From: "Toke Høiland-Jørgensen" <toke@redhat.com>
To: Sami Tolvanen <samitolvanen@google.com>
Cc: "Björn Töpel" <bjorn.topel@intel.com>,
"Yonghong Song" <yhs@fb.com>,
"Alexei Starovoitov" <ast@kernel.org>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Kees Cook" <keescook@chromium.org>, "Martin Lau" <kafai@fb.com>,
"Song Liu" <songliubraving@fb.com>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
"bpf@vger.kernel.org" <bpf@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"Jesper Dangaard Brouer" <brouer@redhat.com>
Subject: Re: [PATCH] bpf: validate bpf_func when BPF_JIT is enabled
Date: Fri, 13 Sep 2019 14:19:26 +0200 [thread overview]
Message-ID: <87h85gs81d.fsf@toke.dk> (raw)
In-Reply-To: <CABCJKufGy0aRDSUPQEOKYZ9tLjqwQDcDaTW-6im-VfjkB_gUsw@mail.gmail.com>
Sami Tolvanen <samitolvanen@google.com> writes:
> On Thu, Sep 12, 2019 at 3:52 AM Toke Høiland-Jørgensen <toke@redhat.com> wrote:
>> I think it would be good if you do both. I'm a bit worried that XDP
>> performance will end up in a "death by a thousand paper cuts" situation,
>> so I'd rather push back on even relatively small overheads like this; so
>> being able to turn it off in the config would be good.
>
> OK, thanks for the feedback. In that case, I think it's probably
> better to wait until we have CFI ready for upstreaming and use the
> same config for this one.
SGTM, thanks!
>> Can you share more details about what the "future CFI checking" is
>> likely to look like?
>
> Sure, I posted an overview of CFI and what we're doing in Pixel devices here:
>
> https://android-developers.googleblog.com/2018/10/control-flow-integrity-in-android-kernel.html
Great, thank you.
-Toke
next prev parent reply other threads:[~2019-09-13 12:19 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-09 22:32 [PATCH] bpf: validate bpf_func when BPF_JIT is enabled Sami Tolvanen
2019-09-10 8:37 ` Yonghong Song
2019-09-10 17:22 ` Sami Tolvanen
2019-09-11 7:42 ` Yonghong Song
2019-09-11 10:39 ` Björn Töpel
2019-09-11 12:09 ` Toke Høiland-Jørgensen
2019-09-11 21:07 ` Sami Tolvanen
2019-09-12 10:46 ` Toke Høiland-Jørgensen
2019-09-12 22:01 ` Sami Tolvanen
2019-09-13 12:19 ` Toke Høiland-Jørgensen [this message]
2019-09-11 20:29 ` Sami Tolvanen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87h85gs81d.fsf@toke.dk \
--to=toke@redhat.com \
--cc=ast@kernel.org \
--cc=bjorn.topel@intel.com \
--cc=bpf@vger.kernel.org \
--cc=brouer@redhat.com \
--cc=daniel@iogearbox.net \
--cc=kafai@fb.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=samitolvanen@google.com \
--cc=songliubraving@fb.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.