commit acadd09c66e1e5966ac771cb338f1ad660aed4c0
author Bram Bonné <brambonne@google.com> Wed May 06 13:49:55 2020 +0200
committer Bram Bonné <brambonne@google.com> Mon May 18 11:20:30 2020 +0200
tree bc11de4fe811b802c698f972cb1eb16ac09ddd0c
parent 57a1c3908ff5a2e427f5d45992d0b463fd71b87a

Speed up seccomp with priority list.

Allow to provide a list of prioritized syscalls (e.g., syscalls that we
know occur often) which are checked before other syscalls in seccomp.

When constructing the bpf seccomp filter, traverse prioritized syscalls
in a linear list before checking all other syscalls in a binary tree.

Bug: 156732794
Test: make, inspect generated *_system_policy.cpp files
Test: simpleperf on futex/ioctl-heavy app seems to show 5-10% less time
spent in seccomp call

Change-Id: I509343bcd32ada90c0591785ab5cb12d2a38c31e
(cherry picked from commit ce84677733c18bc442f7f1b2f1840117c904db70)

libc/Android.bp

diff --git a/libc/Android.bp b/libc/Android.bp
index 31767ef..ff3b3b1 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -2387,6 +2387,7 @@
         "SECCOMP_WHITELIST_COMMON.TXT",
         "SECCOMP_WHITELIST_APP.TXT",
         "SECCOMP_BLACKLIST_COMMON.TXT",
+        "SECCOMP_PRIORITY.TXT",
         ":generate_app_zygote_blacklist",
         ":libseccomp_gen_syscall_nrs_arm",
         ":libseccomp_gen_syscall_nrs_arm64",
@@ -2415,6 +2416,7 @@
         "SECCOMP_WHITELIST_APP.TXT",
         "SECCOMP_BLACKLIST_COMMON.TXT",
         "SECCOMP_BLACKLIST_APP.TXT",
+        "SECCOMP_PRIORITY.TXT",
         ":libseccomp_gen_syscall_nrs_arm",
         ":libseccomp_gen_syscall_nrs_arm64",
         ":libseccomp_gen_syscall_nrs_x86",
@@ -2441,6 +2443,7 @@
         "SECCOMP_WHITELIST_COMMON.TXT",
         "SECCOMP_WHITELIST_SYSTEM.TXT",
         "SECCOMP_BLACKLIST_COMMON.TXT",
+        "SECCOMP_PRIORITY.TXT",
         ":libseccomp_gen_syscall_nrs_arm",
         ":libseccomp_gen_syscall_nrs_arm64",
         ":libseccomp_gen_syscall_nrs_x86",