On Thu, Oct 01, 2020 at 12:24:32AM +0200, Jann Horn wrote: > On Wed, Sep 30, 2020 at 5:20 PM YiFei Zhu <zhuyifei1999@xxxxxxxxx> wrote: > > SECCOMP_CACHE_NR_ONLY will only operate on syscalls that do not > > access any syscall arguments or instruction pointer. To facilitate > > this we need a static analyser to know whether a filter will > > return allow regardless of syscall arguments for a given > > architecture number / syscall number pair. This is implemented > > here with a pseudo-emulator, and stored in a per-filter bitmap. > > > > Each common BPF instruction are emulated. Any weirdness or loading > > from a syscall argument will cause the emulator to bail. > > > > The emulation is also halted if it reaches a return. In that case, > > if it returns an SECCOMP_RET_ALLOW, the syscall is marked as good. > > > > Emulator structure and comments are from Kees [1] and Jann [2]. > > > > Emulation is done at attach time. If a filter depends on more > > filters, and if the dependee does not guarantee to allow the > > syscall, then we skip the emulation of this syscall. > > > > [1] https://lore.kernel.org/lkml/20200923232923.3142503-5-keescook@xxxxxxxxxxxx/ > > [2] https://lore.kernel.org/lkml/CAG48ez1p=dR_2ikKq=xVxkoGg0fYpTBpkhJSv1w-6BG=76PAvw@xxxxxxxxxxxxxx/ > [...] > > +static void seccomp_cache_prepare_bitmap(struct seccomp_filter *sfilter, > > + void *bitmap, const void *bitmap_prev, > > + size_t bitmap_size, int arch) > > +{ > > + struct sock_fprog_kern *fprog = sfilter->prog->orig_prog; > > + struct seccomp_data sd; > > + int nr; > > + > > + for (nr = 0; nr < bitmap_size; nr++) { > > + if (bitmap_prev && !test_bit(nr, bitmap_prev)) > > + continue; > > + > > + sd.nr = nr; > > + sd.arch = arch; > > + > > + if (seccomp_emu_is_const_allow(fprog, &sd)) > > + set_bit(nr, bitmap); > > set_bit() is atomic, but since we only do this at filter setup, before > the filter becomes globally visible, we don't need atomicity here. So > this should probably use __set_bit() instead. Oh yes, excellent point! That will speed this up a bit. When you do this, please include a comment here describing why its safe to do it non-atomic. :) -- Kees Cook
