diff --git a/bpf/progs/clatd.c b/bpf/progs/clatd.c index 7f128dbde6..017d742fb6 100644 --- a/bpf/progs/clatd.c +++ b/bpf/progs/clatd.c @@ -247,29 +247,29 @@ static inline __always_inline int nat64(struct __sk_buff* skb, return TC_ACT_PIPE; } -DEFINE_BPF_PROG_KVER(schedcls, ingress6_clat_ether, 4_14, AID_ROOT, AID_SYSTEM, KVER_4_14) +DEFINE_BPF_PROG_KVER(schedcls, ingress6_clat_ether, 4_14, AID_SYSTEM, 4_14) (struct __sk_buff* skb) { return nat64(skb, ETHER, KVER_4_14); } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, ingress6_clat_ether, 4_9, AID_ROOT, AID_SYSTEM, KVER_NONE, KVER_4_14) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, ingress6_clat_ether, 4_9, AID_SYSTEM, 4_9, 4_14) (struct __sk_buff* skb) { - return nat64(skb, ETHER, KVER_NONE); + return nat64(skb, ETHER, KVER_4_9); } -DEFINE_BPF_PROG_KVER(schedcls, ingress6_clat_rawip, 4_14, AID_ROOT, AID_SYSTEM, KVER_4_14) +DEFINE_BPF_PROG_KVER(schedcls, ingress6_clat_rawip, 4_14, AID_SYSTEM, 4_14) (struct __sk_buff* skb) { return nat64(skb, RAWIP, KVER_4_14); } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, ingress6_clat_rawip, 4_9, AID_ROOT, AID_SYSTEM, KVER_NONE, KVER_4_14) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, ingress6_clat_rawip, 4_9, AID_SYSTEM, 4_9, 4_14) (struct __sk_buff* skb) { - return nat64(skb, RAWIP, KVER_NONE); + return nat64(skb, RAWIP, KVER_4_9); } DEFINE_BPF_MAP_GRW(clat_egress4_map, HASH, ClatEgress4Key, ClatEgress4Value, 16, AID_SYSTEM) -DEFINE_BPF_PROG(schedcls, egress4_clat_rawip, , AID_ROOT, AID_SYSTEM) +DEFINE_BPF_PROG(schedcls, egress4_clat_rawip, , AID_SYSTEM) (struct __sk_buff* skb) { // Must be meta-ethernet IPv4 frame if (skb->protocol != htons(ETH_P_IP)) return TC_ACT_PIPE; diff --git a/bpf/progs/dscpPolicy.c b/bpf/progs/dscpPolicy.c index 2b11e5c12a..8b98b78a3c 100644 --- a/bpf/progs/dscpPolicy.c +++ b/bpf/progs/dscpPolicy.c @@ -264,7 +264,7 @@ static inline __always_inline void match_policy(struct __sk_buff* skb, const boo return; } -DEFINE_BPF_PROG_KVER(schedcls, set_dscp_ether, , AID_ROOT, AID_SYSTEM, KVER_5_15) +DEFINE_BPF_PROG_KVER(schedcls, set_dscp_ether, , AID_SYSTEM, 5_15) (struct __sk_buff* skb) { if (skb->pkt_type != PACKET_HOST) return TC_ACT_PIPE; diff --git a/bpf/progs/include/bpf_helpers.h b/bpf/progs/include/bpf_helpers.h index ab405c2006..b68ad2bde7 100644 --- a/bpf/progs/include/bpf_helpers.h +++ b/bpf/progs/include/bpf_helpers.h @@ -61,7 +61,6 @@ struct kver_uint { unsigned int kver; }; #define KVER_(v) ((struct kver_uint){ .kver = (v) }) #define KVER(a, b, c) KVER_(((a) << 24) + ((b) << 16) + (c)) -#define KVER_NONE KVER_(0) #define KVER_4_9 KVER(4, 9, 0) #define KVER_4_14 KVER(4, 14, 0) #define KVER_4_19 KVER(4, 19, 0) @@ -371,7 +370,7 @@ static long (*bpf_sk_storage_delete_unsafe) (const void* sk_storage, selinux, pindir, min_loader, max_loader, mapFlags) \ DEFINE_BPF_MAP_BASE(the_map, TYPE, sizeof(KeyType), sizeof(ValueType), \ num_entries, usr, grp, md, selinux, pindir, \ - KVER_NONE, KVER_INF, min_loader, max_loader, mapFlags); \ + KVER_4_9, KVER_INF, min_loader, max_loader, mapFlags); \ DEFINE_LIBBPF_MAP(the_map, TYPE, KeyType, ValueType, num_entries); \ BPF_MAP_ASSERT_OK(BPF_MAP_TYPE_##TYPE, (num_entries), (md)); \ _Static_assert(sizeof(KeyType) < 1024, "aosp/2370288 requires < 1024 byte keys"); \ @@ -540,8 +539,8 @@ static long (*bpf_trace_printk)(const char* fmt, int fmt_size, ...) = (void*) BP .attach_type = BPF_PROG_ATTACH_TYPE_##TYPE, \ .uid = (prog_uid), \ .gid = (prog_gid), \ - .min_kver = (min_kv).kver, \ - .max_kver = (max_kv).kver, \ + .min_kver = (KVER_##min_kv).kver, \ + .max_kver = (KVER_##max_kv).kver, \ .optional = (opt).optional, \ .bpfloader_min_ver = (min_loader), \ .bpfloader_max_ver = (max_loader), \ @@ -552,10 +551,9 @@ static long (*bpf_trace_printk)(const char* fmt, int fmt_size, ...) = (void*) BP SECTION(#TYPE "/" #NAME "$" #VER) \ long TYPE##_##NAME##_##VER -#define DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, max_kv, \ - opt) \ - DEFINE_BPF_PROG_EXT(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, max_kv, \ - BPFLOADER_MIN_VER, BPFLOADER_MAX_VER, opt, \ +#define DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_gid, min_kv, max_kv, opt) \ + DEFINE_BPF_PROG_EXT(TYPE, NAME, VER, AID_ROOT, prog_gid, min_kv, max_kv, \ + BPFLOADER_MIN_VER, BPFLOADER_MAX_VER, opt, \ DEFAULT_BPF_MAP_SELINUX_CONTEXT, DEFAULT_BPF_PIN_SUBDIR) // Programs (here used in the sense of functions/sections) marked optional are allowed to fail @@ -570,25 +568,19 @@ static long (*bpf_trace_printk)(const char* fmt, int fmt_size, ...) = (void*) BP // ie. a non-optional program in a critical .o is mandatory for kernels matching the min/max kver. // programs requiring a kernel version >= min_kv && < max_kv -#define DEFINE_BPF_PROG_KVER_RANGE(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, max_kv) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, max_kv, \ - MANDATORY) -#define DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, max_kv) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, max_kv, \ - OPTIONAL) +#define DEFINE_BPF_PROG_KVER_RANGE(TYPE, NAME, VER, prog_gid, min_kv, max_kv) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_gid, min_kv, max_kv, MANDATORY) +#define DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(TYPE, NAME, VER, prog_gid, min_kv, max_kv) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_gid, min_kv, max_kv, OPTIONAL) // programs requiring a kernel version >= min_kv -#define DEFINE_BPF_PROG_KVER(TYPE, NAME, VER, prog_uid, prog_gid, min_kv) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, KVER_INF, \ - MANDATORY) -#define DEFINE_OPTIONAL_BPF_PROG_KVER(TYPE, NAME, VER, prog_uid, prog_gid, min_kv) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_uid, prog_gid, min_kv, KVER_INF, \ - OPTIONAL) +#define DEFINE_BPF_PROG_KVER(TYPE, NAME, VER, prog_gid, min_kv) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_gid, min_kv, INF, MANDATORY) +#define DEFINE_OPTIONAL_BPF_PROG_KVER(TYPE, NAME, VER, prog_gid, min_kv) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_gid, min_kv, INF, OPTIONAL) // programs with no kernel version requirements -#define DEFINE_BPF_PROG(TYPE, NAME, VER, prog_uid, prog_gid) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_uid, prog_gid, KVER_NONE, KVER_INF, \ - MANDATORY) -#define DEFINE_OPTIONAL_BPF_PROG(TYPE, NAME, VER, prog_uid, prog_gid) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_uid, prog_gid, KVER_NONE, KVER_INF, \ - OPTIONAL) +#define DEFINE_BPF_PROG(TYPE, NAME, VER, prog_gid) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_gid, 4_9, INF, MANDATORY) +#define DEFINE_OPTIONAL_BPF_PROG(TYPE, NAME, VER, prog_gid) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, VER, prog_gid, 4_9, INF, OPTIONAL) diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c index 9c300654b8..f83a306cd0 100644 --- a/bpf/progs/netd.c +++ b/bpf/progs/netd.c @@ -114,7 +114,7 @@ DEFINE_BPF_MAP_EXT(local_net_blocked_uid_map, HASH, uint32_t, bool, -1000, // the