From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 90FE1C388F7 for ; Wed, 4 Nov 2020 00:11:46 +0000 (UTC) Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 02C1D223C7 for ; Wed, 4 Nov 2020 00:11:45 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="mPTbV2Uh" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 02C1D223C7 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=containers-bounces@lists.linux-foundation.org Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 79E1087098; Wed, 4 Nov 2020 00:11:45 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xQBuHw14NtQw; Wed, 4 Nov 2020 00:11:44 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by whitealder.osuosl.org (Postfix) with ESMTP id BDF0687038; Wed, 4 Nov 2020 00:11:44 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id A4534C088B; Wed, 4 Nov 2020 00:11:44 +0000 (UTC) Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by lists.linuxfoundation.org (Postfix) with ESMTP id 8F60BC0051 for ; Wed, 4 Nov 2020 00:11:43 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 82DD78707F for ; Wed, 4 Nov 2020 00:11:43 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 96jXRptWp4GX for ; Wed, 4 Nov 2020 00:11:42 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-pg1-f195.google.com (mail-pg1-f195.google.com [209.85.215.195]) by whitealder.osuosl.org (Postfix) with ESMTPS id BE81087038 for ; Wed, 4 Nov 2020 00:11:42 +0000 (UTC) Received: by mail-pg1-f195.google.com with SMTP id r10so15000532pgb.10 for ; Tue, 03 Nov 2020 16:11:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=NFjsAF4kgpQCHVIlKmgYN6bEVL36r1XibqsUv152D08=; b=mPTbV2UhVfnJP2OoJL4D5QLosesGivMu0Yj5j7pkCrVtHA6dueaCzR1JSWWklnSxS2 Wgzos2joCi+Wlp8KUeVXQhCOJbK/Z4g4eTF82BJYkvr8uaU2CIt3++/EZgLF7nCLiPmR RFfDgHAz/9hjV1ZrPMZTrZyKkXhcZM/AoX3+w= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=NFjsAF4kgpQCHVIlKmgYN6bEVL36r1XibqsUv152D08=; b=CfEGw8wmRhI8i8Om4oeVHmOx+yg0sM7hmTybod6RWq0ZcmpE3Ln2dPL6I/dPOmCttZ yRngOkC7XZ2g3qQVao0uW8kCiLrL3knJWzlRMZVYMnz06aR9G/h/Yk7TOMUyM7CMtXaM lmF7f3s+68L/DGPjsW5cYK/iA7e+IMPyGbg42TZXweWX9s4s9yQWv7sUXVOK2O+Dwb// pupA8cg0jiwRTE0DHyrOl5dzqs/Xsoam5yHjCTdaZAZ0GuUJWxTLRBHDbbGgJAFmJMIk 5IaBwsDvL4uh3cMbp/XbSfqILRuttEjQDOqSBaEDztks5xpmcpRlCbAkR3xOT+PiGZzW n1Og== X-Gm-Message-State: AOAM533OVhX6iZrps7izIOgjyYfw0b6ewcsQB8RPOrG5iGMhDV2/FSrK 2ROwyGGoJQy31n6Umk4MUC1B5Q== X-Google-Smtp-Source: ABdhPJybME+aS3qtjx8JuwpcYMqCGEp0y1Q8idII2QCmSunt2ifzlNcehSCk1E6c+iZLzWwdlgTh0g== X-Received: by 2002:a17:90a:5285:: with SMTP id w5mr1762165pjh.50.1604448702345; Tue, 03 Nov 2020 16:11:42 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id j20sm118311pgl.40.2020.11.03.16.11.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Nov 2020 16:11:41 -0800 (PST) Date: Tue, 3 Nov 2020 16:11:40 -0800 From: Kees Cook To: YiFei Zhu Subject: Re: [PATCH seccomp 0/8] seccomp: add bitmap cache support on remaining arches and report cache in procfs Message-ID: <202011031606.423EC9E@keescook> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: Cc: linux-sh@vger.kernel.org, Tobin Feldman-Fitzthum , Hubertus Franke , Jack Chen , linux-riscv@lists.infradead.org, Andrea Arcangeli , linux-s390@vger.kernel.org, YiFei Zhu , linux-csky@vger.kernel.org, Tianyin Xu , linux-xtensa@linux-xtensa.org, Jann Horn , Valentin Rothberg , Josep Torrellas , Will Drewry , linux-parisc@vger.kernel.org, containers@lists.linux-foundation.org, linux-kernel@vger.kernel.org, Andy Lutomirski , Dimitrios Skarlatos , David Laight , Giuseppe Scrivano , linuxppc-dev@lists.ozlabs.org X-BeenThere: containers@lists.linux-foundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Linux Containers List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: containers-bounces@lists.linux-foundation.org Sender: "Containers" On Tue, Nov 03, 2020 at 07:42:56AM -0600, YiFei Zhu wrote: > From: YiFei Zhu > > This patch series enables bitmap cache for the remaining arches with > SECCOMP_FILTER, other than MIPS. > > I was unable to find any of the arches having subarch-specific NR_syscalls > macros, so generic NR_syscalls is used. SH's syscall_get_arch seems to > only have the 32-bit subarch implementation. I'm not sure if this is > expected. > > This series has not been tested; I have not built all the cross compilers > necessary to build test, let alone run the kernel or benchmark the > performance, so help on making sure the bitmap cache works as expected > would be appreciated. The series applies on top of Kees's for-next/seccomp > branch. Thank you! This looks good. I wonder if the different handling of little endian is worth solving -- I'm suspicious about powerpc's use of __LITTLE_ENDIAN__ vs a CONFIG, but I guess the compiler would match the target endian-ness. Regardless, it captures what the architectures are doing, and gets things standardized. > > YiFei Zhu (8): > csky: Enable seccomp architecture tracking > parisc: Enable seccomp architecture tracking I don't have compilers for these. > powerpc: Enable seccomp architecture tracking > riscv: Enable seccomp architecture tracking > s390: Enable seccomp architecture tracking These I can build-test immediately. > sh: Enable seccomp architecture tracking > xtensa: Enable seccomp architecture tracking These two are available in Ubuntu's cross compiler set, so I'll get them added to my cross-builders. > seccomp/cache: Report cache data through /proc/pid/seccomp_cache In the meantime, I'll wait a bit to see if we can get some Acks/Reviews from arch maintainers. :) -Kees > > arch/Kconfig | 15 ++++++++ > arch/csky/include/asm/Kbuild | 1 - > arch/csky/include/asm/seccomp.h | 11 ++++++ > arch/parisc/include/asm/Kbuild | 1 - > arch/parisc/include/asm/seccomp.h | 22 +++++++++++ > arch/powerpc/include/asm/seccomp.h | 21 +++++++++++ > arch/riscv/include/asm/seccomp.h | 10 +++++ > arch/s390/include/asm/seccomp.h | 9 +++++ > arch/sh/include/asm/seccomp.h | 10 +++++ > arch/xtensa/include/asm/Kbuild | 1 - > arch/xtensa/include/asm/seccomp.h | 11 ++++++ > fs/proc/base.c | 6 +++ > include/linux/seccomp.h | 7 ++++ > kernel/seccomp.c | 59 ++++++++++++++++++++++++++++++ > 14 files changed, 181 insertions(+), 3 deletions(-) > create mode 100644 arch/csky/include/asm/seccomp.h > create mode 100644 arch/parisc/include/asm/seccomp.h > create mode 100644 arch/xtensa/include/asm/seccomp.h > > > base-commit: 38c37e8fd3d2590c4234d8cfbc22158362f0eb04 > -- > 2.29.2 -- Kees Cook _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/containers From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kees Cook Date: Wed, 04 Nov 2020 00:11:40 +0000 Subject: Re: [PATCH seccomp 0/8] seccomp: add bitmap cache support on remaining arches and report cache in pr Message-Id: <202011031606.423EC9E@keescook> List-Id: References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: YiFei Zhu Cc: linux-sh@vger.kernel.org, Tobin Feldman-Fitzthum , Hubertus Franke , Jack Chen , linux-riscv@lists.infradead.org, Andrea Arcangeli , linux-s390@vger.kernel.org, YiFei