The kernel updates the length with xchg() which does a memory barrier,
on the kernel side when the data is actually committed to the ring
buffer [1].
On the user space side the volatile is not sufficient to prevent the
data read from being reordered before the load of length.
[1]a20971c187/kernel/bpf/ringbuf.c (L484)
Bug: 374722456
Bug: 368624834
Bug: 376536942
Change-Id: I75eee3deee2afce83c1b760e6df383375f926ebb
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Same as the netd change prior, but this is just to make it easier for
AOSP forks to work on legacy devices not meeting V requirements.
Change-Id: I2ebb479b6c9d3d82ee300bb6bf978184bb6c802b
According to sectionNameTypes in NetBpfLoad.cpp, programs starting with
the following names require these BPF attach types.
* connect4/ -> BPF_CGROUP_INET4_CONNECT
* connect6/ -> BPF_CGROUP_INET6_CONNECT
* recvmsg4/ -> BPF_CGROUP_UDP4_RECVMSG
* recvmsg6/ -> BPF_CGROUP_UDP6_RECVMSG
* sendmsg4/ -> BPF_CGROUP_UDP4_SENDMSG
* sendmsg6/ -> BPF_CGROUP_UDP6_SENDMSG
However, none of these are available in deprecated/android-4.14-stable
kernel/common branch, but all of them are available in
android-4.19-stable.
Change-Id: I5a725628e06642c7a68105d25a65f0cad277cd3b
This helper is available on 5.1+ kernels and required to read certain
fields (like the mark) from skb->sk.
Test: TH
Change-Id: I96087c9974262594fdcb4119cbdbd1b39c26a5d4
This is to avoid kernel fault due to UDPv6 GRO FRAGLIST collapse
(by virtue of pulling more than udp packet's payload).
Bug: 333849117
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I619316eab1cff3103a3d972682e4cb12de8fca8e
Maciej Żenczykowskicommited 2024-10-04 19:06:15 +00:00
netd is after synchronous start of bpfloader,
so we don't actually need to wait for it at all.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia1bcf8ac7d6756be44a1382581e6f2b5188bcb58
Maciej Żenczykowskicommited 2024-10-02 22:53:03 +00:00
6.12 is virtually certain to release in the second half of November:
2024-09-15 - 6.11 release
2024-09-22 - merge window
2024-09-29 - 6.12-rc1
2024-10-06 - 6.12-rc2
2024-10-13 - 6.12-rc3
2024-10-20 - 6.12-rc4
2024-10-27 - 6.12-rc5
2024-11-03 - 6.12-rc6
2024-11-10 - 6.12-rc7 or 6.12
2024-11-16 - 6.12-rc8 or 6.12
2024-11-23 - 6.12-rc9 or 6.12
2024-11-30 - 6.12
This means it *will* be the last Linus kernel of the year.
Hence it is almost certainly going to be the LTS for 2024.
Thus the next Android OS release will drop support for 4.19
and add support for 6.12.
Bug: 370043209
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I53f52a0e65f31d4db5f10f8b1acac18ba6f34d18
Maciej Żenczykowskicommited 2024-09-27 17:12:56 +00:00
This is entirely bpf specific logic for the dns_helper.so
shared library. Let's put it under bpf/ so it can be covered
by bpf source hash logic and used by UML NetBpfLoad test.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I7b544cb1db9f13f2467519068cefd236b814413a
Maciej Żenczykowskicommited 2024-09-27 02:06:05 +00:00
Note: this is a no-op for mainline as this file is built into platform,
and not into the tethering apex mainline module.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1e66831eb7a4b506b6fdde9b2bad65a1a36bbe76
Maciej Żenczykowskicommited 2024-09-23 21:27:37 +00:00
will land in M-2025-01
should fix some long standing cookie_tag_map full issues
(due to the userspace socket destroy listener code failing to run - likely due to buffer overflow)
Bug: 364365891
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: If78c335488eadf605a54f20005d9b14fdadb6473
Maciej Żenczykowskicommited 2024-09-23 20:21:40 +00:00
Since this is just a special case of a bpf cgroup hook,
it really should be in netd.o with all other such hooks.
