lca14: lca14-503: android upstreaming: status, netfilter & open discussion
DESCRIPTION
Resource: LCA14 Name: LCA14-503: Android Upstreaming: Status, Netfilter & open discussion Date: 07-03-2014 Speaker: John Stultz & Mathieu Poirier Video: https://www.youtube.com/watch?v=PyHdw-VReFM Website: http://www.linaro.org/ Linaro Connect: http://connect.linaro.org/ Slide: https://www.slideshare.net/linaroorg/lca14-503-androidupstreamingstatusnetfilteropendiscussionTRANSCRIPT
John Stultz & Mathieu Poirier, LCA14-503, Macau
Android Upstreaming:Netfilter, Status & Discussion
Overview
• Mathieu will cover his recent Netfilter work• General status on Android Upstreaming• Open discussion
Android Netfilter ChangesMathieu Poirier
Netfilter requirements for Android• Capture traffic per application and service• Distinguish between data streams (downloads,
video, chat, …)• Support the notion of quotas.• Allow 3rd party applications to track and collect
their own data.
Current solution:3 netfilter modules:
• xt_qtaguid (quota, tag, uid)• xt_quota2• xt_idletimer
xt_qtaguid• Quota, socket tagging, UID tracking• Tracks all ingress/egress packets• Tracks all interface statistics• Let applications tag and delegate their own
sockets• Count SKB against looked-up TAG+UID• Replaces “drivers/misc/uid_stats.c”
xt_quota2 and xt_IDLETIMERxt_quota2
• Imported from xtables-addons• Add quotas to iptable rules• Send uevent on quota hit
xt_IDLETIMER• Help ConnectivityService deal with quiet interfaces• Keeps track of interfaces coming online.• (I need to read more on this)
Why it can’t go upstream?• xt_qtaguid does a lot of things that should be
better handled in userspace.• xt_quota2 duplicates functionality already in
place in the nfaccounting framework.• xt_IDLETIMER may no longer be needed - need
to review when the above two are dealt with.
Suggested proposal• Use NFQUEUE to replace xt_qtaguid (JPA at
Google)• Initial concerns about efficiency but Eric Dumazet assured
it wouldn’t be a problem at Linux Plumbers in New Orleans last year.
• Extend xt_nfacct with quota capabilities to replace xt_quota2 (Linaro)
Work done at Linaro• Enhance xt_nfacct.c with quota capabilities• Enhance iptables with the capability to define
packet/byte quotas for “-m nfacct”• Port userspace tool “nfacct” from “libnfnl” to
“libnl2.0”.• Add a broadcast group to inform userspace of
quota attainment.
Where is the code?xt_nfacct enhancements:
http://marc.info/?l=netfilter-devel&m=139084250124821&w=2
iptables additions:https://git.linaro.org/people/mathieu.poirier/iptables.git
Port of nfacct application to libnl2.0:http://android.git.linaro.org/gitweb?p=platform/external/nfacct.git;a=summary (linaro)
Current Status (Linaro)• Port of nfacct to libnl2.0 is done and pushed to AOSP.• Iptables changes are considered done - may need minor
tweaks based on pending upstream merge of xt_nfacct changes.
• xt_nfacct is currently considered for review by the upstream community.
• Found a problem with nfnetlink accounting - fixing the issue may introduce a delay.
• Hopefully accepted in 3.15, 3.16 a more likely target.
• JP’s investigation has been stalled by internal project - we may have to pick up the work but reluctant based on heavy coupling with Android userspace.
• JP’s investigation on nfqueue has been stalled by internal projects (android64).
• The new full libnl2.0 doesn’t work with wpa_supplicant - something they need to look into.• Delays in getting xt_nfacct changes accepted doesn’t
matter because of this issue.• Integration of nfacct with BandwithController not started.
• Getting libnl2.0 working is top priority because is solves other issues with the current libnl.
Current Status (Google)
Android Upstreaming StatusJohn Stultz
Recent accomplishments3.12: key reset upstreaming completed
powersupply wakeup_source enablement mergedbinder type cleanups for 64bits
3.13: MMC power management improvements mergedRTC wakeup_source enablement merged
3.14: ION cleaned up and merged in staging
AOSP:binder 64bit abi rework
Community accomplishments3.14: Functionfs support for configfs
ongoing: dma-buf sync
And of course more...
