| Message ID | 20200221165801.32687-1-steve@sk2.org |
|---|---|
| State | Changes Requested |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | docs: sysctl/kernel: document BPF entries | expand |
On Fri, Feb 21, 2020 at 10:18 AM Stephen Kitt <steve@sk2.org> wrote: > > Based on the implementation in kernel/bpf/syscall.c, > kernel/bpf/trampoline.c, include/linux/filter.h, and the documentation > in bpftool-prog.rst. > > Signed-off-by: Stephen Kitt <steve@sk2.org> > --- > Documentation/admin-guide/sysctl/kernel.rst | 24 +++++++++++++++++++++ > 1 file changed, 24 insertions(+) > > diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst > index 1c48ab4bfe30..89c70ea7de7c 100644 > --- a/Documentation/admin-guide/sysctl/kernel.rst > +++ b/Documentation/admin-guide/sysctl/kernel.rst > @@ -102,6 +102,20 @@ See the ``type_of_loader`` and ``ext_loader_ver`` fields in > :doc:`/x86/boot` for additional information. > > > +bpf_stats_enabled > +================= > + > +Controls whether the kernel should collect statistics on BPF programs > +(total time spent running, number of times run...). Enabling > +statistics causes a slight reduction in performance on each program > +run. The statistics can be seen using ``bpftool``. > + > += =================================== > +0 Don't collect statistics (default). > +1 Collect statistics. > += =================================== > + > + > cap_last_cap > ============ > > @@ -1152,6 +1166,16 @@ NMI switch that most IA32 servers have fires unknown NMI up, for > example. If a system hangs up, try pressing the NMI switch. > > > +unprivileged_bpf_disabled > +========================= > + > +Writing 1 to this entry will disabled unprivileged calls to ``bpf()``; 'will disable' ? It doesn't apply to bpf-next with: error: sha1 information is lacking or useless (Documentation/admin-guide/sysctl/kernel.rst). error: could not build fake ancestor Patch failed at 0001 docs: sysctl/kernel: Document BPF entries
On Sun, 23 Feb 2020 14:44:31 -0800, Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote: > On Fri, Feb 21, 2020 at 10:18 AM Stephen Kitt <steve@sk2.org> wrote: > > @@ -1152,6 +1166,16 @@ NMI switch that most IA32 servers have fires > > unknown NMI up, for example. If a system hangs up, try pressing the NMI > > switch. > > > > > > +unprivileged_bpf_disabled > > +========================= > > + > > +Writing 1 to this entry will disabled unprivileged calls to ``bpf()``; > > 'will disable' ? Indeed, thanks. > It doesn't apply to bpf-next with: > error: sha1 information is lacking or useless > (Documentation/admin-guide/sysctl/kernel.rst). > error: could not build fake ancestor > Patch failed at 0001 docs: sysctl/kernel: Document BPF entries Sorry, I forgot to include the base commit information; this is against 8f21f54b8a95 in docs-next. I’ll wait for that to make it to Linus’ tree and re-submit the patch (with the fix above). Regards, Stephen
On Mon, Feb 24, 2020 at 11:50 AM Stephen Kitt <steve@sk2.org> wrote: > > On Sun, 23 Feb 2020 14:44:31 -0800, Alexei Starovoitov > <alexei.starovoitov@gmail.com> wrote: > > On Fri, Feb 21, 2020 at 10:18 AM Stephen Kitt <steve@sk2.org> wrote: > > > @@ -1152,6 +1166,16 @@ NMI switch that most IA32 servers have fires > > > unknown NMI up, for example. If a system hangs up, try pressing the NMI > > > switch. > > > > > > > > > +unprivileged_bpf_disabled > > > +========================= > > > + > > > +Writing 1 to this entry will disabled unprivileged calls to ``bpf()``; > > > > 'will disable' ? > > Indeed, thanks. > > > It doesn't apply to bpf-next with: > > error: sha1 information is lacking or useless > > (Documentation/admin-guide/sysctl/kernel.rst). > > error: could not build fake ancestor > > Patch failed at 0001 docs: sysctl/kernel: Document BPF entries > > Sorry, I forgot to include the base commit information; this is against > 8f21f54b8a95 in docs-next. > > I’ll wait for that to make it to Linus’ tree and re-submit the patch (with > the fix above). Please use bpf-next tree as a base for your patch.
On Mon, 24 Feb 2020 21:43:33 -0800 Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote: > > Sorry, I forgot to include the base commit information; this is against > > 8f21f54b8a95 in docs-next. > > > > I’ll wait for that to make it to Linus’ tree and re-submit the patch (with > > the fix above). > > Please use bpf-next tree as a base for your patch. It seems that folks want to take this through the BPF tree, so I'll assume it's not my problem :) Thanks, jon
diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst index 1c48ab4bfe30..89c70ea7de7c 100644 --- a/Documentation/admin-guide/sysctl/kernel.rst +++ b/Documentation/admin-guide/sysctl/kernel.rst @@ -102,6 +102,20 @@ See the ``type_of_loader`` and ``ext_loader_ver`` fields in :doc:`/x86/boot` for additional information. +bpf_stats_enabled +================= + +Controls whether the kernel should collect statistics on BPF programs +(total time spent running, number of times run...). Enabling +statistics causes a slight reduction in performance on each program +run. The statistics can be seen using ``bpftool``. + += =================================== +0 Don't collect statistics (default). +1 Collect statistics. += =================================== + + cap_last_cap ============ @@ -1152,6 +1166,16 @@ NMI switch that most IA32 servers have fires unknown NMI up, for example. If a system hangs up, try pressing the NMI switch. +unprivileged_bpf_disabled +========================= + +Writing 1 to this entry will disabled unprivileged calls to ``bpf()``; +once disabled, calling ``bpf()`` without ``CAP_SYS_ADMIN`` will return +``-EPERM``. + +Once set, this can't be cleared. + + watchdog ========
Based on the implementation in kernel/bpf/syscall.c, kernel/bpf/trampoline.c, include/linux/filter.h, and the documentation in bpftool-prog.rst. Signed-off-by: Stephen Kitt <steve@sk2.org> --- Documentation/admin-guide/sysctl/kernel.rst | 24 +++++++++++++++++++++ 1 file changed, 24 insertions(+)