Zhu , linux-csky@vger.kernel.org, Tianyin Xu , linux-xtensa@linux-xtensa.org, Jann Horn , Valentin Rothberg , Josep Torrellas , Will Drewry , linux-parisc@vger.kernel.org, containers@lists.linux-foundation.org, linux-kernel@vger.kernel.org, Andy Lutomirski , Dimitrios Skarlatos , David Laight , Giuseppe Scrivano , linuxppc-dev@lists.ozlabs.org On Tue, Nov 03, 2020 at 07:42:56AM -0600, YiFei Zhu wrote: > From: YiFei Zhu > > This patch series enables bitmap cache for the remaining arches with > SECCOMP_FILTER, other than MIPS. > > I was unable to find any of the arches having subarch-specific NR_syscalls > macros, so generic NR_syscalls is used. SH's syscall_get_arch seems to > only have the 32-bit subarch implementation. I'm not sure if this is > expected. > > This series has not been tested; I have not built all the cross compilers > necessary to build test, let alone run the kernel or benchmark the > performance, so help on making sure the bitmap cache works as expected > would be appreciated. The series applies on top of Kees's for-next/seccomp > branch. Thank you! This looks good. I wonder if the different handling of little endian is worth solving -- I'm suspicious about powerpc's use of __LITTLE_ENDIAN__ vs a CONFIG, but I guess the compiler would match the target endian-ness. Regardless, it captures what the architectures are doing, and gets things standardized. > > YiFei Zhu (8): > csky: Enable seccomp architecture tracking > parisc: Enable seccomp architecture tracking I don't have compilers for these. > powerpc: Enable seccomp architecture tracking > riscv: Enable seccomp architecture tracking > s390: Enable seccomp architecture tracking These I can build-test immediately. > sh: Enable seccomp architecture tracking > xtensa: Enable seccomp architecture tracking These two are available in Ubuntu's cross compiler set, so I'll get them added to my cross-builders. > seccomp/cache: Report cache data through /proc/pid/seccomp_cache In the meantime, I'll wait a bit to see if we can get some Acks/Reviews from arch maintainers. :) -Kees > > arch/Kconfig | 15 ++++++++ > arch/csky/include/asm/Kbuild | 1 - > arch/csky/include/asm/seccomp.h | 11 ++++++ > arch/parisc/include/asm/Kbuild | 1 - > arch/parisc/include/asm/seccomp.h | 22 +++++++++++ > arch/powerpc/include/asm/seccomp.h | 21 +++++++++++ > arch/riscv/include/asm/seccomp.h | 10 +++++ > arch/s390/include/asm/seccomp.h | 9 +++++ > arch/sh/include/asm/seccomp.h | 10 +++++ > arch/xtensa/include/asm/Kbuild | 1 - > arch/xtensa/include/asm/seccomp.h | 11 ++++++ > fs/proc/base.c | 6 +++ > include/linux/seccomp.h | 7 ++++ > kernel/seccomp.c | 59 ++++++++++++++++++++++++++++++ > 14 files changed, 181 insertions(+), 3 deletions(-) > create mode 100644 arch/csky/include/asm/seccomp.h > create mode 100644 arch/parisc/include/asm/seccomp.h > create mode 100644 arch/xtensa/include/asm/seccomp.h > > > base-commit: 38c37e8fd3d2590c4234d8cfbc22158362f0eb04 > -- > 2.29.2 -- Kees Cook From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DDEBAC2D0A3 for ; Wed, 4 Nov 2020 00:16:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8A36D223BD for ; Wed, 4 Nov 2020 00:16:48 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="mPTbV2Uh" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729702AbgKDAN0 (ORCPT ); Tue, 3 Nov 2020 19:13:26 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53612 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729956AbgKDALo (ORCPT ); Tue, 3 Nov 2020 19:11:44 -0500 Received: from mail-pf1-x441.google.com (mail-pf1-x441.google.com [IPv6:2607:f8b0:4864:20::441]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D1F1CC061A47 for ; Tue, 3 Nov 2020 16:11:42 -0800 (PST) Received: by mail-pf1-x441.google.com with SMTP id w65so15802342pfd.3 for ; Tue, 03 Nov 2020 16:11:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=NFjsAF4kgpQCHVIlKmgYN6bEVL36r1XibqsUv152D08=; b=mPTbV2UhVfnJP2OoJL4D5QLosesGivMu0Yj5j7pkCrVtHA6dueaCzR1JSWWklnSxS2 Wgzos2joCi+Wlp8KUeVXQhCOJbK/Z4g4eTF82BJYkvr8uaU2CIt3++/EZgLF7nCLiPmR RFfDgHAz/9hjV1ZrPMZTrZyKkXhcZM/AoX3+w= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=NFjsAF4kgpQCHVIlKmgYN6bEVL36r1XibqsUv152D08=; b=JA5P50dlM+7dW/EbQx0x4nzjRRLBLZAboMcWND7qEDun32w1sP92dBkCOBgTwStF/z gBxsxnA7qNmV3dbH1fyaXfKF8LgyvJbjvUJcPtX+768KxHQi0xG+P2Zfsk687BGZ8Xpz tP2EyG7TajajPIDYcCajgstlUxMBzqdIr+JuiBku4v4HhTJFFUt8wJlN54nM3ItC1U/A 4d7tiivGgkvWI5NVSdd7gWeeP7ieo5WTLwRdlG3b7sonMPPzwWWEHykkBu1LCH/CXdVO wTKVe3klGzToOB1SWkVcylVuwmMIO2Mad1T3VDoZLRkQeOuglnPddVHwsRQNz2BAip8P Ja5g== X-Gm-Message-State: AOAM533W8DNKxp5xFLUk7s2m+EDU4OANAZ8puydgy32h3EUaP1NRJJcY xYt4XtDCF7Y08c7oyFJbR7m/lg== X-Google-Smtp-Source: ABdhPJybME+aS3qtjx8JuwpcYMqCGEp0y1Q8idII2QCmSunt2ifzlNcehSCk1E6c+iZLzWwdlgTh0g== X-Received: by 2002:a17:90a:5285:: with SMTP id w5mr1762165pjh.50.1604448702345; Tue, 03 Nov 2020 16:11:42 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id j20sm118311pgl.40.2020.11.03.16.11.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Nov 2020 16:11:41 -0800 (PST) Date: Tue, 3 Nov 2020 16:11:40 -0800 From: Kees Cook To: YiFei Zhu Cc: containers@lists.linux-foundation.org, YiFei Zhu , linux-csky@vger.kernel.org, linux-parisc@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org, linux-sh@vger.kernel.org, linux-xtensa@linux-xtensa.org, linux-kernel@vger.kernel.org, Aleksa Sarai , Andrea Arcangeli , Andy Lutomirski , David Laight , Dimitrios Skarlatos , Giuseppe Scrivano , Hubertus Franke , Jack Chen , Jann Horn , Josep Torrellas , Tianyin Xu , Tobin Feldman-Fitzthum , Tycho Andersen , Valentin Rothberg , Will Drewry Subject: Re: [PATCH seccomp 0/8] seccomp: add bitmap cache support on remaining arches and report cache in procfs Message-ID: <202011031606.423EC9E@keescook> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-parisc@vger.kernel.org On Tue, Nov 03, 2020 at 07:42:56AM -0600, YiFei Zhu wrote: > From: YiFei Zhu > > This patch series enables bitmap cache for the remaining arches with > SECCOMP_FILTER, other than MIPS. > > I was unable to find any of the arches having subarch-specific NR_syscalls > macros, so generic NR_syscalls is used. SH's syscall_get_arch seems to > only have the 32-bit subarch implementation. I'm not sure if this is > expected. > > This series has not been tested; I have not built all the cross compilers > necessary to build test, let alone run the kernel or benchmark the > performance, so help on making sure the bitmap cache works as expected > would be appreciated. The series applies on top of Kees's for-next/seccomp > branch. Thank you! This looks good. I wonder if the different handling of little endian is worth solving -- I'm suspicious about powerpc's use of __LITTLE_ENDIAN__ vs a CONFIG, but I guess the compiler would match the target endian-ness. Regardless, it captures what the architectures are doing, and gets things standardized. > > YiFei Zhu (8): > csky: Enable seccomp architecture tracking > parisc: Enable seccomp architecture tracking I don't