• Alexei Starovoitov's avatar
    seccomp: JIT compile seccomp filter · 8f577cad
    Alexei Starovoitov authored
    Take advantage of internal BPF JIT
    
    05-sim-long_jumps.c of libseccomp was used as micro-benchmark:
    
     seccomp_rule_add_exact(ctx,...
     seccomp_rule_add_exact(ctx,...
    
     rc = seccomp_load(ctx);
    
     for (i = 0; i < 10000000; i++)
        syscall(...);
    
    $ sudo sysctl net.core.bpf_jit_enable=1
    $ time ./bench
    real	0m2.769s
    user	0m1.136s
    sys	0m1.624s
    
    $ sudo sysctl net.core.bpf_jit_enable=0
    $ time ./bench
    real	0m5.825s
    user	0m1.268s
    sys	0m4.548s
    Signed-off-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    8f577cad
seccomp.c 13.6 KB