linux-kernel - Re: [PATCH v2 seccomp 5/6] selftests/seccomp: Compare bitmap vs filter overhead

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202009241646.5739BE3@keescook>
Date:   Thu, 24 Sep 2020 16:47:41 -0700
From:   Kees Cook <keescook@...omium.org>
To:     YiFei Zhu <zhuyifei1999@...il.com>
Cc:     containers@...ts.linux-foundation.org,
        YiFei Zhu <yifeifz2@...inois.edu>, bpf@...r.kernel.org,
        linux-kernel@...r.kernel.org, Aleksa Sarai <cyphar@...har.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        Andy Lutomirski <luto@...capital.net>,
        Dimitrios Skarlatos <dskarlat@...cmu.edu>,
        Giuseppe Scrivano <gscrivan@...hat.com>,
        Hubertus Franke <frankeh@...ibm.com>,
        Jack Chen <jianyan2@...inois.edu>,
        Jann Horn <jannh@...gle.com>,
        Josep Torrellas <torrella@...inois.edu>,
        Tianyin Xu <tyxu@...inois.edu>,
        Tobin Feldman-Fitzthum <tobin@....com>,
        Tycho Andersen <tycho@...ho.pizza>,
        Valentin Rothberg <vrothber@...hat.com>,
        Will Drewry <wad@...omium.org>
Subject: Re: [PATCH v2 seccomp 5/6] selftests/seccomp: Compare bitmap vs
 filter overhead

On Thu, Sep 24, 2020 at 07:44:20AM -0500, YiFei Zhu wrote:
> From: Kees Cook <keescook@...omium.org>
> 
> As part of the seccomp benchmarking, include the expectations with
> regard to the timing behavior of the constant action bitmaps, and report
> inconsistencies better.
> 
> Example output with constant action bitmaps on x86:
> 
> $ sudo ./seccomp_benchmark 100000000
> Current BPF sysctl settings:
> net.core.bpf_jit_enable = 1
> net.core.bpf_jit_harden = 0
> Benchmarking 100000000 syscalls...
> 63.896255358 - 0.008504529 = 63887750829 (63.9s)
> getpid native: 638 ns
> 130.383312423 - 63.897315189 = 66485997234 (66.5s)
> getpid RET_ALLOW 1 filter (bitmap): 664 ns
> 196.789080421 - 130.384414983 = 66404665438 (66.4s)
> getpid RET_ALLOW 2 filters (bitmap): 664 ns
> 268.844643304 - 196.790234168 = 72054409136 (72.1s)
> getpid RET_ALLOW 3 filters (full): 720 ns
> 342.627472515 - 268.845799103 = 73781673412 (73.8s)
> getpid RET_ALLOW 4 filters (full): 737 ns
> Estimated total seccomp overhead for 1 bitmapped filter: 26 ns
> Estimated total seccomp overhead for 2 bitmapped filters: 26 ns
> Estimated total seccomp overhead for 3 full filters: 82 ns
> Estimated total seccomp overhead for 4 full filters: 99 ns
> Estimated seccomp entry overhead: 26 ns
> Estimated seccomp per-filter overhead (last 2 diff): 17 ns
> Estimated seccomp per-filter overhead (filters / 4): 18 ns
> Expectations:
> 	native ≤ 1 bitmap (638 ≤ 664): ✔️
> 	native ≤ 1 filter (638 ≤ 720): ✔️
> 	per-filter (last 2 diff) ≈ per-filter (filters / 4) (17 ≈ 18): ✔️
> 	1 bitmapped ≈ 2 bitmapped (26 ≈ 26): ✔️
> 	entry ≈ 1 bitmapped (26 ≈ 26): ✔️
> 	entry ≈ 2 bitmapped (26 ≈ 26): ✔️
> 	native + entry + (per filter * 4) ≈ 4 filters total (732 ≈ 737): ✔️
> 
> Signed-off-by: Kees Cook <keescook@...omium.org>
> Signed-off-by: YiFei Zhu <yifeifz2@...inois.edu>

BTW, did this benchmark tool's results match your expectations from what
you saw with your RFC? (I assume it helped since you've included in
here.)

-- 
Kees Cook