From nobody Sat Nov 2 18:35:04 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 922E8C64EC4 for ; Wed, 8 Mar 2023 07:32:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229558AbjCHHcX (ORCPT ); Wed, 8 Mar 2023 02:32:23 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55584 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229786AbjCHHcS (ORCPT ); Wed, 8 Mar 2023 02:32:18 -0500 Received: from mail-pf1-x44a.google.com (mail-pf1-x44a.google.com [IPv6:2607:f8b0:4864:20::44a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 856D9A838D for ; Tue, 7 Mar 2023 23:32:12 -0800 (PST) Received: by mail-pf1-x44a.google.com with SMTP id w3-20020aa78583000000b005d244af158eso8586521pfn.23 for ; Tue, 07 Mar 2023 23:32:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; t=1678260732; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=KdP6YpLIkrgOw0lYy0bdzpscqpNI4s/RcyKWmelvr0E=; b=QLqdFxWJJTCcjLfJJw26wi68d2otuqveE486Q1LDW5sQla52Ywi+1Tl4jv3D4AxLUw 3avLGCXQb+mv1yWcYc08B7I0oRGzwex3vI06gsV9j61XaiBQsgKuYpRXvXpAalOSSNev 9uW+1N9swUVFYiNNUrLahwCYNt8pSOAyNrjbAuij0LyQiw2yMX2MGn3B10pJ9i8bTgk8 pmgTIp307skmeFk5+T/6dvS64gc5D0SRFQVxDOobzth79IinQln6GNfwHB1AE9clAVAn dBp7xSgYLwfXWfxPMz/dmFQ/DMUnjXmUJAoQl3bjX5c4uxyGngzH+SlozLWaWG8rRxiF LfNg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1678260732; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=KdP6YpLIkrgOw0lYy0bdzpscqpNI4s/RcyKWmelvr0E=; b=QFiuRgX2xCLHr9YfL6uOxZiJ8F1YwAawOOYt2Xzm8/B/hKkW5k4UnluRs6YLUQmMHS CDqDa4zXovp10OK3jiJVCHmXG7uH2UKd5W9JHvEEPfkgd40P06WM5EYsHmFXAdfPiTHE 1gEzFP2FQ0rbIJsCx6K72w0yThWQMEqWRlk5IUgnmsymYvXYqpcN++0FzEes7RnRrTub tMSmjtaxzT+ddK8utoouvNH4HdWu5iCDKhZFof3fQkKAGaGnHa/R///Dfc42QPWGzgfy 1xk3NrmhT3WdIOEtfIH6tXyaVAR19NOekq+8ToEt77XtHYqytMNrKGd/O962ZaEDKKBU POuQ== X-Gm-Message-State: AO0yUKUDaHwfIb8Eau5/KHuPxT6LBvSPghaxDu2HxRZjn41z03bAdpBe GaYo8t/jTARp86P6FN2qWHJeLEV9ID0= X-Google-Smtp-Source: AK7set8B3jj38rn8ptglrW7yWvEHIdy5OdCXZtLU8YjO4V8UaFgGNiU2Ro861eQ0I/L5FK8DARZmS6xetmo= X-Received: from avagin.kir.corp.google.com ([2620:0:1008:11:b53:99a6:b4fe:b30b]) (user=avagin job=sendgmr) by 2002:a17:902:f783:b0:19c:140d:aada with SMTP id q3-20020a170902f78300b0019c140daadamr6499087pln.2.1678260731766; Tue, 07 Mar 2023 23:32:11 -0800 (PST) Date: Tue, 7 Mar 2023 23:31:56 -0800 In-Reply-To: <20230308073201.3102738-1-avagin@google.com> Mime-Version: 1.0 References: <20230308073201.3102738-1-avagin@google.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog Message-ID: <20230308073201.3102738-2-avagin@google.com> Subject: [PATCH 1/6] seccomp: don't use semaphore and wait_queue together From: Andrei Vagin To: Kees Cook , Peter Zijlstra Cc: linux-kernel@vger.kernel.org, Christian Brauner , Chen Yu , avagin@gmail.com, Andrei Vagin , Andy Lutomirski , Dietmar Eggemann , Ingo Molnar , Juri Lelli , Peter Oskolkov , Tycho Andersen , Will Drewry , Vincent Guittot Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The main reason is to use new wake_up helpers that will be added in the following patches. But here are a few other reasons: * if we use two different ways, we always need to call them both. This patch fixes seccomp_notify_recv where we forgot to call wake_up_poll in the error path. * If we use one primitive, we can control how many waiters are woken up for each request. Our goal is to wake up just one that will handle a request. Right now, wake_up_poll can wake up one waiter and up(&match->notif->request) can wake up one more. Signed-off-by: Andrei Vagin Acked-by: Peter Zijlstra (Intel) --- kernel/seccomp.c | 41 ++++++++++++++++++++++++++++++++++++----- 1 file changed, 36 insertions(+), 5 deletions(-) diff --git a/kernel/seccomp.c b/kernel/seccomp.c index cebf26445f9e..9fca9345111c 100644 --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -145,7 +145,7 @@ struct seccomp_kaddfd { * @notifications: A list of struct seccomp_knotif elements. */ struct notification { - struct semaphore request; + atomic_t requests; u64 next_id; struct list_head notifications; }; @@ -1116,7 +1116,7 @@ static int seccomp_do_user_notification(int this_sysc= all, list_add_tail(&n.list, &match->notif->notifications); INIT_LIST_HEAD(&n.addfd); =20 - up(&match->notif->request); + atomic_inc(&match->notif->requests); wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM); =20 /* @@ -1450,6 +1450,37 @@ find_notification(struct seccomp_filter *filter, u64= id) return NULL; } =20 +static int recv_wake_function(wait_queue_entry_t *wait, unsigned int mode,= int sync, + void *key) +{ + /* Avoid a wakeup if event not interesting for us. */ + if (key && !(key_to_poll(key) & (EPOLLIN | EPOLLERR))) + return 0; + return autoremove_wake_function(wait, mode, sync, key); +} + +static int recv_wait_event(struct seccomp_filter *filter) +{ + DEFINE_WAIT_FUNC(wait, recv_wake_function); + int ret; + + if (atomic_dec_if_positive(&filter->notif->requests) >=3D 0) + return 0; + + for (;;) { + ret =3D prepare_to_wait_event(&filter->wqh, &wait, TASK_INTERRUPTIBLE); + + if (atomic_dec_if_positive(&filter->notif->requests) >=3D 0) + break; + + if (ret) + return ret; + + schedule(); + } + finish_wait(&filter->wqh, &wait); + return 0; +} =20 static long seccomp_notify_recv(struct seccomp_filter *filter, void __user *buf) @@ -1467,7 +1498,7 @@ static long seccomp_notify_recv(struct seccomp_filter= *filter, =20 memset(&unotif, 0, sizeof(unotif)); =20 - ret =3D down_interruptible(&filter->notif->request); + ret =3D recv_wait_event(filter); if (ret < 0) return ret; =20 @@ -1515,7 +1546,8 @@ static long seccomp_notify_recv(struct seccomp_filter= *filter, if (should_sleep_killable(filter, knotif)) complete(&knotif->ready); knotif->state =3D SECCOMP_NOTIFY_INIT; - up(&filter->notif->request); + atomic_inc(&filter->notif->requests); + wake_up_poll(&filter->wqh, EPOLLIN | EPOLLRDNORM); } mutex_unlock(&filter->notify_lock); } @@ -1777,7 +1809,6 @@ static struct file *init_listener(struct seccomp_filt= er *filter) if (!filter->notif) goto out; =20 - sema_init(&filter->notif->request, 0); filter->notif->next_id =3D get_random_u64(); INIT_LIST_HEAD(&filter->notif->notifications); =20 --=20 2.40.0.rc0.216.gc4246ad0f0-goog From nobody Sat Nov 2 18:35:04 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 233F7C678D5 for ; Wed, 8 Mar 2023 07:32:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229819AbjCHHc2 (ORCPT ); Wed, 8 Mar 2023 02:32:28 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55654 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229579AbjCHHcT (ORCPT ); Wed, 8 Mar 2023 02:32:19 -0500 Received: from mail-yb1-xb49.google.com (mail-yb1-xb49.google.com [IPv6:2607:f8b0:4864:20::b49]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C7DF2A336C for ; Tue, 7 Mar 2023 23:32:14 -0800 (PST) Received: by mail-yb1-xb49.google.com with SMTP id d185-20020a25e6c2000000b008fa1d22bd55so17083990ybh.21 for ; Tue, 07 Mar 2023 23:32:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; t=1678260734; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=1HJMLloX8l3VEo0+22HUaFfPeUdekf+/4qykWWC+d8Q=; b=sV1RKOnV7SF9Z0hXW96OjKAFskv9QxYAq2DIgZs6X3jgNThSZn8PERZBPg+ExcAz8q L+yd8AyQO80kF1xo0A5IYqIKP+g037KRTtaDB0s0ruMuH8v/qos7aw9bx8KvIhxL+QdZ nbI3yF7wgTcPM6xv17msJrDyGBFNO/0cm5d3tj0H7gH+XqK/a/fLx4qnF3NtThvqlevo vF84/hm97EKEGvrDziTCNG5cNrIm0gZHhMjxUyXWZuVHZO2MZ8V9XVcbWhj9kj78mjJl qTLc8o1g+gKHaL5FlMjaaGPY8tqvJmhKhA0uYKy5ylyGYJZBd0LqA4JdzqXDGC/TunWj 7uyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1678260734; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=1HJMLloX8l3VEo0+22HUaFfPeUdekf+/4qykWWC+d8Q=; b=nqw5L0UnT+QQDxEErPU8piGziO0+YvlpBKyw6oT5NGWfnvQ+Bji2PdQN//w6iZqGl9 1STFli6une0VU+//6LqBj54QYEUiWvCAlbwJT3iTBzyKNfh53PWJ7+pg1ddLN54SCvNx vrZWuiN6pu8bjba4LQl3+UbEbTR00uwv+mcVnLGeE3gTRKW7gH/PGlKvqApVFOP2i6OD eMIABJLpQRc1imuYzUsMitWpqbQx5QWrtBOePsUNGT8FunbROTeTBaBkiTnJEnfGngoE COvYFYQPzRBQgl/9EjdtRcf2mTpla8oMQWvtb5LUWMPWF5aSfOu8Xjdy6b/n9IHbzl95 eewg== X-Gm-Message-State: AO0yUKW9qbsQn/6DZXPa48OpBFzMxEkfRhiE5RCYqf2dPhZkrBinNA5n 8Kf1dNS5iYdXE+qGidoeVRSZLsnFC4g= X-Google-Smtp-Source: AK7set9ioPK6MoaQWwmMvAEI8zCmlOuHUBwUXXK8WXboKLBqaMGLdSnUaq9+l4rgvMN20bhtpnMM0D5mYlQ= X-Received: from avagin.kir.corp.google.com ([2620:0:1008:11:b53:99a6:b4fe:b30b]) (user=avagin job=sendgmr) by 2002:a05:6902:151:b0:afa:d8b5:8e82 with SMTP id p17-20020a056902015100b00afad8b58e82mr8271697ybh.6.1678260734085; Tue, 07 Mar 2023 23:32:14 -0800 (PST) Date: Tue, 7 Mar 2023 23:31:57 -0800 In-Reply-To: <20230308073201.3102738-1-avagin@google.com> Mime-Version: 1.0 References: <20230308073201.3102738-1-avagin@google.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog Message-ID: <20230308073201.3102738-3-avagin@google.com> Subject: [PATCH 2/6] sched: add WF_CURRENT_CPU and externise ttwu From: Andrei Vagin To: Kees Cook , Peter Zijlstra Cc: linux-kernel@vger.kernel.org, Christian Brauner , Chen Yu , avagin@gmail.com, Andrei Vagin , Andy Lutomirski , Dietmar Eggemann , Ingo Molnar , Juri Lelli , Peter Oskolkov , Tycho Andersen , Will Drewry , Vincent Guittot Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Peter Oskolkov Add WF_CURRENT_CPU wake flag that advices the scheduler to move the wakee to the current CPU. This is useful for fast on-CPU context switching use cases. In addition, make ttwu external rather than static so that the flag could be passed to it from outside of sched/core.c. Signed-off-by: Peter Oskolkov Signed-off-by: Andrei Vagin Acked-by: Peter Zijlstra (Intel) --- kernel/sched/core.c | 3 +-- kernel/sched/fair.c | 4 ++++ kernel/sched/sched.h | 13 ++++++++----- 3 files changed, 13 insertions(+), 7 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index af017e038b48..386a0c40d341 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -4123,8 +4123,7 @@ bool ttwu_state_match(struct task_struct *p, unsigned= int state, int *success) * Return: %true if @p->state changes (an actual wakeup was done), * %false otherwise. */ -static int -try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags) +int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_fla= gs) { unsigned long flags; int cpu, success =3D 0; diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 7a1b1f855b96..4c67652aa302 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7569,6 +7569,10 @@ select_task_rq_fair(struct task_struct *p, int prev_= cpu, int wake_flags) if (wake_flags & WF_TTWU) { record_wakee(p); =20 + if ((wake_flags & WF_CURRENT_CPU) && + cpumask_test_cpu(cpu, p->cpus_ptr)) + return cpu; + if (sched_energy_enabled()) { new_cpu =3D find_energy_efficient_cpu(p, prev_cpu); if (new_cpu >=3D 0) diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 3e8df6d31c1e..f8420e9ed290 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -2093,12 +2093,13 @@ static inline int task_on_rq_migrating(struct task_= struct *p) } =20 /* Wake flags. The first three directly map to some SD flag value */ -#define WF_EXEC 0x02 /* Wakeup after exec; maps to SD_BALANCE_EXEC */ -#define WF_FORK 0x04 /* Wakeup after fork; maps to SD_BALANCE_FORK */ -#define WF_TTWU 0x08 /* Wakeup; maps to SD_BALANCE_WAKE */ +#define WF_EXEC 0x02 /* Wakeup after exec; maps to SD_BALANCE_EXEC= */ +#define