systemd: fix noisy messages about eBPF
Patch systemd sources to fix detection of availability of
the kernel CONFIG_CGROUP_BPF option.
Resolves openbmc/linux#159
(From meta-phosphor rev: 7fbc79b12dc5e137830ffd35c0be839fe77b6699)
Change-Id: I82cd227cb6e14ca57a373b1c6a100a98cff799af
Signed-off-by: Alexander Filippov <a.filippov@yadro.com>
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
diff --git a/meta-phosphor/recipes-core/systemd/systemd/0006-core-fix-the-check-if-CONFIG_CGROUP_BPF-is-on.patch b/meta-phosphor/recipes-core/systemd/systemd/0006-core-fix-the-check-if-CONFIG_CGROUP_BPF-is-on.patch
new file mode 100644
index 0000000..fc3f9e1
--- /dev/null
+++ b/meta-phosphor/recipes-core/systemd/systemd/0006-core-fix-the-check-if-CONFIG_CGROUP_BPF-is-on.patch
@@ -0,0 +1,64 @@
+From 501fa6c60d303f0d6e747939172281d77247626e Mon Sep 17 00:00:00 2001
+From: Alexander Filippov <a.filippov@yadro.com>
+Date: Mon, 17 Sep 2018 13:33:06 +0300
+Subject: [PATCH] core: fix the check if CONFIG_CGROUP_BPF is on
+
+Since the commit torvalds/linux@fdb5c4531c1e0e50e609df83f736b6f3a02896e2
+the syscall BPF_PROG_ATTACH return EBADF when CONFIG_CGROUP_BPF is
+turned off and as result the bpf_firewall_supported() returns the
+incorrect value.
+
+This commmit replaces the syscall BPF_PROG_ATTACH with BPF_PROG_DETACH
+which is still work as expected.
+
+Resolves openbmc/linux#159
+See also systemd/systemd#7054
+
+Signed-off-by: Alexander Filippov <a.filippov@yadro.com>
+---
+ src/core/bpf-firewall.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/src/core/bpf-firewall.c b/src/core/bpf-firewall.c
+index f3f40fb0e8..51dc5b9506 100644
+--- a/src/core/bpf-firewall.c
++++ b/src/core/bpf-firewall.c
+@@ -658,7 +658,7 @@ int bpf_firewall_supported(void) {
+ * b) whether the unified hierarchy is being used
+ * c) the BPF implementation in the kernel supports BPF LPM TRIE maps, which we require
+ * d) the BPF implementation in the kernel supports BPF_PROG_TYPE_CGROUP_SKB programs, which we require
+- * e) the BPF implementation in the kernel supports the BPF_PROG_ATTACH call, which we require
++ * e) the BPF implementation in the kernel supports the BPF_PROG_DETACH call, which we require
+ *
+ */
+
+@@ -711,7 +711,7 @@ int bpf_firewall_supported(void) {
+ * is turned off at kernel compilation time. This sucks of course: why does it allow us to create a cgroup BPF
+ * program if we can't do a thing with it later?
+ *
+- * We detect this case by issuing the BPF_PROG_ATTACH bpf() call with invalid file descriptors: if
++ * We detect this case by issuing the BPF_PROG_DETACH bpf() call with invalid file descriptors: if
+ * CONFIG_CGROUP_BPF is turned off, then the call will fail early with EINVAL. If it is turned on the
+ * parameters are validated however, and that'll fail with EBADF then. */
+
+@@ -721,14 +721,14 @@ int bpf_firewall_supported(void) {
+ .attach_bpf_fd = -1,
+ };
+
+- r = bpf(BPF_PROG_ATTACH, &attr, sizeof(attr));
++ r = bpf(BPF_PROG_DETACH, &attr, sizeof(attr));
+ if (r < 0) {
+ if (errno == EBADF) /* YAY! */
+ return supported = true;
+
+- log_debug_errno(errno, "Didn't get EBADF from BPF_PROG_ATTACH, BPF firewalling is not supported: %m");
++ log_debug_errno(errno, "Didn't get EBADF from BPF_PROG_DETACH, BPF firewalling is not supported: %m");
+ } else
+- log_debug("Wut? kernel accepted our invalid BPF_PROG_ATTACH call? Something is weird, assuming BPF firewalling is broken and hence not supported.");
++ log_debug("Wut? kernel accepted our invalid BPF_PROG_DETACH call? Something is weird, assuming BPF firewalling is broken and hence not supported.");
+
+ return supported = false;
+ }
+--
+2.14.4
+
diff --git a/meta-phosphor/recipes-core/systemd/systemd_%.bbappend b/meta-phosphor/recipes-core/systemd/systemd_%.bbappend
index b403069..bc568cd 100644
--- a/meta-phosphor/recipes-core/systemd/systemd_%.bbappend
+++ b/meta-phosphor/recipes-core/systemd/systemd_%.bbappend
@@ -13,6 +13,7 @@
#TODO upstream the below patch via below issue
#https://github.com/openbmc/openbmc/issues/2016
SRC_URI += "file://0005-dont-return-error-if-unable-to-create-network-namespace.patch"
+SRC_URI += "file://0006-core-fix-the-check-if-CONFIG_CGROUP_BPF-is-on.patch"
RRECOMMENDS_${PN} += "obmc-targets"
FILES_${PN} += "${systemd_unitdir}/network/default.network"