From mboxrd@z Thu Jan 1 00:00:00 1970 Received: with ECARTIS (v1.0.0; list linux-mips); Fri, 27 Jun 2014 21:38:16 +0200 (CEST) Received: from mx1.redhat.com ([209.132.183.28]:59202 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by eddie.linux-mips.org with ESMTP id S6860066AbaF0T3NAHpgY (ORCPT ); Fri, 27 Jun 2014 21:29:13 +0200 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s5RJT2Aa031645 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 27 Jun 2014 15:29:02 -0400 Received: from tranklukator.brq.redhat.com (dhcp-1-125.brq.redhat.com [10.34.1.125]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with SMTP id s5RJSvAc007225; Fri, 27 Jun 2014 15:28:58 -0400 Received: by tranklukator.brq.redhat.com (nbSMTP-1.00) for uid 500 oleg@redhat.com; Fri, 27 Jun 2014 21:27:57 +0200 (CEST) Date: Fri, 27 Jun 2014 21:27:53 +0200 From: Oleg Nesterov To: Kees Cook Cc: Andy Lutomirski , LKML , "Michael Kerrisk (man-pages)" , Alexei Starovoitov , Andrew Morton , Daniel Borkmann , Will Drewry , Julien Tinnes , David Drysdale , Linux API , "x86@kernel.org" , "linux-arm-kernel@lists.infradead.org" , linux-mips@linux-mips.org, linux-arch , linux-security-module Subject: Re: [PATCH v8 5/9] seccomp: split mode set routines Message-ID: <20140627192753.GA30752@redhat.com> References: <20140625173245.GA17695@redhat.com> <20140625175136.GA18185@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26 Return-Path: X-Envelope-To: <"|/home/ecartis/ecartis -s linux-mips"> (uid 0) X-Orcpt: rfc822;linux-mips@linux-mips.org Original-Recipient: rfc822;linux-mips@linux-mips.org X-archive-position: 40878 X-ecartis-version: Ecartis v1.0.0 Sender: linux-mips-bounce@linux-mips.org Errors-to: linux-mips-bounce@linux-mips.org X-original-sender: oleg@redhat.com Precedence: bulk List-help: List-unsubscribe: List-software: Ecartis version 1.0.0 List-Id: linux-mips X-List-ID: linux-mips List-subscribe: List-owner: List-post: List-archive: X-list: linux-mips On 06/27, Kees Cook wrote: > > It looks like SMP ARM issues dsb for rmb, which seems a bit expensive. > http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0204g/CIHJFGFE.htm > > ... > > I really want to avoid adding anything to the secure_computing() > execution path. :( I must have missed something but I do not understand your concerns. __secure_computing() is not trivial, and we are going to execute the filters. Do you really think rmb() can add the noticeable difference? Not to mention that we can only get here if we take the slow syscall enter path due to TIF_SECCOMP... Oleg. From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx1.redhat.com ([209.132.183.28]:59202 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by eddie.linux-mips.org with ESMTP id S6860066AbaF0T3NAHpgY (ORCPT ); Fri, 27 Jun 2014 21:29:13 +0200 Date: Fri, 27 Jun 2014 21:27:53 +0200 From: Oleg Nesterov Subject: Re: [PATCH v8 5/9] seccomp: split mode set routines Message-ID: <20140627192753.GA30752@redhat.com> References: <20140625173245.GA17695@redhat.com> <20140625175136.GA18185@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Return-Path: Sender: linux-mips-bounce@linux-mips.org Errors-to: linux-mips-bounce@linux-mips.org List-help: List-unsubscribe: List-software: Ecartis version 1.0.0 List-subscribe: List-owner: List-post: List-archive: To: Kees Cook Cc: Andy Lutomirski , LKML , "Michael Kerrisk (man-pages)" , Alexei Starovoitov , Andrew Morton , Daniel Borkmann , Will Drewry , Julien Tinnes , David Drysdale , Linux API , "x86@kernel.org" , "linux-arm-kernel@lists.infradead.org" , linux-mips@linux-mips.org, linux-arch , linux-security-module Message-ID: <20140627192753.DHcI29czsyriOtA-rjobwvvFNHkixwZptvKVQvjTsJs@z> On 06/27, Kees Cook wrote: > > It looks like SMP ARM issues dsb for rmb, which seems a bit expensive. > http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0204g/CIHJFGFE.htm > > ... > > I really want to avoid adding anything to the secure_computing() > execution path. :( I must have missed something but I do not understand your concerns. __secure_computing() is not trivial, and we are going to execute the filters. Do you really think rmb() can add the noticeable difference? Not to mention that we can only get here if we take the slow syscall enter path due to TIF_SECCOMP... Oleg.