This is to allow fixing a broken OffloadUtils netd test, but this will
also be useful for future support to make programs per kernel version.
We make the string versions of the enum more readable, because there
is exactly one user:
adb shell dumpsys netd | egrep -i bpf
BPF module status: enabled
BPF support level: Extended [4.14]
...
Test: build, atest
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I843bd7355703a78acc8343ca7f647ce9366927eb
Maciej Żenczykowskicommited 2020-02-18 04:46:58 +00:00
Unlike maps, BPF programs currently have no natural place to declare
metadata like their desired owner & group. Add a bpf_prog_def struct
to allow setting these, located in a new "progs" section, and update
bpfloader to chown pinned programs appropriately based on this
information.
Add a #DEFINE_BPF_PROG macro to simplify adding this data for
programs. The struct name is the name of the corresponding function
with "_def" appended, which bpfloader uses to correlate a bpf_map_def
with the correct program.
Also have bpfloader set mode to 0440 for all programs, since only read
access should ever be needed
Bug: 149434314
Test: load a program that uses DEFINE_BPF_PROG and check that owner &
group are set as expected
Change-Id: I914c355f114368fe53de2c7f272d877463cba461
Signed-off-by: Connor O'Brien <connoro@google.com>
Connor O'Brienauthored and Maciej Żenczykowskicommited 2020-02-14 23:28:44 +00:00
so that it can change the uid/gid of pinned bpf progs and maps
Test: build, atest
Bug: 149434314
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Id23f9caaddf620d4e99d970523f0a9768826e0d7
Maciej Żenczykowskicommited 2020-02-13 13:08:40 -08:00
(being moved from //system/netd/tests/bpf_base_test.cpp)
Test: build, atest
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I7a38eff6d86a1bcd6dde193fd360d198bd57a900
Maciej Żenczykowskicommited 2020-02-12 04:15:29 -08:00
(we don't want to truncate this output, since it can be very useful
for debugging failures)
Test: builds, more useful ebpf load failure logs
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I817853f33b7f59296a041fb0d26ca3ae502b29da
Maciej Żenczykowskicommited 2020-02-11 19:12:34 -08:00
Per Bernie: "in C++, inline implies internal linkage, you can drop static"
Test: build, atest
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I139af1d826d4982a1480fbee433fd9a743509786
Maciej Żenczykowskicommited 2020-02-11 16:43:15 -08:00
In case it happens to get called twice in parallel on
startup. It's never a mistake to do extra calls to the
uncached version.
Test: build, atest
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I2605ed2ebc4ee331b2ca6c9fa915203d70415d7f
Maciej Żenczykowskicommited 2020-02-11 11:20:35 -08:00
Long term we don't even want reset() to exist.
It's simply not useful since only the bpfloader can create maps,
and thus all we can do is construct from pre-existing pinned bpf
path - and we should never destroy/unpin/delete these.
Similarly the move constructor is probably spurious.
Basically the only real use for reset() is in tests,
and even there the overall utility is not clear.
Hence, in the mean time, make it harder to use incorrectly,
and harder to use in general.
To do that we get rid of reset() -> you must call reset(-1)
and we eliminate the ability to call reset(unique_fd)
which has unclear fd-leaking semantics.
Also remove a spot where it is called spuriously.
Test: build, atest
Bug: 129773125
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia018224aca0005ab68809b350595485ccd3f1bd3
Maciej Żenczykowskicommited 2020-01-30 08:59:53 +00:00
switch over to the newer pinned path using constructor
Test: build, atest
mMapFd no longer shows up in this file
Bug: 129773125
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ie70149ffd5a541c80b35804ffd38df07f28b509b
Maciej Żenczykowskicommited 2020-01-30 08:59:44 +00:00
(and remove the old straight from fd constructor)
Note that BpfMapRO is not yet truly compile time read-only,
since it still has methods that can modify things (although those
modifications will of course fail due to the map fd being r/o).
