Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 678efa25 authored by Jae Shin's avatar Jae Shin Committed by Gerrit Code Review
Browse files

Merge changes from topic "rs_vndk_step2" 

* changes:
  fix: boot fails on ASAN builds with VNDK restriction
  templatize ld.config.txt
  Make default namespace for system processes isolated
  vndk: add vendor/lib(64)/vndk for vendor namespace
  Implement system namespace for vendor process
  Use the legacy linker namespace configs when target is sanitized
  Permit /system/lib/vndk-sp/hw/ for 'sphal' namespace
  Add system/${LIB}/vndk to default namespace for vendor.
  Add [test] section for /data/[nativetest|benchmarktest]
  /data/nativetest[64] processes are running with the new ns config
parents 4e2a8e37 257de3de

rootdir/Android.mk

+56 −1
Original line number Original line Diff line number Diff line
@@ -178,8 +178,62 @@ bcp_dep := 
# ld.config.txt

# ld.config.txt

include $(CLEAR_VARS)

include $(CLEAR_VARS)





_enforce_vndk_at_runtime := false



ifdef BOARD_VNDK_VERSION

ifneq ($(BOARD_VNDK_RUNTIME_DISABLE),true)

  _enforce_vndk_at_runtime := true

endif

endif



ifeq ($(_enforce_vndk_at_runtime),true)

LOCAL_MODULE := ld.config.txt

LOCAL_MODULE := ld.config.txt

ifeq ($(PRODUCT_FULL_TREBLE),true)

LOCAL_MODULE_CLASS := ETC

LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)

LOCAL_MODULE_STEM := $(LOCAL_MODULE)

include $(BUILD_SYSTEM)/base_rules.mk

vndk_lib_md5 := $(word 1, $(shell echo $(LLNDK_LIBRARIES) $(VNDK_SAMEPROCESS_LIBRARIES) | $(MD5SUM)))

vndk_lib_dep := $(intermediates)/$(vndk_lib_md5).dep

$(vndk_lib_dep):

	$(hide) mkdir -p $(dir $@) && rm -rf $(dir $@)*.dep && touch $@



llndk_libraries := $(subst $(space),:,$(addsuffix .so,$(LLNDK_LIBRARIES)))



vndk_sameprocess_libraries := $(subst $(space),:,$(addsuffix .so,$(VNDK_SAMEPROCESS_LIBRARIES)))



vndk_core_libraries := $(subst $(space),:,$(addsuffix .so,$(VNDK_CORE_LIBRARIES)))



sanitizer_runtime_libraries := $(subst $(space),:,$(addsuffix .so,\

$(ADDRESS_SANITIZER_RUNTIME_LIBRARY) \

$(UBSAN_RUNTIME_LIBRARY) \

$(TSAN_RUNTIME_LIBRARY) \

$(2ND_ADDRESS_SANITIZER_RUNTIME_LIBRARY) \

$(2ND_UBSAN_RUNTIME_LIBRARY) \

$(2ND_TSAN_RUNTIME_LIBRARY)))



$(LOCAL_BUILT_MODULE): PRIVATE_LLNDK_LIBRARIES := $(llndk_libraries)

$(LOCAL_BUILT_MODULE): PRIVATE_VNDK_SAMEPROCESS_LIBRARIES := $(vndk_sameprocess_libraries)

$(LOCAL_BUILT_MODULE): PRIVATE_LLNDK_PRIVATE_LIBRARIES := $(llndk_private_libraries)

$(LOCAL_BUILT_MODULE): PRIVATE_VNDK_CORE_LIBRARIES := $(vndk_core_libraries)

$(LOCAL_BUILT_MODULE): PRIVATE_SANITIZER_RUNTIME_LIBRARIES := $(sanitizer_runtime_libraries)

$(LOCAL_BUILT_MODULE): $(LOCAL_PATH)/etc/ld.config.txt.in $(vndk_lib_dep)

	@echo "Generate: $< -> $@"

	@mkdir -p $(dir $@)