Linaro.Android branch maintenance
Maintain the AOSP tree forward ported against Linus’ HEAD + a few extra fixes.
linaro.android-3.12-mergelinaro.android-3.13-mergelinaro.android-3.14-merge
Maintain linaro-specific fixes for LSKlinaro.android-3.10-lsk
Current delta (3.14-rc1)3.14-rc1 vs linaro.android-3.14-merge:
b/net/netfilter/xt_qtaguid.c | 3021 ++++++++++++++++++++++++b/drivers/usb/gadget/android.c | 1566 ++++++++++++b/arch/arm/common/fiq_debugger.c | 1376 ++++++++++b/drivers/cpufreq/cpufreq_interactive.c | 1343 ++++++++++b/drivers/usb/gadget/f_mtp.c | 1285 ++++++++++b/drivers/usb/gadget/f_accessory.c | 1180 +++++++++b/drivers/video/adf/adf.c | 1166 +++++++++b/drivers/video/adf/adf_fops.c | 957 +++++++b/drivers/staging/android/binder.c | 867 +++++-b/drivers/usb/gadget/f_audio_source.c | 828 ++++++b/drivers/video/adf/adf_client.c | 810 ++++++b/arch/arm/kernel/etm.c | 678 ++++-b/drivers/video/adf/adf_fbdev.c | 651 +++++b/net/netfilter/xt_qtaguid_print.c | 566 ++++...292 files changed, 30024 insertions(+), 1234 deletions(-)
3.10-stable vs android-3.10:354 files changed, 35472 insertions(+), 1422 deletions(-)
3.4-stable vs android-3.4:1265 files changed, 148684 insertions(+), 5934 deletions(-)
Current delta (3.14-rc1)3.14-rc1 vs linaro.android-3.14-merge:
b/net/netfilter/xt_qtaguid.c | 3021 ++++++++++++++++++++++++b/drivers/usb/gadget/android.c | 1566 ++++++++++++b/arch/arm/common/fiq_debugger.c | 1376 ++++++++++b/drivers/cpufreq/cpufreq_interactive.c | 1343 ++++++++++b/drivers/usb/gadget/f_mtp.c | 1285 ++++++++++b/drivers/usb/gadget/f_accessory.c | 1180 +++++++++b/drivers/video/adf/adf.c | 1166 +++++++++b/drivers/video/adf/adf_fops.c | 957 +++++++b/drivers/staging/android/binder.c | 867 +++++-b/drivers/usb/gadget/f_audio_source.c | 828 ++++++b/drivers/video/adf/adf_client.c | 810 ++++++b/arch/arm/kernel/etm.c | 678 ++++-b/drivers/video/adf/adf_fbdev.c | 651 +++++b/net/netfilter/xt_qtaguid_print.c | 566 ++++...292 files changed, 30024 insertions(+), 1234 deletions(-)
3.10-stable vs android-3.10:354 files changed, 35472 insertions(+), 1422 deletions(-)
3.4-stable vs android-3.4:1265 files changed, 148684 insertions(+), 5934 deletions(-)
Next areas of focus
• ETM/ETB• Android Gadget -> ConfigFS Gadget• FIQ_Debugger• ADF
Continuing work• Netfilter• ION / dmabuf allocation helpers• Volatile Ranges
• Get ashmem out of staging• Influence KDBUS development
• Unlikely to be a binder replacement as hoped• Try to find areas where code can be shared• Fair amount of memfd/ashmem overlap
• Continue to help with the Juice project• Aiding with helping Android userland take advantage of
upstreamed solutions• mempressure notifiers• sysrq-keyreset• etc
Thank yous!
• Takahiro Akashi• Serban Constantinescu• Ulf Hansson• Zoran Markovic• Mathieu Poirier• Jakub Pavelek
Open Discussion• Netfilter related questions?
• What are specific kernel related pain-points for Android device development?
• Is anyone looking at ADF for their devices yet?
• Any adjustments in focus we need?
• Extra resources?
More about Linaro Connect: http://connect.linaro.orgMore about Linaro: http://www.linaro.org/about/
More about Linaro engineering: http://www.linaro.org/engineering/Linaro members: www.linaro.org/members