1 /* 2 * Strictly speaking, this is not a test. But it can report during test 3 * runs so relative performace can be measured. 4 */ 5 #define _GNU_SOURCE 6 #include <assert.h> 7 #include <limits.h> 8 #include <stdbool.h> 9 #include <stddef.h> 10 #include <stdio.h> 11 #include <stdlib.h> 12 #include <time.h> 13 #include <unistd.h> 14 #include <linux/filter.h> 15 #include <linux/seccomp.h> 16 #include <sys/param.h> 17 #include <sys/prctl.h> 18 #include <sys/syscall.h> 19 #include <sys/types.h> 20 21 #define ARRAY_SIZE(a) (sizeof(a) / sizeof(a[0])) 22 23 unsigned long long timing(clockid_t clk_id, unsigned long long samples) 24 { 25 struct timespec start, finish; 26 unsigned long long i; 27 pid_t pid, ret; 28 29 pid = getpid(); 30 assert(clock_gettime(clk_id, &start) == 0); 31 for (i = 0; i < samples; i++) { 32 ret = syscall(__NR_getpid); 33 assert(pid == ret); 34 } 35 assert(clock_gettime(clk_id, &finish) == 0); 36 37 i = finish.tv_sec - start.tv_sec; 38 i *= 1000000000ULL; 39 i += finish.tv_nsec - start.tv_nsec; 40 41 printf("%lu.%09lu - %lu.%09lu = %llu (%.1fs)\n", 42 finish.tv_sec, finish.tv_nsec, 43 start.tv_sec, start.tv_nsec, 44 i, (double)i / 1000000000.0); 45 46 return i; 47 } 48 49 unsigned long long calibrate(void) 50 { 51 struct timespec start, finish; 52 unsigned long long i, samples, step = 9973; 53 pid_t pid, ret; 54 int seconds = 15; 55 56 printf("Calibrating sample size for %d seconds worth of syscalls ...\n", seconds); 57 58 samples = 0; 59 pid = getpid(); 60 assert(clock_gettime(CLOCK_MONOTONIC, &start) == 0); 61 do { 62 for (i = 0; i < step; i++) { 63 ret = syscall(__NR_getpid); 64 assert(pid == ret); 65 } 66 assert(clock_gettime(CLOCK_MONOTONIC, &finish) == 0); 67 68 samples += step; 69 i = finish.tv_sec - start.tv_sec; 70 i *= 1000000000ULL; 71 i += finish.tv_nsec - start.tv_nsec; 72 } while (i < 1000000000ULL); 73 74 return samples * seconds; 75 } 76 77 bool approx(int i_one, int i_two) 78 { 79 double one = i_one, one_bump = one * 0.01; 80 double two = i_two, two_bump = two * 0.01; 81 82 one_bump = one + MAX(one_bump, 2.0); 83 two_bump = two + MAX(two_bump, 2.0); 84 85 /* Equal to, or within 1% or 2 digits */ 86 if (one == two || 87 (one > two && one <= two_bump) || 88 (two > one && two <= one_bump)) 89 return true; 90 return false; 91 } 92 93 bool le(int i_one, int i_two) 94 { 95 if (i_one <= i_two) 96 return true; 97 return false; 98 } 99 100 long compare(const char *name_one, const char *name_eval, const char *name_two, 101 unsigned long long one, bool (*eval)(int, int), unsigned long long two) 102 { 103 bool good; 104 105 printf("\t%s %s %s (%lld %s %lld): ", name_one, name_eval, name_two, 106 (long long)one, name_eval, (long long)two); 107 if (one > INT_MAX) { 108 printf("Miscalculation! Measurement went negative: %lld\n", (long long)one); 109 return 1; 110 } 111 if (two > INT_MAX) { 112 printf("Miscalculation! Measurement went negative: %lld\n", (long long)two); 113 return 1; 114 } 115 116 good = eval(one, two); 117 printf("%s\n", good ? "✔️" : "❌"); 118 119 return good ? 0 : 1; 120 } 121 122 int main(int argc, char *argv[]) 123 { 124 struct sock_filter bitmap_filter[] = { 125 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, offsetof(struct seccomp_data, nr)), 126 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 127 }; 128 struct sock_fprog bitmap_prog = { 129 .len = (unsigned short)ARRAY_SIZE(bitmap_filter), 130 .filter = bitmap_filter, 131 }; 132 struct sock_filter filter[] = { 133 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, offsetof(struct seccomp_data, args[0])), 134 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), 135 }; 136 struct sock_fprog prog = { 137 .len = (unsigned short)ARRAY_SIZE(filter), 138 .filter = filter, 139 }; 140 141 long ret, bits; 142 unsigned long long samples, calc; 143 unsigned long long native, filter1, filter2, bitmap1, bitmap2; 144 unsigned long long entry, per_filter1, per_filter2; 145 146 printf("Current BPF sysctl settings:\n"); 147 system("sysctl net.core.bpf_jit_enable"); 148 system("sysctl net.core.bpf_jit_harden"); 149 150 if (argc > 1) 151 samples = strtoull(argv[1], NULL, 0); 152 else 153 samples = calibrate(); 154 155 printf("Benchmarking %llu syscalls...