kvm: use private futexes.

Use private futexes for performance and to align with other runtime uses.

PiperOrigin-RevId: 219422634
Change-Id: Ief2af5e8302847ea6dc246e8d1ee4d64684ca9dd

pkg/sentry/platform/kvm/machine_unsafe.go

@@ -88,7 +88,7 @@ func (c *vCPU) notify() {
 	_, _, errno := syscall.RawSyscall6(
 		syscall.SYS_FUTEX,
 		uintptr(unsafe.Pointer(&c.state)),
-		linux.FUTEX_WAKE,
+		linux.FUTEX_WAKE|linux.FUTEX_PRIVATE_FLAG,
 		^uintptr(0), // Number of waiters.
 		0, 0, 0)
 	if errno != 0 {
@@ -106,7 +106,7 @@ func (c *vCPU) waitUntilNot(state uint32) {
 	_, _, errno := syscall.Syscall6(
 		syscall.SYS_FUTEX,
 		uintptr(unsafe.Pointer(&c.state)),
-		linux.FUTEX_WAIT,
+		linux.FUTEX_WAIT|linux.FUTEX_PRIVATE_FLAG,
 		uintptr(state),
 		0, 0, 0)
 	if errno != 0 && errno != syscall.EINTR && errno != syscall.EAGAIN {

runsc/boot/filter/config.go

@@ -438,7 +438,6 @@ func ptraceFilters() seccomp.SyscallRules {
 func kvmFilters() seccomp.SyscallRules {
 	return seccomp.SyscallRules{
 		syscall.SYS_ARCH_PRCTL:      {},
-		syscall.SYS_FUTEX:           {},
 		syscall.SYS_IOCTL:           {},
 		syscall.SYS_MMAP:            {},
 		syscall.SYS_RT_SIGSUSPEND:   {},