From ba7a418cab3022556773fd677478f7cd2a2dea5f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Date: Thu, 20 Mar 2025 11:50:17 -0700 Subject: [PATCH] NetBpfLoad: 25Q2+ enforce 1GiB+ memlock MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On at least some kernel versions sufficient memlock is needed for some [types? larger? preallocated?] bpf map creation requests to succeed. (the kernel's bpf subsys ignores CAP_IPC_LOCK) Test: TreeHugger Signed-off-by: Maciej Żenczykowski Change-Id: Ia6975e854e6398ee9c56ce836b278b570e17a0f9 --- bpf/netd/BpfHandler.cpp | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/bpf/netd/BpfHandler.cpp b/bpf/netd/BpfHandler.cpp index d41aa812b3..680c05eb00 100644 --- a/bpf/netd/BpfHandler.cpp +++ b/bpf/netd/BpfHandler.cpp @@ -268,6 +268,16 @@ Status BpfHandler::init(const char* cg2_path) { RETURN_IF_NOT_OK(initMaps()); if (isAtLeast25Q2) { + struct rlimit limit = { + .rlim_cur = 1u << 30, // 1 GiB + .rlim_max = 1u << 30, // 1 GiB + }; + // 25Q2 netd.rc includes "rlimit memlock 1073741824 1073741824" + // so this should be a no-op, and thus just succeed. + // make sure it isn't lowered in platform netd.rc... + if (setrlimit(RLIMIT_MEMLOCK, &limit)) + return statusFromErrno(errno, "Failed to set 1GiB RLIMIT_MEMLOCK"); + // Make sure netd can create & write maps. sepolicy is V+, but enough to enforce on 25Q2+ int key = 1; int value = 123;