Test: build, atest with followup fixes
Bug: 129773125
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I70b511e3f0a62cd4d9d5a923e658b1086337ec4c
Maciej Żenczykowskicommited 2020-01-30 08:50:58 +00:00
Test: build, atest
mMapFd no longer shows up in this file
Bug: 129773125
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ie49f0027d0f04565426ed800b079800b364dd049
Maciej Żenczykowskicommited 2020-01-29 22:43:10 -08:00
bpf_jit_enable = 1 is mostly a no-op since on most future
devices it will be force enabled by BPF_JIT_ALWAYS_ON
It is required for Pixel 3 & co Linux 4.9 based devices, which
can only do JIT for some ebpf programs (and thus can't enable
BPF_JIT_ALWAYS_ON without some netd programs refusing to load)
We also set bpf_jit_kallsyms = 1 because it makes debugging
failures easier, but it is incompatible with bpf_jit_harden != 0.
We don't bother setting bpf_jit_harden because we both want
bpf_jit_kallsyms to work, and because the only entity allowed
to load ebpf programs is the bpfloader and it only loads trusted
(verified file system signed) prebuilt bpf programs.
Test: built and booted, verified settings
Bug: 140377409
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I9b401ee7b01a2042da87ff48d548b11e0cf78efa
Maciej Żenczykowskicommited 2020-01-30 06:23:08 +00:00
(instead of explicit memlock limit)
This reduces chance for memory allocation failures.
Any bpfloader failure is a critical boot time failure
(since without eBPF initializing properly netd will crash and
device will enter crash loop).
Test: builds, atest
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I5ed0118d63c53100e7431324914bf22e9870abfe
Maciej Żenczykowskicommited 2020-01-27 01:08:03 -08:00
Keys and values passed in to lookup/update/delete are not modified.
Test: builds
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I222615af7695f41bfb59c872c7368829631c08a9
Maciej Żenczykowskicommited 2020-01-24 18:53:10 -08:00
Remove libnetdutils dependency because bpf is being used for things other
than networking these days, and we don't want to make libnetdutils
vendor-available in the future. libbase provides an alternative type now.
Bug: 140330870
Test: atest libbpf_android_test netd_integration_test netd_unit_test
libnetdbpf_test bpf_module_test
Change-Id: I72ae8cd7f58a49bfc7dcb914a332a4c4bad5dea5
Steven Morelandcommited 2020-01-21 10:47:33 -08:00
When accessing maps keys are always const/read-only.
Similarly for the value when it is being stored in the map.
This eliminates four const_casts.
Test: build, atest
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Icc57b46a8e9e81b5b06264260bfbf34a4ba9105d
Maciej Żenczykowskicommited 2020-01-18 19:32:09 -08:00
Note, this does not add libbpf_load_test as well because this test
requires adding a bpf program to the system image.
Bug: N/A
Test: `atest --test-mapping .`
Change-Id: I770ec4876e1cb93a526e99bcb5a234f964f46971
Steven Morelandauthored and Maciej Żenczykowskicommited 2020-01-15 08:28:44 +00:00
We can't specify which union member we want to initialize
or the compiler will be too smart and do a partial init,
but a = {} will still zero the entire struct.
Test: builds, atest
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I0f9208be1be65cec35d848d37a0142d03e0919bf
Maciej Żenczykowskicommited 2020-01-15 07:08:21 +00:00
(due to switch to bpfloader from loading via netd)
Test: build, atest
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ic95cdfde26b8e7b905551a7fd2b465e0cf99bbce
Maciej Żenczykowskiauthored and Steven Morelandcommited 2020-01-14 09:10:32 -08:00
Maciej Żenczykowski
commited 
Connor O'Brien
authored and
Gerrit Code Review
commited 
Bernie Innocenti
commited 
Tom Cherry
authored and
Treehugger Robot
authored and
Steven Moreland
commited