	$(hide) sed -e 's?%LLNDK_LIBRARIES%?$(PRIVATE_LLNDK_LIBRARIES)?g' $< >$@

	$(hide) sed -i -e 's?%VNDK_SAMEPROCESS_LIBRARIES%?$(PRIVATE_VNDK_SAMEPROCESS_LIBRARIES)?g' $@

	$(hide) sed -i -e 's?%VNDK_CORE_LIBRARIES%?$(PRIVATE_VNDK_CORE_LIBRARIES)?g' $@

	$(hide) sed -i -e 's?%SANITIZER_RUNTIME_LIBRARIES%?$(PRIVATE_SANITIZER_RUNTIME_LIBRARIES)?g' $@



vndk_lib_md5 :=

vndk_lib_dep :=

llndk_libraries :=

vndk_sameprocess_libraries :=

vndk_core_libraries :=

sanitizer_runtime_libraries :=

else # if _enforce_vndk_at_runtime is not true



LOCAL_MODULE := ld.config.txt

ifeq ($(PRODUCT_FULL_TREBLE)|$(SANITIZE_TARGET),true|)

LOCAL_SRC_FILES := etc/ld.config.txt

LOCAL_SRC_FILES := etc/ld.config.txt

else

else

LOCAL_SRC_FILES := etc/ld.config.legacy.txt

LOCAL_SRC_FILES := etc/ld.config.legacy.txt
@@ -188,3 +242,4 @@ LOCAL_MODULE_CLASS := ETC 
LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)

LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)

LOCAL_MODULE_STEM := $(LOCAL_MODULE)

LOCAL_MODULE_STEM := $(LOCAL_MODULE)

include $(BUILD_PREBUILT)

include $(BUILD_PREBUILT)

endif

rootdir/etc/ld.config.txt

+20 −2
Original line number Original line Diff line number Diff line
@@ -7,6 +7,10 @@ 
dir.system = /system/bin/

dir.system = /system/bin/

dir.system = /system/xbin/

dir.system = /system/xbin/

dir.vendor = /vendor/bin/

dir.vendor = /vendor/bin/

dir.test = /data/nativetest/

dir.test = /data/nativetest64/

dir.test = /data/benchmarktest/

dir.test = /data/benchmarktest64/





[system]

[system]

additional.namespaces = sphal,vndk,rs

additional.namespaces = sphal,vndk,rs
@@ -50,7 +54,7 @@ namespace.default.asan.permitted.paths = /data/asan/system/${LIB}:/system/${LIB} 
namespace.sphal.isolated = true

namespace.sphal.isolated = true

namespace.sphal.visible = true

namespace.sphal.visible = true

namespace.sphal.search.paths = /vendor/${LIB}/egl:/vendor/${LIB}/hw:/vendor/${LIB}

namespace.sphal.search.paths = /vendor/${LIB}/egl:/vendor/${LIB}/hw:/vendor/${LIB}

namespace.sphal.permitted.paths = /vendor/${LIB}

namespace.sphal.permitted.paths = /vendor/${LIB}:/system/${LIB}/vndk-sp/hw





namespace.sphal.asan.search.paths = /data/asan/vendor/${LIB}/egl:/vendor/${LIB}/egl:/data/asan/vendor/${LIB}/hw:/vendor/${LIB}/hw:/data/asan/vendor/${LIB}:/vendor/${LIB}

namespace.sphal.asan.search.paths = /data/asan/vendor/${LIB}/egl:/vendor/${LIB}/egl:/data/asan/vendor/${LIB}/hw:/vendor/${LIB}/hw:/data/asan/vendor/${LIB}:/vendor/${LIB}

namespace.sphal.asan.permitted.paths = /data/asan/vendor/${LIB}:/vendor/${LIB}

namespace.sphal.asan.permitted.paths = /data/asan/vendor/${LIB}:/vendor/${LIB}
@@ -105,9 +109,23 @@ namespace.vndk.asan.permitted.paths = /data/asan/vendor/${LIB}/hw:/vendor/${LIB} 
namespace.vndk.links = default