have compilers for these. > powerpc: Enable seccomp architecture tracking > riscv: Enable seccomp architecture tracking > s390: Enable seccomp architecture tracking These I can build-test immediately. > sh: Enable seccomp architecture tracking > xtensa: Enable seccomp architecture tracking These two are available in Ubuntu's cross compiler set, so I'll get them added to my cross-builders. > seccomp/cache: Report cache data through /proc/pid/seccomp_cache In the meantime, I'll wait a bit to see if we can get some Acks/Reviews from arch maintainers. :) -Kees > > arch/Kconfig | 15 ++++++++ > arch/csky/include/asm/Kbuild | 1 - > arch/csky/include/asm/seccomp.h | 11 ++++++ > arch/parisc/include/asm/Kbuild | 1 - > arch/parisc/include/asm/seccomp.h | 22 +++++++++++ > arch/powerpc/include/asm/seccomp.h | 21 +++++++++++ > arch/riscv/include/asm/seccomp.h | 10 +++++ > arch/s390/include/asm/seccomp.h | 9 +++++ > arch/sh/include/asm/seccomp.h | 10 +++++ > arch/xtensa/include/asm/Kbuild | 1 - > arch/xtensa/include/asm/seccomp.h | 11 ++++++ > fs/proc/base.c | 6 +++ > include/linux/seccomp.h | 7 ++++ > kernel/seccomp.c | 59 ++++++++++++++++++++++++++++++ > 14 files changed, 181 insertions(+), 3 deletions(-) > create mode 100644 arch/csky/include/asm/seccomp.h > create mode 100644 arch/parisc/include/asm/seccomp.h > create mode 100644 arch/xtensa/include/asm/seccomp.h > > > base-commit: 38c37e8fd3d2590c4234d8cfbc22158362f0eb04 > -- > 2.29.2 -- Kees Cook From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D11A4C2D0A3 for ; Wed, 4 Nov 2020 00:12:06 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 6D01A223C7 for ; Wed, 4 Nov 2020 00:12:04 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="YxHF/RkW"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="mPTbV2Uh" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6D01A223C7 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References:Message-ID: Subject:To:From:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=yU9zS2EltGwg0smR6IkUkqpLYq6oU4yIeOobu9PXDXI=; b=YxHF/RkW6mlWwTQlW/XUCtv97 nA/SKfe+hF68VarNfzOs5/s4HnQnNMQJzCVJod4ROK2h93rN+mkZZ20eOeNoWqmS7sH3tIEzBV9cA 59pB42P9GcMm0YRfjBs3p6QPlNOOB+GH+ZuDG0zvw5k5r6aJvpqP8yKbVaNhZ9MSGHa6b1+HGjxbO GQE3KNng3y/BIk+R02ftpU/KOxprKD7n5dqzWsYqdTehXpESlEdLbsPPXH4DIibl5cVwbUsKxY22N TdFpdgsO7c/IFrpnTFQ5sw24Gb/THds+xRp3LrDAvStaCxig+RbWkvuAqpsYrpGlUtiF1sW142AhE KxXjPL7RQ==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1ka6Oy-0004wC-Th; Wed, 04 Nov 2020 00:11:49 +0000 Received: from mail-pg1-x541.google.com ([2607:f8b0:4864:20::541]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1ka6Ow-0004vZ-BZ for linux-riscv@lists.infradead.org; Wed, 04 Nov 2020 00:11:47 +0000 Received: by mail-pg1-x541.google.com with SMTP id w4so4794948pgg.13 for ; Tue, 03 Nov 2020 16:11:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=NFjsAF4kgpQCHVIlKmgYN6bEVL36r1XibqsUv152D08=; b=mPTbV2UhVfnJP2OoJL4D5QLosesGivMu0Yj5j7pkCrVtHA6dueaCzR1JSWWklnSxS2 Wgzos2joCi+Wlp8KUeVXQhCOJbK/Z4g4eTF82BJYkvr8uaU2CIt3++/EZgLF7nCLiPmR RFfDgHAz/9hjV1ZrPMZTrZyKkXhcZM/AoX3+w= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=NFjsAF4kgpQCHVIlKmgYN6bEVL36r1XibqsUv152D08=; b=XA7w69b1Q0C0D8SEwFhPbo1+zT2ioEAfQ7yRZhQSaxGboTnOUFfgSvb5FMI+xyR/sq hHngfPKfHmJG4/ij3G4X2iY2Z8QGKVTX/CYH+Do3oiiZeoPz26K+NCMfwAOenpsHhSp+ Kcc1TZPJyKdTOpYsNSRg0MCsD3IH7ErR3Bs5S8CMNPpVJA5E+vJhbRS9nBV3sljI+JZ8 guZFkqDonKBFdLcuFSTG/j9K9UDY+GDrOPU5/cpDitsxwgs0DXh0OsaF3JM4+k27JAqP x+8OIADdl6UuIxf+0joMdINUaHAd+gw+AoO44YnnmraFjSDNd5BsUP5ujQwLSWcwLyF8 ZvZQ== X-Gm-Message-State: AOAM5330grNSpukcrQFRh/tZHAvKzzfuzvBUCMHMyDjgCwaYO+OYktie MBNOThvl/QBnRKgFE3k9M/cbIg== X-Google-Smtp-Source: ABdhPJybME+aS3qtjx8JuwpcYMqCGEp0y1Q8idII2QCmSunt2ifzlNcehSCk1E6c+iZLzWwdlgTh0g== X-Received: by 2002:a17:90a:5285:: with SMTP id w5mr1762165pjh.50.1604448702345; Tue, 03 Nov 2020 16:11:42 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id j20sm118311pgl.40.2020.11.03.16.11.