WF_FORK 0x04 /* Wakeup after fork; maps to SD_BALANCE_FORK= */ +#define WF_TTWU 0x08 /* Wakeup; maps to SD_BALANCE_WAKE= */ =20 -#define WF_SYNC 0x10 /* Waker goes to sleep after wakeup */ -#define WF_MIGRATED 0x20 /* Internal use, task got migrated */ +#define WF_SYNC 0x10 /* Waker goes to sleep after wakeup */ +#define WF_MIGRATED 0x20 /* Internal use, task got migrated */ +#define WF_CURRENT_CPU 0x40 /* Prefer to move the wakee to the current CP= U. */ =20 #ifdef CONFIG_SMP static_assert(WF_EXEC =3D=3D SD_BALANCE_EXEC); @@ -3232,6 +3233,8 @@ static inline bool is_per_cpu_kthread(struct task_str= uct *p) extern void swake_up_all_locked(struct swait_queue_head *q); extern void __prepare_to_swait(struct swait_queue_head *q, struct swait_qu= eue *wait); =20 +extern int try_to_wake_up(struct task_struct *tsk, unsigned int state, int= wake_flags); + #ifdef CONFIG_PREEMPT_DYNAMIC extern int preempt_dynamic_mode; extern int sched_dynamic_mode(const char *str); --=20 2.40.0.rc0.216.gc4246ad0f0-goog From nobody Sat Nov 2 18:35:04 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55308C64EC4 for ; Wed, 8 Mar 2023 07:32:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229830AbjCHHcc (ORCPT ); Wed, 8 Mar 2023 02:32:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55608 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229803AbjCHHcV (ORCPT ); Wed, 8 Mar 2023 02:32:21 -0500 Received: from mail-pj1-x1049.google.com (mail-pj1-x1049.google.com [IPv6:2607:f8b0:4864:20::1049]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F3C39A6771 for ; Tue, 7 Mar 2023 23:32:16 -0800 (PST) Received: by mail-pj1-x1049.google.com with SMTP id cl18-20020a17090af69200b0023470d96ae6so1760656pjb.1 for ; Tue, 07 Mar 2023 23:32:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; t=1678260736; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=/licageW3tiOFRclAqIq9/0fYCCwDsQhp71Jqd1wdrY=; b=BuHMGtzH4pt/PW4rWmjgn3Ha71ZQ/6mC8Z1SpFucrs9JEGH54JgaPSCPpWSo581/1L MZL6dnSj+6eqJZfzF+zNpzX0T/2E6A3Bn8dtfQ9ppRkvU1A+/vDPmTkShzVtPxgh9/av ui+hcw+fozEiacx4JU3XGX3A2i+vjMUbV6tdlyoT2iNF8MOvbBwsV6w7xTBO3mDejv1c mNlv9GkNN2mReCMQ3BwA5iswQ9UB8/DEQQ1qIMYQ8jUm/00O1yIOt3R+seZWmUHjaH7R Gh4w3YhNu1wsQgO+7lFyIzJ5oIENbvWjrnNJIRFLkArYdDUjrKDfyboWPYUAXSzc/boo gukw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1678260736; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=/licageW3tiOFRclAqIq9/0fYCCwDsQhp71Jqd1wdrY=; b=TlImcbtPgDqu/WIN8bgFomzkELEHkLsJ8PPfsvwftqwCEg6HsVlVCVXoVoPrSaATcX AHEQYgV2k9FqSZ4IcsX9FzFHfOsgeV5tIvjOLnDbly4aDaFsXpl2rRb573W/Upd6irjj manNeO5BcFUIdV3RrJ80jW9VLyJImmSqYFwdDvIly4vQLcTpaVqESXshRCEP1IZYANtd tsAH09uLFGWT/+CEWpPThr2yyxINEn1ulIEbmkQ2AucIy3OwUVgK+7h1FgAzQYKgvd7t ANqZDvqEdIoUwsA2z2Avy9BDwmkk1wg/SdABRhQiWoxP6QyGrHIjIGSlCO3nYF2D9yGI 4Uyg== X-Gm-Message-State: AO0yUKWtub5Aiaa/PkkA5/30USyC/s/ELJFFfY+KdszKmgkHMj0jvLz5 wsLQBtOiwYtY8oo9kXvpDvT0l8/dJbk= X-Google-Smtp-Source: AK7set9KESVJYpyAVXKY3k549PUNqM49vQO+34cR9hPQWNlTpTWAsFhYFSKc5aSTEMbV9mStc/O+yg+5wqA= X-Received: from avagin.kir.corp.google.com ([2620:0:1008:11:b53:99a6:b4fe:b30b]) (user=avagin job=sendgmr) by 2002:a17:902:f807:b0:19a:a411:92ba with SMTP id ix7-20020a170902f80700b0019aa41192bamr6963804plb.8.1678260736548; Tue, 07 Mar 2023 23:32:16 -0800 (PST) Date: Tue, 7 Mar 2023 23:31:58 -0800 In-Reply-To: <20230308073201.3102738-1-avagin@google.com> Mime-Version: 1.0 References: <20230308073201.3102738-1-avagin@google.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog Message-ID: <20230308073201.3102738-4-avagin@google.com> Subject: [PATCH 3/6] sched: add a few helpers to wake up tasks on the current cpu From: Andrei Vagin To: Kees Cook , Peter Zijlstra Cc: linux-kernel@vger.kernel.org, Christian Brauner , Chen Yu , avagin@gmail.com, Andrei Vagin , Andy Lutomirski , Dietmar Eggemann , Ingo Molnar , Juri Lelli , Peter Oskolkov , Tycho Andersen , Will Drewry , Vincent Guittot Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add complete_on_current_cpu, wake_up_poll_on_current_cpu helpers to wake up tasks on the current CPU. These two helpers are useful when the task needs to make a synchronous cont= ext switch to another task. In this context, synchronous means it wakes up the target task and falls asleep right after that. One example of such workloads is seccomp user notifies. This mechanism allo= ws the supervisor process handles system calls on behalf of a target process. While the supervisor is handling an intercepted system call, the target pro= cess will be blocked in the kernel, waiting for a response to come back. On-CPU context switches are much faster than regular ones. Signed-off-by: Andrei Vagin Acked-by: Peter Zijlstra (Intel) --- include/linux/completion.h | 1 + include/linux/swait.h | 2 +- include/linux/wait.h | 3 +++ kernel/sched/completion.c | 26 ++++++++++++++++++-------- kernel/sched/core.c | 2 +- kernel/sched/swait.c | 8 ++++---- kernel/sched/wait.c | 5 +++++ 7 files changed, 33 insertions(+), 14 deletions(-) diff --git a/include/linux/completion.h b/include/linux/completion.h index 62b32b19e0a8..fb2915676574 100644 --- a/include/linux/completion.h +++ b/include/linux/completion.h @@ -116,6 +116,7 @@ extern bool try_wait_for_completion(struct completion *= x); extern bool completion_done(struct completion *x); =20 extern void complete(struct completion *); +extern void complete_on_current_cpu(struct completion *x); extern void complete_all(struct completion *); =20 #endif diff --git a/include/linux/swait.h b/include/linux/swait.h index 6a8c22b8c2a5..d324419482a0 100644 --- a/include/linux/swait.h +++ b/include/linux/swait.h @@ -146,7 +146,7 @@ static inline bool swq_has_sleeper(struct swait_queue_h= ead *wq) =20 extern void swake_up_one(struct swait_queue_head *q); extern void swake_up_all(struct swait_queue_head *q); -extern void swake_up_locked(struct swait_queue_head *q); +extern void swake_up_locked(struct swait_queue_head *q, int wake_flags); =20 extern void prepare_to_swait_exclusive(struct swait_queue_head *q, struct = swait_queue *wait, int state); extern long prepare_to_swait_event(struct swait_queue_head *q, struct swai= t_queue *wait, int state); diff --git a/include/linux/wait.h b/include/linux/wait.h index a0307b516b09..5ec7739400f4 100644 --- a/include/linux/wait.h +++ b/include/linux/wait.h @@ -210,6 +210,7 @@ __remove_wait_queue(struct wait_queue_head *wq_head, st= ruct wait_queue_entry *wq } =20 int __wake_up(struct wait_queue_head *wq_head, unsigned int mode, int nr, = void *key); +void __wake_up_on_current_cpu(struct wait_queue_head *wq_head, unsigned in= t mode, void *key); void __wake_up_locked_key(struct wait_queue_head *wq_head, unsigned int mo= de, void *key); void __wake_up_locked_key_bookmark(struct wait_queue_head *wq_head, unsigned int mode, void *key, wait_queue_entry_t *bookmark); @@ -237,6 +238,8 @@ void __wake_up_pollfree(struct wait_queue_head *wq_head= ); #define key_to_poll(m) ((__force __poll_t)(uintptr_t)(void *)(m)) #define wake_up_poll(x, m) \ __wake_up(x, TASK_NORMAL, 1, poll_to_key(m)) +#define wake_up_poll_on_current_cpu(x, m) \ + __wake_up_on_current_cpu(x, TASK_NORMAL, poll_to_key(m)) #define wake_up_locked_poll(x, m) \ __wake_up_locked_key((x), TASK_NORMAL, poll_to_key(m)) #define wake_up_interruptible_poll(x, m) \ diff --git a/kernel/sched/completion.c b/kernel/sched/completion.c index d57a5c1c1cd9..3561ab533dd4 100644 --- a/kernel/sched/completion.c +++ b/kernel/sched/completion.c @@ -13,6 +13,23 @@ * Waiting for completion is a typically sync point, but not an exclusion = point. */ =20 +static void complete_with_flags(struct completion *x, int wake_flags) +{ + unsigned long flags; + + raw_spin_lock_irqsave(&x->wait.lock, flags); + + if (x->done !=3D UINT_MAX) + x->done++; + swake_up_locked(&x->wait, wake_flags); + raw_spin_unlock_irqrestore(&x->wait.lock, flags); +} + +void complete_on_current_cpu(struct completion *x) +{ + return complete_with_flags(x, WF_CURRENT_CPU); +} + /** * complete: - signals a single thread waiting on this completion * @x: holds the state of this particular completion @@ -27,14 +44,7 @@ */ void complete(struct completion *x) { - unsigned long flags; - - raw_spin_lock_irqsave(&x->wait.lock, flags); - - if (x->done !=3D UINT_MAX) - x->done++; - swake_up_locked(&x->wait); - raw_spin_unlock_irqrestore(&x->wait.lock, flags); + complete_with_flags(x, 0); } EXPORT_SYMBOL(complete); =20 diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 386a0c40d341..c5f7bfbc4967 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -6941,7 +6941,7 @@ asmlinkage __visible void __sched preempt_schedule_ir= q(void) int default_wake_function(wait_queue_entry_t *curr, unsigned mode, int wak= e_flags, void *key) { - WARN_ON_ONCE(IS_ENABLED(CONFIG_SCHED_DEBUG) && wake_flags & ~WF_SYNC); + WARN_ON_ONCE(IS_ENABLED(CONFIG_SCHED_DEBUG) && wake_flags & ~(WF_SYNC|WF_= CURRENT_CPU)); return try_to_wake_up(curr->private, mode, wake_flags); } EXPORT_SYMBOL(default_wake_function); diff --git a/kernel/sched/swait.c b/kernel/sched/swait.c index 76b9b796e695..72505cd3b60a 100644 --- a/kernel/sched/swait.c +++ b/kernel/sched/swait.c @@ -18,7 +18,7 @@ EXPORT_SYMBOL(__init_swait_queue_head); * If for some reason it would return 0, that means the previously waiting * task is already running, so it will observe condition true (or has alre= ady). */ -void swake_up_locked(struct swait_queue_head *q) +void swake_up_locked(struct swait_queue_head *q, int wake_flags) { struct swait_queue *curr; =20 @@ -26,7 +26,7 @@ void swake_up_locked(struct swait_queue_head *q) return; =20 curr =3D list_first_entry(&q->task_list, typeof(*curr), task_list); - wake_up_process(curr->task); + try_to_wake_up(curr->task, TASK_NORMAL, wake_flags); list_del_init(&curr->task_list); } EXPORT_SYMBOL(swake_up_locked); @@ -41,7 +41,7 @@ EXPORT_SYMBOL(swake_up_locked); void swake_up_all_locked(struct swait_queue_head *q) { while (!list_empty(&q->task_list)) - swake_up_locked(q); + swake_up_locked(q, 0); } =20 void swake_up_one(struct swait_queue_head *q) @@ -49,7 +49,7 @@ void swake_up_one(struct swait_queue_head *q) unsigned long flags; =20 raw_spin_lock_irqsave(&q->lock, flags); - swake_up_locked(q); + swake_up_locked(q, 0); raw_spin_unlock_irqrestore(&q->lock, flags); } EXPORT_SYMBOL(swake_up_one); diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c index 133b74730738..47803a0b8d5d 100644 --- a/kernel/sched/wait.c +++ b/kernel/sched/wait.c @@ -161,6 +161,11 @@ int __wake_up(struct wait_queue_head *wq_head, unsigne= d int mode, } EXPORT_SYMBOL(__wake_up); =20 +void __wake_up_on_current_cpu(struct wait_queue_head *wq_head, unsigned in= t mode, void *key) +{ + __wake_up_common_lock(wq_head, mode, 1, WF_CURRENT_CPU, key); +} + /* * Same as __wake_up but called with the spinlock in wait_queue_head_t hel= d. */ --=20 2.40.0.rc0.216.gc4246ad0f0-goog From nobody Sat Nov 2 18:35:04 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F684C678D5 for ; Wed, 8 Mar 2023 07:32:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229813AbjCHHci (ORCPT ); Wed, 8 Mar 2023 02:32:38 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55670 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229816AbjCHHcX (ORCPT ); Wed, 8 Mar 2023 02:32:23 -0500 Received: from mail-yw1-x114a.google.com (mail-yw1-x114a.google.com [IPv6:2607:f8b0:4864:20::114a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 43B69AA242 for ; Tue, 7 Mar 2023 23:32:19 -0800 (PST) Received: by mail-yw1-x114a.google.com with SMTP id 00721157ae682-5376fa4106eso161313527b3.7 for ; Tue, 07 Mar 2023 23:32:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; t=1678260738; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:from:to:cc:subject:date:message-id :reply-to; bh=N/zczmyojBS9P2rt92Hh+NQdVJTLpoFAFXyTJQmiZyg=; b=s/G0ZGPiIu+LtCsClWoP3xJ4KF91NU9KO2/f3Oh5EMHV82JxNgVxUMHBhQuFe1RB/9 DmKSSpQH7/fOcJAsj+Wyfo2s/+jJuYmpBczyP1qMXTPlnvdWYEPGFJXBS4Bukyj6cuww JWq41rlZsYcERqCNTo2ogmEp4xUy1qZ0qh55tryMjF5UnbIaJ8n/U4IuJs6kzivuOQr6 X5GYVGxDIKJ3fR3qnboPFaaEMzcDZrZEFxxvI9i+CPkVPs6i/lTZwqQd3T5x7I8iWjTj XIWyjkqfCza7F0XOBQcHGgg7YqlL3vpzxijs1x4on9MXLAOovFhpXbl8tgNYLvgCkumF xkUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1678260738; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=N/zczmyojBS9P2rt92Hh+NQdVJTLpoFAFXyTJQmiZyg=; b=6SLd3K55yncXuIqlsU6Nt65qlGKESGs72uiecg7crtPacDtX/ragsrnmtMp+W/KsGc ov4S8F33Eu7SC8FwwKrQbihMbIQMsqjaFWY40osa9PXpNEBHequERcApn1JOq1372i1u 00ysBjVazqV5vyQFukVzHHozYRDpn3RTPkGQ93fr3KOzj8MSy9Y2haFXjDqE1/VPwsbe 2FqcbWuzBrRQsrP4pOpTQSXN14mGyFNkXrK6o97dltusT6zjTx4CFLjGWrpFmlvsu/ll EOyzOki09/aGU+p1v7blUhI8syH6MhJQM+hnR/h/ueIRJvK9S9TVBMhfmqXMRyqZE2X0 jTKA== X-Gm-Message-State: AO0yUKUKLb+o9pWYmoBEEjjyJvP339XcDlGvQmp8k7DjmMWRaCsC3sd5 S036QpHASxPDDexsPguFLsgxdpyXjTA= X-Google-Smtp-Source: AK7set/Rgn2XNpF1h9Xp6zthH1vqCWX2SvKTkS0/og89DfLnEwI/k79nooHRWKBJ+JEi/gk2Z0/kL0IuCbo= X-Received: from avagin.kir.corp.google.com ([2620:0:1008:11:b53:99a6:b4fe:b30b]) (user=avagin job=sendgmr) by 2002:a25:ae1c:0:b0:9f5:af6b:6f69 with SMTP id a28-20020a25ae1c000000b009f5af6b6f69mr13442474ybj.5.1678260738463; Tue, 07 Mar 2023 23:32:18 -0800 (PST) Date: Tue, 7 Mar 2023 23:31:59 -0800 In-Reply-To: <20230308073201.3102738-1-avagin@google.com> Mime-Version: 1.0 References: <20230308073201.3102738-1-avagin@google.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog Message-ID: <20230308073201.3102738-5-avagin@google.com> Subject: [PATCH 4/6] seccomp: add the synchronous mode for seccomp_unotify From: Andrei Vagin To: Kees Cook , Peter Zijlstra Cc: linux-kernel@vger.kernel.org, Christian Brauner , Chen Yu , avagin@gmail.com, Andrei Vagin , Andy Lutomirski , Dietmar Eggemann , Ingo Molnar , Juri Lelli , Peter Oskolkov , Tycho Andersen , Will Drewry , Vincent Guittot Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" seccomp_unotify allows more privileged processes do actions on behalf of less privileged processes. In many cases, the workflow is fully synchronous. It means a target process triggers a system call and passes controls to a supervisor process that handles the system call and returns controls to the target process. In this context, "synchronous" means that only one process is running and another one is waiting. There is the WF_CURRENT_CPU flag that is used to advise the scheduler to move the wakee to the current CPU. For such synchronous workflows, it makes context switches a few times faster. Right now, each interaction takes 12=C2=B5s. With this patch, it takes about 3=C2=B5s. This change introduce the SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP flag that it used to enable the sync mode. Signed-off-by: Andrei Vagin Acked-by: Peter Zijlstra (Intel) --- include/uapi/linux/seccomp.h | 4 ++++ kernel/seccomp.c | 31 +++++++++++++++++++++++++++++-- 2 files changed, 33 insertions(+), 2 deletions(-) diff --git a/include/uapi/linux/seccomp.h b/include/uapi/linux/seccomp.h index 0fdc6ef02b94..dbfc9b37fcae 100644 --- a/include/uapi/linux/seccomp.h +++ b/include/uapi/linux/seccomp.h @@ -115,6 +115,8 @@ struct seccomp_notif_resp { __u32 flags; }; =20 +#define SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP (1UL << 0) + /* valid flags for seccomp_notif_addfd */ #define SECCOMP_ADDFD_FLAG_SETFD (1UL << 0) /* Specify remote fd */ #define SECCOMP_ADDFD_FLAG_SEND (1UL << 1) /* Addfd and return it, atomic= ally */ @@ -150,4 +152,6 @@ struct seccomp_notif_addfd { #define SECCOMP_IOCTL_NOTIF_ADDFD SECCOMP_IOW(3, \ struct seccomp_notif_addfd) =20 +#define SECCOMP_IOCTL_NOTIF_SET_FLAGS SECCOMP_IOW(4, __u64) + #endif /* _UAPI_LINUX_SECCOMP_H */ diff --git a/kernel/seccomp.c b/kernel/seccomp.c index 9fca9345111c..d323edeae7da 100644 --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -143,9 +143,12 @@ struct seccomp_kaddfd { * filter->notify_lock. * @next_id: The id of the next request. * @notifications: A list of struct seccomp_knotif elements. + * @flags: A set of SECCOMP_USER_NOTIF_FD_* flags. */ + struct notification { atomic_t requests; + u32 flags; u64 next_id; struct list_head notifications; }; @@ -1117,7 +1120,10 @@ static int seccomp_do_user_notification(int this_sys= call, INIT_LIST_HEAD(&n.addfd); =20 atomic_inc(&match->notif->requests); - wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM); + if (match->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP) + wake_up_poll_on_current_cpu(&match->wqh, EPOLLIN | EPOLLRDNORM); + else + wake_up_poll(&match->wqh, EPOLLIN | EPOLLRDNORM); =20 /* * This is where we wait for a reply from userspace. @@ -1593,7 +1599,10 @@ static long seccomp_notify_send(struct seccomp_filte= r *filter, knotif->error =3D resp.error; knotif->val =3D resp.val; knotif->flags =3D resp.flags; - complete(&knotif->ready); + if (filter->notif->flags & SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP) + complete_on_current_cpu(&knotif->ready); + else + complete(&knotif->ready); out: mutex_unlock(&filter->notify_lock); return ret; @@ -1623,6 +1632,22 @@ static long seccomp_notify_id_valid(struct seccomp_f= ilter *filter, return ret; } =20 +static long seccomp_notify_set_flags(struct seccomp_filter *filter, + unsigned long flags) +{ + long ret; + + if (flags & ~SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP) + return -EINVAL; + + ret =3D mutex_lock_interruptible(&filter->notify_lock); + if (ret < 0) + return ret; + filter->notif->flags =3D flags; + mutex_unlock(&filter->notify_lock); + return 0; +} + static long seccomp_notify_addfd(struct seccomp_filter *filter, struct seccomp_notif_addfd __user *uaddfd, unsigned int size) @@ -1752,6 +1777,8 @@ static long seccomp_notify_ioctl(struct file *file, u= nsigned int cmd, case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR: case SECCOMP_IOCTL_NOTIF_ID_VALID: return seccomp_notify_id_valid(filter, buf); + case SECCOMP_IOCTL_NOTIF_SET_FLAGS: + return seccomp_notify_set_flags(filter, arg); } =20 /* Extensible Argument ioctls */ --=20 2.40.0.rc0.216.gc4246ad0f0-goog From nobody Sat Nov 2 18:35:04 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77261C64EC4 for ; Wed, 8 Mar 2023 07:32:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229844AbjCHHcm (ORCPT ); Wed, 8 Mar 2023 02:32:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56150 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229841AbjCHHce (ORCPT ); Wed, 8 Mar 2023 02:32:34 -0500 Received: from mail-yw1-x114a.google.com (mail-yw1-x114a.google.com [IPv6:2607:f8b0:4864:20::114a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B36B0A7295 for ; Tue, 7 Mar 2023 23:32:21 -0800 (PST) Received: by mail-yw1-x114a.google.com with SMTP id 00721157ae682-536be78056eso160482717b3.1 for ; Tue, 07 Mar 2023 23:32:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; t=1678260741; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=eiPiVq4qnV5b3yyOHukFyCYe6YsVtSEQ0lj3gSUnBVU=; b=Nc5RYpMPMcJmlMk8UTyky0FVierCho4KPLKPoggzP9J288W8hSAzN7Nt/ILUPiMFol 7a3b7CX70eq/+Byb31yem1HSegPxIZqw1QD7EraC/qnTvl8KGW2P8tbqjWSqbFdUnxiO QhoqxfYm8GTR8vJZwIhhtIjIwJ8OxnUcFhocWX4k6ZYfLlNxjBIKAYRTvYAenm6kCJ55 e2oqd0X5MvmYOv1Dhn8Z9ClBPU9VPd0uXVryuyYDO0BAFCKsAoeEM/gec8NvjRK8p69i 5Tg5FFypJJhpDSOMOuo9D7eFHl7f1lnIqU6W+nx+0SSnMapnyv6K/abDJwIG1p6ym3+4 EJHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1678260741; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=eiPiVq4qnV5b3yyOHukFyCYe6YsVtSEQ0lj3gSUnBVU=; b=Kv9BdiBf7hs2gcew48vG5S0Wq583yT8W7NgQAFjkX/xK4QoLNb1Qj7o76s8TiLvYel 10prIVLJWjBFojnV3GbaLPgZd5Q+ds3dZgQEzXP4LqA4EBE0Eg6puIWIGVOV1+jl8KYA CIhIYrebS/pFlqlcrExqZJuVucMpqbD+2rBFrlUemkHBaHujcLx+BTY1xNhQ+Nq1oi/i pZtj7y1LHJLatUDz8BOLzLD8saY/MNS8rH7nvfx4tA7sQ3LP97s6yJKUZiXyqmHs5ZGI AkrBe5k/uwtB1VhLNs8yGibcoXp1iEwVFdVulUFQHDv1zOjmcbtPKe0fPjfQrWYhwyHA MaVg== X-Gm-Message-State: AO0yUKU4AdPePHR/b0aC+QrgQkbhIg/Vw/Vs4PuVvam0BaOXkAj88krU qGYu9fS5Ua0WEG66sI4Iei6qcXtkI0c= X-Google-Smtp-Source: AK7set8qvEHThPBqFtM4csDHhQ7h5MWe3xxPdzBqrQ71ITAES3t7H95wYlw1p6MVlrSvgAPTabY7hme9UNg= X-Received: from avagin.kir.corp.google.com ([2620:0:1008:11:b53:99a6:b4fe:b30b]) (user=avagin job=sendgmr) by 2002:a0d:ea13:0:b0:533:54d1:9e40 with SMTP id t19-20020a0dea13000000b0053354d19e40mr4ywe.21.1678260740739; Tue, 07 Mar 2023 23:32:20 -0800 (PST) Date: Tue, 7 Mar 2023 23:32:00 -0800 In-Reply-To: <20230308073201.3102738-1-avagin@google.com> Mime-Version: 1.0 References: <20230308073201.3102738-1-avagin@google.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog Message-ID: <20230308073201.3102738-6-avagin@google.com> Subject: [PATCH 5/6] selftest/seccomp: add a new test for the sync mode of seccomp_user_notify From: Andrei Vagin To: Kees Cook , Peter Zijlstra Cc: linux-kernel@vger.kernel.org, Christian Brauner , Chen Yu , avagin@gmail.com, Andrei Vagin , Andy Lutomirski , Dietmar Eggemann , Ingo Molnar , Juri Lelli , Peter Oskolkov , Tycho Andersen , Will Drewry , Vincent Guittot Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Test output: # RUN global.user_notification_sync ... # OK global.user_notification_sync ok 51 global.user_notification_sync Signed-off-by: Andrei Vagin Acked-by: Peter Zijlstra (Intel) --- tools/testing/selftests/seccomp/seccomp_bpf.c | 55 +++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/= selftests/seccomp/seccomp_bpf.c index 43ec36b179dc..f6a04d88e02f 100644 --- a/tools/testing/selftests/seccomp/seccomp_bpf.c +++ b/tools/testing/selftests/seccomp/seccomp_bpf.c @@ -4255,6 +4255,61 @@ TEST(user_notification_addfd_rlimit) close(memfd); } =20 +#ifndef SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP +#define SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP (1UL << 0) +#define SECCOMP_IOCTL_NOTIF_SET_FLAGS SECCOMP_IOW(4, __u64) +#endif + +TEST(user_notification_sync) +{ + struct seccomp_notif req =3D {}; + struct seccomp_notif_resp resp =3D {}; + int status, listener; + pid_t pid; + long ret; + + ret =3D prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); + ASSERT_EQ(0, ret) { + TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!"); + } + + listener =3D user_notif_syscall(__NR_getppid, + SECCOMP_FILTER_FLAG_NEW_LISTENER); + ASSERT_GE(listener, 0); + + /* Try to set invalid flags. */ + EXPECT_SYSCALL_RETURN(-EINVAL, + ioctl(listener, SECCOMP_IOCTL_NOTIF_SET_FLAGS, 0xffffffff, 0)); + + ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SET_FLAGS, + SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP, 