From c041c4825bbea0640bb453fdbede40705ea295c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Date: Mon, 16 Jun 2025 01:27:55 -0700 Subject: [PATCH 1/3] bpf: remove /system/etc/bpf from the loader MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit These directories are not populated on real devices and are not part of the test suite. This change removes them from the BPF loader. Test: TreeHugger Signed-off-by: Maciej Żenczykowski Change-Id: I719d0feb9ef1a6f0a1e41265af47916410590ac7 --- loader/Loader.cpp | 31 ------------------------------- 1 file changed, 31 deletions(-) diff --git a/loader/Loader.cpp b/loader/Loader.cpp index 9fbea05..651be69 100644 --- a/loader/Loader.cpp +++ b/loader/Loader.cpp @@ -866,23 +866,6 @@ int loadProg(const char* elfPath, bool* isCritical, const Location& location) { return ret; } -// Networking-related program types are limited to the Tethering Apex -// to prevent things from breaking due to conflicts on mainline updates -// (exception made for socket filters, ie. xt_bpf for potential use in iptables, -// or for attaching to sockets directly) -constexpr bpf_prog_type kPlatformAllowedProgTypes[] = { - BPF_PROG_TYPE_KPROBE, - BPF_PROG_TYPE_PERF_EVENT, - BPF_PROG_TYPE_SOCKET_FILTER, - BPF_PROG_TYPE_TRACEPOINT, - BPF_PROG_TYPE_UNSPEC, // Will be replaced with fuse bpf program type -}; - -constexpr bpf_prog_type kMemEventsAllowedProgTypes[] = { - BPF_PROG_TYPE_TRACEPOINT, - BPF_PROG_TYPE_SOCKET_FILTER, -}; - // see b/162057235. For arbitrary program types, the concern is that due to the lack of // SELinux access controls over BPF program attachpoints, we have no way to control the // attachment of programs to shared resources (or to detect when a shared resource @@ -892,20 +875,6 @@ constexpr bpf_prog_type kVendorAllowedProgTypes[] = { }; const Location locations[] = { - // Core operating system - { - .dir = "/system/etc/bpf/", - .prefix = "", - .allowedProgTypes = kPlatformAllowedProgTypes, - .allowedProgTypesLength = arraysize(kPlatformAllowedProgTypes), - }, - // memevents - { - .dir = "/system/etc/bpf/memevents/", - .prefix = "memevents/", - .allowedProgTypes = kMemEventsAllowedProgTypes, - .allowedProgTypesLength = arraysize(kMemEventsAllowedProgTypes), - }, // Vendor operating system { .dir = "/vendor/etc/bpf/", From 7d62694b8f2769c46098b4141e3fce5bfc7a277c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Date: Tue, 17 Jun 2025 03:54:48 -0700 Subject: [PATCH 2/3] make platform bpfloader require bpftool cli MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Test: TreeHugger Flag: EXEMPT adds as yet unused cli tool Signed-off-by: Maciej Żenczykowski Change-Id: Ib6c2be3c40338743f3482010d7500fef8964adc6 --- loader/Android.bp | 1 + 1 file changed, 1 insertion(+) diff --git a/loader/Android.bp b/loader/Android.bp index ab8ed49..a1184e5 100644 --- a/loader/Android.bp +++ b/loader/Android.bp @@ -102,6 +102,7 @@ rust_binary { name: "bpfloader", defaults: ["bpfloader_defaults"], required: [ + "bpftool", "timeInState.bpf", ], product_variables: { From d689e6e01ad9a4b262159058f5eb26a9036098a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Date: Tue, 17 Jun 2025 04:18:01 -0700 Subject: [PATCH 3/3] bpfloader: refactor C++ loader to just one function MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit no need for the complexity, as it is only for vendor now Test: TreeHugger Signed-off-by: Maciej Żenczykowski Change-Id: Ia807f7ee8aeca25d92e60e46f180ffe536eef87c --- loader/Loader.cpp | 8 +------- loader/bpfloader.rs | 11 ++++------- loader/include/libbpf_android.h | 7 ++----- 3 files changed, 7 insertions(+), 19 deletions(-) diff --git a/loader/Loader.cpp b/loader/Loader.cpp index 651be69..af684c5 100644 --- a/loader/Loader.cpp +++ b/loader/Loader.cpp @@ -936,23 +936,19 @@ int createSysFsBpfSubDir(const char* const prefix) { // ----- extern C stuff for rust below here ----- -void initLogging() { +void vendorBpfLoader() { // since we only ever get called from mainline NetBpfLoad // (see packages/modules/Connectivity/netbpfload/NetBpfLoad.cpp around line 516) // and there no arguments, so we can just pretend/assume this is the case. const char* argv[] = {"/system/bin/bpfloader", NULL}; android::base::InitLogging(const_cast(argv), &android::base::KernelLogger); -} -void createBpfFsSubDirectories() { for (const auto& location : android::bpf::locations) { if (android::bpf::createSysFsBpfSubDir(location.prefix)) { exit(120); } } -} -void legacyBpfLoader() { // Load all ELF objects, create programs and maps, and pin them for (const auto& location : android::bpf::locations) { if (android::bpf::loadAllElfObjects(location)) { @@ -965,9 +961,7 @@ void legacyBpfLoader() { exit(121); } } -} -void execNetBpfLoadDone() { const char* args[] = {"/apex/com.android.tethering/bin/netbpfload", "done", NULL}; execve(args[0], (char**)args, environ); ALOGE("FATAL: execve(): %d[%s]", errno, strerror(errno)); diff --git a/loader/bpfloader.rs b/loader/bpfloader.rs index b3af300..6c73606 100644 --- a/loader/bpfloader.rs +++ b/loader/bpfloader.rs @@ -640,14 +640,11 @@ fn main() { load_libbpf_progs(); info!("Loading legacy BPF progs"); - // SAFETY: Linking in the existing legacy bpfloader functionality. - // Any of the four following bindgen functions can abort() or exit() - // on failure and execNetBpfLoadDone() execve()'s. + // SAFETY: Linking in the existing legacy vendor bpfloader functionality. + // The following bindgen function can abort() or exit() on failure, + // but will usually execve(). unsafe { - bpf_android_bindgen::initLogging(); - bpf_android_bindgen::createBpfFsSubDirectories(); - bpf_android_bindgen::legacyBpfLoader(); - bpf_android_bindgen::execNetBpfLoadDone(); + bpf_android_bindgen::vendorBpfLoader(); } } diff --git a/loader/include/libbpf_android.h b/loader/include/libbpf_android.h index ae4a36d..9fb30b5 100644 --- a/loader/include/libbpf_android.h +++ b/loader/include/libbpf_android.h @@ -47,11 +47,8 @@ extern "C" { #define __noreturn #endif // __cplusplus -// The C++ portion of the BpfLoader is exposed as 3 functions to be called in order. -void initLogging(); -void createBpfFsSubDirectories(); -void legacyBpfLoader(); -__noreturn void execNetBpfLoadDone(); +// The C++ portion of the BpfLoader is exposed as a terminal function. +__noreturn void vendorBpfLoader(); #ifdef __cplusplus } // extern C