Reasoning: critical load failures for netd bpf programs will just result
in unpredictable behaviour later on. For example netd/systemserver
crash loops.
Test: builds
Bug: 150040815
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Iefa01e60cd0a9a223e96411726a199bfb4857a5a
Maciej Żenczykowskicommited 2020-06-15 08:01:50 +00:00
... which also means waitForProgsLoaded() has to be a no-op on pre-bpf devices.
This is more consistent: it's weird to have bpf.progs_loaded set on a 4.4 device.
Test: builds, atest
Bug: 150040815
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Iddabcf56c187ea518dd2e4d8db451b2f6902aa8e
Maciej Żenczykowskicommited 2020-06-13 22:41:48 -07:00
Fixes:
system/bpf/libbpf_android/Loader.cpp:557:49: warning: 'find_last_of' called with a string literal consisting of a single character; consider using the more effective overload accepting a character [performance-faster-string-find]
name = name.substr(0, name.find_last_of("$"));
^~~
'$'
Test: builds
Bug: 153035880
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Iea62a59380c155796a7fa2ac4ca3352f9236ba98
Maciej Żenczykowskicommited 2020-04-24 04:18:00 +00:00
bpf program section names must be unique to prevent programs from
appending to each other, so instead the bpf loader will strip
everything past the final $ symbol when actually pinning
the program into the filesystem.
While at it add a little bit more logging.
Example on aosp cuttlefish 5.4.30 virtual device:
D LibBpfLoader: bpf_prog_load lib call for /system/etc/bpf/offload.o (schedcls_ingress_tether_ether) returned fd: 8 (no error)
D LibBpfLoader: cs[1].name:schedcls_ingress_tether_rawip$stub min_kver:0 .max_kver:40e00 (kvers:5041e)
D LibBpfLoader: cs[2].name:schedcls_ingress_tether_rawip$4_14 min_kver:40e00 .max_kver:ffffffff (kvers:5041e)
D LibBpfLoader: bpf_prog_load lib call for /system/etc/bpf/offload.o (schedcls_ingress_tether_rawip$4_14) returned fd: 9 (no error)
I bpfloader: Attempted load object: /system/etc/bpf/offload.o, ret: Success
$ adb shell ls -l /sys/fs/bpf | egrep offload
-rw-rw---- 1 root network_stack 0 2020-04-22 01:27 map_offload_tether_ingress_map
-rw-rw---- 1 root network_stack 0 2020-04-22 01:27 map_offload_tether_stats_map
-r--r----- 1 root root 0 2020-04-22 01:27 prog_offload_schedcls_ingress_tether_ether
-r--r----- 1 root root 0 2020-04-22 01:27 prog_offload_schedcls_ingress_tether_rawip
Test: builds, atest, proper program loaded on 5.4.30 aosp cuttlefish
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Id3fcb8e2a6b0087f704e77726e9961efc6145739
Maciej Żenczykowskicommited 2020-04-21 18:29:58 -07:00
Some ebpf code cannot be loaded on too old kernels.
Sometimes we want a different - more advanced - version of an ebpf program
to be loaded on a newer kernel.
Test: build, atest
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I9e93e7246951916e6d60544575337a7a19c82886
Maciej Żenczykowskicommited 2020-02-19 15:46:23 -08:00
Unlike maps, BPF programs currently have no natural place to declare
metadata like their desired owner & group. Add a bpf_prog_def struct
to allow setting these, located in a new "progs" section, and update
bpfloader to chown pinned programs appropriately based on this
information.
Add a #DEFINE_BPF_PROG macro to simplify adding this data for
programs. The struct name is the name of the corresponding function
with "_def" appended, which bpfloader uses to correlate a bpf_map_def
with the correct program.
Also have bpfloader set mode to 0440 for all programs, since only read
access should ever be needed
Bug: 149434314
Test: load a program that uses DEFINE_BPF_PROG and check that owner &
group are set as expected
Change-Id: I914c355f114368fe53de2c7f272d877463cba461
Signed-off-by: Connor O'Brien <connoro@google.com>
Connor O'Brienauthored and Maciej Żenczykowskicommited 2020-02-14 23:28:44 +00:00
(we don't want to truncate this output, since it can be very useful
for debugging failures)
Test: builds, more useful ebpf load failure logs
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I817853f33b7f59296a041fb0d26ca3ae502b29da
Maciej Żenczykowskicommited 2020-02-11 19:12:34 -08:00
Creating a function for this rather than having people copy/paste a loop
there.
It's very intentional that there is no timeout here. If bpfloader is
down, there is a serious problem, and we shouldn't let code move forward
in a state where it may not have been tested.
Bug: 140330870
Test: boot & use bpf/netd
Change-Id: I358d1fcf77ad5406e294dd57307bc411e2c8ad6a
Steven Morelandcommited 2020-01-10 15:37:53 -08:00
Currently, if a bpf program object has no map section, this error is
propagated, and the program will fail to load. However, it is desirable
to have programs without any map.
Bug: 140330870
Test: load program w/ bpf w/o maps section
Change-Id: Ia53c699212a8cb962e3c2db562921880fef0cce0
Steven Morelandcommited 2020-01-10 13:33:03 -08:00
errno is left unchanged on successful calls to this function, so it is
confusing to log it in the success path.
Fixes: 146171927
Test: looking at logs
Change-Id: Ia424dd865bd518d8c533e99fb1a64b02bc92e759
Steven Morelandcommited 2019-12-12 17:24:00 -08:00
Using unique_fd to ensure we release bpf prog fds when they are no
longer needed.
Change-Id: I9d5c2673c7e1bdf05052771e06ac78cec21957ec
Merged-In: I9d5c2673c7e1bdf05052771e06ac78cec21957ec
Signed-off-by: Connor O'Brien <connoro@google.com>
(cherry picked from commit 206dd3381e)
Connor O'Brienauthored and Maciej Żenczykowskicommited 2019-11-13 21:58:28 -08:00
The return of bpf_prog_load() library call is insufficient, we also need
errno to know what the bpf(2) syscall did.
Bug: 143236645
Change-Id: Id2c543fdb63b1e077278a8b1ede03a21afad74dc
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Joel Fernandes (Google)authored and Joel Fernandescommited 2019-11-08 16:51:11 -05:00
Changed finds that use a string with a single character ("X"), to 'X'.
Remove using statements from header file.
Add a couple of missing includes.
Changed a couple of functions that take a string to const string& to
avoid extra copies.
Test: No warnings when compiled, unit tests pass.
Change-Id: I218ee0e6b6c7fb1c79d1337c1ce3d6f1e318a3cd
Christopher Ferriscommited 2019-02-01 15:48:19 -08:00
Add support for cgroup socket filter program loading in bpfloader,
and create a uid permission map to store the uids that have INTERNET
permission.
Bug: 111560570
Bug: 111560739
Test: dumpsys netd trafficcontroller
Change-Id: I658f533d302cb594d7b36d4a3a2a70e394874c33
which maps to BPF_PROG_TYPE_SCHED_CLS
Bug: 65674744
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I7ca5912756c575e2c0667b9dae2d24471845e028
Maciej Żenczykowskicommited 2019-01-24 23:16:10 -08:00
* Wrote a relocatable ELF loader from scratch. The loader library loads
all objects in /system/etc/bpf/, parses and fixes up eBPF instructions
based on relocation information, creates maps and programs and pins
them. A single API call without arguments is made which results in this
operation. The API has all the information it needs from the filesystem
and the ELF objects, so there is no configuration stored in the code
calling the loader API essentially making it zero conf. Initially this
will be used by time_in_state statistics collection using tracepoints.
In the future, netd's eBPF C code should be rewritten to use this
infrastructure and the old ELF loader can be gotten rid off. This is the
first step.
* Link libbpf with libbpf_android which will come from the external/ bcc
project. This will be used for tracepoint and perf eBPF support. In the
future it can be used for other things as kernel eBPF support advances.
This patch will be merged only after bcc is cloned into external/ to
prevent build breakage.
Bug: 112334572
Change-Id: Ic0fd9504e18031132d40bb627c5e44058d59c9f8
Signed-off-by: Joel Fernandes <joelaf@google.com>
Maciej Żenczykowski
commited 
Connor O'Brien
authored and
Treehugger Robot
authored and
Gerrit Code Review
commited 
Steven Moreland
commited 
Joel Fernandes (Google)
authored and
Joel Fernandes
commited 
Christopher Ferris
commited 
Chenbo Feng
commited