lkml.org 
[lkml]   [2020]   [Mar]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH] seccomp: allow BPF_MOD ALU instructions
    вт, 17 мар. 2020 г. в 16:21, Kees Cook <keescook@chromium.org>:
    >
    > On Mon, Mar 16, 2020 at 06:17:34PM -0400, Anton Protopopov wrote:
    > > and in every case to walk only a corresponding factor-list. In my case
    > > I had a list of ~40 syscall numbers and after this change filter
    > > executed in 17.25 instructions on average per syscall vs. 45
    > > instructions for the linear filter (so this removes about 30
    > > instructions penalty per every syscall). To replace "mod #4" I
    > > actually used "and #3", but this obviously doesn't work for
    > > non-power-of-two divisors. If I would use "mod 5", then it would give
    > > me about 15.5 instructions on average.
    >
    > Gotcha. My real concern is with breaking the ABI here -- using BPF_MOD
    > would mean a process couldn't run on older kernels without some tricks
    > on the seccomp side.

    Yes, I understood. Could you tell what would you do exactly if there
    was a real need in a new instruction?

    > Since the syscall list is static for a given filter, why not arrange it
    > as a binary search? That should get even better average instructions
    > as O(log n) instead of O(n).

    Right, thanks! This saves about 4 more instructions for my case and
    works 1-2 ns faster.

    > Though frankly I've also been considering an ABI version bump for adding
    > a syscall bitmap feature: the vast majority of seccomp filters are just
    > binary yes/no across a list of syscalls. Only the special cases need
    > special handling (arg inspection, fd notification, etc). Then these
    > kinds of filters could run as O(1).
    >
    > --
    > Kees Cook

    Thanks,
    Anton

    \
     
     \ /
      Last update: 2020-03-18 02:13    [W:22.424 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site