Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Kees Cook
On Fri, Jun 27, 2014 at 12:55 PM, Oleg Nesterov wrote: > On 06/27, Andy Lutomirski wrote: >> >> On Fri, Jun 27, 2014 at 12:27 PM, Oleg Nesterov wrote: >> > On 06/27, Kees Cook wrote: >> >> >> >> It looks like SMP ARM issues dsb for rmb, which seems a bit expensive. >> >>

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Andy Lutomirski
On Fri, Jun 27, 2014 at 12:55 PM, Oleg Nesterov wrote: > On 06/27, Andy Lutomirski wrote: >> >> On Fri, Jun 27, 2014 at 12:27 PM, Oleg Nesterov wrote: >> > On 06/27, Kees Cook wrote: >> >> >> >> It looks like SMP ARM issues dsb for rmb, which seems a bit expensive. >> >>

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Oleg Nesterov
On 06/27, Andy Lutomirski wrote: > > On Fri, Jun 27, 2014 at 12:27 PM, Oleg Nesterov wrote: > > On 06/27, Kees Cook wrote: > >> > >> It looks like SMP ARM issues dsb for rmb, which seems a bit expensive. > >> http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0204g/CIHJFGFE.htm > >> >

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Andy Lutomirski
On Fri, Jun 27, 2014 at 12:27 PM, Oleg Nesterov wrote: > On 06/27, Kees Cook wrote: >> >> It looks like SMP ARM issues dsb for rmb, which seems a bit expensive. >> http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0204g/CIHJFGFE.htm >> >> ... >> >> I really want to avoid adding

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Oleg Nesterov
On 06/27, Kees Cook wrote: > > It looks like SMP ARM issues dsb for rmb, which seems a bit expensive. > http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0204g/CIHJFGFE.htm > > ... > > I really want to avoid adding anything to the secure_computing() > execution path. :( I must have

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Andy Lutomirski
On Fri, Jun 27, 2014 at 12:04 PM, Kees Cook wrote: > On Fri, Jun 27, 2014 at 11:56 AM, Andy Lutomirski wrote: >> On Fri, Jun 27, 2014 at 11:52 AM, Kees Cook wrote: >>> On Fri, Jun 27, 2014 at 11:39 AM, Andy Lutomirski >>> wrote: On Fri, Jun 27, 2014 at 11:33 AM, Kees Cook wrote: >

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Kees Cook
On Fri, Jun 27, 2014 at 11:56 AM, Andy Lutomirski wrote: > On Fri, Jun 27, 2014 at 11:52 AM, Kees Cook wrote: >> On Fri, Jun 27, 2014 at 11:39 AM, Andy Lutomirski >> wrote: >>> On Fri, Jun 27, 2014 at 11:33 AM, Kees Cook wrote: On Wed, Jun 25, 2014 at 11:07 AM, Andy Lutomirski

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Andy Lutomirski
On Fri, Jun 27, 2014 at 11:52 AM, Kees Cook wrote: > On Fri, Jun 27, 2014 at 11:39 AM, Andy Lutomirski wrote: >> On Fri, Jun 27, 2014 at 11:33 AM, Kees Cook wrote: >>> On Wed, Jun 25, 2014 at 11:07 AM, Andy Lutomirski >>> wrote: On Wed, Jun 25, 2014 at 11:00 AM, Kees Cook wrote: >

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Kees Cook
On Fri, Jun 27, 2014 at 11:39 AM, Andy Lutomirski wrote: > On Fri, Jun 27, 2014 at 11:33 AM, Kees Cook wrote: >> On Wed, Jun 25, 2014 at 11:07 AM, Andy Lutomirski >> wrote: >>> On Wed, Jun 25, 2014 at 11:00 AM, Kees Cook wrote: On Wed, Jun 25, 2014 at 10:51 AM, Oleg Nesterov wrote:

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Andy Lutomirski
On Fri, Jun 27, 2014 at 11:33 AM, Kees Cook wrote: > On Wed, Jun 25, 2014 at 11:07 AM, Andy Lutomirski wrote: >> On Wed, Jun 25, 2014 at 11:00 AM, Kees Cook wrote: >>> On Wed, Jun 25, 2014 at 10:51 AM, Oleg Nesterov wrote: On 06/25, Andy Lutomirski wrote: > > On Wed, Jun 25, 2014

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Kees Cook
On Wed, Jun 25, 2014 at 11:07 AM, Andy Lutomirski wrote: > On Wed, Jun 25, 2014 at 11:00 AM, Kees Cook wrote: >> On Wed, Jun 25, 2014 at 10:51 AM, Oleg Nesterov wrote: >>> On 06/25, Andy Lutomirski wrote: On Wed, Jun 25, 2014 at 10:32 AM, Oleg Nesterov wrote: > On 06/25, Andy

