32-bit x86 has a crazy networking calling convention and instead of using
individual system calls has a single multiplexed socketcall()
bionic hasn't finished transitioning to the individual calls yet
which were added to Linux kernels around the 4.10-4.14-ish timeframe.
This does open a bit of security hole, since it effectively allows
all 20-ish networking system calls, but oh well, better than constantly
allowing & logging.
I don't think we'll ever want to enable KILL mode on x86-32 any way.
Test: TreeHugger
Flag: EXEMPT mainline & disabled code
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I7228132cfbf716592607d010f64d5adeeb4419aa
Maciej Żenczykowskicommited 2025-08-05 12:14:42 -07:00
* changes:
NetBpfLoad: remove spurious explicit pin location from pinProg()
bpf: switch progs from using 'pin_prefix' to 'pin_location'
bpf/progs: automate function name determination from prog section name
Maciej Żenczykowskiauthored and Android (Google) Code Reviewcommited 2025-08-05 09:41:19 -07:00
Note: I discovered that C considers:
char s[4] = "abcd";
a valid initialization without a terminating NULL, resulting
in an invalid string.
(Specifically pinned programs had a '\1' as their last char
due to little endian encoding of the next field in the array
of prog def structs)
The simplest workaround appears to be to explicitly add a "\0"
That results in a string/array that ends with 2 NULLs,
and the compiler will at most *strip* the final one.
ie.
char s[4] = "abcd\0";
fails to compile.
Obviously:
char s[100] = "abcd\0";
also does the right thing, since it 0-pads with or without the extra null.
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Iaeb8db2cd4750f8521a971382b9f9f9f216195b2
Maciej Żenczykowskicommited 2025-08-04 18:02:51 -07:00
This is to match upstream kernel include/uapi/linux/bpf.h
Since bpf is 64-bit, so long is the appropriate width type,
and not int which is only 32-bit
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I2685ec1e9e85aab09615d40c6c518b0251308835
Maciej Żenczykowskicommited 2025-08-04 18:00:47 -07:00
BPF is a 64-bit architecture, so this makes more sense:
int is 32-bits, while long is 64-bits.
In practice this doesn't do much, but it does make sure
the top 32-bits of the 64-bit R0 register are well defined.
I think this might matter when we try to introduce function calls,
as per Linux Kernel eBPF uapi we have (for example):
long (*callback_fn)(struct bpf_map *map, const void *key, void *value, void *ctx);
long bpf_for_each_map_elem(struct bpf_map *map, void *callback_fn, void *callback_ctx, u64 flags);
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I0abad90043eff8f8d99c2c29988dd5ce2fef9927
Maciej Żenczykowskicommited 2025-08-04 18:00:47 -07:00
* changes:
NetBpfLoad: make loadObject() return bool
NetBpfLoad: remove comments in loadAllObjects()
NetBpfLoad: make loadAllObjects() return a bool
NetBpfLoad: make loadObject take a fully specified .o path
Treehugger Robotauthored and Android (Google) Code Reviewcommited 2025-08-04 16:06:11 -07:00
in favour of just using the info from the prog definition
which was calculated at compilation time.
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I7542726b4c671177b30f79e90361b2dffdb38ac2
Maciej Żenczykowskicommited 2025-08-04 15:09:29 -07:00
(this matches what we did for maps)
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I2d75fb519f00471a6f1e6b0ffded9f327ecae7b4
Maciej Żenczykowskicommited 2025-08-04 15:07:05 -07:00
This is already documented at:
//packages/modules/Connectivity/bpf/progs/include/bpf_helpers.h
which is the more logical location, since we're trying
to merge all the .o's into 1 per kernel version.
Test: TreeHugger
Flag: EXEMPT mainline/noop
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ibda074ccbbf6efdf36dffd481d953ef38b421637
Maciej Żenczykowskicommited 2025-08-04 14:08:46 -07:00
This gives us access to the program type during compile time.
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Iba6cb294b1c4ea054f7fcd208fcc2355149e00f9
Maciej Żenczykowskicommited 2025-08-04 13:02:06 -07:00
This cannot happen (it's a .c misconfig if it does)
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I5d82c7bb8c0214f5ffcc0ce391daddb9fe6a3295
Maciej Żenczykowskicommited 2025-08-04 13:02:06 -07:00
This is a noop, because this operation is already done by NetBpfLoad itself:
NetBpfLoad.cpp-434: // convert all slashes to underscores
NetBpfLoad.cpp:435: std::replace(name.begin(), name.end(), '/', '_');
The first / is meaningful because it is used for section lookup
on strings with / terminators (and must match libbpf)
Test: TreeHugger
Flag: EXEMPT mainline/noop
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ie3cacebfcbe317d23a884aa3ab46ac02e8b70a8b
Maciej Żenczykowskicommited 2025-08-04 13:02:06 -07:00
so that elf object related functions are next to each other
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I159e4e7ad96e3764206546f9f8c69ff156bcf790
Maciej Żenczykowskicommited 2025-08-01 14:53:27 -07:00
We go to a lot of trouble to return error codes, but
we never actually care about anything besides pass/fail.
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I8c0552246f1050813cca372a280b2302c701d617
Maciej Żenczykowskicommited 2025-08-01 14:53:18 -07:00
Sometimes *all* we see is the return code of the binary printed
out by init when we terminate with failure. Unique codes will
make debugging easier.
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Icc93813674af2855b2d9f378a1accac48b403aa3
Maciej Żenczykowskicommited 2025-08-01 14:53:06 -07:00
RaParams is populated with the upstream IPv4 MTU, rather than the IPv6
or route MTU. This change clamps that value between 1280 and 1400. 1280
as it is the minimum IPv6 MTU and 1400 to keep QUIC working. A follow up
change could improve on this by either adding the IPv6 MTU to
LinkProperties, or (possibly better) binding and connecting a UDP socket
to determine the MTU. Note that at that point the MTU in the Tether6Key
should also be fixed.
Test: TH
Flag: EXEMPT low risk
Bug: 432676104
Change-Id: I1d900039caf84c58cd04fdb52bdeaf2d1b846268
Maciej Żenczykowski
commited 
Android (Google) Code Review
commited 
Treehugger Robot
authored and
Jimi Chen
authored and
Patrick Rohr
commited 
Chen Wang
authored and