On Thu, Sep 24, 2020 at 07:44:20AM -0500, YiFei Zhu wrote: > From: Kees Cook <keescook@xxxxxxxxxxxx> > > As part of the seccomp benchmarking, include the expectations with > regard to the timing behavior of the constant action bitmaps, and report > inconsistencies better. > > Example output with constant action bitmaps on x86: > > $ sudo ./seccomp_benchmark 100000000 > Current BPF sysctl settings: > net.core.bpf_jit_enable = 1 > net.core.bpf_jit_harden = 0 > Benchmarking 100000000 syscalls... > 63.896255358 - 0.008504529 = 63887750829 (63.9s) > getpid native: 638 ns > 130.383312423 - 63.897315189 = 66485997234 (66.5s) > getpid RET_ALLOW 1 filter (bitmap): 664 ns > 196.789080421 - 130.384414983 = 66404665438 (66.4s) > getpid RET_ALLOW 2 filters (bitmap): 664 ns > 268.844643304 - 196.790234168 = 72054409136 (72.1s) > getpid RET_ALLOW 3 filters (full): 720 ns > 342.627472515 - 268.845799103 = 73781673412 (73.8s) > getpid RET_ALLOW 4 filters (full): 737 ns > Estimated total seccomp overhead for 1 bitmapped filter: 26 ns > Estimated total seccomp overhead for 2 bitmapped filters: 26 ns > Estimated total seccomp overhead for 3 full filters: 82 ns > Estimated total seccomp overhead for 4 full filters: 99 ns > Estimated seccomp entry overhead: 26 ns > Estimated seccomp per-filter overhead (last 2 diff): 17 ns > Estimated seccomp per-filter overhead (filters / 4): 18 ns > Expectations: > native ≤ 1 bitmap (638 ≤ 664): ✔️ > native ≤ 1 filter (638 ≤ 720): ✔️ > per-filter (last 2 diff) ≈ per-filter (filters / 4) (17 ≈ 18): ✔️ > 1 bitmapped ≈ 2 bitmapped (26 ≈ 26): ✔️ > entry ≈ 1 bitmapped (26 ≈ 26): ✔️ > entry ≈ 2 bitmapped (26 ≈ 26): ✔️ > native + entry + (per filter * 4) ≈ 4 filters total (732 ≈ 737): ✔️ > > Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> > Signed-off-by: YiFei Zhu <yifeifz2@xxxxxxxxxxxx> BTW, did this benchmark tool's results match your expectations from what you saw with your RFC? (I assume it helped since you've included in here.) -- Kees Cook
