Re: [PATCH 0/5 v3] seccomp: add the synchronous mode for seccomp_unotify

[Kees Cook <keescook@chromium.org>]

On Thu, Nov 10, 2022 at 11:31:49PM -0800, Andrei Vagin wrote:
> From: Andrei Vagin <avagin@gmail.com>
> 
> seccomp_unotify allows more privileged processes do actions on behalf
> of less privileged processes.
> 
> In many cases, the workflow is fully synchronous. It means a target
> process triggers a system call and passes controls to a supervisor
> process that handles the system call and returns controls back to the
> target process. In this context, "synchronous" means that only one
> process is running and another one is waiting.
> 
> The new WF_CURRENT_CPU flag advises the scheduler to move the wakee to
> the current CPU. For such synchronous workflows, it makes context
> switches a few times faster.
> 
> Right now, each interaction takes 12µs. With this patch, it takes about
> 3µs.
> 
> v2: clean up the first patch and add the test.
> v3: update commit messages and a few fixes suggested by Kees Cook.

Thanks for the update! If I can get Acks from the sched folks, I think
this looks good to take.

-Kees

> 
> Cc: Andy Lutomirski <luto@amacapital.net>
> Cc: Christian Brauner <brauner@kernel.org>
> Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Juri Lelli <juri.lelli@redhat.com>
> Cc: Peter Oskolkov <posk@google.com>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Tycho Andersen <tycho@tycho.pizza>
> Cc: Will Drewry <wad@chromium.org>
> Cc: Vincent Guittot <vincent.guittot@linaro.org>
> 
> Andrei Vagin (4):
>   seccomp: don't use semaphore and wait_queue together
>   sched: add a few helpers to wake up tasks on the current cpu
>   seccomp: add the synchronous mode for seccomp_unotify
>   selftest/seccomp: add a new test for the sync mode of
>     seccomp_user_notify
> 
> Peter Oskolkov (1):
>   sched: add WF_CURRENT_CPU and externise ttwu
> 
>  include/linux/completion.h                    |  1 +
>  include/linux/swait.h                         |  1 +
>  include/linux/wait.h                          |  3 +
>  include/uapi/linux/seccomp.h                  |  4 +
>  kernel/sched/completion.c                     | 12 +++
>  kernel/sched/core.c                           |  5 +-
>  kernel/sched/fair.c                           |  4 +
>  kernel/sched/sched.h                          | 13 +--
>  kernel/sched/swait.c                          | 11 +++
>  kernel/sched/wait.c                           |  5 ++
>  kernel/seccomp.c                              | 72 +++++++++++++--
>  tools/testing/selftests/seccomp/seccomp_bpf.c | 88 +++++++++++++++++++
>  12 files changed, 204 insertions(+), 15 deletions(-)
> 
> -- 
> 2.37.2
> 

-- 
Kees Cook