summaryrefslogtreecommitdiff
path: root/src/qcam/assets
diff options
context:
space:
mode:
authorNicholas Roth <nicholas@rothemail.net>2022-10-30 18:04:58 -0500
committerJacopo Mondi <jacopo@jmondi.org>2022-12-01 11:32:13 +0100
commit69050ca70469c40b90fad8bc2b3182ebe1ea4f5a (patch)
tree5cfc6f7a9aed031e6eb8e7c3e2d448718c66356c /src/qcam/assets
parentac58d82c55806dea35275344f0fd12a4cf2c8904 (diff)
ipa: add a flag to disable isolation for Android
Currently, libcamera isolates any IPAs whose signatures cannot be verified. Shared objects are created at build-time, and then signed. The public signing key is embedded in a .cpp file, and libcamera verifies IPA signatures at runtime. When libcamera cannot authenticate an IPA, it runs it out-of-process. This is problematic on three levels: * IPA signing fundamentally does not work on Android for vendor modules like HALs (discussed below) * Executables built to run out-of-process are not ABI-compatible with Android, making isolation infeasible [1] * Linux phone hardware tends to be low-end because of the FOSS requirement, so the performance hit from out-of-process IPA isolation is significant IPA signing fundamentally does not work for Android vendor modules: After we "meson install" built .so files to a known location, Android explicitly access them in PREBUILT_SHARED_LIBRARY or BUILD_PREBUILIT to transform the .so files by stripping symbols among other things [2]. By modifying prebuilt libraries after we have already signed them, the build system renders our signatures useless on Android. Android distribution maintainers can use this flag to disable signature verification, which will allow them to use libcamera. [1] https://github.com/waydroid/waydroid/issues/519 [2] https://cs.android.com/android/platform/superproject/+/master:build/make/core/cc_prebuilt_internal.mk?q=cc_prebuilt_internal Signed-off-by: Nicholas Roth <nicholas@rothemail.net>
Diffstat (limited to 'src/qcam/assets')
0 files changed, 0 insertions, 0 deletions