feat(client_lib): bundle a crypto_selftest microbench triggered by env var

Author: jkaczman

camera_hub/Cargo.lock

@@ -131,14 +131,21 @@ struct Args {
     flag_save_all: bool,
 }
 
-fn main() -> io::Result<()> {
+fn main() -> anyhow::Result<()> {
     let version = env!("CARGO_PKG_NAME").to_string() + ", version: " + env!("CARGO_PKG_VERSION");
     env_logger::init();
 
     // ring TLS backend (armv6/Pi Zero W) needs provider installed before any HTTPS request
     #[cfg(feature = "crypto-ring")]
     secluso_client_lib::http_client::install_crypto_provider();
 
+    // SECLUSO_CRYPTO_SELFTEST=1 RUST_LOG=info /usr/bin/secluso-camera-hub
+    // Runs MLS in hot loop on the otherwise idle process, then exits without starting the camera pipeline
+    if std::env::var_os("SECLUSO_CRYPTO_SELFTEST").is_some() {
+        secluso_client_lib::crypto_selftest::run()?;
+        return Ok(());
+    }
+
     let args: Args = Docopt::new(USAGE)
         .map(|d| d.help(true))
         .map(|d| d.version(Some(version)))

camera_hub/src/main.rs

@@ -24,6 +24,7 @@ openmls_libcrux_crypto = "=0.3.1"
 openmls_memory_storage = { version = "=0.5.0", features = ["persistence"] }
 openmls_basic_credential = "=0.5.0"
 bincode = "1.3.3"
+libc = "0.2"
 reqwest = { version = "0.13", default-features = false, features = ["blocking", "multipart"], optional = true }
 rustls = { version = "0.23", default-features = false, features = ["std", "tls12", "logging"], optional = true }
 base64 = { version = "0.22.1", optional = true }

