seccomp_benchmark.c

  1/*
  2 * Strictly speaking, this is not a test. But it can report during test
  3 * runs so relative performance can be measured.
  4 */
  5#define _GNU_SOURCE
  6#include <assert.h>
  7#include <err.h>
  8#include <limits.h>
  9#include <sched.h>
 10#include <stdbool.h>
 11#include <stddef.h>
 12#include <stdio.h>
 13#include <stdlib.h>
 14#include <time.h>
 15#include <unistd.h>
 16#include <linux/filter.h>
 17#include <linux/seccomp.h>
 18#include <sys/param.h>
 19#include <sys/prctl.h>
 20#include <sys/syscall.h>
 21#include <sys/types.h>
 22
 23#include "kselftest.h"
 24
 25unsigned long long timing(clockid_t clk_id, unsigned long long samples)
 26{
 27	struct timespec start, finish;
 28	unsigned long long i;
 29	pid_t pid, ret;
 30
 31	pid = getpid();
 32	assert(clock_gettime(clk_id, &start) == 0);
 33	for (i = 0; i < samples; i++) {
 34		ret = syscall(__NR_getpid);
 35		assert(pid == ret);
 36	}
 37	assert(clock_gettime(clk_id, &finish) == 0);
 38
 39	i = finish.tv_sec - start.tv_sec;
 40	i *= 1000000000ULL;
 41	i += finish.tv_nsec - start.tv_nsec;
 42
 43	ksft_print_msg("%lu.%09lu - %lu.%09lu = %llu (%.1fs)\n",
 44		       finish.tv_sec, finish.tv_nsec,
 45		       start.tv_sec, start.tv_nsec,
 46		       i, (double)i / 1000000000.0);
 47
 48	return i;
 49}
 50
 51unsigned long long calibrate(void)
 52{
 53	struct timespec start, finish;
 54	unsigned long long i, samples, step = 9973;
 55	pid_t pid, ret;
 56	int seconds = 15;
 57
 58	ksft_print_msg("Calibrating sample size for %d seconds worth of syscalls ...\n", seconds);
 59
 60	samples = 0;
 61	pid = getpid();
 62	assert(clock_gettime(CLOCK_MONOTONIC, &start) == 0);
 63	do {
 64		for (i = 0; i < step; i++) {
 65			ret = syscall(__NR_getpid);
 66			assert(pid == ret);
 67		}
 68		assert(clock_gettime(CLOCK_MONOTONIC, &finish) == 0);
 69
 70		samples += step;
 71		i = finish.tv_sec - start.tv_sec;
 72		i *= 1000000000ULL;
 73		i += finish.tv_nsec - start.tv_nsec;
 74	} while (i < 1000000000ULL);
 75
 76	return samples * seconds;
 77}
 78
 79bool approx(int i_one, int i_two)
 80{
 81	/*
 82	 * This continues to be a noisy test. Instead of a 1% comparison
 83	 * go with 10%.
 84	 */
 85	double one = i_one, one_bump = one * 0.1;
 86	double two = i_two, two_bump = two * 0.1;
 87
 88	one_bump = one + MAX(one_bump, 2.0);
 89	two_bump = two + MAX(two_bump, 2.0);
 90
 91	/* Equal to, or within 1% or 2 digits */
 92	if (one == two ||
 93	    (one > two && one <= two_bump) ||
 94	    (two > one && two <= one_bump))
 95		return true;
 96	return false;
 97}
 98
 99bool le(int i_one, int i_two)
100{
101	if (i_one <= i_two)
102		return true;
103	return false;
104}
105
106long compare(const char *name_one, const char *name_eval, const char *name_two,
107	     unsigned long long one, bool (*eval)(int, int), unsigned long long two,
108	     bool skip)
109{
110	bool good;
111
112	if (skip) {
113		ksft_test_result_skip("%s %s %s\n", name_one, name_eval,
114				      name_two);
115		return 0;
116	}
117
118	ksft_print_msg("\t%s %s %s (%lld %s %lld): ", name_one, name_eval, name_two,
119		       (long long)one, name_eval, (long long)two);
120	if (one > INT_MAX) {
121		ksft_print_msg("Miscalculation! Measurement went negative: %lld\n", (long long)one);
122		good = false;
123		goto out;
124	}
125	if (two > INT_MAX) {
126		ksft_print_msg("Miscalculation! Measurement went negative: %lld\n", (long long)two);
127		good = false;
128		goto out;
129	}
130
131	good = eval(one, two);
132	printf("%s\n", good ? "✔️" : "❌");
133
134out:
135	ksft_test_result(good, "%s %s %s\n", name_one, name_eval, name_two);
136
137	return good ? 0 : 1;
138}
139
140/* Pin to a single CPU so the benchmark won't bounce around the system. */
141void affinity(void)
142{
143	long cpu;
144	ulong ncores = sysconf(_SC_NPROCESSORS_CONF);
145	cpu_set_t *setp = CPU_ALLOC(ncores);
146	ulong setsz = CPU_ALLOC_SIZE(ncores);
147
148	/*
149	 * Totally unscientific way to avoid CPUs that might be busier:
150	 * choose the highest CPU instead of the lowest.