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Nov 2020 16:11:41 -0800 (PST) Date: Tue, 3 Nov 2020 16:11:40 -0800 From: Kees Cook To: YiFei Zhu Subject: Re: [PATCH seccomp 0/8] seccomp: add bitmap cache support on remaining arches and report cache in procfs Message-ID: <202011031606.423EC9E@keescook> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20201103_191146_460067_87ABD1F6 X-CRM114-Status: GOOD ( 21.65 ) X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-sh@vger.kernel.org, Tobin Feldman-Fitzthum , Hubertus Franke , Jack Chen , linux-riscv@lists.infradead.org, Andrea Arcangeli , linux-s390@vger.kernel.org, YiFei Zhu , linux-csky@vger.kernel.org, Tianyin Xu , linux-xtensa@linux-xtensa.org, Jann Horn , Valentin Rothberg , Aleksa Sarai , Josep Torrellas , Will Drewry , linux-parisc@vger.kernel.org, containers@lists.linux-foundation.org, linux-kernel@vger.kernel.org, Andy Lutomirski , Dimitrios Skarlatos , David Laight , Giuseppe Scrivano , linuxppc-dev@lists.ozlabs.org, Tycho Andersen Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-riscv" Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org On Tue, Nov 03, 2020 at 07:42:56AM -0600, YiFei Zhu wrote: > From: YiFei Zhu > > This patch series enables bitmap cache for the remaining arches with > SECCOMP_FILTER, other than MIPS. > > I was unable to find any of the arches having subarch-specific NR_syscalls > macros, so generic NR_syscalls is used. SH's syscall_get_arch seems to > only have the 32-bit subarch implementation. I'm not sure if this is > expected. > > This series has not been tested; I have not built all the cross compilers > necessary to build test, let alone run the kernel or benchmark the > performance, so help on making sure the bitmap cache works as expected > would be appreciated. The series applies on top of Kees's for-next/seccomp > branch. Thank you! This looks good. I wonder if the different handling of little endian is worth solving -- I'm suspicious about powerpc's use of __LITTLE_ENDIAN__ vs a CONFIG, but I guess the compiler would match the target endian-ness. Regardless, it captures what the architectures are doing, and gets things standardized. > > YiFei Zhu (8): > csky: Enable seccomp architecture tracking > parisc: Enable seccomp architecture tracking I don't have compilers for these. > powerpc: Enable seccomp architecture tracking > riscv: Enable seccomp architecture tracking > s390: Enable seccomp architecture tracking These I can build-test immediately. > sh: Enable seccomp architecture tracking > xtensa: Enable seccomp architecture tracking These two are available in Ubuntu's cross compiler set, so I'll get them added to my cross-builders. > seccomp/cache: Report cache data through /proc/pid/seccomp_cache In the meantime, I'll wait a bit to see if we can get some Acks/Reviews from arch maintainers. :) -Kees > > arch/Kconfig | 15 ++++++++ > arch/csky/include/asm/Kbuild | 1 - > arch/csky/include/asm/seccomp.h | 11 ++++++ > arch/parisc/include/asm/Kbuild | 1 - > arch/parisc/include/asm/seccomp.h | 