Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH bpf-next] bpf: allow CGROUP_SKB programs to use
 bpf_get_current_cgroup_id() helper
To:     Roman Gushchin <guro@fb.com>
Cc:     Alexei Starovoitov <ast@kernel.org>,
        "bpf@vger.kernel.org" <bpf@vger.kernel.org>,
        Kernel Team <Kernel-team@fb.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Yonghong Song <yhs@fb.com>
References: <20190606185911.4089151-1-guro@fb.com>
 <20190606190752.GA28743@tower.DHCP.thefacebook.com>
 <a604b9eb-4e39-c4ec-0868-bac360bc2fb4@iogearbox.net>
 <20190606195317.GA22965@tower.DHCP.thefacebook.com>
From:   Daniel Borkmann <daniel@iogearbox.net>
Message-ID: <ff3b1419-6692-7db4-d2d5-b8a94e9fe422@iogearbox.net>
Date:   Thu, 6 Jun 2019 21:59:13 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.3.0
MIME-Version: 1.0
In-Reply-To: <20190606195317.GA22965@tower.DHCP.thefacebook.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 06/06/2019 09:53 PM, Roman Gushchin wrote:
> On Thu, Jun 06, 2019 at 09:39:35PM +0200, Daniel Borkmann wrote:
>> On 06/06/2019 09:08 PM, Roman Gushchin wrote:
>>> On Thu, Jun 06, 2019 at 11:59:11AM -0700, Roman Gushchin wrote:
>>>> Currently bpf_get_current_cgroup_id() is not supported for
>>>> CGROUP_SKB programs. An attempt to load such a program generates an
>>>> error like this:
>>>>     libbpf:
>>>>     0: (b7) r6 = 0
>>>>     ...
>>>>     8: (63) *(u32 *)(r10 -28) = r6
>>>>     9: (85) call bpf_get_current_cgroup_id#80
>>>>     unknown func bpf_get_current_cgroup_id#80
>>>>
>>>> There are no particular reasons for denying it,
>>>> and we have some use cases where it might be useful.
>>>
>>> Ah, sorry, it's not so simple, as we probably need to take
>>> the cgroup pointer from the socket, not from current.
>>>
>>> So the implementation of the helper should be different
>>> for this type of programs.
>>>
>>> So I wonder if it's better to introduce a new helper
>>> bpf_get_sock_cgroup_id()?
>>>
>>> What do you think?
>>
>> We do have bpf_skb_cgroup_id(), did you give that a try?
> 
> It also isn't supported for CGROUP_SKB, but other than that looks
> exactly what I need.
> 
> Thank you for pointing at it!

Yes, the helper would need to be enabled there.

Cheers,
Daniel