0), 0); + + pid =3D fork(); + ASSERT_GE(pid, 0); + if (pid =3D=3D 0) { + ret =3D syscall(__NR_getppid); + ASSERT_EQ(ret, USER_NOTIF_MAGIC) { + _exit(1); + } + _exit(0); + } + + req.pid =3D 0; + ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0); + + ASSERT_EQ(req.data.nr, __NR_getppid); + + resp.id =3D req.id; + resp.error =3D 0; + resp.val =3D USER_NOTIF_MAGIC; + resp.flags =3D 0; + ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp), 0); + + ASSERT_EQ(waitpid(pid, &status, 0), pid); + ASSERT_EQ(status, 0); +} + + /* Make sure PTRACE_O_SUSPEND_SECCOMP requires CAP_SYS_ADMIN. */ FIXTURE(O_SUSPEND_SECCOMP) { pid_t pid; --=20 2.40.0.rc0.216.gc4246ad0f0-goog From nobody Sat Nov 2 18:35:04 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A02D8C678D5 for ; Wed, 8 Mar 2023 07:32:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229928AbjCHHcw (ORCPT ); Wed, 8 Mar 2023 02:32:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56150 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229869AbjCHHcf (ORCPT ); Wed, 8 Mar 2023 02:32:35 -0500 Received: from mail-pl1-x649.google.com (mail-pl1-x649.google.com [IPv6:2607:f8b0:4864:20::649]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6AF9DA72AB for ; Tue, 7 Mar 2023 23:32:23 -0800 (PST) Received: by mail-pl1-x649.google.com with SMTP id c3-20020a170902724300b0019d1ffec36dso8964686pll.9 for ; Tue, 07 Mar 2023 23:32:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; t=1678260743; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=OGMLdMm5qBcc4olci9fMTmM3WsrESinWs9N+BXJl1jg=; b=eFnDR5mgN514m3UH4vGPG8H/G2XQBLtJr7TNKaPz0nsq7dq76gfvLoTW7/l4eG+xYr YUQ1k3uwseN1igCqXa9gcvETdz0XyZpT3I+OQuNMaDbvJlCbYYV5lgkcQBwGonABEF8j pgYLWtwBIsNJfPsTyka0p8zl8wPxIcExK8RIKT977hgU9yOuPhPC40JRiMlYPTWzCGqW 6XQoHCjwSaRJHbEjWZ+BIxSK+UWIVQlKogIDm4yddmh3nEuE1CxXkUrKtNce2oHKYCA5 fzkkKx2mo2/d3Cj0zdYivbxeCQPpYqsDawTxkcsG8Bh0HETbo5KlQ27bWcRTpcLQi9lp xu6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1678260743; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=OGMLdMm5qBcc4olci9fMTmM3WsrESinWs9N+BXJl1jg=; b=6bnIoNcJI7iwwEArnjIP6dy64OI4dYTuNjBGQfvyjlSt1/V4VA8O3pI1r07k9bDoS+ YiWO20NCuJsUO6Q3RbOuSBnE07aQ/GWLx1UaoTnz08/MpWA0ctLbC+PuxBgh6o6EJ6lv 4oLBX1HJ6OYRaZwSd94SNQ7muorPfKfWpy8E+yUCp4xbKEljFv3RjzUQY0H44jfs2n68 qj9CSB2L3qK3yTmBwktt2t4HfCcDV1uYJOGgfGotGeqBrZvNJyAoHfRnkfF2end+K6VD f0Mr3w3KhtschQDJ/2jW3xyHaiJG2qEgK4zpPRyCFYyFRZZ8VfNMWNSLRNTrSr2OYIVI vJ/Q== X-Gm-Message-State: AO0yUKU+PCXO8VDB997H60w2Dy9Y2nolAoEThRMWiae/JREcHmfAbxfy +zv2c/eEKrJpBegMputa8ICQcliAZVA= X-Google-Smtp-Source: AK7set8ruj/89TGB01UGqmLIMQktUAo34UCOgYtMeyvgGSvOvoKTHIUgkmK7x3uiz9IunReEVbwB+mgNqPc= X-Received: from avagin.kir.corp.google.com ([2620:0:1008:11:b53:99a6:b4fe:b30b]) (user=avagin job=sendgmr) by 2002:a63:fd41:0:b0:503:a7:c934 with SMTP id m1-20020a63fd41000000b0050300a7c934mr7076545pgj.2.1678260742857; Tue, 07 Mar 2023 23:32:22 -0800 (PST) Date: Tue, 7 Mar 2023 23:32:01 -0800 In-Reply-To: <20230308073201.3102738-1-avagin@google.com> Mime-Version: 1.0 References: <20230308073201.3102738-1-avagin@google.com> X-Mailer: git-send-email 2.40.0.rc0.216.gc4246ad0f0-goog Message-ID: <20230308073201.3102738-7-avagin@google.com> Subject: [PATCH 6/6] perf/benchmark: add a new benchmark for seccom_unotify From: Andrei Vagin To: Kees Cook , Peter Zijlstra Cc: linux-kernel@vger.kernel.org, Christian Brauner , Chen Yu , avagin@gmail.com, Andrei Vagin , Andy Lutomirski , Dietmar Eggemann , Ingo Molnar , Juri Lelli , Peter Oskolkov , Tycho Andersen , Will Drewry , Vincent Guittot Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The benchmark is similar to the pipe benchmark. It creates two processes, one is calling syscalls, and another process is handling them via seccomp user notifications. It measures the time required to run a specified number of interations. $ ./perf bench sched seccomp-notify --sync-mode --loop 1000000 # Running 'sched/seccomp-notify' benchmark: # Executed 1000000 system calls Total time: 2.769 [sec] 2.769629 usecs/op 361059 ops/sec $ ./perf bench sched seccomp-notify # Running 'sched/seccomp-notify' benchmark: # Executed 1000000 system calls Total time: 8.571 [sec] 8.571119 usecs/op 116670 ops/sec Signed-off-by: Andrei Vagin Acked-by: Peter Zijlstra (Intel) --- tools/arch/x86/include/uapi/asm/unistd_32.h | 3 + tools/arch/x86/include/uapi/asm/unistd_64.h | 3 + tools/perf/bench/Build | 1 + tools/perf/bench/bench.h | 1 + tools/perf/bench/sched-seccomp-notify.c | 168 ++++++++++++++++++++ tools/perf/builtin-bench.c | 1 + 6 files changed, 177 insertions(+) create mode 100644 tools/perf/bench/sched-seccomp-notify.c diff --git a/tools/arch/x86/include/uapi/asm/unistd_32.h b/tools/arch/x86/i= nclude/uapi/asm/unistd_32.h index 2712d5e03e2e..5fb3589c14bf 100644 --- a/tools/arch/x86/include/uapi/asm/unistd_32.h +++ b/tools/arch/x86/include/uapi/asm/unistd_32.h @@ -23,3 +23,6 @@ #ifndef __NR_setns #define __NR_setns 346 #endif +#ifdef __NR_seccomp +#define __NR_seccomp 354 +#endif diff --git a/tools/arch/x86/include/uapi/asm/unistd_64.h b/tools/arch/x86/i= nclude/uapi/asm/unistd_64.h index a6f7fe84d4df..e0549617f9d7 100644 --- a/tools/arch/x86/include/uapi/asm/unistd_64.h +++ b/tools/arch/x86/include/uapi/asm/unistd_64.h @@ -23,3 +23,6 @@ #ifndef __NR_getcpu #define __NR_getcpu 309 #endif +#ifndef __NR_seccomp +#define __NR_seccomp 317 +#endif diff --git a/tools/perf/bench/Build b/tools/perf/bench/Build index 6b6155a8ad09..e3ec2c1b0682 100644 --- a/tools/perf/bench/Build +++ b/tools/perf/bench/Build @@ -1,5 +1,6 @@ perf-y +=3D sched-messaging.o