22 +++++++++++ > arch/powerpc/include/asm/seccomp.h | 21 +++++++++++ > arch/riscv/include/asm/seccomp.h | 10 +++++ > arch/s390/include/asm/seccomp.h | 9 +++++ > arch/sh/include/asm/seccomp.h | 10 +++++ > arch/xtensa/include/asm/Kbuild | 1 - > arch/xtensa/include/asm/seccomp.h | 11 ++++++ > fs/proc/base.c | 6 +++ > include/linux/seccomp.h | 7 ++++ > kernel/seccomp.c | 59 ++++++++++++++++++++++++++++++ > 14 files changed, 181 insertions(+), 3 deletions(-) > create mode 100644 arch/csky/include/asm/seccomp.h > create mode 100644 arch/parisc/include/asm/seccomp.h > create mode 100644 arch/xtensa/include/asm/seccomp.h > > > base-commit: 38c37e8fd3d2590c4234d8cfbc22158362f0eb04 > -- > 2.29.2 -- Kees Cook _______________________________________________ linux-riscv mailing list linux-riscv@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-riscv From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 10C1CC2D0A3 for ; Wed, 4 Nov 2020 00:13:54 +0000 (UTC) Received: from lists.ozlabs.org (lists.ozlabs.org [203.11.71.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 2BF9F223EA for ; Wed, 4 Nov 2020 00:13:52 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="mPTbV2Uh" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 2BF9F223EA Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=linuxppc-dev-bounces+linuxppc-dev=archiver.kernel.org@lists.ozlabs.org Received: from bilbo.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 4CQnFB1KkzzDqcw for ; Wed, 4 Nov 2020 11:13:50 +1100 (AEDT) Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=chromium.org (client-ip=2607:f8b0:4864:20::543; helo=mail-pg1-x543.google.com; envelope-from=keescook@chromium.org; receiver=) Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: lists.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=chromium.org header.i=@chromium.org header.a=rsa-sha256 header.s=google header.b=mPTbV2Uh; dkim-atps=neutral Received: from mail-pg1-x543.google.com (mail-pg1-x543.google.com [IPv6:2607:f8b0:4864:20::543]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4CQnBx4Mf9zDqRH for ; Wed, 4 Nov 2020 11:11:46 +1100 (AEDT) Received: by mail-pg1-x543.google.com with SMTP id z24so15033473pgk.3 for ; Tue, 03 Nov 2020 16:11:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=NFjsAF4kgpQCHVIlKmgYN6bEVL36r1XibqsUv152D08=; b=mPTbV2UhVfnJP2OoJL4D5QLosesGivMu0Yj5j7pkCrVtHA6dueaCzR1JSWWklnSxS2 Wgzos2joCi+Wlp8KUeVXQhCOJbK/Z4g4eTF82BJYkvr8uaU2CIt3++/EZgLF7nCLiPmR RFfDgHAz/9hjV1ZrPMZTrZyKkXhcZM/AoX3+w= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=NFjsAF4kgpQCHVIlKmgYN6bEVL36r1XibqsUv152D08=; b=N/ViB20SDSfBSfASGhKCkRKTJF4sam/nwsIiERCPbiT2/tWytKViU+HR+9iLTDJwT3 mYyZoSCsZJDHz2H9PbZS3B1LKzdFMqFxC61zcE7FKNa0QhhvmEoaySdgMF6zKWb7stVj +cmOYCN9ZqnDwc/PDKnoB5MXnTqeEy5uHdZKS7Q+DPVINEipPLu3UPpXBzerKsb9rxOH OXrGjsxEJpOo/Fv4i0tvKnkjrypS7wLlnyW+y+yqGAp6vkodqqFCFTbVuNMlrh3ktUVM DzihacnkQlw6wTtzXG/I0SscDbgmmFFRLCeq1pQpRUiSY15i8fcdCWmjuN/eZ1k0X6Nl 1S2g== X-Gm-Message-State: AOAM530ePOyoADp/m+5yHOOC+qLwTT1U2UCeTbBRsHFIYNmOODJlhb6P RV7bigMrxeK/7IJNMFjeBN4a0w== X-Google-Smtp-Source: ABdhPJybME+aS3qtjx8JuwpcYMqCGEp0y1Q8idII2QCmSunt2ifzlNcehSCk1E6c+iZLzWwdlgTh0g== X-Received: by 2002:a17:90a:5285:: with SMTP id w5mr1762165pjh.50.1604448702345; Tue, 03 Nov 2020 16:11:42 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id j20sm118311pgl.40.2020.11.03.16.11.