From 2525cdec7046b85f1e4ffa8f284c3a5185d97dbb Mon Sep 17 00:00:00 2001 From: Alexander Filippov Date: Mon, 17 Sep 2018 12:09:30 +0300 Subject: systemd: fix noisy messages about eBPF Patch systemd sources to fix detection of availability of the kernel CONFIG_CGROUP_BPF option. Resolves openbmc/linux#159 (From meta-phosphor rev: 7fbc79b12dc5e137830ffd35c0be839fe77b6699) Change-Id: I82cd227cb6e14ca57a373b1c6a100a98cff799af Signed-off-by: Alexander Filippov Signed-off-by: Brad Bishop --- ...-fix-the-check-if-CONFIG_CGROUP_BPF-is-on.patch | 64 ++++++++++++++++++++++ .../recipes-core/systemd/systemd_%.bbappend | 1 + 2 files changed, 65 insertions(+) create mode 100644 meta-phosphor/recipes-core/systemd/systemd/0006-core-fix-the-check-if-CONFIG_CGROUP_BPF-is-on.patch (limited to 'meta-phosphor/recipes-core/systemd') diff --git a/meta-phosphor/recipes-core/systemd/systemd/0006-core-fix-the-check-if-CONFIG_CGROUP_BPF-is-on.patch b/meta-phosphor/recipes-core/systemd/systemd/0006-core-fix-the-check-if-CONFIG_CGROUP_BPF-is-on.patch new file mode 100644 index 0000000000..fc3f9e1ee5 --- /dev/null +++ b/meta-phosphor/recipes-core/systemd/systemd/0006-core-fix-the-check-if-CONFIG_CGROUP_BPF-is-on.patch @@ -0,0 +1,64 @@ +From 501fa6c60d303f0d6e747939172281d77247626e Mon Sep 17 00:00:00 2001 +From: Alexander Filippov +Date: Mon, 17 Sep 2018 13:33:06 +0300 +Subject: [PATCH] core: fix the check if CONFIG_CGROUP_BPF is on + +Since the commit torvalds/linux@fdb5c4531c1e0e50e609df83f736b6f3a02896e2 +the syscall BPF_PROG_ATTACH return EBADF when CONFIG_CGROUP_BPF is +turned off and as result the bpf_firewall_supported() returns the +incorrect value. + +This commmit replaces the syscall BPF_PROG_ATTACH with BPF_PROG_DETACH +which is still work as expected. + +Resolves openbmc/linux#159 +See also systemd/systemd#7054 + +Signed-off-by: Alexander Filippov +--- + src/core/bpf-firewall.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/src/core/bpf-firewall.c b/src/core/bpf-firewall.c +index f3f40fb0e8..51dc5b9506 100644 +--- a/src/core/bpf-firewall.c ++++ b/src/core/bpf-firewall.c +@@ -658,7 +658,7 @@ int bpf_firewall_supported(void) { + * b) whether the unified hierarchy is being used + * c) the BPF implementation in the kernel supports BPF LPM TRIE maps, which we require + * d) the BPF implementation in the kernel supports BPF_PROG_TYPE_CGROUP_SKB programs, which we require +- * e) the BPF implementation in the kernel supports the BPF_PROG_ATTACH call, which we require ++ * e) the BPF implementation in the kernel supports the BPF_PROG_DETACH call, which we require + * + */ + +@@ -711,7 +711,7 @@ int bpf_firewall_supported(void) { + * is turned off at kernel compilation time. This sucks of course: why does it allow us to create a cgroup BPF + * program if we can't do a thing with it later? + * +- * We detect this case by issuing the BPF_PROG_ATTACH bpf() call with invalid file descriptors: if ++ * We detect this case by issuing the BPF_PROG_DETACH bpf() call with invalid file descriptors: if + * CONFIG_CGROUP_BPF is turned off, then the call will fail early with EINVAL. If it is turned on the + * parameters are validated however, and that'll fail with EBADF then. */ + +@@ -721,14 +721,14 @@ int bpf_firewall_supported(void) { + .attach_bpf_fd = -1, + }; + +- r = bpf(BPF_PROG_ATTACH, &attr, sizeof(attr)); ++ r = bpf(BPF_PROG_DETACH, &attr, sizeof(attr)); + if (r < 0) { + if (errno == EBADF) /* YAY! */ + return supported = true; + +- log_debug_errno(errno, "Didn't get EBADF from BPF_PROG_ATTACH, BPF firewalling is not supported: %m"); ++ log_debug_errno(errno, "Didn't get EBADF from BPF_PROG_DETACH, BPF firewalling is not supported: %m"); + } else +- log_debug("Wut? kernel accepted our invalid BPF_PROG_ATTACH call? Something is weird, assuming BPF firewalling is broken and hence not supported."); ++ log_debug("Wut? kernel accepted our invalid BPF_PROG_DETACH call? Something is weird, assuming BPF firewalling is broken and hence not supported."); + + return supported = false; + } +-- +2.14.4 + diff --git a/meta-phosphor/recipes-core/systemd/systemd_%.bbappend b/meta-phosphor/recipes-core/systemd/systemd_%.bbappend index b403069a58..bc568cd480 100644 --- a/meta-phosphor/recipes-core/systemd/systemd_%.bbappend +++ b/meta-phosphor/recipes-core/systemd/systemd_%.bbappend @@ -13,6 +13,7 @@ SRC_URI += "file://0004-basic-Use-path-escaping-when-mangling-path-instances.pat #TODO upstream the below patch via below issue #https://github.com/openbmc/openbmc/issues/2016 SRC_URI += "file://0005-dont-return-error-if-unable-to-create-network-namespace.patch" +SRC_URI += "file://0006-core-fix-the-check-if-CONFIG_CGROUP_BPF-is-on.patch" RRECOMMENDS_${PN} += "obmc-targets" FILES_${PN} += "${systemd_unitdir}/network/default.network" -- cgit v1.2.3