From: Stanislav Fomichev <sdf@fomichev•me>
To: Alexei Starovoitov <alexei.starovoitov@gmail•com>
Cc: Stanislav Fomichev <sdf@google•com>,
netdev@vger•kernel.org, bpf@vger•kernel.org, davem@davemloft•net,
ast@kernel•org, daniel@iogearbox•net, Martin Lau <kafai@fb•com>
Subject: Re: [PATCH bpf-next v8 1/9] bpf: implement getsockopt and setsockopt hooks
Date: Wed, 26 Jun 2019 12:10:21 -0700 [thread overview]
Message-ID: <20190626191021.GB4866@mini-arch> (raw)
In-Reply-To: <20190626185420.wzsb7v6rawn4wtzd@ast-mbp.dhcp.thefacebook.com>
On 06/26, Alexei Starovoitov wrote:
> On Mon, Jun 24, 2019 at 09:24:21AM -0700, Stanislav Fomichev wrote:
> > Implement new BPF_PROG_TYPE_CGROUP_SOCKOPT program type and
> > BPF_CGROUP_{G,S}ETSOCKOPT cgroup hooks.
> >
> > BPF_CGROUP_SETSOCKOPT get a read-only view of the setsockopt arguments.
> > BPF_CGROUP_GETSOCKOPT can modify the supplied buffer.
> > Both of them reuse existing PTR_TO_PACKET{,_END} infrastructure.
>
> getsockopt side looks good to me.
> I tried to convince myself that readonly setsockopt is fine for now,
> but it feels we need to make it writeable from the start.
> I agree with your reasoning that doing copy_to_user is no good,
> but we can do certainly do set_fs(KERNEL_DS) game.
> The same way as kernel_setsockopt() is doing.
> It seems quite useful to modify 'optval' before passing it to kernel.
> Then bpf prog would be able to specify sane values for SO_SNDBUF
> instead of rejecting them.
> The alternative would be to allow bpf prog to call setsockopt
> from inside, but sock is locked when prog is running,
> so unlocking within helper is not going to be clean.
> wdyt?
Sure, I can take a look if you think that it would be useful in general.
Looks like set_fs should do the trick.
(I was thinking about exporting something like the existing bpf_setsockopt
to a setsockopt hooks, but I agree, it comes with its own bag
of problems).
next prev parent reply other threads:[~2019-06-26 19:10 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-24 16:24 [PATCH bpf-next v8 0/9] bpf: getsockopt and setsockopt hooks Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 1/9] bpf: implement " Stanislav Fomichev
2019-06-24 21:19 ` Andrii Nakryiko
2019-06-26 18:54 ` Alexei Starovoitov
2019-06-26 19:10 ` Stanislav Fomichev [this message]
2019-06-26 19:21 ` Alexei Starovoitov
2019-06-24 16:24 ` [PATCH bpf-next v8 2/9] bpf: sync bpf.h to tools/ Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 3/9] libbpf: support sockopt hooks Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 4/9] selftests/bpf: test sockopt section name Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 5/9] selftests/bpf: add sockopt test Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 6/9] selftests/bpf: add sockopt test that exercises sk helpers Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 7/9] selftests/bpf: add sockopt test that exercises BPF_F_ALLOW_MULTI Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 8/9] bpf: add sockopt documentation Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 9/9] bpftool: support cgroup sockopt Stanislav Fomichev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190626191021.GB4866@mini-arch \
--to=sdf@fomichev$(echo .)me \
--cc=alexei.starovoitov@gmail$(echo .)com \
--cc=ast@kernel$(echo .)org \
--cc=bpf@vger$(echo .)kernel.org \
--cc=daniel@iogearbox$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=kafai@fb$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=sdf@google$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox