From: YiFei Zhu <zhuyifei1999@gmail.com> To: containers@lists.linux-foundation.org Cc: Andrea Arcangeli <aarcange@redhat.com>, Giuseppe Scrivano <gscrivan@redhat.com>, Valentin Rothberg <vrothber@redhat.com>, Kees Cook <keescook@chromium.org>, Jann Horn <jannh@google.com>, YiFei Zhu <yifeifz2@illinois.edu>, Tobin Feldman-Fitzthum <tobin@ibm.com>, linux-kernel@vger.kernel.org, Andy Lutomirski <luto@amacapital.net>, Hubertus Franke <frankeh@us.ibm.com>, Jack Chen <jianyan2@illinois.edu>, Dimitrios Skarlatos <dskarlat@cs.cmu.edu>, Josep Torrellas <torrella@illinois.edu>, Will Drewry <wad@chromium.org>, bpf@vger.kernel.org, Tianyin Xu <tyxu@illinois.edu> Subject: [PATCH v2 seccomp 5/6] selftests/seccomp: Compare bitmap vs filter overhead Date: Thu, 24 Sep 2020 07:44:20 -0500 [thread overview] Message-ID: <eedf3323eed8615a4be150b39a717de1a68f0c12.1600951211.git.yifeifz2@illinois.edu> (raw) In-Reply-To: <cover.1600951211.git.yifeifz2@illinois.edu> From: Kees Cook <keescook@chromium.org> As part of the seccomp benchmarking, include the expectations with regard to the timing behavior of the constant action bitmaps, and report inconsistencies better. Example output with constant action bitmaps on x86: $ sudo ./seccomp_benchmark 100000000 Current BPF sysctl settings: net.core.bpf_jit_enable = 1 net.core.bpf_jit_harden = 0 Benchmarking 100000000 syscalls... 63.896255358 - 0.008504529 = 63887750829 (63.9s) getpid native: 638 ns 130.383312423 - 63.897315189 = 66485997234 (66.5s) getpid RET_ALLOW 1 filter (bitmap): 664 ns 196.789080421 - 130.384414983 = 66404665438 (66.4s) getpid RET_ALLOW 2 filters (bitmap): 664 ns 268.844643304 - 196.790234168 = 72054409136 (72.1s) getpid RET_ALLOW 3 filters (full): 720 ns 342.627472515 - 268.845799103 = 73781673412 (73.8s) getpid RET_ALLOW 4 filters (full): 737 ns Estimated total seccomp overhead for 1 bitmapped filter: 26 ns Estimated total seccomp overhead for 2 bitmapped filters: 26 ns Estimated total seccomp overhead for 3 full filters: 82 ns Estimated total seccomp overhead for 4 full filters: 99 ns Estimated seccomp entry overhead: 26 ns Estimated seccomp per-filter overhead (last 2 diff): 17 ns Estimated seccomp per-filter overhead (filters / 4): 18 ns Expectations: native ≤ 1 bitmap (638 ≤ 664): ✔️ native ≤ 1 filter (638 ≤ 720): ✔️ per-filter (last 2 diff) ≈ per-filter (filters / 4) (17 ≈ 18): ✔️ 1 bitmapped ≈ 2 bitmapped (26 ≈ 26): ✔️ entry ≈ 1 bitmapped (26 ≈ 26): ✔️ entry ≈ 2 bitmapped (26 ≈ 26): ✔️ native + entry + (per filter * 4) ≈ 4 filters total (732 ≈ 737): ✔️ Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: YiFei Zhu <yifeifz2@illinois.edu> --- .../selftests/seccomp/seccomp_benchmark.c | 151 +++++++++++++++--- tools/testing/selftests/seccomp/settings | 2 +- 2 files changed, 130 insertions(+), 23 deletions(-) diff --git a/tools/testing/selftests/seccomp/seccomp_benchmark.c b/tools/testing/selftests/seccomp/seccomp_benchmark.c index 91f5a89cadac..fcc806585266 100644 --- a/tools/testing/selftests/seccomp/seccomp_benchmark.c +++ b/tools/testing/selftests/seccomp/seccomp_benchmark.c @@ -4,12 +4,16 @@ */ #define _GNU_SOURCE #include <assert.h> +#include <limits.h> +#include <stdbool.h> +#include <stddef.h> #include <stdio.h> #include <stdlib.h> #include <time.h> #include <unistd.h> #include <linux/filter.h> #include <linux/seccomp.h> +#include <sys/param.h> #include <sys/prctl.h> #include <sys/syscall.h> #include <sys/types.h> @@ -70,18 +74,74 @@ unsigned long long calibrate(void) return samples * seconds; } +bool approx(int i_one, int i_two) +{ + double one = i_one, one_bump = one * 0.01; + double two = i_two, two_bump = two * 0.01; + + one_bump = one + MAX(one_bump, 2.0); + two_bump = two + MAX(two_bump, 2.0); + + /* Equal to, or within 1% or 2 digits */ + if (one == two || + (one > two && one <= two_bump) || + (two > one && two <= one_bump)) + return true; + return false; +} + +bool le(int i_one, int i_two) +{ + if (i_one <= i_two) + return true; + return false; +} + +long compare(const char *name_one, const char *name_eval, const char *name_two, + unsigned long long one, bool (*eval)(int, int), unsigned long long two) +{ + bool good; + + printf("\t%s %s %s (%lld %s %lld): ", name_one, name_eval, name_two, + (long long)one, name_eval, (long long)two); + if (one > INT_MAX) { + printf("Miscalculation! Measurement went negative: %lld\n", (long long)one); + return 1; + } + if (two > INT_MAX) { + printf("Miscalculation! Measurement went negative: %lld\n", (long long)two); + return 1; + } + + good = eval(one, two); + printf("%s\n", good ? "✔️" : "❌"); + + return good ? 