[PATCH v2] docs: sysctl/kernel: document BPF entries

[PATCH v2] docs: sysctl/kernel: document BPF entries

[Stephen Kitt]

Based on the implementation in kernel/bpf/syscall.c,
kernel/bpf/trampoline.c, include/linux/filter.h, and the documentation
in bpftool-prog.rst.

The section style doesn't match the surrounding sections; it matches
the style of the reworked kernel.rst queued up in docs-next.

Signed-off-by: Stephen Kitt <steve@sk2.org>
---

Notes:
    Changes since v1:
    - rebased on bpf-next instead of docs-next.

 Documentation/admin-guide/sysctl/kernel.rst | 24 +++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst
index def074807cee..eea7afd509ac 100644
--- a/Documentation/admin-guide/sysctl/kernel.rst
+++ b/Documentation/admin-guide/sysctl/kernel.rst
@@ -174,6 +174,20 @@ See the type_of_loader and ext_loader_ver fields in
 Documentation/x86/boot.rst for additional information.
 
 
+bpf_stats_enabled
+=================
+
+Controls whether the kernel should collect statistics on BPF programs
+(total time spent running, number of times run...). Enabling
+statistics causes a slight reduction in performance on each program
+run. The statistics can be seen using ``bpftool``.
+
+= ===================================
+0 Don't collect statistics (default).
+1 Collect statistics.
+= ===================================
+
+
 cap_last_cap:
 =============
 
@@ -1123,6 +1137,16 @@ NMI switch that most IA32 servers have fires unknown NMI up, for
 example.  If a system hangs up, try pressing the NMI switch.
 
 
+unprivileged_bpf_disabled
+=========================
+
+Writing 1 to this entry will disabled unprivileged calls to ``bpf()``;
+once disabled, calling ``bpf()`` without ``CAP_SYS_ADMIN`` will return
+``-EPERM``.
+
+Once set, this can't be cleared.
+
+
 watchdog:
 =========
 

base-commit: 3e7c67d90e3ed2f34fce42699f11b150dd1d3999
-- 
2.20.1

Re: [PATCH v2] docs: sysctl/kernel: document BPF entries

[Alexei Starovoitov]

On Mon, Mar 9, 2020 at 11:05 AM Stephen Kitt <steve@sk2.org> wrote:
>
> Based on the implementation in kernel/bpf/syscall.c,
> kernel/bpf/trampoline.c, include/linux/filter.h, and the documentation
> in bpftool-prog.rst.
>
> The section style doesn't match the surrounding sections; it matches
> the style of the reworked kernel.rst queued up in docs-next.
>
> Signed-off-by: Stephen Kitt <steve@sk2.org>
> ---
>
> Notes:
>     Changes since v1:
>     - rebased on bpf-next instead of docs-next.
>
>  Documentation/admin-guide/sysctl/kernel.rst | 24 +++++++++++++++++++++
>  1 file changed, 24 insertions(+)
>
> diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst
> index def074807cee..eea7afd509ac 100644
> --- a/Documentation/admin-guide/sysctl/kernel.rst
> +++ b/Documentation/admin-guide/sysctl/kernel.rst
> @@ -174,6 +174,20 @@ See the type_of_loader and ext_loader_ver fields in
>  Documentation/x86/boot.rst for additional information.
>
>
> +bpf_stats_enabled
> +=================
> +
> +Controls whether the kernel should collect statistics on BPF programs
> +(total time spent running, number of times run...). Enabling
> +statistics causes a slight reduction in performance on each program
> +run. The statistics can be seen using ``bpftool``.
> +
> += ===================================
> +0 Don't collect statistics (default).
> +1 Collect statistics.
> += ===================================
> +
> +
>  cap_last_cap:
>  =============
>
> @@ -1123,6 +1137,16 @@ NMI switch that most IA32 servers have fires unknown NMI up, for
>  example.  If a system hangs up, try pressing the NMI switch.
>
>
> +unprivileged_bpf_disabled
> +=========================
> +
> +Writing 1 to this entry will disabled unprivileged calls to ``bpf()``;

same typo as was pointed out earlier.

Re: [PATCH v2] docs: sysctl/kernel: document BPF entries

[Stephen Kitt]

[-- Attachment #1: Type: text/plain, Size: 2179 bytes --]

On Tue, 10 Mar 2020 10:47:15 -0700, Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:

> On Mon, Mar 9, 2020 at 11:05 AM Stephen Kitt <steve@sk2.org> wrote:
> >
> > Based on the implementation in kernel/bpf/syscall.c,
> > kernel/bpf/trampoline.c, include/linux/filter.h, and the documentation
> > in bpftool-prog.rst.
> >
> > The section style doesn't match the surrounding sections; it matches
> > the style of the reworked kernel.rst queued up in docs-next.
> >
> > Signed-off-by: Stephen Kitt <steve@sk2.org>
> > ---
> >
> > Notes:
> >     Changes since v1:
> >     - rebased on bpf-next instead of docs-next.
> >
> >  Documentation/admin-guide/sysctl/kernel.rst | 24 +++++++++++++++++++++
> >  1 file changed, 24 insertions(+)
> >
> > diff --git a/Documentation/admin-guide/sysctl/kernel.rst
> > b/Documentation/admin-guide/sysctl/kernel.rst index
> > def074807cee..eea7afd509ac 100644 ---
> > a/Documentation/admin-guide/sysctl/kernel.rst +++
> > b/Documentation/admin-guide/sysctl/kernel.rst @@ -174,6 +174,20 @@ See
> > the type_of_loader and ext_loader_ver fields in
> > Documentation/x86/boot.rst for additional information.
> >
> >
> > +bpf_stats_enabled
> > +=================
> > +
> > +Controls whether the kernel should collect statistics on BPF programs
> > +(total time spent running, number of times run...). Enabling
> > +statistics causes a slight reduction in performance on each program
> > +run. The statistics can be seen using ``bpftool``.
> > +
> > += ===================================
> > +0 Don't collect statistics (default).
> > +1 Collect statistics.
> > += ===================================
> > +
> > +
> >  cap_last_cap:
> >  =============
> >
> > @@ -1123,6 +1137,16 @@ NMI switch that most IA32 servers have fires
> > unknown NMI up, for example.  If a system hangs up, try pressing the NMI
> > switch.
> >
> >
> > +unprivileged_bpf_disabled
> > +=========================
> > +
> > +Writing 1 to this entry will disabled unprivileged calls to ``bpf()``;  
> 
> same typo as was pointed out earlier.

Oh dear, sorry about that, v3 is on its way :-(.

Regards,

Stephen

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]