kernel acting on behalf of it) must be able to retrieve the pinned program // for the reload to succeed #define DEFINE_XTBPF_PROG(TYPE, NAME, VER) \ - DEFINE_BPF_PROG(TYPE, NAME, VER, AID_ROOT, AID_NET_ADMIN) + DEFINE_BPF_PROG(TYPE, NAME, VER, AID_NET_ADMIN) // programs that need to be usable by netd, but not by netutils_wrappers // (this is because these are currently attached by the mainline provided libnetd_updatable .so @@ -128,20 +128,20 @@ DEFINE_BPF_MAP_EXT(local_net_blocked_uid_map, HASH, uint32_t, bool, -1000, DEFINE_NETD_BPF_PROG_RANGES(TYPE, NAME, VER, minKV, maxKV, BPFLOADER_MIN_VER, BPFLOADER_MAX_VER) #define DEFINE_NETD_BPF_PROG_KVER(TYPE, NAME, VER, min_kv) \ - DEFINE_NETD_BPF_PROG_KVER_RANGE(TYPE, NAME, VER, min_kv, KVER_INF) + DEFINE_NETD_BPF_PROG_KVER_RANGE(TYPE, NAME, VER, min_kv, INF) #define DEFINE_NETD_BPF_PROG(TYPE, NAME, VER) \ - DEFINE_NETD_BPF_PROG_KVER(TYPE, NAME, VER, KVER_NONE) + DEFINE_NETD_BPF_PROG_KVER(TYPE, NAME, VER, 4_9) -#define DEFINE_NETD_V_BPF_PROG_KVER(TYPE, NAME, VER, minKV) \ - DEFINE_BPF_PROG_EXT(TYPE, NAME, VER, AID_ROOT, AID_ROOT, minKV, \ - KVER_INF, BPFLOADER_MAINLINE_V_VERSION, BPFLOADER_MAX_VER, MANDATORY, \ +#define DEFINE_NETD_V_BPF_PROG_KVER(TYPE, NAME, VER, minKV) \ + DEFINE_BPF_PROG_EXT(TYPE, NAME, VER, AID_ROOT, AID_ROOT, minKV, INF, \ + BPFLOADER_MAINLINE_V_VERSION, BPFLOADER_MAX_VER, MANDATORY, \ "netd_readonly", DEFAULT_BPF_PIN_SUBDIR) // programs that only need to be usable by the system server #define DEFINE_SYS_BPF_PROG(TYPE, NAME, VER) \ - DEFINE_BPF_PROG_EXT(TYPE, NAME, VER, AID_ROOT, AID_NET_ADMIN, KVER_NONE, KVER_INF, \ - BPFLOADER_MIN_VER, BPFLOADER_MAX_VER, MANDATORY, \ + DEFINE_BPF_PROG_EXT(TYPE, NAME, VER, AID_ROOT, AID_NET_ADMIN, 4_9, INF, \ + BPFLOADER_MIN_VER, BPFLOADER_MAX_VER, MANDATORY, \ "net_shared", DEFAULT_BPF_PIN_SUBDIR) /* @@ -608,83 +608,83 @@ static __always_inline inline int bpf_traffic_account(struct __sk_buff* skb, // ----- cgroupskb/ingress/stats ----- // Android 25Q2+ 5.10+ (localnet protection + tracing) -DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, ingress_stats, 5_10_25q2, KVER_5_10, KVER_INF, +DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, ingress_stats, 5_10_25q2, 5_10, INF, BPFLOADER_MAINLINE_25Q2_VERSION, BPFLOADER_MAX_VER) (struct __sk_buff* skb) { return bpf_traffic_account(skb, INGRESS, KVER_5_10, SDK_LEVEL_25Q2); } // Android 25Q2+ 5.4 (localnet protection) -DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, ingress_stats, 5_4_25q2, KVER_5_4, KVER_5_10, +DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, ingress_stats, 5_4_25q2, 5_4, 5_10, BPFLOADER_MAINLINE_25Q2_VERSION, BPFLOADER_MAX_VER) (struct __sk_buff* skb) { return bpf_traffic_account(skb, INGRESS, KVER_5_4, SDK_LEVEL_25Q2); } // Android U/V 5.10+ (tracing) -DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, ingress_stats, 5_10_u, KVER_5_10, KVER_INF, +DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, ingress_stats, 5_10_u, 5_10, INF, BPFLOADER_MAINLINE_U_VERSION, BPFLOADER_MAINLINE_25Q2_VERSION) (struct __sk_buff* skb) { return bpf_traffic_account(skb, INGRESS, KVER_5_10, SDK_LEVEL_U); } // Android T/U/V/25Q2 5.4 & T 5.10/5.15 -DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, ingress_stats, 5_4, KVER_5_4, KVER_INF) +DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, ingress_stats, 5_4, 5_4, INF) (struct __sk_buff* skb) { return bpf_traffic_account(skb, INGRESS, KVER_5_4, SDK_LEVEL_T); } // Android T/U/V 4.19 -DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, ingress_stats, 4_19, KVER_4_19, KVER_5_4) +DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, ingress_stats, 4_19, 4_19, 5_4) (struct __sk_buff* skb) { return bpf_traffic_account(skb, INGRESS, KVER_4_19, SDK_LEVEL_T); } // Android T 4.9 & T/U 4.14 -DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, ingress_stats, 4_9, KVER_NONE, KVER_4_19) +DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, ingress_stats, 4_9, 4_9, 4_19) (struct __sk_buff* skb) { - return bpf_traffic_account(skb, INGRESS, KVER_NONE, SDK_LEVEL_T); + return bpf_traffic_account(skb, INGRESS, KVER_4_9, SDK_LEVEL_T); } // ----- cgroupskb/egress/stats ----- // Android 25Q2+ 5.10+ (localnet protection + tracing) -DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, egress_stats, 5_10_25q2, KVER_5_10, KVER_INF, +DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, egress_stats, 5_10_25q2, 5_10, INF, BPFLOADER_MAINLINE_25Q2_VERSION, BPFLOADER_MAX_VER) (struct __sk_buff* skb) { return bpf_traffic_account(skb, EGRESS, KVER_5_10, SDK_LEVEL_25Q2); } // Android 25Q2+ 5.4 (localnet protection) -DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, egress_stats, 5_4_25q2, KVER_5_4, KVER_5_10, +DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, egress_stats, 5_4_25q2, 5_4, 5_10, BPFLOADER_MAINLINE_25Q2_VERSION, BPFLOADER_MAX_VER) (struct __sk_buff* skb) { return bpf_traffic_account(skb, EGRESS, KVER_5_4, SDK_LEVEL_25Q2); } // Android U/V 5.10+ (tracing) -DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, egress_stats, 5_10_u, KVER_5_10, KVER_INF, +DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, egress_stats, 5_10_u, 5_10, INF, BPFLOADER_MAINLINE_U_VERSION, BPFLOADER_MAINLINE_25Q2_VERSION) (struct __sk_buff* skb) { return bpf_traffic_account(skb, EGRESS, KVER_5_10, SDK_LEVEL_U); } // Android T/U/V/25Q2 5.4 & T 5.10/5.15 -DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, egress_stats, 5_4, KVER_5_4, KVER_INF) +DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, egress_stats, 5_4, 5_4, INF) (struct __sk_buff* skb) { return bpf_traffic_account(skb, EGRESS, KVER_5_4, SDK_LEVEL_T); } // Android T/U/V 4.19 -DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, egress_stats, 4_19, KVER_4_19, KVER_5_4) +DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, egress_stats, 4_19, 4_19, 5_4) (struct __sk_buff* skb) { return bpf_traffic_account(skb, EGRESS, KVER_4_19, SDK_LEVEL_T); } // Android T 4.9 & T/U 4.14 -DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, egress_stats, 4_9, KVER_NONE, KVER_4_19) +DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, egress_stats, 4_9, 4_9, 4_19) (struct __sk_buff* skb) { - return bpf_traffic_account(skb, EGRESS, KVER_NONE, SDK_LEVEL_T); + return bpf_traffic_account(skb, EGRESS, KVER_4_9, SDK_LEVEL_T); } // ----- @@ -704,7 +704,7 @@ DEFINE_XTBPF_PROG(skfilter, egress_xtbpf, ) } uint32_t key = skb->ifindex; - update_iface_stats_map(skb, &key, EGRESS, KVER_NONE); + update_iface_stats_map(skb, &key, EGRESS, KVER_4_9); return XTBPF_MATCH; } @@ -717,7 +717,7 @@ DEFINE_XTBPF_PROG(skfilter, ingress_xtbpf, ) // Keep that in mind when moving this out of iptables xt_bpf and into tc ingress (or xdp). uint32_t key = skb->ifindex; - update_iface_stats_map(skb, &key, INGRESS, KVER_NONE); + update_iface_stats_map(skb, &key, INGRESS, KVER_4_9); return XTBPF_MATCH; } @@ -726,7 +726,7 @@ DEFINE_SYS_BPF_PROG(schedact, ingress_account, ) if (is_received_skb(skb)) { // Account