Commit Graph

8 Commits

Author SHA1 Message Date
Maciej Żenczykowski
901c71051e bpf_progs: use macros for kernel version
Generated via:
  for f in bpf_progs/{block,dscpPolicy,netd,offload,test}.c; do
    sed -i -r 's@KVER[(]([45]), ([0-9]+), 0[)]@KVER_\1_\2@g' "${f}"
  done

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I8f211e47bf259fc75aa1caaaf82f41c1929ceab2
2023-10-06 15:54:39 -07:00
Maciej Żenczykowski
3cb494fd28 move BPF_CGROUP_INET*_BIND registration into BpfHandler
(in preparation for moving it into netbpfload)

The programs themselves (in bpf_progs/block.c) required a 5.4+ kernel.

We relax this restriction to 4.19+ as we don't have any 5.4 device coverage
(while the pixel 4a 5G / 5 / 5a are all 4.19 devices).

I believe we could relax it further to 4.14+ but Pixel 4/4xl/4a that
would exercise those code paths are EOL and probably have poor to
non existent test coverage, and we cannot do anything for 4.9 T devices
anyway.

Note: on <4.19 kernels (ie. T devices running 4.9/4.14, U running 4.14)
this results in ConnectivityNativeService going from null to initialized
(as the bpf map will exist).

This doesn't hurt as the set/clear port interfaces are only ever
called by vendor code on devices where the kernel doesn't support
the older mechanism.  And even if you call them it will just set/clear
the bits in the bpf bitmap, they just won't actually affect anything.

We could flag the map itself as being 4.19+ as well, but I think
I prefer the no-op map to exist...

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1085addd22f4f3b709e1875049633832c5dac836
2023-10-06 14:31:20 -07:00
Maciej Żenczykowski
a09c2bbe49 use static const instead of #define (DIS)ALLOW
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1b38f6ac0f511c07610a6afec616e6ec880d8905
2023-10-06 14:08:50 -07:00
Maciej Żenczykowski
de1342a033 bpf_progs: disable BTF on <=U && user builds
This is to cut down bpfloader boot time.
Potential savings might be on the order of 30+% (300ms).

Loading BTF requires fork-execing the btfloader,
and currently BTF is only used to facilitate debugging.

Bug: 286369326
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ifa5f0052135b9dc826b18ca4622784615ed9c3c8
2023-06-09 05:58:57 +00:00
Maciej Żenczykowski
c5af9f2084 Drop support for beta versions of Android T.
Android T beta3/4 haven't been tested in ages,
and were really only tested for the transition to final T
nearly a year ago.

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I520e60026179c078859572231b86184796182142
2023-04-25 15:08:28 -07:00
Maciej Żenczykowski
f769952212 bpf programs: switch from integers to #define'd bpfloader versions
(per request from Lorenzo)

We do bump block/clatd/dscp_policy requirements from 0.12 to 0.13,
but this effectively doesn't matter:

- Beta2 is too old either way (pre-0.12)
- Beta3 is new enough (0.13)
- versions in between are simply obsolete / unused / not important
- bpfloader 0.12 won't boot right anyway due to lack of netd maps/programs
  (which cause a netd startup failure)

This allows us to have one less #define in the header files,
with a hard to write explanation about what exactly v0.12 is (or was).

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1ecf15f9d7abbb82ec6bd49848255fab6a41aed4
2022-05-24 16:11:09 -07:00
Maciej Żenczykowski
acebffb966 add proper minimum bpfloader version annotations for block/clatd/dscp_policy/netd
In practice this doesn't actually really matter, since older versions
of the bpfloader won't even look in the relevant directories:

BpfLoader v0.9 is the first one that looks into
  '/apex/com.android.tethering/etc/bpf/net_shared',
but it is only v0.12 that pins the resulting programs and maps
correctly into
  /sys/fs/bpf/net_shared/
hence the annotations for block/clatd/dscp_policy.

BpfLoader v0.13 is the first one that looks into
  '/apex/com.android.tethering/etc/bpf/netd_shared'
subdirectory and pins into
  /sys/fs/bpf/netd_shared/
hence the annotation for netd.

But it's best to explicitly document the intent.

Note that in practice the mainline module will fail spectacularly
on a T OS if it can't find the programs and maps
(presumably due to the bpfloader being too old)
but will work on S even though the bpfloader there is much older,
because these programs/maps are not required on pre-T OS.

This change is thus really only documentation.

Bug: 218408035
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I5ffa2faf83ca337b84e34b01df84436629989c58
2022-05-16 17:09:58 -07:00
Tyler Wear
b37f551287 Vendor AIDL interface for port blocking via eBPF
New Connectivity Service exposed to vendor for
restricting certain ports for use only in vendor.

Bug: 179733303

Change-Id: Iad9aff6924498ede5a08cfa5482082f094c0a90b
2022-03-25 09:14:48 -07:00