0 : 1; +} + int main(int argc, char *argv[]) { + struct sock_filter bitmap_filter[] = { + BPF_STMT(BPF_LD|BPF_W|BPF_ABS, offsetof(struct seccomp_data, nr)), + BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), + }; + struct sock_fprog bitmap_prog = { + .len = (unsigned short)ARRAY_SIZE(bitmap_filter), + .filter = bitmap_filter, + }; struct sock_filter filter[] = { + BPF_STMT(BPF_LD|BPF_W|BPF_ABS, offsetof(struct seccomp_data, args[0])), BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), }; struct sock_fprog prog = { .len = (unsigned short)ARRAY_SIZE(filter), .filter = filter, }; - long ret; - unsigned long long samples; - unsigned long long native, filter1, filter2; + + long ret, bits; + unsigned long long samples, calc; + unsigned long long native, filter1, filter2, bitmap1, bitmap2; + unsigned long long entry, per_filter1, per_filter2; printf("Current BPF sysctl settings:\n"); system("sysctl net.core.bpf_jit_enable"); @@ -101,35 +161,82 @@ int main(int argc, char *argv[]) ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); assert(ret == 0); - /* One filter */ - ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); + /* One filter resulting in a bitmap */ + ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog); assert(ret == 0); - filter1 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; - printf("getpid RET_ALLOW 1 filter: %llu ns\n", filter1); + bitmap1 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; + printf("getpid RET_ALLOW 1 filter (bitmap): %llu ns\n", bitmap1); + + /* Second filter resulting in a bitmap */ + ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog); + assert(ret == 0); - if (filter1 == native) - printf("No overhead measured!? Try running again with more samples.\n"); + bitmap2 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; + printf("getpid RET_ALLOW 2 filters (bitmap): %llu ns\n", bitmap2); - /* Two filters */ + /* Third filter, can no longer be converted to bitmap */ ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); assert(ret == 0); - filter2 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; - printf("getpid RET_ALLOW 2 filters: %llu ns\n", filter2); - - /* Calculations */ - printf("Estimated total seccomp overhead for 1 filter: %llu ns\n", - filter1 - native); + filter1 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; + printf("getpid RET_ALLOW 3 filters (full): %llu ns\n", filter1); - printf("Estimated total seccomp overhead for 2 filters: %llu ns\n", - filter2 - native); + /* Fourth filter, can not be converted to bitmap because of filter 3 */ + ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog); + assert(ret == 0); - printf("Estimated seccomp per-filter overhead: %llu ns\n", - filter2 - filter1); + filter2 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; + printf("getpid RET_ALLOW 4 filters (full): %llu ns\n", filter2); + + /* Estimations */ +#define ESTIMATE(fmt, var, what) do { \ + var = (what); \ + printf("Estimated " fmt ": %llu ns\n", var); \ + if (var > INT_MAX) \ + goto more_samples; \ + } while (0) + + ESTIMATE("total seccomp overhead for 1 bitmapped filter", calc, + bitmap1 - native); + ESTIMATE("total seccomp overhead for 2 bitmapped filters", calc, + bitmap2 - native); + ESTIMATE("total seccomp overhead for 3 full filters", calc, + filter1 - native); + ESTIMATE("total seccomp overhead for 4 full filters", calc, + filter2 - native); + ESTIMATE("seccomp entry overhead", entry, + bitmap1 - native - (bitmap2 - bitmap1)); + ESTIMATE("seccomp per-filter overhead (last 2 diff)", per_filter1, + filter2 - filter1); + ESTIMATE("seccomp per-filter overhead (filters / 4)", per_filter2, + (filter2 - native - entry) / 4); + + printf("Expectations:\n"); + ret |= compare("native", "≤", "1 bitmap", native, le, bitmap1); + bits = compare("native", "≤", "1 filter", native, le, filter1); + if (bits) + goto more_samples; + + ret |= compare("per-filter (last 2 diff)", "≈", "per-filter (filters / 4)", + per_filter1, approx, per_filter2); + + bits = compare("1 bitmapped", "≈", "2 bitmapped", + bitmap1 - native, approx, bitmap2 - native); + if (bits) { + printf("Skipping constant action bitmap expectations: they appear unsupported.\n"); + goto out; + } - printf("Estimated seccomp entry overhead: %llu ns\n", - filter1 - native - (filter2 - filter1)); + ret |= compare("entry", "≈", "1 bitmapped", entry, approx, bitmap1 - native); + ret |= compare("entry", "≈", "2 bitmapped", entry, approx, bitmap2 - native); + ret |= compare("native + entry + (per filter * 4)", "≈", "4 filters total", + entry + (per_filter1 * 4) + native, approx, filter2); + if (ret == 0) + goto out; +more_samples: + printf("Saw unexpected benchmark result. Try running again with more samples?\n"); +out: return 0; } diff --git a/tools/testing/selftests/seccomp/settings b/tools/testing/selftests/seccomp/settings index ba4d85f74cd6..6091b45d226b 100644 --- a/tools/testing/selftests/seccomp/settings +++ b/tools/testing/selftests/seccomp/settings @@ -1 +1 @@ -timeout=90 +timeout=120 -- 2.28.0 _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/containers
WARNING: multiple messages have this Message-ID (diff)
From: YiFei Zhu <zhuyifei1999@gmail.com> To: containers@lists.linux-foundation.org Cc: YiFei Zhu <yifeifz2@illinois.edu>, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, Aleksa Sarai <cyphar@cyphar.com>, Andrea Arcangeli <aarcange@redhat.com>, Andy Lutomirski <luto@amacapital.net>, Dimitrios Skarlatos <dskarlat@cs.cmu.edu>, Giuseppe Scrivano <gscrivan@redhat.com>, Hubertus Franke <frankeh@us.ibm.com>, Jack Chen <jianyan2@illinois.edu>, Jann Horn <jannh@google.com>, Josep Torrellas <torrella@illinois.edu>, Kees Cook <keescook@chromium.org>, Tianyin Xu <tyxu@illinois.edu>, Tobin Feldman-Fitzthum <tobin@ibm.com>, Tycho Andersen <tycho@tycho.pizza>, Valentin Rothberg <vrothber@redhat.com>, Will Drewry <wad@chromium.org> Subject: [PATCH v2 seccomp 5/6] selftests/seccomp: Compare bitmap vs filter overhead Date: Thu, 24 Sep 2020 07:44:20 -0500 [thread overview] Message-ID: <eedf3323eed8615a4be150b39a717de1a68f0c12.1600951211.git.yifeifz2@illinois.edu> (raw) In-Reply-To: <cover.1600951211.git.yifeifz2@illinois.edu> From: Kees Cook <keescook@chromium.org> As part of the seccomp benchmarking, include the expectations with regard to the timing behavior of the constant action bitmaps, and report inconsistencies better. Example output with constant action bitmaps on x86: $ sudo ./seccomp_benchmark 100000000 Current BPF sysctl settings: net.core.bpf_jit_enable = 1 net.core.bpf_jit_harden = 0 Benchmarking 100000000 syscalls... 63.896255358 - 0.008504529 = 63887750829 (63.9s) getpid native: 638 ns 130.383312423 - 63.897315189 = 66485997234 (66.5s) getpid RET_ALLOW 1 filter (bitmap): 664 ns 196.789080421 - 130.384414983 = 66404665438 (66.4s) getpid RET_ALLOW 2 filters (bitmap): 664 ns 268.844643304 - 196.790234168 = 72054409136 (72.1s) getpid RET_ALLOW 3 filters (full): 720 ns 342.627472515 - 268.845799103 = 73781673412 (73.8s) getpid RET_ALLOW 4 filters (full): 737 ns Estimated total seccomp overhead for 1 bitmapped filter: 26 ns Estimated total seccomp overhead for 2 bitmapped filters: 26 ns Estimated total seccomp overhead for 3 full filters: 82 ns Estimated total seccomp overhead for 4 full filters: 99 ns Estimated seccomp entry overhead: 26 ns Estimated seccomp per-filter overhead (last 2 diff): 17 ns Estimated seccomp per-filter overhead (filters / 4): 18 ns Expectations: native ≤ 1 bitmap (638 ≤ 664): ✔️ native ≤ 1 filter (638 ≤ 720): ✔️ per-filter (last 2 diff) ≈ per-filter (filters / 4) (17 ≈ 18): ✔️ 1 bitmapped ≈ 2 bitmapped (26 ≈ 26): ✔️ entry ≈ 1 bitmapped (26 ≈ 26): ✔️ entry ≈ 2 bitmapped (26 ≈ 26): ✔️ native + entry + (per filter * 4) ≈ 4 filters total (732 ≈ 737): ✔️ Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: YiFei Zhu <yifeifz2@illinois.edu> --- .../selftests/seccomp/seccomp_benchmark.c | 151 +++++++++++++++--- tools/testing/selftests/seccomp/settings | 2 +- 2 files changed, 130 insertions(+), 23 deletions(-) diff --git a/tools/testing/selftests/seccomp/seccomp_benchmark.c b/tools/testing/selftests/seccomp/seccomp_benchmark.c index 91f5a89cadac..fcc806585266 100644 --- a/tools/testing/selftests/seccomp/seccomp_benchmark.c +++ b/tools/testing/selftests/seccomp/seccomp_benchmark.c @@ -4,12 +4,16 @@ */ #define _GNU_SOURCE #include <assert.h> +#include <limits.h> +#include <stdbool.h> +#include <stddef.h> #include <stdio.h> #include <stdlib.h> #include <time.h> #include <unistd.h> #include <linux/filter.h> #include <linux/seccomp.h> +#include <sys/param.h> #include <sys/prctl.h> #include <sys/syscall.h> #include <sys/types.h> @@ -70,18 +74,74 @@ unsigned long long calibrate(void) return samples * seconds; } +bool approx(int i_one, int i_two) +{ + double one = i_one, one_bump = one * 0.01; + double two = i_two, two_bump = two * 0.01; + + one_bump = one + MAX(one_bump, 2.0); + two_bump = two + MAX(two_bump, 2.0); + + /* Equal to, or within 1% or 2 digits */ + if (one == two || + (one > two && one <= two_bump) || + (two > one && two <= one_bump)) + return true; + return false; +} + +bool le(int i_one, int i_two) +{ + if (i_one <= i_two) + return true; + return false; +} + +long compare(const char *name_one, const char *name_eval, const char *name_two, + unsigned long long one, bool (*eval)(int, int), unsigned long long two) +{ + bool good; + + printf("\t%s %s %s (%lld %s %lld): ", name_one, name_eval, name_two, + (long long)one, name_eval, (long long)two); + if (one > INT_MAX) { + printf("Miscalculation! Measurement went negative: %lld\n", (long long)one); + return 1; + } + if (two > INT_MAX) { + printf("Miscalculation! Measurement went negative: %lld\n", (long long)two); + return 1; + } + + good = eval(one, two); + printf("%s\n", good ? "✔️" : "❌"); + + return good ? 0 : 1; +} + int main(int argc, char *argv[]) { + struct sock_filter bitmap_filter[] = { + BPF_STMT(BPF_LD|BPF_W|BPF_ABS, offsetof(struct seccomp_data, nr)), + BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), + }; + struct sock_fprog bitmap_prog = { + .len = (unsigned short)ARRAY_SIZE(bitmap_filter), + .filter = bitmap_filter, + }; struct sock_filter filter[] = { + BPF_STMT(BPF_LD|BPF_W|BPF_ABS, offsetof(struct seccomp_data, args[0])), BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), }; struct sock_fprog prog = { .len = (unsigned short)ARRAY_SIZE(filter), .filter = filter, }; - long ret; - unsigned long long samples; - unsigned long long native, filter1, filter2; + + long ret, bits; + unsigned long long samples, calc; + unsigned long long native, filter1, filter2, bitmap1, bitmap2; + unsigned long long entry, per_filter1, per_filter2; printf("Current BPF sysctl settings:\n"); system("sysctl net.core.bpf_jit_enable"); @@ -101,35 +161,82 @@ int main(int argc, char *argv[]) ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); assert(ret == 0); - /* One filter */ - ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); + /* One filter resulting in a bitmap */ + ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog); assert(ret == 0); - filter1 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; - printf("getpid RET_ALLOW 1 filter: %llu ns\n", filter1); + bitmap1 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; + printf("getpid RET_ALLOW 1 filter (bitmap): %llu ns\n", bitmap1); + + /* Second filter resulting in a bitmap */ + ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog); + assert(ret == 0); - if (filter1 == native) - printf("No overhead measured!? Try running again with more samples.