Re: [RFC 5/5] x86,seccomp: Add a seccomp fastpath

2014-06-13 Thread Will Drewry
On Wed, Jun 11, 2014 at 5:32 PM, Kees Cook wrote: > On Wed, Jun 11, 2014 at 3:28 PM, Andy Lutomirski wrote: >> On Wed, Jun 11, 2014 at 3:27 PM, H. Peter Anvin wrote: >>> On 06/11/2014 03:22 PM, Andy Lutomirski wrote: On Wed, Jun 11, 2014 at 3:18 PM, H. Peter Anvin wrote: > On 06/11/201

Re: [RFC 5/5] x86,seccomp: Add a seccomp fastpath

2014-06-11 Thread Kees Cook
On Wed, Jun 11, 2014 at 3:28 PM, Andy Lutomirski wrote: > On Wed, Jun 11, 2014 at 3:27 PM, H. Peter Anvin wrote: >> On 06/11/2014 03:22 PM, Andy Lutomirski wrote: >>> On Wed, Jun 11, 2014 at 3:18 PM, H. Peter Anvin wrote: On 06/11/2014 02:56 PM, Andy Lutomirski wrote: > > 13ns is wi

Re: [RFC 5/5] x86,seccomp: Add a seccomp fastpath

2014-06-11 Thread Andy Lutomirski
On Wed, Jun 11, 2014 at 3:27 PM, H. Peter Anvin wrote: > On 06/11/2014 03:22 PM, Andy Lutomirski wrote: >> On Wed, Jun 11, 2014 at 3:18 PM, H. Peter Anvin wrote: >>> On 06/11/2014 02:56 PM, Andy Lutomirski wrote: 13ns is with the simplest nonempty filter. I hope that empty filters

Re: [RFC 5/5] x86,seccomp: Add a seccomp fastpath

2014-06-11 Thread H. Peter Anvin
On 06/11/2014 03:22 PM, Andy Lutomirski wrote: > On Wed, Jun 11, 2014 at 3:18 PM, H. Peter Anvin wrote: >> On 06/11/2014 02:56 PM, Andy Lutomirski wrote: >>> >>> 13ns is with the simplest nonempty filter. I hope that empty filters >>> don't work. >>> >> >> Why wouldn't they? > > Is it permissibl

Re: [RFC 5/5] x86,seccomp: Add a seccomp fastpath

2014-06-11 Thread Andy Lutomirski
On Wed, Jun 11, 2014 at 3:18 PM, H. Peter Anvin wrote: > On 06/11/2014 02:56 PM, Andy Lutomirski wrote: >> >> 13ns is with the simplest nonempty filter. I hope that empty filters >> don't work. >> > > Why wouldn't they? Is it permissible to fall off the end of a BPF program? I'm getting EINVAL

Re: [RFC 5/5] x86,seccomp: Add a seccomp fastpath

2014-06-11 Thread H. Peter Anvin
On 06/11/2014 02:56 PM, Andy Lutomirski wrote: > > 13ns is with the simplest nonempty filter. I hope that empty filters > don't work. > Why wouldn't they? -hpa -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel

Re: [RFC 5/5] x86,seccomp: Add a seccomp fastpath

2014-06-11 Thread Andy Lutomirski
On Wed, Jun 11, 2014 at 2:29 PM, Alexei Starovoitov wrote: > On Wed, Jun 11, 2014 at 1:23 PM, Andy Lutomirski wrote: >> On my VM, getpid takes about 70ns. Before this patch, adding a >> single-instruction always-accept seccomp filter added about 134ns of >> overhead to getpid. With this patch,

Re: [RFC 5/5] x86,seccomp: Add a seccomp fastpath

2014-06-11 Thread Alexei Starovoitov
On Wed, Jun 11, 2014 at 1:23 PM, Andy Lutomirski wrote: > On my VM, getpid takes about 70ns. Before this patch, adding a > single-instruction always-accept seccomp filter added about 134ns of > overhead to getpid. With this patch, the overhead is down to about > 13ns. interesting. Is this the g