Re: [linus:master] [x86/bugs] a3af84b0fa: stress-ng.seccomp.ops_per_sec 95.7% regression

[Pawan Gupta]

On Wed, Aug 19, 2026 at 08:26:53AM -0700, Dave Hansen wrote:
> On 8/18/26 23:20, kernel test robot wrote:
> > kernel test robot noticed a 95.7% regression of stress-ng.seccomp.ops_per_sec on:
> 
> One one level this is a "vulnerability mitigations cause performance
> loss, news at 11" kind of thing. Like, Duh!
> 
> The microbenchmark here does seem to be a pretty worse-case scenario
> where it sits in a loop loading and running a seccomp filter program. In
> other words, it's just about as pathological of a test as you can have.
> 
> I think Pawan had some more ideas about ways to optimize this. Is there
> any appetite for that? Or is the test just too synthetic to worry about?

One of the optimization is to do fine-grained tracking, i.e. track reuse
per-chunk instead of per-pack. This requires an additional bitmap per-pack.

Another option is to track the CPUs where the cBPF program ran, and only
send IPIs to those CPUs. This mainly reduces the overhead on workloads on
other CPUs, not necessarily the workload allocating programs. Seems more
relevant on servers with many CPUs.

Not sure if these are worth the effort yet, given that I am not aware of a
real-world workload with a significant impact.