selftests/seccomp: Add simple seccomp overhead benchmark

This attempts to produce a comparison between native getpid() and a
RET_ALLOW-filtered getpid(), to measure the overhead cost of using
seccomp().

Signed-off-by: Kees Cook <keescook@chromium.org>

diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile
index aeb0c805f3ca0f9471ae0f211e5633aa9d7a52f8..553d870b4ca983252a19dbe3a52ddb23e492a06a 100644 (file)
--- a/tools/testing/selftests/seccomp/Makefile
+++ b/tools/testing/selftests/seccomp/Makefile
@@ -1,8 +1,16 @@
-TEST_GEN_PROGS := seccomp_bpf
-CFLAGS += -Wl,-no-as-needed -Wall
-LDFLAGS += -lpthread
+all:
 
 include ../lib.mk
 
-$(TEST_GEN_PROGS): seccomp_bpf.c ../kselftest_harness.h
-       $(CC) $(CFLAGS) $(LDFLAGS) $< -o $@
+.PHONY: all clean
+
+BINARIES := seccomp_bpf seccomp_benchmark
+CFLAGS += -Wl,-no-as-needed -Wall
+
+seccomp_bpf: seccomp_bpf.c ../kselftest_harness.h
+       $(CC) $(CFLAGS) $(LDFLAGS) -lpthread $< -o $@
+
+TEST_PROGS += $(BINARIES)
+EXTRA_CLEAN := $(BINARIES)
+
+all: $(BINARIES)

diff --git a/tools/testing/selftests/seccomp/seccomp_benchmark.c b/tools/testing/selftests/seccomp/seccomp_benchmark.c
new file mode 100644 (file)
index 0000000..5838c86
--- /dev/null
+++ b/tools/testing/selftests/seccomp/seccomp_benchmark.c
@@ -0,0 +1,99 @@
+/*
+ * Strictly speaking, this is not a test. But it can report during test
+ * runs so relative performace can be measured.
+ */
+#define _GNU_SOURCE
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <unistd.h>
+#include <linux/filter.h>
+#include <linux/seccomp.h>
+#include <sys/prctl.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+
+#define ARRAY_SIZE(a)    (sizeof(a) / sizeof(a[0]))
+
+unsigned long long timing(clockid_t clk_id, unsigned long long samples)
+{
+       pid_t pid, ret;
+       unsigned long long i;
+       struct timespec start, finish;
+
+       pid = getpid();
+       assert(clock_gettime(clk_id, &start) == 0);
+       for (i = 0; i < samples; i++) {
+               ret = syscall(__NR_getpid);
+               assert(pid == ret);
+       }
+       assert(clock_gettime(clk_id, &finish) == 0);
+
+       i = finish.tv_sec - start.tv_sec;
+       i *= 1000000000;
+       i += finish.tv_nsec - start.tv_nsec;
+
+       printf("%lu.%09lu - %lu.%09lu = %llu\n",
+               finish.tv_sec, finish.tv_nsec,
+               start.tv_sec, start.tv_nsec,
+               i);
+
+       return i;
+}
+
+unsigned long long calibrate(void)
+{
+       unsigned long long i;
+
+       printf("Calibrating reasonable sample size...\n");
+
+       for (i = 5; ; i++) {
+               unsigned long long samples = 1 << i;
+
+               /* Find something that takes more than 5 seconds to run. */
+               if (timing(CLOCK_REALTIME, samples) / 1000000000ULL > 5)
+                       return samples;
+       }
+}
+
+int main(int argc, char *argv[])
+{
+       struct sock_filter filter[] = {
+               BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
+       };
+       struct sock_fprog prog = {
+               .len = (unsigned short)ARRAY_SIZE(filter),
+               .filter = filter,
+       };
+       long ret;
+       unsigned long long samples;
+       unsigned long long native, filtered;
+
+       if (argc > 1)
+               samples = strtoull(argv[1], NULL, 0);
+       else
+               samples = calibrate();
+
+       printf("Benchmarking %llu samples...\n", samples);
+
+       native = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
+       printf("getpid native: %llu ns\n", native);
+
+       ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+       assert(ret == 0);
+
+       ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
+       assert(ret == 0);
+
+       filtered = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
+       printf("getpid RET_ALLOW: %llu ns\n", filtered);
+
+       printf("Estimated seccomp overhead per syscall: %llu ns\n",
+               filtered - native);
+
+       if (filtered == native)
+               printf("Trying running again with more samples.\n");
+
+       return 0;
+}