linux-kernel - Re: [PATCH 0/5 v3] seccomp: add the synchronous mode for seccomp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202211181438.7D252CDC10@keescook>
Date:   Fri, 18 Nov 2022 14:38:21 -0800
From:   Kees Cook <keescook@...omium.org>
To:     Andrei Vagin <avagin@...gle.com>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        Christian Brauner <brauner@...nel.org>,
        linux-kernel@...r.kernel.org, Andrei Vagin <avagin@...il.com>,
        Andy Lutomirski <luto@...capital.net>,
        Dietmar Eggemann <dietmar.eggemann@....com>,
        Ingo Molnar <mingo@...hat.com>,
        Juri Lelli <juri.lelli@...hat.com>,
        Peter Oskolkov <posk@...gle.com>,
        Tycho Andersen <tycho@...ho.pizza>,
        Will Drewry <wad@...omium.org>,
        Vincent Guittot <vincent.guittot@...aro.org>
Subject: Re: [PATCH 0/5 v3] seccomp: add the synchronous mode for
 seccomp_unotify

On Thu, Nov 10, 2022 at 11:31:49PM -0800, Andrei Vagin wrote:
> From: Andrei Vagin <avagin@...il.com>
> 
> seccomp_unotify allows more privileged processes do actions on behalf
> of less privileged processes.
> 
> In many cases, the workflow is fully synchronous. It means a target
> process triggers a system call and passes controls to a supervisor
> process that handles the system call and returns controls back to the
> target process. In this context, "synchronous" means that only one
> process is running and another one is waiting.
> 
> The new WF_CURRENT_CPU flag advises the scheduler to move the wakee to
> the current CPU. For such synchronous workflows, it makes context
> switches a few times faster.
> 
> Right now, each interaction takes 12µs. With this patch, it takes about
> 3µs.
> 
> v2: clean up the first patch and add the test.
> v3: update commit messages and a few fixes suggested by Kees Cook.

Thanks for the update! If I can get Acks from the sched folks, I think
this looks good to take.

-Kees

> 
> Cc: Andy Lutomirski <luto@...capital.net>
> Cc: Christian Brauner <brauner@...nel.org>
> Cc: Dietmar Eggemann <dietmar.eggemann@....com>
> Cc: Kees Cook <keescook@...omium.org>
> Cc: Ingo Molnar <mingo@...hat.com>
> Cc: Juri Lelli <juri.lelli@...hat.com>
> Cc: Peter Oskolkov <posk@...gle.com>
> Cc: Peter Zijlstra <peterz@...radead.org>
> Cc: Tycho Andersen <tycho@...ho.pizza>
> Cc: Will Drewry <wad@...omium.org>
> Cc: Vincent Guittot <vincent.guittot@...aro.org>
> 
> Andrei Vagin (4):
>   seccomp: don't use semaphore and wait_queue together
>   sched: add a few helpers to wake up tasks on the current cpu
>   seccomp: add the synchronous mode for seccomp_unotify
>   selftest/seccomp: add a new test for the sync mode of
>     seccomp_user_notify
> 
> Peter Oskolkov (1):
>   sched: add WF_CURRENT_CPU and externise ttwu
> 
>  include/linux/completion.h                    |  1 +
>  include/linux/swait.h                         |  1 +
>  include/linux/wait.h                          |  3 +
>  include/uapi/linux/seccomp.h                  |  4 +
>  kernel/sched/completion.c                     | 12 +++
>  kernel/sched/core.c                           |  5 +-
>  kernel/sched/fair.c                           |  4 +
>  kernel/sched/sched.h                          | 13 +--
>  kernel/sched/swait.c                          | 11 +++
>  kernel/sched/wait.c                           |  5 ++
>  kernel/seccomp.c                              | 72 +++++++++++++--
>  tools/testing/selftests/seccomp/seccomp_bpf.c | 88 +++++++++++++++++++
>  12 files changed, 204 insertions(+), 15 deletions(-)
> 
> -- 
> 2.37.2
> 

-- 
Kees Cook