selftests/seccomp/seccomp_benchmark.c

0001 /*
0002  * Strictly speaking, this is not a test. But it can report during test
0003  * runs so relative performace can be measured.
0004  */
0005 #define _GNU_SOURCE
0006 #include <assert.h>
0007 #include <limits.h>
0008 #include <stdbool.h>
0009 #include <stddef.h>
0010 #include <stdio.h>
0011 #include <stdlib.h>
0012 #include <time.h>
0013 #include <unistd.h>
0014 #include <linux/filter.h>
0015 #include <linux/seccomp.h>
0016 #include <sys/param.h>
0017 #include <sys/prctl.h>
0018 #include <sys/syscall.h>
0019 #include <sys/types.h>
0020
0021 #include "../kselftest.h"
0022
0023 unsigned long long timing(clockid_t clk_id, unsigned long long samples)
0024 {
0025     struct timespec start, finish;
0026     unsigned long long i;
0027     pid_t pid, ret;
0028
0029     pid = getpid();
0030     assert(clock_gettime(clk_id, &start) == 0);
0031     for (i = 0; i < samples; i++) {
0032         ret = syscall(__NR_getpid);
0033         assert(pid == ret);
0034     }
0035     assert(clock_gettime(clk_id, &finish) == 0);
0036
0037     i = finish.tv_sec - start.tv_sec;
0038     i *= 1000000000ULL;
0039     i += finish.tv_nsec - start.tv_nsec;
0040
0041     printf("%lu.%09lu - %lu.%09lu = %llu (%.1fs)\n",
0042         finish.tv_sec, finish.tv_nsec,
0043         start.tv_sec, start.tv_nsec,
0044         i, (double)i / 1000000000.0);
0045
0046     return i;
0047 }
0048
0049 unsigned long long calibrate(void)
0050 {
0051     struct timespec start, finish;
0052     unsigned long long i, samples, step = 9973;
0053     pid_t pid, ret;
0054     int seconds = 15;
0055
0056     printf("Calibrating sample size for %d seconds worth of syscalls ...\n", seconds);
0057
0058     samples = 0;
0059     pid = getpid();
0060     assert(clock_gettime(CLOCK_MONOTONIC, &start) == 0);
0061     do {
0062         for (i = 0; i < step; i++) {
0063             ret = syscall(__NR_getpid);
0064             assert(pid == ret);
0065         }
0066         assert(clock_gettime(CLOCK_MONOTONIC, &finish) == 0);
0067
0068         samples += step;
0069         i = finish.tv_sec - start.tv_sec;
0070         i *= 1000000000ULL;
0071         i += finish.tv_nsec - start.tv_nsec;
0072     } while (i < 1000000000ULL);
0073
0074     return samples * seconds;
0075 }
0076
0077 bool approx(int i_one, int i_two)
0078 {
0079     double one = i_one, one_bump = one * 0.01;
0080     double two = i_two, two_bump = two * 0.01;
0081
0082     one_bump = one + MAX(one_bump, 2.0);
0083     two_bump = two + MAX(two_bump, 2.0);
0084
0085     /* Equal to, or within 1% or 2 digits */
0086     if (one == two ||
0087         (one > two && one <= two_bump) ||
0088         (two > one && two <= one_bump))
0089         return true;
0090     return false;
0091 }
0092
0093 bool le(int i_one, int i_two)
0094 {
0095     if (i_one <= i_two)
0096         return true;
0097     return false;
0098 }
0099
0100 long compare(const char *name_one, const char *name_eval, const char *name_two,
0101          unsigned long long one, bool (*eval)(int, int), unsigned long long two)
0102 {
0103     bool good;
0104
0105     printf("\t%s %s %s (%lld %s %lld): ", name_one, name_eval, name_two,
0106            (long long)one, name_eval, (long long)two);
0107     if (one > INT_MAX) {
0108         printf("Miscalculation! Measurement went negative: %lld\n", (long long)one);
0109         return 1;
0110     }
0111     if (two > INT_MAX) {
0112         printf("Miscalculation! Measurement went negative: %lld\n", (long long)two);
0113         return 1;
0114     }
0115
0116     good = eval(one, two);
0117     printf("%s\n", good ? "✔️" : "❌");
0118
0119     return good ? 0 : 1;
0120 }
0121
0122 int main(int argc, char *argv[])
0123 {
0124     struct sock_filter bitmap_filter[] = {
0125         BPF_STMT(BPF_LD|BPF_W|BPF_ABS, offsetof(struct seccomp_data, nr)),
0126         BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
0127     };
0128     struct sock_fprog bitmap_prog = {
0129         .len = (unsigned short)ARRAY_SIZE(bitmap_filter),
0130         .filter = bitmap_filter,
0131     };
0132     struct sock_filter filter[] = {
0133         BPF_STMT(BPF_LD|BPF_W|BPF_ABS, offsetof(struct seccomp_data, args[0])),
0134         BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
0135     };
0136     struct sock_fprog prog = {
0137         .len = (unsigned short)ARRAY_SIZE(filter),
0138         .filter = filter,
0139     };
0140
0141     long ret, bits;