\n"); + bitmap2 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; + printf("getpid RET_ALLOW 2 filters (bitmap): %llu ns\n", bitmap2); - /* Two filters */ + /* Third filter, can no longer be converted to bitmap */ ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); assert(ret == 0); - filter2 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; - printf("getpid RET_ALLOW 2 filters: %llu ns\n", filter2); - - /* Calculations */ - printf("Estimated total seccomp overhead for 1 filter: %llu ns\n", - filter1 - native); + filter1 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; + printf("getpid RET_ALLOW 3 filters (full): %llu ns\n", filter1); - printf("Estimated total seccomp overhead for 2 filters: %llu ns\n", - filter2 - native); + /* Fourth filter, can not be converted to bitmap because of filter 3 */ + ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog); + assert(ret == 0); - printf("Estimated seccomp per-filter overhead: %llu ns\n", - filter2 - filter1); + filter2 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; + printf("getpid RET_ALLOW 4 filters (full): %llu ns\n", filter2); + + /* Estimations */ +#define ESTIMATE(fmt, var, what) do { \ + var = (what); \ + printf("Estimated " fmt ": %llu ns\n", var); \ + if (var > INT_MAX) \ + goto more_samples; \ + } while (0) + + ESTIMATE("total seccomp overhead for 1 bitmapped filter", calc, + bitmap1 - native); + ESTIMATE("total seccomp overhead for 2 bitmapped filters", calc, + bitmap2 - native); + ESTIMATE("total seccomp overhead for 3 full filters", calc, + filter1 - native); + ESTIMATE("total seccomp overhead for 4 full filters", calc, + filter2 - native); + ESTIMATE("seccomp entry overhead", entry, + bitmap1 - native - (bitmap2 - bitmap1)); + ESTIMATE("seccomp per-filter overhead (last 2 diff)", per_filter1, + filter2 - filter1); + ESTIMATE("seccomp per-filter overhead (filters / 4)", per_filter2, + (filter2 - native - entry) / 4); + + printf("Expectations:\n"); + ret |= compare("native", "≤", "1 bitmap", native, le, bitmap1); + bits = compare("native", "≤", "1 filter", native, le, filter1); + if (bits) + goto more_samples; + + ret |= compare("per-filter (last 2 diff)", "≈", "per-filter (filters / 4)", + per_filter1, approx, per_filter2); + + bits = compare("1 bitmapped", "≈", "2 bitmapped", + bitmap1 - native, approx, bitmap2 - native); + if (bits) { + printf("Skipping constant action bitmap expectations: they appear unsupported.\n"); + goto out; + } - printf("Estimated seccomp entry overhead: %llu ns\n", - filter1 - native - (filter2 - filter1)); + ret |= compare("entry", "≈", "1 bitmapped", entry, approx, bitmap1 - native); + ret |= compare("entry", "≈", "2 bitmapped", entry, approx, bitmap2 - native); + ret |= compare("native + entry + (per filter * 4)", "≈", "4 filters total", + entry + (per_filter1 * 4) + native, approx, filter2); + if (ret == 0) + goto out; +more_samples: + printf("Saw unexpected benchmark result. Try running again with more samples?\n"); +out: return 0; } diff --git a/tools/testing/selftests/seccomp/settings b/tools/testing/selftests/seccomp/settings index ba4d85f74cd6..6091b45d226b 100644 --- a/tools/testing/selftests/seccomp/settings +++ b/tools/testing/selftests/seccomp/settings @@ -1 +1 @@ -timeout=90 +timeout=120 -- 2.28.0
next prev parent reply other threads:[~2020-09-24 12:44 UTC|newest] Thread overview: 302+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-09-21 5:35 [RFC PATCH seccomp 0/2] seccomp: Add bitmap cache of arg-independent filter results that allow syscalls YiFei Zhu 2020-09-21 5:35 ` YiFei Zhu 2020-09-21 5:35 ` [RFC PATCH seccomp 1/2] seccomp/cache: Add "emulator" to check if filter is arg-dependent YiFei Zhu 2020-09-21 5:35 ` YiFei Zhu 2020-09-21 17:47 ` Jann Horn via Containers 2020-09-21 17:47 ` Jann Horn 2020-09-21 18:38 ` Jann Horn via Containers 2020-09-21 18:38 ` Jann Horn 2020-09-21 23:44 ` YiFei Zhu 2020-09-21 23:44 ` YiFei Zhu 2020-09-22 0:25 ` Jann Horn via Containers 2020-09-22 0:25 ` Jann Horn 2020-09-22 0:47 ` YiFei Zhu 2020-09-22 0:47 ` YiFei Zhu 2020-09-21 5:35 ` [RFC PATCH seccomp 2/2] seccomp/cache: Cache filter results that allow syscalls YiFei Zhu 2020-09-21 5:35 ` YiFei