client_lib/Cargo.toml

@@ -0,0 +1,131 @@
+//! SPDX-License-Identifier: GPL-3.0-or-later
+//!
+//! Startup diagnostic (microbench) for MLS on constrained hardware (right now, testing the Pi Zero W, ARMv6)
+//! Runs the exact crypto the camera hub uses in a tight hot loop in an (otherwise) idle process.
+//! Reports wall time, thread CPU time, throughput
+
+use crate::openmls_rust_persistent_crypto::OpenMlsRustPersistentCrypto;
+use anyhow::{anyhow, Context};
+use openmls::prelude::*;
+use openmls_basic_credential::SignatureKeyPair;
+use openmls_traits::crypto::OpenMlsCrypto;
+use openmls_traits::signatures::Signer;
+use openmls_traits::types::AeadType;
+use openmls_traits::OpenMlsProvider;
+use std::time::{Duration, Instant};
+
+// Matches mls_client::CIPHERSUITE
+const CIPHERSUITE: Ciphersuite = Ciphersuite::MLS_256_XWING_CHACHA20POLY1305_SHA256_Ed25519;
+const PAYLOAD_BYTES: usize = 64 * 1024;
+const ITERS: usize = 20;
+
+/// Thread CPU time consumed so far (not wall time).
+/// Get the on-core cost, excluding time the scheduler gave to other threads.
+pub fn thread_cpu_time() -> anyhow::Result<Duration> {
+    let mut ts = libc::timespec {
+        tv_sec: 0,
+        tv_nsec: 0,
+    };
+    let rc = unsafe { libc::clock_gettime(libc::CLOCK_THREAD_CPUTIME_ID, &raw mut ts) };
+    if rc != 0 {
+        return Ok(Duration::ZERO);
+    }
+    Ok(Duration::new(ts.tv_sec.cast_unsigned(), u32::try_from(ts.tv_nsec)?))
+}
+
+fn report(name: &str, wall: Duration, cpu: Duration, bytes: usize) -> anyhow::Result<()> {
+    let wall_ms = wall.as_secs_f64() * 1000.0f64 / f64::from(u32::try_from(ITERS)?);
+    let cpu_ms = cpu.as_secs_f64() * 1000.0f64 / f64::from(u32::try_from(ITERS)?);
+    let mb = f64::from(u32::try_from(bytes)?) / (1024.0f64 * 1024.0f64);
+    let mbps = mb / (wall_ms / 1000.0f64);
+    log::info!("{name} wall={wall_ms}ms  cpu={cpu_ms}ms  {mbps} MB/s");
+    Ok(())
+}
+
+/// Run the diagnostic at process startup if the caller passes the env var.
+pub fn run() -> anyhow::Result<()> {
+    log::info!("payload={} kb, iters={}", PAYLOAD_BYTES / 1024, ITERS);
+
+    let provider = OpenMlsRustPersistentCrypto::default();
+    let signer = SignatureKeyPair::new(CIPHERSUITE.signature_algorithm())?;
+    signer.store(provider.storage())?;
+    let credential = BasicCredential::new(b"secluso-selftest".to_vec());
+    let credential_with_key = CredentialWithKey {
+        credential: credential.into(),
+        signature_key: signer.to_public_vec().into(),
+    };
+    let group_config = MlsGroupCreateConfig::builder()
+        .ciphersuite(CIPHERSUITE)
+        .use_ratchet_tree_extension(true)
+        .build();
+    let mut group = MlsGroup::new(&provider, &signer, &group_config, credential_with_key)?;
+
+    let payload = vec![0xABu8; PAYLOAD_BYTES];
+
+    // Raw ChaCha20Poly1305 seal
+    {
+        let key = vec![0u8; 32];
+        let nonce = vec![0u8; 12];
+        let aad = b"secluso-selftest";
+        let _ =
+            provider
+                .crypto()
+                .aead_encrypt(AeadType::ChaCha20Poly1305, &key, &payload, &nonce, aad);
+        let w = Instant::now();
+        let c = thread_cpu_time()?;
+        for _ in 0..ITERS {
+            let _ct = provider.crypto().aead_encrypt(
+                AeadType::ChaCha20Poly1305,
+                &key,
+                &payload,
+                &nonce,
+                aad,
+            )?;
+        }
+        report(
+            "aead_seal",
+            w.elapsed(),
+            thread_cpu_time()?.checked_sub(c).context("failed to subtract s from thread cpu time")?,
+            PAYLOAD_BYTES,
+        )?;
+    }
+
+    // Ed25519 signature over the full payload
+    {
+        let _ = signer.sign(&payload);
+        let w = Instant::now();
+        let c = thread_cpu_time()?;
+        for _ in 0..ITERS {
+            // SignerError does not have StdError trait
+            if let Err(e) = signer.sign(&payload) {
+                println!("{e:?}");
+                return Err(anyhow!("Signer error."));
+            }
+        }
+        report(
+            "ed25519_sign",
+            w.elapsed(),
+            thread_cpu_time()?.checked_sub(c).context("failed to subtract s from thread cpu time")?,
+            PAYLOAD_BYTES,
+        )?;
+    }
+
+    // MlsGroup::create_message
+    {
+        let _ = group.create_message(&provider, &signer, &payload);
+        let w = Instant::now();
+        let c = thread_cpu_time()?;
+        for _ in 0..ITERS {
+            let _m = group.create_message(&provider, &signer, &payload)?;
+        }
+        report(
+            "create_message",
+            w.elapsed(),
+            thread_cpu_time()?.checked_sub(c).context("failed to subtract s from thread cpu time")?,
+            PAYLOAD_BYTES,
+        )?;
+    }
+
+    log::info!("done");
+    Ok(())
+}

client_lib/src/crypto_selftest.rs

@@ -1,6 +1,7 @@
 //! SPDX-License-Identifier: GPL-3.0-or-later
 
 pub mod config;
+pub mod crypto_selftest;
 pub mod identity;
 pub mod mls_client;
 pub mod mls_clients;

client_lib/src/lib.rs

@@ -7,6 +7,7 @@
 
 use super::identity::Identity;
 use super::openmls_rust_persistent_crypto::OpenMlsRustPersistentCrypto;
+use crate::crypto_selftest::thread_cpu_time;
 use openmls_traits::{storage::StorageProvider as StorageProviderTrait};
 use crate::pairing;
 use openmls::prelude::*;
@@ -853,13 +854,16 @@ impl MlsClient {
         group.mls_group.set_aad(group_aad.as_bytes().to_vec());
 
         let create_start = Instant::now();
+        let create_cpu_start = thread_cpu_time().expect("thread cpu time failed");
         let message_out = group
             .mls_group
             .create_message(&self.provider, &self.identity.signer, bytes)
             .map_err(|e| io::Error::other(format!("{e}")))?;
+        let create_cpu_end = thread_cpu_time().expect("thread cpu time failed");
         log::debug!(
-            "encrypt: create_message took {}ms for {} input bytes",
+            "encrypt: create_message took {}ms wall / {}ms cpu for {} input bytes",
             create_start.elapsed().as_millis(),
+            (create_cpu_end - create_cpu_start).as_millis(),
             bytes.len()
         );