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Kees Cook
On Wed, Jun 25, 2014 at 11:07 AM, Andy Lutomirski l...@amacapital.net wrote: On Wed, Jun 25, 2014 at 11:00 AM, Kees Cook keesc...@chromium.org wrote: On Wed, Jun 25, 2014 at 10:51 AM, Oleg Nesterov o...@redhat.com wrote: On 06/25, Andy Lutomirski wrote: On Wed, Jun 25, 2014 at 10:32 AM, Oleg

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Andy Lutomirski
On Fri, Jun 27, 2014 at 11:33 AM, Kees Cook keesc...@chromium.org wrote: On Wed, Jun 25, 2014 at 11:07 AM, Andy Lutomirski l...@amacapital.net wrote: On Wed, Jun 25, 2014 at 11:00 AM, Kees Cook keesc...@chromium.org wrote: On Wed, Jun 25, 2014 at 10:51 AM, Oleg Nesterov o...@redhat.com wrote:

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Kees Cook
On Fri, Jun 27, 2014 at 11:39 AM, Andy Lutomirski l...@amacapital.net wrote: On Fri, Jun 27, 2014 at 11:33 AM, Kees Cook keesc...@chromium.org wrote: On Wed, Jun 25, 2014 at 11:07 AM, Andy Lutomirski l...@amacapital.net wrote: On Wed, Jun 25, 2014 at 11:00 AM, Kees Cook keesc...@chromium.org

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Andy Lutomirski
On Fri, Jun 27, 2014 at 11:52 AM, Kees Cook keesc...@chromium.org wrote: On Fri, Jun 27, 2014 at 11:39 AM, Andy Lutomirski l...@amacapital.net wrote: On Fri, Jun 27, 2014 at 11:33 AM, Kees Cook keesc...@chromium.org wrote: On Wed, Jun 25, 2014 at 11:07 AM, Andy Lutomirski l...@amacapital.net

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Kees Cook
On Fri, Jun 27, 2014 at 11:56 AM, Andy Lutomirski l...@amacapital.net wrote: On Fri, Jun 27, 2014 at 11:52 AM, Kees Cook keesc...@chromium.org wrote: On Fri, Jun 27, 2014 at 11:39 AM, Andy Lutomirski l...@amacapital.net wrote: On Fri, Jun 27, 2014 at 11:33 AM, Kees Cook keesc...@chromium.org

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Andy Lutomirski
On Fri, Jun 27, 2014 at 12:04 PM, Kees Cook keesc...@chromium.org wrote: On Fri, Jun 27, 2014 at 11:56 AM, Andy Lutomirski l...@amacapital.net wrote: On Fri, Jun 27, 2014 at 11:52 AM, Kees Cook keesc...@chromium.org wrote: On Fri, Jun 27, 2014 at 11:39 AM, Andy Lutomirski l...@amacapital.net

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Oleg Nesterov
On 06/27, Kees Cook wrote: It looks like SMP ARM issues dsb for rmb, which seems a bit expensive. http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0204g/CIHJFGFE.htm ... I really want to avoid adding anything to the secure_computing() execution path. :( I must have missed

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Andy Lutomirski
On Fri, Jun 27, 2014 at 12:27 PM, Oleg Nesterov o...@redhat.com wrote: On 06/27, Kees Cook wrote: It looks like SMP ARM issues dsb for rmb, which seems a bit expensive. http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0204g/CIHJFGFE.htm ... I really want to avoid adding

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Oleg Nesterov
On 06/27, Andy Lutomirski wrote: On Fri, Jun 27, 2014 at 12:27 PM, Oleg Nesterov o...@redhat.com wrote: On 06/27, Kees Cook wrote: It looks like SMP ARM issues dsb for rmb, which seems a bit expensive. http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0204g/CIHJFGFE.htm

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Andy Lutomirski
On Fri, Jun 27, 2014 at 12:55 PM, Oleg Nesterov o...@redhat.com wrote: On 06/27, Andy Lutomirski wrote: On Fri, Jun 27, 2014 at 12:27 PM, Oleg Nesterov o...@redhat.com wrote: On 06/27, Kees Cook wrote: It looks like SMP ARM issues dsb for rmb, which seems a bit expensive.

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-27 Thread Kees Cook
On Fri, Jun 27, 2014 at 12:55 PM, Oleg Nesterov o...@redhat.com wrote: On 06/27, Andy Lutomirski wrote: On Fri, Jun 27, 2014 at 12:27 PM, Oleg Nesterov o...@redhat.com wrote: On 06/27, Kees Cook wrote: It looks like SMP ARM issues dsb for rmb, which seems a bit expensive.