for ingress traffic before tc drops it. uint32_t key = skb->ifindex; - update_iface_stats_map(skb, &key, INGRESS, KVER_NONE); + update_iface_stats_map(skb, &key, INGRESS, KVER_4_9); } return TC_ACT_UNSPEC; } @@ -783,17 +783,17 @@ static __always_inline inline int inet_socket_create(struct bpf_sock* sk, return (get_app_permissions() & BPF_PERMISSION_INTERNET) ? BPF_ALLOW : BPF_DISALLOW; } -DEFINE_NETD_BPF_PROG_KVER(cgroupsock, inet_create, 5_10, KVER_5_10) +DEFINE_NETD_BPF_PROG_KVER(cgroupsock, inet_create, 5_10, 5_10) (struct bpf_sock* sk) { return inet_socket_create(sk, KVER_5_10); } -DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupsock, inet_create, 4_14, KVER_4_14, KVER_5_10) +DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupsock, inet_create, 4_14, 4_14, 5_10) (struct bpf_sock* sk) { return inet_socket_create(sk, KVER_4_14); } -DEFINE_NETD_BPF_PROG_KVER(cgroupsockrelease, inet_release, , KVER_5_10) +DEFINE_NETD_BPF_PROG_KVER(cgroupsockrelease, inet_release, , 5_10) (struct bpf_sock* sk) { uint64_t cookie = bpf_get_sk_cookie(sk); if (cookie) bpf_cookie_tag_map_delete_elem(&cookie); @@ -846,47 +846,47 @@ static inline __always_inline int block_port(struct bpf_sock_addr *ctx) { return BPF_ALLOW; } -DEFINE_NETD_BPF_PROG_KVER(bind4, inet4_bind, , KVER_4_19) +DEFINE_NETD_BPF_PROG_KVER(bind4, inet4_bind, , 4_19) (struct bpf_sock_addr *ctx) { return block_port(ctx); } -DEFINE_NETD_BPF_PROG_KVER(bind6, inet6_bind, , KVER_4_19) +DEFINE_NETD_BPF_PROG_KVER(bind6, inet6_bind, , 4_19) (struct bpf_sock_addr *ctx) { return block_port(ctx); } -DEFINE_NETD_V_BPF_PROG_KVER(connect4, inet4_connect, , KVER_4_19) +DEFINE_NETD_V_BPF_PROG_KVER(connect4, inet4_connect, , 4_19) (struct bpf_sock_addr *ctx) { return check_localhost(ctx); } -DEFINE_NETD_V_BPF_PROG_KVER(connect6, inet6_connect, , KVER_4_19) +DEFINE_NETD_V_BPF_PROG_KVER(connect6, inet6_connect, , 4_19) (struct bpf_sock_addr *ctx) { return check_localhost(ctx); } -DEFINE_NETD_V_BPF_PROG_KVER(recvmsg4, udp4_recvmsg, , KVER_4_19) +DEFINE_NETD_V_BPF_PROG_KVER(recvmsg4, udp4_recvmsg, , 4_19) (struct bpf_sock_addr *ctx) { return check_localhost(ctx); } -DEFINE_NETD_V_BPF_PROG_KVER(recvmsg6, udp6_recvmsg, , KVER_4_19) +DEFINE_NETD_V_BPF_PROG_KVER(recvmsg6, udp6_recvmsg, , 4_19) (struct bpf_sock_addr *ctx) { return check_localhost(ctx); } -DEFINE_NETD_V_BPF_PROG_KVER(sendmsg4, udp4_sendmsg, , KVER_4_19) +DEFINE_NETD_V_BPF_PROG_KVER(sendmsg4, udp4_sendmsg, , 4_19) (struct bpf_sock_addr *ctx) { return check_localhost(ctx); } -DEFINE_NETD_V_BPF_PROG_KVER(sendmsg6, udp6_sendmsg, , KVER_4_19) +DEFINE_NETD_V_BPF_PROG_KVER(sendmsg6, udp6_sendmsg, , 4_19) (struct bpf_sock_addr *ctx) { return check_localhost(ctx); } -DEFINE_NETD_V_BPF_PROG_KVER(getsockopt, prog, , KVER_5_4) +DEFINE_NETD_V_BPF_PROG_KVER(getsockopt, prog, , 5_4) (struct bpf_sockopt *ctx) { // Tell kernel to return 'original' kernel reply (instead of the bpf modified buffer) // This is important if the answer is larger than PAGE_SIZE (max size this bpf hook can provide) @@ -894,7 +894,7 @@ DEFINE_NETD_V_BPF_PROG_KVER(getsockopt, prog, , KVER_5_4) return BPF_ALLOW; } -DEFINE_NETD_V_BPF_PROG_KVER(setsockopt, prog, , KVER_5_4) +DEFINE_NETD_V_BPF_PROG_KVER(setsockopt, prog, , 5_4) (struct bpf_sockopt *ctx) { // Tell kernel to use/process original buffer provided by userspace. // This is important if it is larger than PAGE_SIZE (max size this bpf hook can handle). diff --git a/bpf/progs/offload.c b/bpf/progs/offload.c index 