Besides moving/renaming the map & programs this should be a no-op.
Test: TreeHugger, atest bpf_existence_test
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I4a2aedaf77f89a9c0a96fa1c369d80659535eabe
Maciej Żenczykowskicommited 2024-09-19 00:40:53 +00:00
All 6 .c files under bpf/progs are flagged CRITICAL(),
and as such we can simplify this logic.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I884705e1f0fdb20c992499aa2c83d5953a24fd9e
Maciej Żenczykowskicommited 2024-09-18 23:46:16 +00:00
With the addition of defaults to the bpf soong module (see aosp/3249485
), the name `bpf_defaults` will be used to define defaults for bpf
program compilation. While there are separate soong namespaces for
module types and module names, rename the existing bpf_defaults
cc_defaults to bpf_cc_defaults for clarity.
While we're at it, add -Wextra, and cleanup unnecessary cflags in
clauses which use bpf_cc_defaults. Add -Wno-sign-compare to resolve
build issues in external test code.
Test: TH
Change-Id: Id0407f86ad50033a77a8679d465dc9412991d764
Signed-off-by: Neill Kapron <nkapron@google.com>
Manually tested via x86_64 UML netbpfloader hack on:
5.15.158-U android/kernel/common/android14-5.15
c8c7a44800dffe1c3a3840f433ba72f9ab1cdfb0
Combined with previous dscpPolicy verifier optimizer patch load time
goes from 0.151s to 0.061s, but this is on a desktop Android build
capable box. Decrease of 2.5x will of course be much more noticeable
on slower devices - like Pixel phones, and *even* more noticeable
on low/mid tier devices (including Android Go).
Bug: 361492282
Test: TreeHugger, atest CtsNetTestCases:android.net.cts.DscpPolicyTest
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ice2bfa0d614d70420c41fb25294bb0425ec273b0
Maciej Żenczykowskicommited 2024-09-06 04:22:58 +00:00
We're not currently using this XDP program, and it really only tests
bpfloader functionality, but with that being mainline it just doesn't
matter anymore.
It's not like we'll spontaneously decide to ever use XDP on devices
without some sort of per-device opt-in: too much could go wrong.
Unfortunately the Android S bpfloader has to be able to load test.o,
and it may fail if there is no prog section.
So we add a trivial 'placeholder' skfilter_match program, so that there
is at least 1 program in the file (and thus a 'prog' section exists).
Alternatively we could also probably just force an empty 'prog' section,
but this approach seems way easier...
Test: TreeHugger, atest bpf_existence_test
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1d2fb8ceb33871c915d3f3d4fe6f2d811781a0c4
Maciej Żenczykowskicommited 2024-09-06 04:18:02 +00:00
log_buf.size() was always BPF_LOAD_LOG_SZ and thus != 0
After changing ALOGD to ALOGI you now see (for example):
NetBpfLoad: BPF_PROG_LOAD call for /apex/com.android.tethering/etc/bpf/net_shared/block.o (bind4_block_port) returned 'processed 55 insns (limit 1000000) max_states_per_insn 0 total_states 4 peak_states 4 mark_read 1' fd: 6 (ok)
(ALOGV/ALOGD's are effectively silently dropped by the KernelLogger we use)
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I4a296976ae3f1e2217c46d81ed48850fdfa95a3c
Maciej Żenczykowskicommited 2024-09-05 22:00:33 +00:00
You can't pass xTS test suites without these maps.
As there is nothing besides 3 trivial HASH maps and 1 ARRAY,
there really isn't any way this can fail to load.
If bpf hash map / array creation fails we've really got bigger
problems, and we should see failures in netd_updatable.so
and thus boot failures.
Even the program is required to load correctly or
the bpf_existence_test xTS would fail...