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Nov 2020 16:11:41 -0800 (PST) Date: Tue, 3 Nov 2020 16:11:40 -0800 From: Kees Cook To: YiFei Zhu Subject: Re: [PATCH seccomp 0/8] seccomp: add bitmap cache support on remaining arches and report cache in procfs Message-ID: <202011031606.423EC9E@keescook> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-sh@vger.kernel.org, Tobin Feldman-Fitzthum , Hubertus Franke , Jack Chen , linux-riscv@lists.infradead.org, Andrea Arcangeli , linux-s390@vger.kernel.org, YiFei Zhu , linux-csky@vger.kernel.org, Tianyin Xu , linux-xtensa@linux-xtensa.org, Jann Horn , Valentin Rothberg , Aleksa Sarai , Josep Torrellas , Will Drewry , linux-parisc@vger.kernel.org, containers@lists.linux-foundation.org, linux-kernel@vger.kernel.org, Andy Lutomirski , Dimitrios Skarlatos , David Laight , Giuseppe Scrivano , linuxppc-dev@lists.ozlabs.org, Tycho Andersen Errors-To: linuxppc-dev-bounces+linuxppc-dev=archiver.kernel.org@lists.ozlabs.org Sender: "Linuxppc-dev" On Tue, Nov 03, 2020 at 07:42:56AM -0600, YiFei Zhu wrote: > From: YiFei Zhu > > This patch series enables bitmap cache for the remaining arches with > SECCOMP_FILTER, other than MIPS. > > I was unable to find any of the arches having subarch-specific NR_syscalls > macros, so generic NR_syscalls is used. SH's syscall_get_arch seems to > only have the 32-bit subarch implementation. I'm not sure if this is > expected. > > This series has not been tested; I have not built all the cross compilers > necessary to build test, let alone run the kernel or benchmark the > performance, so help on making sure the bitmap cache works as expected > would be appreciated. The series applies on top of Kees's for-next/seccomp > branch. Thank you! This looks good. I wonder if the different handling of little endian is worth solving -- I'm suspicious about powerpc's use of __LITTLE_ENDIAN__ vs a CONFIG, but I guess the compiler would match the target endian-ness. Regardless, it captures what the architectures are doing, and gets things standardized. > > YiFei Zhu (8): > csky: Enable seccomp architecture tracking > parisc: Enable seccomp architecture tracking I don't have compilers for these. > powerpc: Enable seccomp architecture tracking > riscv: Enable seccomp architecture tracking > s390: Enable seccomp architecture tracking These I can build-test immediately. > sh: Enable seccomp architecture tracking > xtensa: Enable seccomp architecture tracking These two are available in Ubuntu's cross compiler set, so I'll get them added to my cross-builders. > seccomp/cache: Report cache data through /proc/pid/seccomp_cache In the meantime, I'll wait a bit to see if we can get some Acks/Reviews from arch maintainers. :) -Kees > > arch/Kconfig | 15 ++++++++ > arch/csky/include/asm/Kbuild | 1 - > arch/csky/include/asm/seccomp.h | 11 ++++++ > arch/parisc/include/asm/Kbuild | 1 - > arch/parisc/include/asm/seccomp.h | 22 +++++++++++ > arch/powerpc/include/asm/seccomp.h | 21 +++++++++++ > arch/riscv/include/asm/seccomp.h | 10 +++++ > arch/s390/include/asm/seccomp.h | 9 +++++ > arch/sh/include/asm/seccomp.h | 10 +++++ > arch/xtensa/include/asm/Kbuild | 1 - > arch/xtensa/include/asm/seccomp.h | 11 ++++++ > fs/proc/base.c | 6 +++ > include/linux/seccomp.h | 7 ++++ > kernel/seccomp.c | 59 ++++++++++++++++++++++++++++++ > 14 files changed, 181 insertions(+), 3 deletions(-) > create mode 100644 arch/csky/include/asm/seccomp.h > create mode 100644 arch/parisc/include/asm/seccomp.h > create mode 100644 arch/xtensa/include/asm/seccomp.h > > > base-commit: 38c37e8fd3d2590c4234d8cfbc22158362f0eb04 > -- > 2.29.2 -- Kees Cook