Messages in this thread | | | Date | Wed, 1 Feb 2023 19:04:23 -0800 | Subject | [PATCH 0/6 v5] seccomp: add the synchronous mode for seccomp_unotify | From | Andrei Vagin <> |
| |
seccomp_unotify allows more privileged processes do actions on behalf of less privileged processes.
In many cases, the workflow is fully synchronous. It means a target process triggers a system call and passes controls to a supervisor process that handles the system call and returns controls back to the target process. In this context, "synchronous" means that only one process is running and another one is waiting.
The new WF_CURRENT_CPU flag advises the scheduler to move the wakee to the current CPU. For such synchronous workflows, it makes context switches a few times faster.
Right now, each interaction takes 12µs. With this patch, it takes about 3µs.
v2: clean up the first patch and add the test. v3: update commit messages and a few fixes suggested by Kees Cook. v4: update the third patch to avoid code duplications (suggested by Peter Zijlstra) Add the benchmark to the perf bench set. v5: Update the author email. No code changes.
Kees is ready to take this patch set, but wants to get Acks from the sched folks.
Cc: Andy Lutomirski <luto@amacapital.net> Cc: Christian Brauner <brauner@kernel.org> Cc: Dietmar Eggemann <dietmar.eggemann@arm.com> Cc: Kees Cook <keescook@chromium.org> Cc: Ingo Molnar <mingo@redhat.com> Cc: Juri Lelli <juri.lelli@redhat.com> Cc: Peter Oskolkov <posk@google.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Tycho Andersen <tycho@tycho.pizza> Cc: Will Drewry <wad@chromium.org> Cc: Vincent Guittot <vincent.guittot@linaro.org>
Andrei Vagin (4): seccomp: don't use semaphore and wait_queue together sched: add a few helpers to wake up tasks on the current cpu seccomp: add the synchronous mode for seccomp_unotify selftest/seccomp: add a new test for the sync mode of seccomp_user_notify
Peter Oskolkov (1): sched: add WF_CURRENT_CPU and externise ttwu
include/linux/completion.h | 1 + include/linux/swait.h | 2 +- include/linux/wait.h | 3 + include/uapi/linux/seccomp.h | 4 + kernel/sched/completion.c | 26 ++- kernel/sched/core.c | 5 +- kernel/sched/fair.c | 4 + kernel/sched/sched.h | 13 +- kernel/sched/swait.c | 8 +- kernel/sched/wait.c | 5 + kernel/seccomp.c | 72 +++++++- tools/arch/x86/include/uapi/asm/unistd_32.h | 3 + tools/arch/x86/include/uapi/asm/unistd_64.h | 3 + tools/perf/bench/Build | 1 + tools/perf/bench/bench.h | 1 + tools/perf/bench/sched-seccomp-notify.c | 167 ++++++++++++++++++ tools/perf/builtin-bench.c | 1 + tools/testing/selftests/seccomp/seccomp_bpf.c | 55 ++++++ 18 files changed, 346 insertions(+), 28 deletions(-) create mode 100644 tools/perf/bench/sched-seccomp-notify.c
-- 2.37.2
| |