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia750abd0b42fccd3c2a252b7780875bdee83abf8
Maciej Żenczykowskicommited 2024-09-05 22:00:05 +00:00
This change avoids the use of multiple conditionals/ifs
by merging them all into one via bitwise arithmetic.
Bug: 361492282
Test: TreeHugger, atest CtsNetTestCases:android.net.cts.DscpPolicyTest
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I05c2f9cbddf14e0388cb8ac99c63ce0c76e46960
Maciej Żenczykowskicommited 2024-09-05 02:40:55 +00:00
By construction it cannot actually fail, since
per_cpu_array[cookie % nr_entries_per_cpu]
is always a valid array item...
This allows us to do direct per-cpu write into the cache
instead of going via bpf map update helper function
Test: TreeHugger, atest CtsNetTestCases:android.net.cts.DscpPolicyTest^C
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I8a70ae341b21202db88877856522288149a54f31
Maciej Żenczykowskicommited 2024-09-04 18:58:29 -07:00
(since this map relies on percpu access semantics,
and we don't even have userspace helpers to access PERCPU_ maps)
This will also be used by the upcoming satellite egress limiting logic.
See aosp/3235142
With this change we see:
$ adbz shell ls -lZ /sys/fs/bpf/net_shared/*_dscpPolicy_*
-rw-rw---- 1 root system u:object_r:fs_bpf_net_shared:s0 0 2024-09-04 17:01 /sys/fs/bpf/net_shared/map_dscpPolicy_ipv4_dscp_policies_map
-rw-rw---- 1 root system u:object_r:fs_bpf_net_shared:s0 0 2024-09-04 17:01 /sys/fs/bpf/net_shared/map_dscpPolicy_ipv6_dscp_policies_map
---------- 1 root root u:object_r:fs_bpf_loader:s0 0 2024-09-04 17:01 /sys/fs/bpf/net_shared/map_dscpPolicy_socket_policy_cache_map
-r--r----- 1 root system u:object_r:fs_bpf_net_shared:s0 0 2024-09-04 17:01 /sys/fs/bpf/net_shared/prog_dscpPolicy_schedcls_set_dscp_ether
Test: TreeHugger, atest CtsNetTestCases:android.net.cts.DscpPolicyTest
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I50a12ca4cd5587342f8aaf9df8cb28917f555252
Maciej Żenczykowskicommited 2024-09-04 17:41:47 -07:00
This simplified macro will prevent leaking of mainline specific
bpf implementation details into platform.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Id0564f2e8a927ace6dcddb93d78a58891f06795c
Maciej Żenczykowskicommited 2024-09-04 17:39:49 -07:00
To shorten lines.
Now:
egrep 'base:' NetBpfLoad.cpp
only finds the 'using' statements.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I8b125c420c106e4b9c2af0a4fa2e4892a08bb152
Maciej Żenczykowskicommited 2024-09-04 11:43:31 -07:00
Note that this is a no-op for everything before sdk=36+,
since V/sdk=35 only supports up to 6.6 LTS anyway.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I701045074dfb7b0c586536634e210318b5af364b
Maciej Żenczykowskicommited 2024-09-03 16:09:59 -07:00
This duplicates the previous check, but without the exceptions.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Id83695689268baacd1112821fa3fd212c3aa0bb6
Maciej Żenczykowskicommited 2024-09-03 16:04:11 -07:00
(prep work to make next diff easier on the eyes)
Test: N/A
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I2a6a10cbdeace7e7b43d64bc1e0743216e4321e1
Maciej Żenczykowskicommited 2024-09-03 15:43:33 -07:00
Treehugger Robot
authored and
Gerrit Code Review
commited 
Patrick Rohr
commited 
Maciej Żenczykowski
commited 
Jimi Chen
commited 
Kalesh Singh
commited 
Yu-Ting Tseng
commited 
LuK1337
commited 
Neill Kapron
commited