Re: [RFC patch 09/19] bpf: Use BPF_PROG_RUN_PIN_ON_CPU() at simple call sites.

Kees Cook [off-list ref] writes:

On Wed, Feb 19, 2020 at 10:00:56AM +0100, Thomas Gleixner wrote:

quoted

Vinicius Costa Gomes [off-list ref] writes:

quoted

More a question really, isn't the behavior changing here? i.e. shouldn't
migrate_disable()/migrate_enable() be moved to outside the loop? Or is
running seccomp filters on different cpus not a problem?

In my understanding this is a list of filters and they are independent
of each other.

Kees, Will. Andy?

They're technically independent, but they are related to each
other. (i.e. order matters, process hierarchy matters, etc). There's no
reason I can see that we can't switch CPUs between running them, though.
(AIUI, nothing here would suddenly make these run in parallel, right?)

Of course not. If we'd run the same thread on multiple CPUs in parallel
the ordering of your BPF programs would be the least of your worries.

As long as "current" is still "current", and they run in the same order,
we'll get the same final result as far as seccomp is concerned.

Right.

Thanks,

        tglx