51221064d1..4e82d019fd 100644 --- a/bpf/progs/offload.c +++ b/bpf/progs/offload.c @@ -257,29 +257,25 @@ static inline __always_inline int do_forward6(struct __sk_buff* skb, } // implementation for 5.4+ (can use skb->gso_{segs,size}) -DEFINE_BPF_PROG_KVER(schedcls, tether_downstream6_ether, 5_4, AID_ROOT, AID_NETWORK_STACK, - KVER_5_4) +DEFINE_BPF_PROG_KVER(schedcls, tether_downstream6_ether, 5_4, AID_NETWORK_STACK, 5_4) (struct __sk_buff* skb) { return do_forward6(skb, ETHER, DOWNSTREAM, KVER_5_4); } -DEFINE_BPF_PROG_KVER(schedcls, tether_upstream6_ether, 5_4, AID_ROOT, AID_NETWORK_STACK, - KVER_5_4) +DEFINE_BPF_PROG_KVER(schedcls, tether_upstream6_ether, 5_4, AID_NETWORK_STACK, 5_4) (struct __sk_buff* skb) { return do_forward6(skb, ETHER, UPSTREAM, KVER_5_4); } // implementation for 4.9/4.14/4.19 -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream6_ether, , AID_ROOT, AID_NETWORK_STACK, - KVER_NONE, KVER_5_4) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream6_ether, , AID_NETWORK_STACK, 4_9, 5_4) (struct __sk_buff* skb) { - return do_forward6(skb, ETHER, DOWNSTREAM, KVER_NONE); + return do_forward6(skb, ETHER, DOWNSTREAM, KVER_4_9); } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream6_ether, , AID_ROOT, AID_NETWORK_STACK, - KVER_NONE, KVER_5_4) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream6_ether, , AID_NETWORK_STACK, 4_9, 5_4) (struct __sk_buff* skb) { - return do_forward6(skb, ETHER, UPSTREAM, KVER_NONE); + return do_forward6(skb, ETHER, UPSTREAM, KVER_4_9); } // Note: section names must be unique to prevent programs from appending to each other, @@ -296,40 +292,34 @@ DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream6_ether, , AID_ROOT, AID_NET // and in system/netd/tests/binder_test.cpp NetdBinderTest TetherOffloadForwarding. // // Hence, these mandatory (must load successfully) implementations for 5.4+ kernels: -DEFINE_BPF_PROG_KVER(schedcls, tether_downstream6_rawip, 5_4, AID_ROOT, AID_NETWORK_STACK, - KVER_5_4) +DEFINE_BPF_PROG_KVER(schedcls, tether_downstream6_rawip, 5_4, AID_NETWORK_STACK, 5_4) (struct __sk_buff* skb) { return do_forward6(skb, RAWIP, DOWNSTREAM, KVER_5_4); } -DEFINE_BPF_PROG_KVER(schedcls, tether_upstream6_rawip, 5_4, AID_ROOT, AID_NETWORK_STACK, - KVER_5_4) +DEFINE_BPF_PROG_KVER(schedcls, tether_upstream6_rawip, 5_4, AID_NETWORK_STACK, 5_4) (struct __sk_buff* skb) { return do_forward6(skb, RAWIP, UPSTREAM, KVER_5_4); } // and for 4.14/4.19 kernels -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream6_rawip, 4_14, AID_ROOT, AID_NETWORK_STACK, - KVER_4_14, KVER_5_4) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream6_rawip, 4_14, AID_NETWORK_STACK, 4_14, 5_4) (struct __sk_buff* skb) { return do_forward6(skb, RAWIP, DOWNSTREAM, KVER_4_14); } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream6_rawip, 4_14, AID_ROOT, AID_NETWORK_STACK, - KVER_4_14, KVER_5_4) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream6_rawip, 4_14, AID_NETWORK_STACK, 4_14, 5_4) (struct __sk_buff* skb) { return do_forward6(skb, RAWIP, UPSTREAM, KVER_4_14); } // and define no-op stubs for pre-4.14 kernels. -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream6_rawip, stub, AID_ROOT, AID_NETWORK_STACK, - KVER_NONE, KVER_4_14) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream6_rawip, stub, AID_NETWORK_STACK, 4_9, 4_14) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream6_rawip, stub, AID_ROOT, AID_NETWORK_STACK, - KVER_NONE, KVER_4_14) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream6_rawip, stub, AID_NETWORK_STACK, 