Zhu 2020-09-21 18:08 ` Jann Horn via Containers 2020-09-21 18:08 ` Jann Horn 2020-09-21 22:50 ` YiFei Zhu 2020-09-21 22:50 ` YiFei Zhu 2020-09-21 22:57 ` Jann Horn via Containers 2020-09-21 22:57 ` Jann Horn 2020-09-21 23:08 ` YiFei Zhu 2020-09-21 23:08 ` YiFei Zhu 2020-09-25 0:01 ` [PATCH v2 seccomp 2/6] asm/syscall.h: Add syscall_arches[] array Kees Cook 2020-09-25 0:01 ` Kees Cook 2020-09-25 0:15 ` Jann Horn via Containers 2020-09-25 0:15 ` Jann Horn 2020-09-25 0:18 ` Al Viro 2020-09-25 0:18 ` Al Viro 2020-09-25 0:24 ` Jann Horn via Containers 2020-09-25 0:24 ` Jann Horn 2020-09-25 1:27 ` YiFei Zhu 2020-09-25 1:27 ` YiFei Zhu 2020-09-25 3:09 ` Kees Cook 2020-09-25 3:09 ` Kees Cook 2020-09-25 3:28 ` YiFei Zhu 2020-09-25 3:28 ` YiFei Zhu 2020-09-25 16:39 ` YiFei Zhu 2020-09-25 16:39 ` YiFei Zhu 2020-09-21 5:48 ` [RFC PATCH seccomp 0/2] seccomp: Add bitmap cache of arg-independent filter results that allow syscalls Sargun Dhillon 2020-09-21 5:48 ` Sargun Dhillon 2020-09-21 7:13 ` YiFei Zhu 2020-09-21 7:13 ` YiFei Zhu 2020-09-21 8:30 ` Christian Brauner 2020-09-21 8:30 ` Christian Brauner 2020-09-21 8:44 ` YiFei Zhu 2020-09-21 8:44 ` YiFei Zhu 2020-09-21 13:51 ` Tycho Andersen 2020-09-21 13:51 ` Tycho Andersen 2020-09-21 15:27 ` YiFei Zhu 2020-09-21 15:27 ` YiFei Zhu 2020-09-21 16:39 ` Tycho Andersen 2020-09-21 16:39 ` Tycho Andersen 2020-09-21 22:57 ` YiFei Zhu 2020-09-21 22:57 ` YiFei Zhu 2020-09-21 19:16 ` Jann Horn via Containers 2020-09-21 19:16 ` Jann Horn 2020-09-21 19:35 ` Hubertus Franke 2020-09-21 19:45 ` Jann Horn via Containers 2020-09-21 19:45 ` Jann Horn 2020-09-23 19:26 ` Kees Cook 2020-09-23 19:26 ` Kees Cook 2020-09-23 22:54 ` YiFei Zhu 2020-09-23 22:54 ` YiFei Zhu 2020-09-24 6:52 ` Kees Cook 2020-09-24 6:52 ` Kees Cook 2020-09-24 12:06 ` [PATCH seccomp 0/6] " YiFei Zhu 2020-09-24 12:06 ` YiFei Zhu 2020-09-24 12:06 ` [PATCH seccomp 1/6] seccomp: Move config option SECCOMP to arch/Kconfig YiFei Zhu 2020-09-24 12:06 ` YiFei Zhu 2020-09-24 12:06 ` YiFei Zhu 2020-09-24 12:06 ` YiFei Zhu 2020-09-24 12:06 ` [PATCH seccomp 2/6] asm/syscall.h: Add syscall_arches[] array YiFei Zhu 2020-09-24 12:06 ` YiFei Zhu 2020-09-24 12:06 ` [PATCH seccomp 3/6] seccomp/cache: Add "emulator" to check if filter is arg-dependent YiFei Zhu 2020-09-24 12:06 ` YiFei Zhu 2020-09-24 12:06 ` [PATCH seccomp 4/6] seccomp/cache: Lookup syscall allowlist for fast path YiFei Zhu 2020-09-24 12:06 ` YiFei Zhu 2020-09-24 12:06 ` [PATCH seccomp 5/6] selftests/seccomp: Compare bitmap vs filter overhead YiFei Zhu 2020-09-24 12:06 ` YiFei Zhu 2020-09-24 12:06 ` [PATCH seccomp 6/6] seccomp/cache: Report cache data through /proc/pid/seccomp_cache YiFei Zhu 2020-09-24 12:06 ` YiFei Zhu 2020-09-24 12:44 ` [PATCH v2 seccomp 0/6] seccomp: Add bitmap cache of arg-independent filter results that allow syscalls YiFei Zhu 2020-09-24 12:44 ` YiFei Zhu 2020-09-24 12:44 ` [PATCH v2 seccomp 1/6] seccomp: Move config option SECCOMP to arch/Kconfig YiFei Zhu 2020-09-24 12:44 ` YiFei Zhu 2020-09-24 19:11 ` Kees Cook 2020-09-24 19:11 ` Kees Cook 2020-10-27 9:52 ` Geert Uytterhoeven 2020-10-27 9:52 ` Geert Uytterhoeven 2020-10-27 19:08 ` YiFei Zhu 2020-10-27 19:08 ` YiFei Zhu 2020-10-28 0:06 ` Kees Cook 2020-10-28 0:06 ` Kees Cook 2020-10-28 8:18 ` Geert Uytterhoeven 2020-10-28 8:18 ` Geert Uytterhoeven 2020-10-28 9:34 ` Jann Horn via Containers 2020-10-28 9:34 ` Jann Horn 2020-09-24 12:44 ` [PATCH v2 seccomp 2/6] asm/syscall.h: Add syscall_arches[] array YiFei Zhu 2020-09-24 12:44 ` YiFei Zhu 2020-09-24 13:47 ` David Laight 2020-09-24 13:47 ` David Laight 2020-09-24 14:16 ` YiFei Zhu 2020-09-24 14:16 ` YiFei Zhu 2020-09-24 14:20 ` David Laight 2020-09-24 14:20 ` David Laight 2020-09-24 14:37 ` YiFei Zhu 2020-09-24 14:37 ` YiFei Zhu 2020-09-24 16:02 ` YiFei Zhu 2020-09-24 16:02 ` YiFei Zhu 2020-09-24 12:44 ` [PATCH v2 seccomp 3/6] seccomp/cache: Add "emulator" to check if filter is arg-dependent YiFei Zhu 2020-09-24 12:44 ` YiFei Zhu 2020-09-24 23:25 ` Kees Cook 2020-09-24 23:25 ` Kees Cook 2020-09-25 3:04 ` YiFei Zhu 2020-09-25 3:04 ` YiFei