Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Feedback-ID: i21f147d5:Fastmail
Date:   Thu, 12 Jan 2023 08:00:25 -0700
From:   Tycho Andersen <tycho@tycho.pizza>
To:     Andrei Vagin <avagin@google.com>
Cc:     Peter Zijlstra <peterz@infradead.org>,
        Ingo Molnar <mingo@redhat.com>,
        Vincent Guittot <vincent.guittot@linaro.org>,
        Dietmar Eggemann <dietmar.eggemann@arm.com>,
        linux-kernel@vger.kernel.org, Kees Cook <keescook@chromium.org>,
        Christian Brauner <brauner@kernel.org>,
        Andrei Vagin <avagin@gmail.com>,
        Andy Lutomirski <luto@amacapital.net>,
        Juri Lelli <juri.lelli@redhat.com>,
        Peter Oskolkov <posk@google.com>,
        Will Drewry <wad@chromium.org>
Subject: Re: [PATCH 4/5] seccomp: add the synchronous mode for seccomp_unotify
Message-ID: <Y8AgiZqYSjozXbhP@tycho.pizza>
References: <20230110213010.2683185-1-avagin@google.com>
 <20230110213010.2683185-5-avagin@google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20230110213010.2683185-5-avagin@google.com>
Precedence: bulk

On Tue, Jan 10, 2023 at 01:30:09PM -0800, Andrei Vagin wrote:
> From: Andrei Vagin <avagin@gmail.com>
> 
> seccomp_unotify allows more privileged processes do actions on behalf
> of less privileged processes.
> 
> In many cases, the workflow is fully synchronous. It means a target
> process triggers a system call and passes controls to a supervisor
> process that handles the system call and returns controls to the target
> process. In this context, "synchronous" means that only one process is
> running and another one is waiting.
> 
> There is the WF_CURRENT_CPU flag that is used to advise the scheduler to
> move the wakee to the current CPU. For such synchronous workflows, it
> makes context switches a few times faster.
> 
> Right now, each interaction takes 12?s. With this patch, it takes about
> 3?s.
> 
> This change introduce the SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP flag that
> it used to enable the sync mode.

What about just not having a flag and using the new primitives all the
time? Is there any reason not to?

Tycho