From: Jann Horn > Sent: 24 September 2020 13:29 ... > I think our goal here should be that if a syscall is always allowed, > seccomp should execute the smallest amount of instructions we can get > away with, and touch the smallest amount of memory possible (and > preferably that memory should be shared between threads). The bitmap > fastpath should probably also avoid populate_seccomp_data(). If most syscalls are expected to be allowed then an initial: if (global_mask & (1u << (syscall_number & 63)) test can be used to skip any further lookups. Although ISTR someone suggesting that the global_mask should be per-cpu because even shared read-only cache lines were expensive on some architecture. David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