namespace.vndk.links = default

namespace.vndk.link.default.shared_libs = android.hidl.memory@1.0-impl.so:libc.so:libz.so:libm.so:libdl.so:libstdc++.so:liblog.so:libnativewindow.so:libEGL.so:libsync.so:libvndksupport.so

namespace.vndk.link.default.shared_libs = android.hidl.memory@1.0-impl.so:libc.so:libz.so:libm.so:libdl.so:libstdc++.so:liblog.so:libnativewindow.so:libEGL.so:libsync.so:libvndksupport.so







###############################################################################

# Namespace config for vendor processes. In O, no restriction is enforced for

# them. However, in O-MR1, access to /system/${LIB} will not be allowed to

# the default namespace. 'system' namespace will be added to give limited

# (LL-NDK only) access.

###############################################################################

[vendor]

[vendor]

namespace.default.isolated = false

namespace.default.isolated = false

namespace.default.search.paths = /vendor/${LIB}/hw:/vendor/${LIB}/egl:/vendor/${LIB}:/system/${LIB}/vndk:/vendor/${LIB}/vndk-sp:/system/${LIB}/vndk-sp:/system/${LIB}



namespace.default.asan.search.paths = /data/asan/vendor/${LIB}/hw:/vendor/${LIB}/hw:/data/asan/vendor/${LIB}/egl:/vendor/${LIB}/egl:/data/asan/vendor/${LIB}:/vendor/${LIB}:/data/asan/system/${LIB}/vndk:/system/${LIB}/vndk:/data/asan/vendor/${LIB}/vndk-sp:/vendor/${LIB}/vndk-sp:/data/asan/system/${LIB}/vndk-sp:/system/${LIB}/vndk-sp:/data/asan/system/${LIB}:/system/${LIB}



###############################################################################

# Namespace config for tests. No VNDK restriction is enforced for these tests.

###############################################################################

[test]

namespace.default.isolated = false

namespace.default.search.paths = /vendor/${LIB}:/vendor/${LIB}/vndk-sp:/system/${LIB}/vndk-sp:/system/${LIB}

namespace.default.search.paths = /vendor/${LIB}:/vendor/${LIB}/vndk-sp:/system/${LIB}/vndk-sp:/system/${LIB}





namespace.default.asan.search.paths = /data/asan/vendor/${LIB}:/vendor/${LIB}:/data/asan/vendor/${LIB}/vndk-sp:/vendor/${LIB}/vndk-sp:/data/asan/system/${LIB}/vndk-sp:/system/${LIB}/vndk-sp:/data/asan/system/${LIB}:/system/${LIB}
 
namespace.default.asan.search.paths = /data/asan/vendor/${LIB}:/vendor/${LIB}:/data/asan/vendor/${LIB}/vndk-sp:/vendor/${LIB}/vndk-sp:/data/asan/system/${LIB}/vndk-sp:/system/${LIB}/vndk-sp:/data/asan/system/${LIB}:/system/${LIB}

rootdir/etc/ld.config.txt.in

0 → 100644
+152 −0
Original line number Original line Diff line number Diff line 
# Copyright (C) 2017 The Android Open Source Project

#

# Bionic loader config file.

#



# Don't change the order here. The first pattern that matches with the

# absolution path of an executable is selected.

dir.system = /system/bin/

dir.system = /system/xbin/

dir.vendor = /vendor/bin/

dir.vendor = /data/nativetest/vendor

dir.vendor = /data/nativetest64/vendor

dir.vendor = /data/benchmarktest/vendor

dir.vendor = /data/benchmarktest64/vendor

dir.system = /data/nativetest

dir.system = /data/nativetest64

dir.system = /data/benchmarktest

dir.system = /data/benchmarktest64



[system]