Zhu 2020-09-25 16:45 ` YiFei Zhu 2020-09-25 16:45 ` YiFei Zhu 2020-09-25 19:42 ` Kees Cook 2020-09-25 19:42 ` Kees Cook 2020-09-25 19:51 ` Andy Lutomirski 2020-09-25 19:51 ` Andy Lutomirski 2020-09-25 20:37 ` Kees Cook 2020-09-25 20:37 ` Kees Cook 2020-09-25 21:07 ` Andy Lutomirski 2020-09-25 21:07 ` Andy Lutomirski 2020-09-25 23:49 ` Kees Cook 2020-09-25 23:49 ` Kees Cook 2020-09-26 0:34 ` Andy Lutomirski 2020-09-26 0:34 ` Andy Lutomirski 2020-09-26 1:23 ` YiFei Zhu 2020-09-26 1:23 ` YiFei Zhu 2020-09-26 2:47 ` Andy Lutomirski 2020-09-26 2:47 ` Andy Lutomirski 2020-09-26 4:35 ` Kees Cook 2020-09-26 4:35 ` Kees Cook 2020-09-24 12:44 ` [PATCH v2 seccomp 4/6] seccomp/cache: Lookup syscall allowlist for fast path YiFei Zhu 2020-09-24 12:44 ` YiFei Zhu 2020-09-24 23:46 ` Kees Cook 2020-09-24 23:46 ` Kees Cook 2020-09-25 1:55 ` YiFei Zhu 2020-09-25 1:55 ` YiFei Zhu 2020-09-24 12:44 ` YiFei Zhu [this message] 2020-09-24 12:44 ` [PATCH v2 seccomp 5/6] selftests/seccomp: Compare bitmap vs filter overhead YiFei Zhu 2020-09-24 23:47 ` Kees Cook 2020-09-24 23:47 ` Kees Cook 2020-09-25 1:35 ` YiFei Zhu 2020-09-25 1:35 ` YiFei Zhu 2020-09-24 12:44 ` [PATCH v2 seccomp 6/6] seccomp/cache: Report cache data through /proc/pid/seccomp_cache YiFei Zhu 2020-09-24 12:44 ` YiFei Zhu 2020-09-24 23:56 ` Kees Cook 2020-09-24 23:56 ` Kees Cook 2020-09-25 3:11 ` YiFei Zhu 2020-09-25 3:11 ` YiFei Zhu 2020-09-25 3:26 ` Kees Cook 2020-09-25 3:26 ` Kees Cook 2020-09-30 15:19 ` [PATCH v3 seccomp 0/5] seccomp: Add bitmap cache of constant allow filter results YiFei Zhu 2020-09-30 15:19 ` YiFei Zhu 2020-09-30 15:19 ` [PATCH v3 seccomp 1/5] x86: Enable seccomp architecture tracking YiFei Zhu 2020-09-30 15:19 ` YiFei Zhu 2020-09-30 21:21 ` Kees Cook 2020-09-30 21:21 ` Kees Cook 2020-09-30 21:33 ` Jann Horn via Containers 2020-09-30 21:33 ` Jann Horn 2020-09-30 22:53 ` Kees Cook 2020-09-30 22:53 ` Kees Cook 2020-09-30 23:15 ` Jann Horn via Containers 2020-09-30 23:15 ` Jann Horn 2020-09-30 15:19 ` [PATCH v3 seccomp 2/5] seccomp/cache: Add "emulator" to check if filter is constant allow YiFei Zhu 2020-09-30 15:19 ` YiFei Zhu 2020-09-30 22:24 ` Jann Horn via Containers 2020-09-30 22:24 ` Jann Horn 2020-09-30 22:49 ` Kees Cook 2020-09-30 22:49 ` Kees Cook 2020-10-01 11:28 ` YiFei Zhu 2020-10-01 11:28 ` YiFei Zhu 2020-10-01 21:08 ` Jann Horn via Containers 2020-10-01 21:08 ` Jann Horn 2020-09-30 22:40 ` Kees Cook 2020-09-30 22:40 ` Kees Cook 2020-10-01 11:52 ` YiFei Zhu 2020-10-01 11:52 ` YiFei Zhu 2020-10-01 21:05 ` Kees Cook 2020-10-01 21:05 ` Kees Cook 2020-10-02 11:08 ` YiFei Zhu 2020-10-02 11:08 ` YiFei Zhu 2020-10-09 4:47 ` YiFei Zhu 2020-10-09 4:47 ` YiFei Zhu 2020-10-09 5:41 ` Kees Cook 2020-10-09 5:41 ` Kees Cook 2020-09-30 15:19 ` [PATCH v3 seccomp 3/5] seccomp/cache: Lookup syscall allowlist for fast path YiFei Zhu 2020-09-30 15:19 ` YiFei Zhu 2020-09-30 21:32 ` Kees Cook 2020-09-30 21:32 ` Kees Cook 2020-10-09 0:17 ` YiFei Zhu 2020-10-09 0:17 ` YiFei Zhu 2020-10-09 5:35 ` Kees Cook 2020-10-09 5:35 ` Kees Cook 2020-09-30 15:19 ` [PATCH v3 seccomp 4/5] selftests/seccomp: Compare bitmap vs filter overhead YiFei Zhu 2020-09-30 15:19 ` YiFei Zhu 2020-09-30 15:19 ` [PATCH v3 seccomp 5/5] seccomp/cache: Report cache data through /proc/pid/seccomp_cache YiFei Zhu 2020-09-30 15:19 ` YiFei Zhu 2020-09-30 22:00 ` Jann Horn via Containers 2020-09-30 22:00 ` Jann Horn 2020-09-30 23:12 ` Kees Cook 2020-09-30 23:12 ` Kees Cook 2020-10-01 12:06 ` YiFei Zhu 2020-10-01 12:06 ` YiFei Zhu 2020-10-01 16:05 ` Jann Horn via Containers 2020-10-01 16:05 ` Jann Horn 2020-10-01 16:18 ` YiFei Zhu 2020-10-01 16:18 ` YiFei Zhu 2020-09-30 22:59 ` Kees Cook 2020-09-30 22:59 ` Kees Cook 2020-09-30 23:08 ` Jann Horn via Containers 2020-09-30 23:08 ` Jann Horn 2020-09-30 23:21 ` Kees Cook 2020-09-30 23:21 ` Kees Cook 2020-10-09 17:14 ` [PATCH v4 seccomp 0/5] seccomp: Add bitmap cache of constant allow filter results YiFei Zhu 2020-10-09 17:14 ` YiFei Zhu 2020-10-09 17:14 ` [PATCH v4 seccomp 1/5] seccomp/cache: Lookup syscall allowlist bitmap for fast path