\n", samples); 156 157 /* Native call */ 158 native = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; 159 printf("getpid native: %llu ns\n", native); 160 161 ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); 162 assert(ret == 0); 163 164 /* One filter resulting in a bitmap */ 165 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog); 166 assert(ret == 0); 167 168 bitmap1 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; 169 printf("getpid RET_ALLOW 1 filter (bitmap): %llu ns\n", bitmap1); 170 171 /* Second filter resulting in a bitmap */ 172 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog); 173 assert(ret == 0); 174 175 bitmap2 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; 176 printf("getpid RET_ALLOW 2 filters (bitmap): %llu ns\n", bitmap2); 177 178 /* Third filter, can no longer be converted to bitmap */ 179 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); 180 assert(ret == 0); 181 182 filter1 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; 183 printf("getpid RET_ALLOW 3 filters (full): %llu ns\n", filter1); 184 185 /* Fourth filter, can not be converted to bitmap because of filter 3 */ 186 ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &bitmap_prog); 187 assert(ret == 0); 188 189 filter2 = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples; 190 printf("getpid RET_ALLOW 4 filters (full): %llu ns\n", filter2); 191 192 /* Estimations */ 193 #define ESTIMATE(fmt, var, what) do { \ 194 var = (what); \ 195 printf("Estimated " fmt ": %llu ns\n", var); \ 196 if (var > INT_MAX) \ 197 goto more_samples; \ 198 } while (0) 199 200 ESTIMATE("total seccomp overhead for 1 bitmapped filter", calc, 201 bitmap1 - native); 202 ESTIMATE("total seccomp overhead for 2 bitmapped filters", calc, 203 bitmap2 - native); 204 ESTIMATE("total seccomp overhead for 3 full filters", calc, 205 filter1 - native); 206 ESTIMATE("total seccomp overhead for 4 full filters", calc, 207 filter2 - native); 208 ESTIMATE("seccomp entry overhead", entry, 209 bitmap1 - native - (bitmap2 - bitmap1)); 210 ESTIMATE("seccomp per-filter overhead (last 2 diff)", per_filter1, 211 filter2 - filter1); 212 ESTIMATE("seccomp per-filter overhead (filters / 4)", per_filter2, 213 (filter2 - native - entry) / 4); 214 215 printf("Expectations:\n"); 216 ret |= compare("native", "≤", "1 bitmap", native, le, bitmap1); 217 bits = compare("native", "≤", "1 filter", native, le, filter1); 218 if (bits) 219 goto more_samples; 220 221 ret |= compare("per-filter (last 2 diff)", "≈", "per-filter (filters / 4)", 222 per_filter1, approx, per_filter2); 223 224 bits = compare("1 bitmapped", "≈", "2 bitmapped", 225 bitmap1 - native, approx, bitmap2 - native); 226 if (bits) { 227 printf("Skipping constant action bitmap expectations: they appear unsupported.\n"); 228 goto out; 229 } 230 231 ret |= compare("entry", "≈", "1 bitmapped", entry, approx, bitmap1 - native); 232 ret |= compare("entry", "≈", "2 bitmapped", entry, approx, bitmap2 - native); 233 ret |= compare("native + entry + (per filter * 4)", "≈", "4 filters total", 234 entry + (per_filter1 * 4) + native, approx, filter2); 235 if (ret == 0) 236 goto out; 237 238 more_samples: 239 printf("Saw unexpected benchmark result. Try running again with more samples?\n"); 240 out: 241 return 0; 242 } 243