additional.namespaces = sphal,vndk,rs



###############################################################################

# "default" namespace

#

# Framework-side code runs in this namespace. Libs from /vendor partition

# can't be loaded in this namespace.

###############################################################################

namespace.default.isolated = true

# TODO(b/63553457): remove /vendor/lib from the search path. For now, this is

# required since the classloader namespace for vendor apks should have access

# vendor libraries in the directory. These search paths are copied to the search

# paths of the classloader namespace.

namespace.default.search.paths = /system/${LIB}:/vendor/${LIB}

# /vendor/app, /vendor/framework were added since libart should be able to dlopen

# the odex files from the directory.

namespace.default.permitted.paths = /system/${LIB}/drm:/system/${LIB}/hw:/system/framework:/system/app:/system/priv-app:/vendor/app:/vendor/framework:/oem/app:/data:/mnt/expand



namespace.default.asan.search.paths = /data/asan/system/${LIB}:/system/${LIB}:/data/asan/vendor/${LIB}:/vendor/${LIB}

namespace.default.asan.permitted.paths = /data:/system/${LIB}/drm:/system/${LIB}/hw:/system/framework:/system/app:/system/priv-app:/vendor/app:/vendor/framework:/oem/app:/mnt/expand



###############################################################################

# "sphal" namespace

#

# SP-HAL(Sameprocess-HAL)s are the only vendor libraries that are allowed to be

# loaded inside system processes. libEGL_<chipset>.so, libGLESv2_<chipset>.so,

# android.hardware.graphics.mapper@2.0-impl.so, etc are SP-HALs.

#

# This namespace is exclusivly for SP-HALs. When the framework tries to dynami-

# cally load SP-HALs, android_dlopen_ext() is used to explicitly specifying

# that they should be searched and loaded from this namespace.

#

# Note that there is no link from the default namespace to this namespace.

###############################################################################

namespace.sphal.isolated = true

namespace.sphal.visible = true

namespace.sphal.search.paths = /vendor/${LIB}/egl:/vendor/${LIB}/hw:/vendor/${LIB}

namespace.sphal.permitted.paths = /vendor/${LIB}:/system/${LIB}/vndk-sp/hw



namespace.sphal.asan.search.paths = /data/asan/vendor/${LIB}/egl:/vendor/${LIB}/egl:/data/asan/vendor/${LIB}/hw:/vendor/${LIB}/hw:/data/asan/vendor/${LIB}:/vendor/${LIB}

namespace.sphal.asan.permitted.paths = /data/asan/vendor/${LIB}:/vendor/${LIB}



# Once in this namespace, access to libraries in /system/lib is restricted. Only

# libs listed here can be used.

namespace.sphal.links = default,vndk,rs



# WARNING: only NDK libs can be listed here.

namespace.sphal.link.default.shared_libs = %LLNDK_LIBRARIES%:%SANITIZER_RUNTIME_LIBRARIES%



# WARNING: only VNDK-SP libs can be listed here. DO NOT EDIT this line.

namespace.sphal.link.vndk.shared_libs = %VNDK_SAMEPROCESS_LIBRARIES%



# Renderscript gets separate namespace

namespace.sphal.link.rs.shared_libs = libRS_internal.so



###############################################################################

# "rs" namespace

#

# This namespace is exclusively for Renderscript internal libraries.

# This namespace has slightly looser restriction than the vndk namespace because

# of the genuine characteristics of Renderscript; /data is in the permitted path

# to load the compiled *.so file and libmediandk.so can be used here.

###############################################################################

namespace.rs.isolated = true

namespace.rs.visible = true

namespace.rs.search.paths = /vendor/${LIB}/vndk-sp:/system/${LIB}/vndk-sp:/vendor/${LIB}

namespace.rs.permitted.paths = /vendor/${LIB}:/data



namespace.rs.asan.search.paths = /data/asan/vendor/${LIB}/vndk-sp:/vendor/${LIB}/vndk-sp:/data/asan/system/${LIB}/vndk-sp:/system/${LIB}/vndk-sp:/data/asan/vendor/${LIB}:/vendor/${LIB}

namespace.rs.asan.permitted.paths = /data/asan/vendor/${LIB}:/vendor/${LIB}:/data