perf-y +=3D sched-pipe.o +perf-y +=3D sched-seccomp-notify.o perf-y +=3D syscall.o perf-y +=3D mem-functions.o perf-y +=3D futex-hash.o diff --git a/tools/perf/bench/bench.h b/tools/perf/bench/bench.h index e43893151a3e..9d28510fcf9d 100644 --- a/tools/perf/bench/bench.h +++ b/tools/perf/bench/bench.h @@ -21,6 +21,7 @@ extern struct timeval bench__start, bench__end, bench__ru= ntime; int bench_numa(int argc, const char **argv); int bench_sched_messaging(int argc, const char **argv); int bench_sched_pipe(int argc, const char **argv); +int bench_sched_seccomp_notify(int argc, const char **argv); int bench_syscall_basic(int argc, const char **argv); int bench_syscall_getpgid(int argc, const char **argv); int bench_syscall_execve(int argc, const char **argv); diff --git a/tools/perf/bench/sched-seccomp-notify.c b/tools/perf/bench/sch= ed-seccomp-notify.c new file mode 100644 index 000000000000..443f4b43702d --- /dev/null +++ b/tools/perf/bench/sched-seccomp-notify.c @@ -0,0 +1,168 @@ +// SPDX-License-Identifier: GPL-2.0 +#include +#include "bench.h" + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define LOOPS_DEFAULT 1000000UL +static uint64_t loops =3D LOOPS_DEFAULT; +static bool sync_mode; + +static const struct option options[] =3D { + OPT_U64('l', "loop", &loops, "Specify number of loops"), + OPT_BOOLEAN('s', "sync-mode", &sync_mode, + "Enable the synchronious mode for seccomp notifications"), + OPT_END() +}; + +static const char * const bench_seccomp_usage[] =3D { + "perf bench sched secccomp-notify ", + NULL +}; + +static int seccomp(unsigned int op, unsigned int flags, void *args) +{ + return syscall(__NR_seccomp, op, flags, args); +} + +static int user_notif_syscall(int nr, unsigned int flags) +{ + struct sock_filter filter[] =3D { + BPF_STMT(BPF_LD|BPF_W|BPF_ABS, + offsetof(struct seccomp_data, nr)), + BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, nr, 0, 1), + BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_USER_NOTIF), + BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), + }; + + struct sock_fprog prog =3D { + .len =3D (unsigned short)ARRAY_SIZE(filter), + .filter =3D filter, + }; + + return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog); +} + +#define USER_NOTIF_MAGIC INT_MAX +static void user_notification_sync_loop(int listener) +{ + struct seccomp_notif_resp resp; + struct seccomp_notif req; + uint64_t nr; + + for (nr =3D 0; nr < loops; nr++) { + memset(&req, 0, sizeof(req)); + assert(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req) =3D=3D 0); + + assert(req.data.nr =3D=3D __NR_gettid); + + resp.id =3D req.id; + resp.error =3D 0; + resp.val =3D USER_NOTIF_MAGIC; + resp.flags =3D 0; + assert(ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp) =3D=3D 0); + } +} + +#ifndef SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP +#define SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP (1UL << 0) +#define SECCOMP_IOCTL_NOTIF_SET_FLAGS SECCOMP_IOW(4, __u64) +#endif +int bench_sched_seccomp_notify(int argc, const char **argv) +{ + struct timeval start, stop, diff; + unsigned long long result_usec =3D 0; + int status, listener; + pid_t pid; + long ret; + + argc =3D parse_options(argc, argv, options, bench_seccomp_usage, 0); + + gettimeofday(&start, NULL); + + prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); + listener =3D user_notif_syscall(__NR_gettid, + SECCOMP_FILTER_FLAG_NEW_LISTENER); + assert(listener >=3D 0); + + pid =3D fork(); + assert(pid >=3D 0); + if (pid =3D=3D 0) { + assert(prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0) =3D=3D 0); + while (1) { + ret =3D syscall(__NR_gettid); + if (ret =3D=3D USER_NOTIF_MAGIC) + continue; + break; + } + _exit(1); + } + + if (sync_mode) { + assert(ioctl(listener, SECCOMP_IOCTL_NOTIF_SET_FLAGS, + SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP, 0) =3D=3D 0); + } + user_notification_sync_loop(listener); + + kill(pid, SIGKILL); + assert(waitpid(pid, &status, 0) =3D=3D pid); + assert(WIFSIGNALED(status)); + assert(WTERMSIG(status) =3D=3D SIGKILL); + + gettimeofday(&stop, NULL); + timersub(&stop, &start, &diff); + + switch (bench_format) { + case BENCH_FORMAT_DEFAULT: + printf("# Executed %lu system calls\n\n", + loops); + + result_usec =3D diff.tv_sec * USEC_PER_SEC; + result_usec +=3D diff.tv_usec; + + printf(" %14s: %lu.%03lu [sec]\n\n", "Total time", + (unsigned long) diff.tv_sec, + (unsigned long) (diff.tv_usec / USEC_PER_MSEC)); + + printf(" %14lf usecs/op\n", + (double)result_usec / (double)loops); + printf(" %14d ops/sec\n", + (int)((double)loops / + ((double)result_usec / (double)USEC_PER_SEC))); + break; + + case BENCH_FORMAT_SIMPLE: + printf("%lu.%03lu\n", + (unsigned long) diff.tv_sec, + (unsigned long) (diff.tv_usec / USEC_PER_MSEC)); + break; + + default: + /* reaching here is something disaster */ + fprintf(stderr, "Unknown format:%d\n", bench_format); + exit(1); + break; + } + + return 0; +} diff --git a/tools/perf/builtin-bench.c b/tools/perf/builtin-bench.c index 814e9afc86f6..db57813fe4e5 100644 --- a/tools/perf/builtin-bench.c +++ b/tools/perf/builtin-bench.c @@ -46,6 +46,7 @@ static struct bench numa_benchmarks[] =3D { static struct bench sched_benchmarks[] =3D { { "messaging", "Benchmark for scheduling and IPC", bench_sched_messaging= }, { "pipe", "Benchmark for pipe() between two processes", bench_sched_pipe = }, + { "seccomp-notify", "Benchmark for seccomp user notify", bench_sched_secc= omp_notify}, { "all", "Run all scheduler benchmarks", NULL }, { NULL, NULL, NULL } }; --=20 2.40.0.rc0.216.gc4246ad0f0-goog