):
BPFLOADER_OBJ_AT_VERSION -> BPFLOADER_T_VERSION
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I4b688692ffca0db7ead20cefd9e7e892ca92c70a
(in preparation for this being run-time dynamic)
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Icac8d1afdd3d55b80c232dd5a124a79a9063f350
cannot happen as it only loads mainline code
that it was built (and tested) along side of.
ie. a failure here would cause a TH boot failure.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia350deb10b4e40c9f4f01ea140a0bf97db508086
(instead of going via platform symlink to it)
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I5ae8105525733788b62f2866fc4eedcce3f51085
(this may well be the last version bump ever)
To get mainline version > any existing platform version.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I20c5dc515b0f94fae2c2fb6f45b6b8907fe7506e
since there is no longer a platform netbpfload...
hence we can simplify
Now:
git grep 'platformNetBpfLoad|apexNetBpfLoad|is_mainline|is_platform'
comes up empty
Test: TreeHugger, manual
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I834656bc4860386b6463db3f6a898d249a05e3a4
This reverts commit e636c61fd7.
Reason for revert: main is now building mainline modules from source
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I0fc96a9eda10deed8f2d014fcb6f12a71ba73571
This reverts commit 7f3d748cef.
Reason for revert: Potential cause for Build failures: b/328408957
Change-Id: I2a1e2375429ce1556362d369a97724c829b5aeb6
