RE: [PATCH 3/6] seccomp: Implement constant action bitmaps

From: Jann Horn

Sent: 24 September 2020 13:29

...

I think our goal here should be that if a syscall is always allowed,
seccomp should execute the smallest amount of instructions we can get
away with, and touch the smallest amount of memory possible (and
preferably that memory should be shared between threads). The bitmap
fastpath should probably also avoid populate_seccomp_data().

If most syscalls are expected to be allowed then an initial:
	if (global_mask & (1u << (syscall_number & 63))
test can be used to skip any further lookups.

Although ISTR someone suggesting that the global_mask should
be per-cpu because even shared read-only cache lines were
expensive on some architecture.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)