4_9, 4_14) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; } @@ -644,26 +634,22 @@ static inline __always_inline int do_forward4(struct __sk_buff* skb, // Full featured (required) implementations for 5.10+ kernels (these are S+ by definition) -DEFINE_BPF_PROG_KVER(schedcls, tether_downstream4_rawip, 5_10, AID_ROOT, AID_NETWORK_STACK, - KVER_5_10) +DEFINE_BPF_PROG_KVER(schedcls, tether_downstream4_rawip, 5_10, AID_NETWORK_STACK, 5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, DOWNSTREAM, UPDATETIME, KVER_5_10); } -DEFINE_BPF_PROG_KVER(schedcls, tether_upstream4_rawip, 5_10, AID_ROOT, AID_NETWORK_STACK, - KVER_5_10) +DEFINE_BPF_PROG_KVER(schedcls, tether_upstream4_rawip, 5_10, AID_NETWORK_STACK, 5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, UPSTREAM, UPDATETIME, KVER_5_10); } -DEFINE_BPF_PROG_KVER(schedcls, tether_downstream4_ether, 5_10, AID_ROOT, AID_NETWORK_STACK, - KVER_5_10) +DEFINE_BPF_PROG_KVER(schedcls, tether_downstream4_ether, 5_10, AID_NETWORK_STACK, 5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, DOWNSTREAM, UPDATETIME, KVER_5_10); } -DEFINE_BPF_PROG_KVER(schedcls, tether_upstream4_ether, 5_10, AID_ROOT, AID_NETWORK_STACK, - KVER_5_10) +DEFINE_BPF_PROG_KVER(schedcls, tether_upstream4_ether, 5_10, AID_NETWORK_STACK, 5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, UPSTREAM, UPDATETIME, KVER_5_10); } @@ -672,25 +658,25 @@ DEFINE_BPF_PROG_KVER(schedcls, tether_upstream4_ether, 5_10, AID_ROOT, AID_NETWO // (optional, because we need to be able to fallback for 5.4 pre-S kernels) DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_rawip, opt54, - AID_ROOT, AID_NETWORK_STACK, KVER_5_4, KVER_5_10) + AID_NETWORK_STACK, 5_4, 5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, DOWNSTREAM, UPDATETIME, KVER_5_4); } DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, opt54, - AID_ROOT, AID_NETWORK_STACK, KVER_5_4, KVER_5_10) + AID_NETWORK_STACK, 5_4, 5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, UPSTREAM, UPDATETIME, KVER_5_4); } DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_ether, opt54, - AID_ROOT, AID_NETWORK_STACK, KVER_5_4, KVER_5_10) + AID_NETWORK_STACK, 5_4, 5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, DOWNSTREAM, UPDATETIME, KVER_5_4); } DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, opt54, - AID_ROOT, AID_NETWORK_STACK, KVER_5_4, KVER_5_10) + AID_NETWORK_STACK, 5_4, 5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, UPSTREAM, UPDATETIME, KVER_5_4); } @@ -699,25 +685,25 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, opt54, // (optional, because we need to be able to fallback for 4.14/4.19 pre-S kernels) DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_rawip, opt, - AID_ROOT, AID_NETWORK_STACK, KVER_4_14, KVER_5_4) + AID_NETWORK_STACK, 4_14, 5_4) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, DOWNSTREAM, UPDATETIME, KVER_4_14); } DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, opt, - AID_ROOT, AID_NETWORK_STACK, KVER_4_14, KVER_5_4) + AID_NETWORK_STACK, 4_14, 5_4) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, UPSTREAM, UPDATETIME, KVER_4_14); } DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_ether, opt, - AID_ROOT, AID_NETWORK_STACK, KVER_4_14, KVER_5_4) + AID_NETWORK_STACK, 4_14, 5_4) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, DOWNSTREAM, UPDATETIME, KVER_4_14); } DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, opt, - AID_ROOT, AID_NETWORK_STACK, KVER_4_14, KVER_5_4) + AID_NETWORK_STACK, 