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Andy Lutomirski
On Wed, Jun 25, 2014 at 11:00 AM, Kees Cook wrote: > On Wed, Jun 25, 2014 at 10:51 AM, Oleg Nesterov wrote: >> On 06/25, Andy Lutomirski wrote: >>> >>> On Wed, Jun 25, 2014 at 10:32 AM, Oleg Nesterov wrote: >>> > On 06/25, Andy Lutomirski wrote: >>> >> >>> >> Write the filter, then smp_mb (or

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Kees Cook
On Wed, Jun 25, 2014 at 10:51 AM, Oleg Nesterov wrote: > On 06/25, Andy Lutomirski wrote: >> >> On Wed, Jun 25, 2014 at 10:32 AM, Oleg Nesterov wrote: >> > On 06/25, Andy Lutomirski wrote: >> >> >> >> Write the filter, then smp_mb (or maybe a weaker barrier is okay), >> >> then set the bit. >> >

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Oleg Nesterov
On 06/25, Andy Lutomirski wrote: > > On Wed, Jun 25, 2014 at 10:32 AM, Oleg Nesterov wrote: > > On 06/25, Andy Lutomirski wrote: > >> > >> Write the filter, then smp_mb (or maybe a weaker barrier is okay), > >> then set the bit. > > > > Yes, exactly, this is what I meant. Plas rmb() in

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Andy Lutomirski
On Wed, Jun 25, 2014 at 10:32 AM, Oleg Nesterov wrote: > On 06/25, Andy Lutomirski wrote: >> >> Write the filter, then smp_mb (or maybe a weaker barrier is okay), >> then set the bit. > > Yes, exactly, this is what I meant. Plas rmb() in __secure_computing(). > > But I still can't understand the

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Oleg Nesterov
On 06/25, Andy Lutomirski wrote: > > Write the filter, then smp_mb (or maybe a weaker barrier is okay), > then set the bit. Yes, exactly, this is what I meant. Plas rmb() in __secure_computing(). But I still can't understand the rest of your discussion about the ordering we need ;) Oleg. -- To

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Andy Lutomirski
On Wed, Jun 25, 2014 at 9:54 AM, Kees Cook wrote: > On Wed, Jun 25, 2014 at 9:10 AM, Andy Lutomirski wrote: >> On Wed, Jun 25, 2014 at 7:51 AM, Kees Cook wrote: >>> On Wed, Jun 25, 2014 at 6:51 AM, Oleg Nesterov wrote: On 06/24, Kees Cook wrote: > > +static inline void

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Oleg Nesterov
On 06/25, Kees Cook wrote: > > On Wed, Jun 25, 2014 at 6:51 AM, Oleg Nesterov wrote: > > On 06/24, Kees Cook wrote: > >> > >> +static inline void seccomp_assign_mode(struct task_struct *task, > >> +unsigned long seccomp_mode) > >> +{ > >> +

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Kees Cook
On Wed, Jun 25, 2014 at 9:10 AM, Andy Lutomirski wrote: > On Wed, Jun 25, 2014 at 7:51 AM, Kees Cook wrote: >> On Wed, Jun 25, 2014 at 6:51 AM, Oleg Nesterov wrote: >>> On 06/24, Kees Cook wrote: +static inline void seccomp_assign_mode(struct task_struct *task, +

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Andy Lutomirski
On Wed, Jun 25, 2014 at 7:51 AM, Kees Cook wrote: > On Wed, Jun 25, 2014 at 6:51 AM, Oleg Nesterov wrote: >> On 06/24, Kees Cook wrote: >>> >>> +static inline void seccomp_assign_mode(struct task_struct *task, >>> +unsigned long seccomp_mode) >>> +{ >>> +

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Kees Cook
On Wed, Jun 25, 2014 at 6:51 AM, Oleg Nesterov wrote: > On 06/24, Kees Cook wrote: >> >> +static inline void seccomp_assign_mode(struct task_struct *task, >> +unsigned long seccomp_mode) >> +{ >> + BUG_ON(!spin_is_locked(>sighand->siglock)); >> + >> +

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Oleg Nesterov
On 06/24, Kees Cook wrote: > > +static inline void seccomp_assign_mode(struct task_struct *task, > +unsigned long seccomp_mode) > +{ > + BUG_ON(!spin_is_locked(>sighand->siglock)); > + > + task->seccomp.mode = seccomp_mode; > +

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Oleg Nesterov
On 06/24, Kees Cook wrote: +static inline void seccomp_assign_mode(struct task_struct *task, +unsigned long seccomp_mode) +{ + BUG_ON(!spin_is_locked(task-sighand-siglock)); + + task-seccomp.mode = seccomp_mode; + set_tsk_thread_flag(task,

