fix(network): apply RKNN network settings through NetworkManager

[athenawxd]

Summary

RKNN builds save network configuration but reject applying it because the network entry points are guarded as Sophon-only. Use NetworkManager to persist and apply RKNN IP, DHCP, and DNS configuration at startup.

Related issue

No linked issue; diagnosis and scope are recorded here.

Root cause

DoNetCard, DoNetCards, and DnsEffect reject every non-Sophon backend, including RKNN, while logging that the platform is x86.

Scope

In scope

• Modify the active profile by UUID, reapply it, and fall back to activation.
• Create a profile for a disconnected interface if needed; skip a missing secondary interface.
• Persist DNS and query DHCP mode through NetworkManager.
• Add regression coverage for static configuration, DHCP transitions, DNS, profile creation and command failures.

Out of scope

Device deployment and firmware changes. Existing Sophon and CPU paths are unchanged.

Risk tags

• API / authentication / network
• Build / package / deployment
• Compatibility / migration

Type of change

• Bug fix
• Test

Area

• Backend service

Candidate identity

• Parent / tested base: 3eac959ee8e15ea0834eba1904b7d357297e2833
• Candidate commit: 0c62cfa5c9bfd78a3e042ba380bc5fd2f1daea3d
• Candidate tree: 9a6d075d1facd1e427d3d6efa6029f5cd9e5c8e9
• Package SHA-256: 7344ea8819659e28799138cea501b899c31badab3a5e4a6a38d709170cb7ed07
• Test binary SHA-256: not recorded.

The original network build/package evidence below was collected for commit 8026b67 before committing, from the same five network-related changed files. They were not subsequently modified. This is not a post-commit rebuild. The tested preserve-models package reports V1.1.94 from the parent revision and is not a newly published release.

Verification

Parent baseline

FAIL (observed startup): unsupported network configuration, with Network Init DoNetCards Ret -1. No separate parent full-suite run was collected.

Candidate checks

• PASS: native Linux focused workflow tests: g++ -std=c++17 -O0 -Isrc -Itest test/test_network_manager_config.cc test/catch_amalgamated.cpp -o <test-binary> then <test-binary> '[network-manager]': 5 cases, 54 assertions.
• PASS: bash scripts/build_cpu_test.sh in the existing x86 builder.
• PASS: LD_LIBRARY_PATH=/src/prebuild/ffmpeg/x86_64/lib:/src/build_cpu/thirdparty_install/openssl/lib ./build_cpu/cosmo-tests: 1018 cases, 18424 assertions. Earlier execution attempts failed to resolve FFmpeg / selected incompatible system OpenSSL; the final process-local library path resolved both, without system installation.
• PASS: bash scripts/build_rknn.sh -c rk3576 -r /opt/rknn -p /opt/rockchip-media/rk3576 -T in the repository-locked Rockchip builder, using production-release, preserve-models and required RKLLM settings. Both engine and aarch64 tests compiled; hardware tests were not run.
• PASS: python3 scripts/verify_package_contents.py --archive <package> --build-profile production-release --target-chip rk3576 --target-policy-lock config/rockchip-build/builder-lock.json.
• PASS: bash scripts/format_check.sh --staged --check, clang-format 18.1.8, all four changed C++ files.
• PASS: git diff --check.
• Full-repository formatting has existing unrelated source/node_modules failures; no unrelated files were reformatted.

Risk-based evidence

Command workflow tested through an injected argv runner. Post-reboot network behavior on hardware remains unverified; no device/production acceptance claim is made.

Documentation impact

• Documentation will be handled in a follow-up for supported firmware/network-manager combinations.

Compatibility and deployment impact

RKNN configuration requires NetworkManager/nmcli and permission to change network profiles. Applying a changed address can interrupt active connections. Sophon keeps its existing implementation; CPU network writes remain unsupported.

Third-party code and assets

• No third-party code, models, datasets, media or generated assets added.
• No GPL/AGPL code added.

Security and release checklist

• No credentials, certificates, customer endpoints, private device identifiers or model weights included.
• Signed-off-by included as required by CONTRIBUTING.md.
• CONTRIBUTING.md and CODE_OF_CONDUCT.md read.

Acceptance and cleanup

• Candidate-bound hardware acceptance: pending.
• Device test filter, backup and cleanup: N/A; no device changes made.
• Local Git status: clean; private build evidence is ignored.
• No temporary credentials, device exports or generated packages included.

Notes for reviewers

Review profile selection and activation/reapply behavior on supported NetworkManager-managed RK images. Build and unit tests are not hardware acceptance.

CI scheduling regression

The initial x86 workflow compiled successfully but failed CameraServiceImpl: concurrent GetTasks reads are safe: the main thread could set stop before any reader ran, resulting in readCount == 0. This was reproduced by repeating the original test on one CPU.

Each reader now performs 100 reads and the main thread checks the exact total and empty results after joining. No production code is changed by this test correction. The test covers concurrent calls against a missing camera, not atomic updates to real task state.

Validation for the updated test source before commit:

• PASS: bash scripts/build_cpu_test.sh and full CPU suite: 1018 cases, 33114 assertions.
• PASS: 100 consecutive targeted runs constrained to one CPU, using the same reproduction setup.
• PASS: staged clang-format 18 check and git diff --check.
• RK hardware execution remains unverified; the historical package above was not rebuilt for this test-only correction.