4_14, 5_4) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, UPSTREAM, UPDATETIME, KVER_4_14); } @@ -736,14 +722,12 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, opt, // RAWIP: Required for 5.4-R kernels -- which always support bpf_skb_change_head(). -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_rawip, 5_4, AID_ROOT, AID_NETWORK_STACK, - KVER_5_4, KVER_5_10) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_rawip, 5_4, AID_NETWORK_STACK, 5_4, 5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, DOWNSTREAM, NO_UPDATETIME, KVER_5_4); } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, 5_4, AID_ROOT, AID_NETWORK_STACK, - KVER_5_4, KVER_5_10) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, 5_4, AID_NETWORK_STACK, 5_4, 5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, UPSTREAM, NO_UPDATETIME, KVER_5_4); } @@ -752,27 +736,25 @@ DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, 5_4, AID_ROOT, AID_ // [Note: fallback for 4.14/4.19 (P/Q) kernels is below in stub section] DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_rawip, 4_14, - AID_ROOT, AID_NETWORK_STACK, KVER_4_14, KVER_5_4) + AID_NETWORK_STACK, 4_14, 5_4) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, DOWNSTREAM, NO_UPDATETIME, KVER_4_14); } DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, 4_14, - AID_ROOT, AID_NETWORK_STACK, KVER_4_14, KVER_5_4) + AID_NETWORK_STACK, 4_14, 5_4) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, UPSTREAM, NO_UPDATETIME, KVER_4_14); } // ETHER: Required for 4.14-Q/R, 4.19-Q/R & 5.4-R kernels. -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_ether, 4_14, AID_ROOT, AID_NETWORK_STACK, - KVER_4_14, KVER_5_10) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_ether, 4_14, AID_NETWORK_STACK, 4_14, 5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, DOWNSTREAM, NO_UPDATETIME, KVER_4_14); } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, 4_14, AID_ROOT, AID_NETWORK_STACK, - KVER_4_14, KVER_5_10) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, 4_14, AID_NETWORK_STACK, 4_14, 5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, UPSTREAM, NO_UPDATETIME, KVER_4_14); } @@ -781,28 +763,24 @@ DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, 4_14, AID_ROOT, AID // RAWIP: 4.9-P/Q, 4.14-P/Q & 4.19-Q kernels -- without bpf_skb_change_head() for tc programs -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_rawip, stub, AID_ROOT, AID_NETWORK_STACK, - KVER_NONE, KVER_5_4) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_rawip, stub, AID_NETWORK_STACK, 4_9, 5_4) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, stub, AID_ROOT, AID_NETWORK_STACK, - KVER_NONE, KVER_5_4) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_rawip, stub, AID_NETWORK_STACK, 4_9, 5_4) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; } // ETHER: 4.9-P/Q kernel -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_ether, stub, AID_ROOT, AID_NETWORK_STACK, - KVER_NONE, KVER_4_14) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_downstream4_ether, stub, AID_NETWORK_STACK, 4_9, 4_14) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; } -DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, stub, AID_ROOT, AID_NETWORK_STACK, - KVER_NONE, KVER_4_14) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, tether_upstream4_ether, stub, AID_NETWORK_STACK, 4_9, 4_14) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; }