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Kees Cook
On Wed, Jun 25, 2014 at 6:51 AM, Oleg Nesterov o...@redhat.com wrote: On 06/24, Kees Cook wrote: +static inline void seccomp_assign_mode(struct task_struct *task, +unsigned long seccomp_mode) +{ + BUG_ON(!spin_is_locked(task-sighand-siglock)); + +

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Andy Lutomirski
On Wed, Jun 25, 2014 at 7:51 AM, Kees Cook keesc...@chromium.org wrote: On Wed, Jun 25, 2014 at 6:51 AM, Oleg Nesterov o...@redhat.com wrote: On 06/24, Kees Cook wrote: +static inline void seccomp_assign_mode(struct task_struct *task, +unsigned long

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Kees Cook
On Wed, Jun 25, 2014 at 9:10 AM, Andy Lutomirski l...@amacapital.net wrote: On Wed, Jun 25, 2014 at 7:51 AM, Kees Cook keesc...@chromium.org wrote: On Wed, Jun 25, 2014 at 6:51 AM, Oleg Nesterov o...@redhat.com wrote: On 06/24, Kees Cook wrote: +static inline void seccomp_assign_mode(struct

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Oleg Nesterov
On 06/25, Kees Cook wrote: On Wed, Jun 25, 2014 at 6:51 AM, Oleg Nesterov o...@redhat.com wrote: On 06/24, Kees Cook wrote: +static inline void seccomp_assign_mode(struct task_struct *task, +unsigned long seccomp_mode) +{ +

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Andy Lutomirski
On Wed, Jun 25, 2014 at 9:54 AM, Kees Cook keesc...@chromium.org wrote: On Wed, Jun 25, 2014 at 9:10 AM, Andy Lutomirski l...@amacapital.net wrote: On Wed, Jun 25, 2014 at 7:51 AM, Kees Cook keesc...@chromium.org wrote: On Wed, Jun 25, 2014 at 6:51 AM, Oleg Nesterov o...@redhat.com wrote: On

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Oleg Nesterov
On 06/25, Andy Lutomirski wrote: Write the filter, then smp_mb (or maybe a weaker barrier is okay), then set the bit. Yes, exactly, this is what I meant. Plas rmb() in __secure_computing(). But I still can't understand the rest of your discussion about the ordering we need ;) Oleg. -- To

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Andy Lutomirski
On Wed, Jun 25, 2014 at 10:32 AM, Oleg Nesterov o...@redhat.com wrote: On 06/25, Andy Lutomirski wrote: Write the filter, then smp_mb (or maybe a weaker barrier is okay), then set the bit. Yes, exactly, this is what I meant. Plas rmb() in __secure_computing(). But I still can't understand

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Oleg Nesterov
On 06/25, Andy Lutomirski wrote: On Wed, Jun 25, 2014 at 10:32 AM, Oleg Nesterov o...@redhat.com wrote: On 06/25, Andy Lutomirski wrote: Write the filter, then smp_mb (or maybe a weaker barrier is okay), then set the bit. Yes, exactly, this is what I meant. Plas rmb() in

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Kees Cook
On Wed, Jun 25, 2014 at 10:51 AM, Oleg Nesterov o...@redhat.com wrote: On 06/25, Andy Lutomirski wrote: On Wed, Jun 25, 2014 at 10:32 AM, Oleg Nesterov o...@redhat.com wrote: On 06/25, Andy Lutomirski wrote: Write the filter, then smp_mb (or maybe a weaker barrier is okay), then set the

Re: [PATCH v8 5/9] seccomp: split mode set routines

2014-06-25 Thread Andy Lutomirski
On Wed, Jun 25, 2014 at 11:00 AM, Kees Cook keesc...@chromium.org wrote: On Wed, Jun 25, 2014 at 10:51 AM, Oleg Nesterov o...@redhat.com wrote: On 06/25, Andy Lutomirski wrote: On Wed, Jun 25, 2014 at 10:32 AM, Oleg Nesterov o...@redhat.com wrote: On 06/25, Andy Lutomirski wrote: Write

[PATCH v8 5/9] seccomp: split mode set routines

2014-06-24 Thread Kees Cook
Extracts the common check/assign logic, and separates the two mode setting paths to make things more readable with fewer #ifdefs within function bodies. Signed-off-by: Kees Cook --- kernel/seccomp.c | 123 +- 1 file changed, 84 insertions(+),

[PATCH v8 5/9] seccomp: split mode set routines

2014-06-24 Thread Kees Cook
Extracts the common check/assign logic, and separates the two mode setting paths to make things more readable with fewer #ifdefs within function bodies. Signed-off-by: Kees Cook keesc...@chromium.org --- kernel/seccomp.c | 123 +- 1 file