namespace.rs.links = default,vndk

namespace.rs.link.default.shared_libs = %LLNDK_LIBRARIES%:%SANITIZER_RUNTIME_LIBRARIES%

namespace.rs.link.vndk.shared_libs = %VNDK_SAMEPROCESS_LIBRARIES%



###############################################################################

# "vndk" namespace

#

# This namespace is exclusively for vndk-sp libs.

###############################################################################

namespace.vndk.isolated = true

namespace.vndk.search.paths = /vendor/${LIB}/vndk-sp:/system/${LIB}/vndk-sp

namespace.vndk.permitted.paths = /vendor/${LIB}/hw:/vendor/${LIB}/egl



namespace.vndk.asan.search.paths = /data/asan/vendor/${LIB}/vndk-sp:/vendor/${LIB}/vndk-sp:/data/asan/system/${LIB}/vndk-sp:/system/${LIB}/vndk-sp

namespace.vndk.asan.permitted.paths = /data/asan/vendor/${LIB}/hw:/vendor/${LIB}/hw:/data/asan/vendor/${LIB}/egl:/vendor/${LIB}/egl



# When these NDK libs are required inside this namespace, then it is redirected

# to the default namespace. This is possible since their ABI is stable across

# Android releases.

namespace.vndk.links = default

namespace.vndk.link.default.shared_libs = %LLNDK_LIBRARIES%:%SANITIZER_RUNTIME_LIBRARIES%



###############################################################################

# Namespace config for vendor processes. In O, no restriction is enforced for

# them. However, in O-MR1, access to /system/${LIB} will not be allowed to

# the default namespace. 'system' namespace will be added to give limited

# (LL-NDK only) access.

###############################################################################

[vendor]

additional.namespaces = system



###############################################################################

# "default" namespace

#

# Vendor-side code runs in this namespace.

###############################################################################

namespace.default.isolated = true

namespace.default.visible = true



namespace.default.search.paths = /vendor/${LIB}/hw:/vendor/${LIB}/egl:/vendor/${LIB}:/vendor/${LIB}/vndk:/system/${LIB}/vndk:/vendor/${LIB}/vndk-sp:/system/${LIB}/vndk-sp

namespace.default.permitted.paths = /vendor:/system/${LIB}/vndk:/system/${LIB}/vndk-sp



namespace.default.asan.search.paths = /data/asan/vendor/${LIB}/hw:/vendor/${LIB}/hw:/data/asan/vendor/${LIB}/egl:/vendor/${LIB}/egl:/data/asan/vendor/${LIB}:/vendor/${LIB}:/data/asan/vendor/${LIB}/vndk:/vendor/${LIB}/vndk:/data/asan/system/${LIB}/vndk:/system/${LIB}/vndk:/data/asan/vendor/${LIB}/vndk-sp:/vendor/${LIB}/vndk-sp:/data/asan/system/${LIB}/vndk-sp:/system/${LIB}/vndk-sp

namespace.default.asan.permitted.paths = /data/asan/vendor:/vendor:/data/asan/system/${LIB}/vndk:/system/${LIB}/vndk:/data/asan/system/${LIB}/vndk-sp:/system/${LIB}/vndk-sp



namespace.default.links = system

namespace.default.link.system.shared_libs = %LLNDK_LIBRARIES%:libmedia.so:libandroid_runtime.so

# libmedia.so must be removed after we have fix for lib-dplmedia.so (b/64427765)

# libandroid_runtime.so must be removed after we have a fix for qseeproxydaemon (b/64820887)



###############################################################################

# "system" namespace

#

# This is for vendor process to use LL-NDK in system partition.

###############################################################################

namespace.system.isolated = false

namespace.system.search.paths = /system/${LIB}

namespace.system.permitted.paths = /system/${LIB}



namespace.system.asan.search.paths = /data/asan/system/${LIB}:/system/${LIB}

namespace.system.asan.permitted.paths = /data/asan/system/${LIB}:/system/${LIB}