Field-debug node for the kmod, and stop truncating bundles on big ROMs - #313
Merged
Conversation
Read-only proc node, separate from the frozen control/telemetry wire, for root-causing field reports where the module perturbs networking. Surfaces kernel-internal state that /proc/vpnhide_ctl does not: per-probe registration plus kretprobe/kprobe nmissed counters (to see if a device exhausts VPNHIDE_KRETPROBE_MAXACTIVE), active vs installed hook masks, and the LIVE is_vpn_ifname() verdict against every netdev in the reader's netns. Reports the current verdict as-is, bugs included, so a false-positive interface match is observable. The debug-bundle collector cats it into a new kmod_diag section; no UI surface.
…shot sections probe_mask (module_param, baked in via -DVPNHIDE_PROBE_MASK_DEFAULT) gates which hooks register at load — bits 0-9 the kretprobes, 10 socket-bind, 11 filesystem (ANDed with filesystem_hiding). Default 0xfff = current behaviour; a diagnostic variant bakes in a reduced set with no source edit. A fully-masked build stays loaded-but-inert (init no longer aborts when nothing was attempted). Surfaced in /proc/vpnhide_diag. Also reorder the debug snapshot so network_*/proc_net_* emit before the heavy per-user pm scans (which overran the su timeout on bloatware-heavy HyperOS and truncated exactly the route sections); timeout 60s->120s as backstop.
Build-time -DVPNHIDE_BARE_INIT makes vpnhide_init return immediately (no hooks, no proc nodes, no symbol resolution) so a loaded-but-does-nothing .ko can be tested in the field to separate 'loading the module at all' from anything the module's init does. Default builds unaffected.
The branch added /proc/vpnhide_diag and a kmod_diag bundle section but documented neither, and this repo's rule is that every path it creates is written down with its owner and lifetime. Also logs the truncation fix that came with the reordering: bundles from bloatware-heavy ROMs were losing exactly the network and routing sections a connectivity report needs, because the per-user package scan ahead of them ate the su timeout.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This branch had been sitting unrebased since before the shell moved out of Kotlin, so it is rebased onto main here and its snapshot changes are ported into
resources/shell/debug_snapshot.sh. Two of its three parts are worth having in main regardless of the Xiaomi 14 Ultra investigation that prompted them.Bundles were losing the sections a connectivity report needs. The per-user package scan ran before the network probes and can eat most of the su timeout on a bloatware-heavy ROM — both recent reporters' bundles came back truncated at
app_scan_diagnostics, with everynetwork_*andproc_net_*section gone. Those now run first, and the timeout is 120s as a backstop rather than the fix./proc/vpnhide_diag— read-only, root-only, separate from the frozen control/telemetry wire and never parsed. It reports what/proc/vpnhide_ctlcannot: per-probe registration, kretprobe/kprobenmissedcounters (an exhaustedVPNHIDE_KRETPROBE_MAXACTIVEbecomes visible), active vs installed hook masks, and the liveis_vpn_ifname()verdict for every netdev in the reader's netns — reported as-is, bugs included, so a false-positive interface match shows up instead of being hidden by a corrected copy of the logic. The bundle cats it into akmod_diagsection.Build-time diagnostic gates, both no-ops by default:
probe_mask(-DVPNHIDE_PROBE_MASK_DEFAULT, default0xfff= today's behaviour) to bisect which hook perturbs a device without source edits, and-DVPNHIDE_BARE_INITfor a loaded-but-inert.kothat separates "loading the module at all" from anything its init does.Docs: the new proc node is recorded in state.md with owner and lifetime, and the section in debug-bundle.md.