0142     unsigned long long samples, calc;
0143     unsigned long long native, filter1, filter2, bitmap1, bitmap2;
0144     unsigned long long entry, per_filter1, per_filter2;
0145
0146     setbuf(stdout, NULL);
0147
0148     printf("Running on:\n");
0149     system("uname -a");
0150
0151     printf("Current BPF sysctl settings:\n");
0152     /* Avoid using "sysctl" which may not be installed. */
0153     system("grep -H . /proc/sys/net/core/bpf_jit_enable");
0154     system("grep -H . /proc/sys/net/core/bpf_jit_harden");
0155
0156     if (argc > 1)
0157         samples = strtoull(argv[1], NULL, 0);
0158     else
0159         samples = calibrate();
0160
0161     printf("Benchmarking %llu syscalls...\n", samples);
0162
0163     /* Native call */
0164     native = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
0165     printf("getpid native: %llu ns\n", native);
0166
0167     ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
0168     assert(ret == 0);
0169
0170     /* One filter resulting in a bitmap */
0171     ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog);
0172     assert(ret == 0);
0173
0174     bitmap1 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
0175     printf("getpid RET_ALLOW 1 filter (bitmap): %llu ns\n", bitmap1);
0176
0177     /* Second filter resulting in a bitmap */
0178     ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog);
0179     assert(ret == 0);
0180
0181     bitmap2 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
0182     printf("getpid RET_ALLOW 2 filters (bitmap): %llu ns\n", bitmap2);
0183
0184     /* Third filter, can no longer be converted to bitmap */
0185     ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
0186     assert(ret == 0);
0187
0188     filter1 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
0189     printf("getpid RET_ALLOW 3 filters (full): %llu ns\n", filter1);
0190
0191     /* Fourth filter, can not be converted to bitmap because of filter 3 */
0192     ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog);
0193     assert(ret == 0);
0194
0195     filter2 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
0196     printf("getpid RET_ALLOW 4 filters (full): %llu ns\n", filter2);
0197
0198     /* Estimations */
0199 #define ESTIMATE(fmt, var, what)    do {            \
0200         var = (what);                   \
0201         printf("Estimated " fmt ": %llu ns\n", var);    \
0202         if (var > INT_MAX)              \
0203             goto more_samples;          \
0204     } while (0)
0205
0206     ESTIMATE("total seccomp overhead for 1 bitmapped filter", calc,
0207          bitmap1 - native);
0208     ESTIMATE("total seccomp overhead for 2 bitmapped filters", calc,
0209          bitmap2 - native);
0210     ESTIMATE("total seccomp overhead for 3 full filters", calc,
0211          filter1 - native);
0212     ESTIMATE("total seccomp overhead for 4 full filters", calc,
0213          filter2 - native);
0214     ESTIMATE("seccomp entry overhead", entry,
0215          bitmap1 - native - (bitmap2 - bitmap1));
0216     ESTIMATE("seccomp per-filter overhead (last 2 diff)", per_filter1,
0217          filter2 - filter1);
0218     ESTIMATE("seccomp per-filter overhead (filters / 4)", per_filter2,
0219          (filter2 - native - entry) / 4);
0220
0221     printf("Expectations:\n");
0222     ret |= compare("native", "≤", "1 bitmap", native, le, bitmap1);
0223     bits = compare("native", "≤", "1 filter", native, le, filter1);
0224     if (bits)
0225         goto more_samples;
0226
0227     ret |= compare("per-filter (last 2 diff)", "≈", "per-filter (filters / 4)",
0228             per_filter1, approx, per_filter2);
0229
0230     bits = compare("1 bitmapped", "≈", "2 bitmapped",
0231             bitmap1 - native, approx, bitmap2 - native);
0232     if (bits) {
0233         printf("Skipping constant action bitmap expectations: they appear unsupported.\n");
0234         goto out;
0235     }
0236
0237     ret |= compare("entry", "≈", "1 bitmapped", entry, approx, bitmap1 - native);
0238     ret |= compare("entry", "≈", "2 bitmapped", entry, approx, bitmap2 - native);
0239     ret |= compare("native + entry + (per filter * 4)", "≈", "4 filters total",
0240             entry + (per_filter1 * 4) + native, approx, filter2);
0241     if (ret == 0)
0242         goto out;
0243
0244 more_samples:
0245     printf("Saw unexpected benchmark result. Try running again with more samples?\n");
0246 out:
0247     return 0;
0248 }