tequilaOS/platform_system_bpf
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

execute bpfloader via netbpfload

Browse source 
This effectively reverts us most of the way back to U,
after this change we have:

$ git diff aosp/android14-release:bpfloader/bpfloader.rc HEAD:bpfloader/bpfloader.rc
@@ -17,7 +17,8 @@
 on load_bpf_programs
     exec_start bpfloader

-service bpfloader /system/bin/bpfloader
+service bpfloader /system/bin/netbpfload
+    # netbpfload will do network bpf loading, then execute /system/bin/bpfloader
     capabilities CHOWN SYS_ADMIN NET_ADMIN
     # The following group memberships are a workaround for lack of DAC_OVERRIDE
     # and allow us to open (among other things) files that we created and are
@@ -67,10 +68,10 @@ service bpfloader /system/bin/bpfloader
     # 2. comment out 'reboot_on_failure reboot,bpfloader-failed' below
     # 3. rebuild/reflash/reboot
     # 4. as the device is booting up capture bpfloader logs via:
-    #    adb logcat -s 'bpfloader:*' 'LibBpfLoader:*'
+    #    adb logcat -s 'bpfloader:*' 'LibBpfLoader:*' 'NetBpfLoad:*' 'NetBpfLoader:*'
     #
     # something like:
-    #   $ adb reboot; sleep 1; adb wait-for-device; adb root; sleep 1; adb wait-for-device; adb logcat -s 'bpfloader:*' 'LibBpfLoader:*'
+    #   $ adb reboot; sleep 1; adb wait-for-device; adb root; sleep 1; adb wait-for-device; adb logcat -s 'bpfloader:*' 'LibBpfLoader:*' 'NetBpfLoad:*' 'NetBpfLoader:*'
     # will take care of capturing logs as early as possible
     #
     # 5. look through the logs from the kernel's bpf verifier that bpfloader dumps out,

Change-Id: If3bc3da2b66fdb135850d094df68a9dc420be832
This commit is contained in:
Maciej Żenczykowski 2023-10-20 14:17:02 -07:00
parent ab8fd4c4f6
commit 483d5710e8
1 changed files with 9 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
bpfloader/bpfloader.rc
View file

@ -15,17 +15,17 @@
# considered to have booted successfully. # considered to have booted successfully.
# #
on load_bpf_programs on load_bpf_programs
exec_start netbpfload
exec_start bpfloader exec_start bpfloader
service bpfloader /system/bin/bpfloader service bpfloader /system/bin/netbpfload
capabilities CHOWN SYS_ADMIN # netbpfload will do network bpf loading, then execute /system/bin/bpfloader
capabilities CHOWN SYS_ADMIN NET_ADMIN
# The following group memberships are a workaround for lack of DAC_OVERRIDE # The following group memberships are a workaround for lack of DAC_OVERRIDE
# and allow us to open (among other things) files that we created and are # and allow us to open (among other things) files that we created and are
# no longer root owned (due to CHOWN) but still have group read access to # no longer root owned (due to CHOWN) but still have group read access to
# one of the following groups. This is not perfect, but a more correct # one of the following groups. This is not perfect, but a more correct
# solution requires significantly more effort to implement. # solution requires significantly more effort to implement.
group root graphics system group root graphics network_stack net_admin net_bw_acct net_bw_stats net_raw system
user root user root
# #
# Set RLIMIT_MEMLOCK to 1GiB for bpfloader # Set RLIMIT_MEMLOCK to 1GiB for bpfloader
@ -37,8 +37,9 @@ service bpfloader /system/bin/bpfloader
# memlock data before bpfloader even gets a chance to run, it would fail # memlock data before bpfloader even gets a chance to run, it would fail
# if its memlock rlimit is only 8MiB - since there would be none left for it. # if its memlock rlimit is only 8MiB - since there would be none left for it.
# #
# bpfloader succeeding is critical to system health: # bpfloader succeeding is critical to system health, since a failure will
# the only way to recover is a full kernel reboot. # cause netd crashloop and thus system server crashloop... and the only
# recovery is a full kernel reboot.
# #
# We've had issues where devices would sometimes (rarely) boot into # We've had issues where devices would sometimes (rarely) boot into
# a crashloop because bpfloader would occasionally lose a boot time # a crashloop because bpfloader would occasionally lose a boot time
@ -67,10 +68,10 @@ service bpfloader /system/bin/bpfloader
# 2. comment out 'reboot_on_failure reboot,bpfloader-failed' below # 2. comment out 'reboot_on_failure reboot,bpfloader-failed' below
# 3. rebuild/reflash/reboot # 3. rebuild/reflash/reboot
# 4. as the device is booting up capture bpfloader logs via: # 4. as the device is booting up capture bpfloader logs via:
# adb logcat -s 'bpfloader:*' 'LibBpfLoader:*' # adb logcat -s 'bpfloader:*' 'LibBpfLoader:*' 'NetBpfLoad:*' 'NetBpfLoader:*'
# #
# something like: # something like:
# $ adb reboot; sleep 1; adb wait-for-device; adb root; sleep 1; adb wait-for-device; adb logcat -s 'bpfloader:*' 'LibBpfLoader:*' # $ adb reboot; sleep 1; adb wait-for-device; adb root; sleep 1; adb wait-for-device; adb logcat -s 'bpfloader:*' 'LibBpfLoader:*' 'NetBpfLoad:*' 'NetBpfLoader:*'
# will take care of capturing logs as early as possible # will take care of capturing logs as early as possible
# #
# 5. look through the logs from the kernel's bpf verifier that bpfloader dumps out, # 5. look through the logs from the kernel's bpf verifier that bpfloader dumps out,
@ -83,14 +84,3 @@ service bpfloader /system/bin/bpfloader
reboot_on_failure reboot,bpfloader-failed reboot_on_failure reboot,bpfloader-failed
# we're not really updatable, but want to be able to load bpf programs shipped in apexes # we're not really updatable, but want to be able to load bpf programs shipped in apexes
updatable updatable
# Note: comments for 'bpfloader' from up above also apply here.
# Use: adb logcat -s 'NetBpfLoad:*' 'NetBpfLoader:*'
service netbpfload /system/bin/netbpfload
capabilities CHOWN SYS_ADMIN NET_ADMIN
group root network_stack net_admin net_bw_acct net_bw_stats net_raw system
user root
rlimit memlock 1073741824 1073741824
oneshot
reboot_on_failure reboot,netbpfload-failed
updatable