[PATCH v2 seccomp 5/6] selftests/seccomp: Compare bitmap vs filter overhead

[Kees Cook]

On Thu, Sep 24, 2020 at 07:44:20AM -0500, YiFei Zhu wrote:
> From: Kees Cook <keescook at chromium.org>
> 
> As part of the seccomp benchmarking, include the expectations with
> regard to the timing behavior of the constant action bitmaps, and report
> inconsistencies better.
> 
> Example output with constant action bitmaps on x86:
> 
> $ sudo ./seccomp_benchmark 100000000
> Current BPF sysctl settings:
> net.core.bpf_jit_enable = 1
> net.core.bpf_jit_harden = 0
> Benchmarking 100000000 syscalls...
> 63.896255358 - 0.008504529 = 63887750829 (63.9s)
> getpid native: 638 ns
> 130.383312423 - 63.897315189 = 66485997234 (66.5s)
> getpid RET_ALLOW 1 filter (bitmap): 664 ns
> 196.789080421 - 130.384414983 = 66404665438 (66.4s)
> getpid RET_ALLOW 2 filters (bitmap): 664 ns
> 268.844643304 - 196.790234168 = 72054409136 (72.1s)
> getpid RET_ALLOW 3 filters (full): 720 ns
> 342.627472515 - 268.845799103 = 73781673412 (73.8s)
> getpid RET_ALLOW 4 filters (full): 737 ns
> Estimated total seccomp overhead for 1 bitmapped filter: 26 ns
> Estimated total seccomp overhead for 2 bitmapped filters: 26 ns
> Estimated total seccomp overhead for 3 full filters: 82 ns
> Estimated total seccomp overhead for 4 full filters: 99 ns
> Estimated seccomp entry overhead: 26 ns
> Estimated seccomp per-filter overhead (last 2 diff): 17 ns
> Estimated seccomp per-filter overhead (filters / 4): 18 ns
> Expectations:
> 	native ≤ 1 bitmap (638 ≤ 664): ✔️
> 	native ≤ 1 filter (638 ≤ 720): ✔️
> 	per-filter (last 2 diff) ≈ per-filter (filters / 4) (17 ≈ 18): ✔️
> 	1 bitmapped ≈ 2 bitmapped (26 ≈ 26): ✔️
> 	entry ≈ 1 bitmapped (26 ≈ 26): ✔️
> 	entry ≈ 2 bitmapped (26 ≈ 26): ✔️
> 	native + entry + (per filter * 4) ≈ 4 filters total (732 ≈ 737): ✔️
> 
> Signed-off-by: Kees Cook <keescook at chromium.org>
> Signed-off-by: YiFei Zhu <yifeifz2 at illinois.edu>

BTW, did this benchmark tool's results match your expectations from what
you saw with your RFC? (I assume it helped since you've included in
here.)

-- 
Kees Cook