151	 */
152	for (cpu = ncores - 1; cpu >= 0; cpu--) {
153		CPU_ZERO_S(setsz, setp);
154		CPU_SET_S(cpu, setsz, setp);
155		if (sched_setaffinity(getpid(), setsz, setp) == -1)
156			continue;
157		printf("Pinned to CPU %lu of %lu\n", cpu + 1, ncores);
158		goto out;
159	}
160	fprintf(stderr, "Could not set CPU affinity -- calibration may not work well");
161
162out:
163	CPU_FREE(setp);
164}
165
166int main(int argc, char *argv[])
167{
168	struct sock_filter bitmap_filter[] = {
169		BPF_STMT(BPF_LD|BPF_W|BPF_ABS, offsetof(struct seccomp_data, nr)),
170		BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
171	};
172	struct sock_fprog bitmap_prog = {
173		.len = (unsigned short)ARRAY_SIZE(bitmap_filter),
174		.filter = bitmap_filter,
175	};
176	struct sock_filter filter[] = {
177		BPF_STMT(BPF_LD|BPF_W|BPF_ABS, offsetof(struct seccomp_data, args[0])),
178		BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
179	};
180	struct sock_fprog prog = {
181		.len = (unsigned short)ARRAY_SIZE(filter),
182		.filter = filter,
183	};
184
185	long ret, bits;
186	unsigned long long samples, calc;
187	unsigned long long native, filter1, filter2, bitmap1, bitmap2;
188	unsigned long long entry, per_filter1, per_filter2;
189	bool skip = false;
190
191	setbuf(stdout, NULL);
192
193	ksft_print_header();
194	ksft_set_plan(7);
195
196	ksft_print_msg("Running on:\n");
197	ksft_print_msg("%s", "");
198	system("uname -a");
199
200	ksft_print_msg("Current BPF sysctl settings:\n");
201	/* Avoid using "sysctl" which may not be installed. */
202	ksft_print_msg("%s", "");
203	system("grep -H . /proc/sys/net/core/bpf_jit_enable");
204	ksft_print_msg("%s", "");
205	system("grep -H . /proc/sys/net/core/bpf_jit_harden");
206
207	affinity();
208
209	if (argc > 1)
210		samples = strtoull(argv[1], NULL, 0);
211	else
212		samples = calibrate();
213
214	ksft_print_msg("Benchmarking %llu syscalls...\n", samples);
215
216	/* Native call */
217	native = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
218	ksft_print_msg("getpid native: %llu ns\n", native);
219
220	ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
221	assert(ret == 0);
222
223	/* One filter resulting in a bitmap */
224	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog);
225	assert(ret == 0);
226
227	bitmap1 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
228	ksft_print_msg("getpid RET_ALLOW 1 filter (bitmap): %llu ns\n", bitmap1);
229
230	/* Second filter resulting in a bitmap */
231	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog);
232	assert(ret == 0);
233
234	bitmap2 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
235	ksft_print_msg("getpid RET_ALLOW 2 filters (bitmap): %llu ns\n", bitmap2);
236
237	/* Third filter, can no longer be converted to bitmap */
238	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
239	assert(ret == 0);
240
241	filter1 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
242	ksft_print_msg("getpid RET_ALLOW 3 filters (full): %llu ns\n", filter1);
243
244	/* Fourth filter, can not be converted to bitmap because of filter 3 */
245	ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog);
246	assert(ret == 0);
247
248	filter2 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
249	ksft_print_msg("getpid RET_ALLOW 4 filters (full): %llu ns\n", filter2);
250
251	/* Estimations */
252#define ESTIMATE(fmt, var, what)	do {			\
253		var = (what);					\
254		ksft_print_msg("Estimated " fmt ": %llu ns\n", var);	\
255		if (var > INT_MAX) {				\
256			skip = true;				\
257			ret |= 1;				\
258		}						\
259	} while (0)
260
261	ESTIMATE("total seccomp overhead for 1 bitmapped filter", calc,
262		 bitmap1 - native);
263	ESTIMATE("total seccomp overhead for 2 bitmapped filters", calc,
264		 bitmap2 - native);
265	ESTIMATE("total seccomp overhead for 3 full filters", calc,
266		 filter1 - native);
267	ESTIMATE("total seccomp overhead for 4 full filters", calc,
268		 filter2 - native);
269	ESTIMATE("seccomp entry overhead", entry,
270		 bitmap1 - native - (bitmap2 - bitmap1));
271	ESTIMATE("seccomp per-filter overhead (last 2 diff)", per_filter1,
272		 filter2 - filter1);
273	ESTIMATE("seccomp per-filter overhead (filters / 4)", per_filter2,
274		 (filter2 - native - entry) / 4);
275
276	ksft_print_msg("Expectations:\n");
277	ret |= compare("native", "≤", "1 bitmap", native, le, bitmap1,
278		       skip);
279	bits = compare("native", "≤", "1 filter", native, le, filter1,
280		       skip);
281	if (bits)
282		skip = true;
283
284	ret |= compare("per-filter (last 2 diff)", "≈", "per-filter (filters / 4)",
285		       per_filter1, approx, per_filter2, skip);
286
287	bits = compare("1 bitmapped", "≈", "2 bitmapped",
288		       bitmap1 - native, approx, bitmap2 - native, skip);
289	if (bits) {
290		ksft_print_msg("Skipping constant action bitmap expectations: they appear unsupported.\n");
291		skip = true;
292	}
293
294	ret |= compare("entry", "≈", "1 bitmapped", entry, approx,
295		       bitmap1 - native, skip);
296	ret |= compare("entry", "≈", "2 bitmapped", entry, approx,
297		       bitmap2 - native, skip);
298	ret |= compare("native + entry + (per filter * 4)", "≈", "4 filters total",
299		       entry + (per_filter1 * 4) + native, approx, filter2,
300		       skip);
301
302	if (ret)
303		ksft_print_msg("Saw unexpected benchmark result. Try running again with more samples?\n");
304
305	ksft_finished();
306}