YiFei Zhu 2020-10-09 17:14 ` YiFei Zhu 2020-10-09 21:30 ` Jann Horn via Containers 2020-10-09 21:30 ` Jann Horn 2020-10-09 23:18 ` Kees Cook 2020-10-09 23:18 ` Kees Cook 2020-10-09 17:14 ` [PATCH v4 seccomp 2/5] seccomp/cache: Add "emulator" to check if filter is constant allow YiFei Zhu 2020-10-09 17:14 ` YiFei Zhu 2020-10-09 21:30 ` Jann Horn via Containers 2020-10-09 21:30 ` Jann Horn 2020-10-09 22:47 ` Kees Cook 2020-10-09 22:47 ` Kees Cook 2020-10-09 17:14 ` [PATCH v4 seccomp 3/5] x86: Enable seccomp architecture tracking YiFei Zhu 2020-10-09 17:14 ` YiFei Zhu 2020-10-09 17:25 ` Andy Lutomirski 2020-10-09 17:25 ` Andy Lutomirski 2020-10-09 18:32 ` YiFei Zhu 2020-10-09 18:32 ` YiFei Zhu 2020-10-09 20:59 ` Andy Lutomirski 2020-10-09 20:59 ` Andy Lutomirski 2020-10-09 17:14 ` [PATCH v4 seccomp 4/5] selftests/seccomp: Compare bitmap vs filter overhead YiFei Zhu 2020-10-09 17:14 ` YiFei Zhu 2020-10-09 17:14 ` [PATCH v4 seccomp 5/5] seccomp/cache: Report cache data through /proc/pid/seccomp_cache YiFei Zhu 2020-10-09 17:14 ` YiFei Zhu 2020-10-09 21:24 ` kernel test robot 2020-10-09 21:24 ` kernel test robot 2020-10-09 21:24 ` kernel test robot 2020-10-09 21:45 ` Jann Horn via Containers 2020-10-09 21:45 ` Jann Horn 2020-10-09 23:14 ` Kees Cook 2020-10-09 23:14 ` Kees Cook 2020-10-10 13:26 ` YiFei Zhu 2020-10-10 13:26 ` YiFei Zhu 2020-10-12 22:57 ` Kees Cook 2020-10-12 22:57 ` Kees Cook 2020-10-13 0:31 ` YiFei Zhu 2020-10-13 0:31 ` YiFei Zhu 2020-10-22 20:52 ` YiFei Zhu 2020-10-22 20:52 ` YiFei Zhu 2020-10-22 22:32 ` Kees Cook 2020-10-22 22:32 ` Kees Cook 2020-10-22 23:40 ` YiFei Zhu 2020-10-22 23:40 ` YiFei Zhu 2020-10-24 2:51 ` Kees Cook 2020-10-24 2:51 ` Kees Cook 2020-10-30 12:18 ` YiFei Zhu 2020-10-30 12:18 ` YiFei Zhu 2020-11-03 13:00 ` YiFei Zhu 2020-11-03 13:00 ` YiFei Zhu 2020-11-04 0:29 ` Kees Cook 2020-11-04 0:29 ` Kees Cook 2020-11-04 11:40 ` YiFei Zhu 2020-11-04 11:40 ` YiFei Zhu 2020-11-04 18:57 ` Kees Cook 2020-11-04 18:57 ` Kees Cook 2020-10-11 15:47 ` [PATCH v5 seccomp 0/5]seccomp: Add bitmap cache of constant allow filter results YiFei Zhu 2020-10-11 15:47 ` YiFei Zhu 2020-10-11 15:47 ` [PATCH v5 seccomp 1/5] seccomp/cache: Lookup syscall allowlist bitmap for fast path YiFei Zhu 2020-10-11 15:47 ` YiFei Zhu 2020-10-12 6:42 ` Jann Horn via Containers 2020-10-12 6:42 ` Jann Horn 2020-10-11 15:47 ` [PATCH v5 seccomp 2/5] seccomp/cache: Add "emulator" to check if filter is constant allow YiFei Zhu 2020-10-11 15:47 ` YiFei Zhu 2020-10-12 6:46 ` Jann Horn via Containers 2020-10-12 6:46 ` Jann Horn 2020-10-11 15:47 ` [PATCH v5 seccomp 3/5] x86: Enable seccomp architecture tracking YiFei Zhu 2020-10-11 15:47 ` YiFei Zhu 2020-10-11 15:47 ` [PATCH v5 seccomp 4/5] selftests/seccomp: Compare bitmap vs filter overhead YiFei Zhu 2020-10-11 15:47 ` YiFei Zhu 2020-10-11 15:47 ` [PATCH v5 seccomp 5/5] seccomp/cache: Report cache data through /proc/pid/seccomp_cache YiFei Zhu 2020-10-11 15:47 ` YiFei Zhu 2020-10-12 6:49 ` Jann Horn via Containers 2020-10-12 6:49 ` Jann Horn 2020-12-17 12:14 ` Geert Uytterhoeven 2020-12-17 12:14 ` Geert Uytterhoeven 2020-12-17 18:34 ` YiFei Zhu 2020-12-17 18:34 ` YiFei Zhu 2020-12-18 12:35 ` Geert Uytterhoeven 2020-12-18 12:35 ` Geert Uytterhoeven 2020-10-27 19:14 ` [PATCH v5 seccomp 0/5]seccomp: Add bitmap cache of constant allow filter results Kees Cook 2020-10-27 19:14 ` Kees Cook
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=eedf3323eed8615a4be150b39a717de1a68f0c12.1600951211.git.yifeifz2@illinois.edu \ --to=zhuyifei1999@gmail.com \ --cc=aarcange@redhat.com \ --cc=bpf@vger.kernel.org \ --cc=containers@lists.linux-foundation.org \ --cc=dskarlat@cs.cmu.edu \ --cc=frankeh@us.ibm.com \ --cc=gscrivan@redhat.com \ --cc=jannh@google.com \ --cc=jianyan2@illinois.edu \ --cc=keescook@chromium.org \ --cc=linux-kernel@vger.kernel.org \ --cc=luto@amacapital.net \ --cc=tobin@ibm.com \ --cc=torrella@illinois.edu \ --cc=tyxu@illinois.edu \ --cc=vrothber@redhat.com \ --cc=wad@chromium.org \ --cc=yifeifz2@illinois.edu \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.