From: Stanislav Fomichev <sdf@fomichev.me>
To: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc: Stanislav Fomichev <sdf@google.com>,
netdev@vger.kernel.org, bpf@vger.kernel.org, davem@davemloft.net,
ast@kernel.org, daniel@iogearbox.net, Martin Lau <kafai@fb.com>
Subject: Re: [PATCH bpf-next v8 1/9] bpf: implement getsockopt and setsockopt hooks
Date: Wed, 26 Jun 2019 12:10:21 -0700 [thread overview]
Message-ID: <20190626191021.GB4866@mini-arch> (raw)
In-Reply-To: <20190626185420.wzsb7v6rawn4wtzd@ast-mbp.dhcp.thefacebook.com>
On 06/26, Alexei Starovoitov wrote:
> On Mon, Jun 24, 2019 at 09:24:21AM -0700, Stanislav Fomichev wrote:
> > Implement new BPF_PROG_TYPE_CGROUP_SOCKOPT program type and
> > BPF_CGROUP_{G,S}ETSOCKOPT cgroup hooks.
> >
> > BPF_CGROUP_SETSOCKOPT get a read-only view of the setsockopt arguments.
> > BPF_CGROUP_GETSOCKOPT can modify the supplied buffer.
> > Both of them reuse existing PTR_TO_PACKET{,_END} infrastructure.
>
> getsockopt side looks good to me.
> I tried to convince myself that readonly setsockopt is fine for now,
> but it feels we need to make it writeable from the start.
> I agree with your reasoning that doing copy_to_user is no good,
> but we can do certainly do set_fs(KERNEL_DS) game.
> The same way as kernel_setsockopt() is doing.
> It seems quite useful to modify 'optval' before passing it to kernel.
> Then bpf prog would be able to specify sane values for SO_SNDBUF
> instead of rejecting them.
> The alternative would be to allow bpf prog to call setsockopt
> from inside, but sock is locked when prog is running,
> so unlocking within helper is not going to be clean.
> wdyt?
Sure, I can take a look if you think that it would be useful in general.
Looks like set_fs should do the trick.
(I was thinking about exporting something like the existing bpf_setsockopt
to a setsockopt hooks, but I agree, it comes with its own bag
of problems).
next prev parent reply other threads:[~2019-06-26 19:10 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-24 16:24 [PATCH bpf-next v8 0/9] bpf: getsockopt and setsockopt hooks Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 1/9] bpf: implement " Stanislav Fomichev
2019-06-24 21:19 ` Andrii Nakryiko
2019-06-26 18:54 ` Alexei Starovoitov
2019-06-26 19:10 ` Stanislav Fomichev [this message]
2019-06-26 19:21 ` Alexei Starovoitov
2019-06-24 16:24 ` [PATCH bpf-next v8 2/9] bpf: sync bpf.h to tools/ Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 3/9] libbpf: support sockopt hooks Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 4/9] selftests/bpf: test sockopt section name Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 5/9] selftests/bpf: add sockopt test Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 6/9] selftests/bpf: add sockopt test that exercises sk helpers Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 7/9] selftests/bpf: add sockopt test that exercises BPF_F_ALLOW_MULTI Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 8/9] bpf: add sockopt documentation Stanislav Fomichev
2019-06-24 16:24 ` [PATCH bpf-next v8 9/9] bpftool: support cgroup sockopt Stanislav Fomichev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190626191021.GB4866@mini-arch \
--to=sdf@fomichev.me \
--cc=alexei.starovoitov@gmail.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=kafai@fb.com \
--cc=netdev@vger.kernel.org \
--cc=sdf@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.