seccomp blog post: Account for further BST optimization.

The BST structure was further optimized in
https://github.com/google/gvisor/commit/1e61310ce61e1c3d9272fbdbccd9d02dd27388f9

PiperOrigin-RevId: 604503481
This commit is contained in:
Etienne Perot
2024-02-05 19:18:32 -08:00
committed by gVisor bot
parent 10498cb8d4
commit 59b41a150e
+15 -13
View File
@@ -367,20 +367,22 @@ traversal.
Consider this structure instead:
```javascript
if syscall number < current node value
jump @left_node
if syscall_number > current node value
jump @right_node
jump @rules_for_this_syscall
// Traversal code:
if syscall number < current node value
jump @left_node
if syscall_number > current node value
jump @right_node
jump @rules_for_this_syscall
@left_node:
// Recursively render only the traversal code for the left node here
@right_node:
// Recursively render only the traversal code for the right node here
@left_node:
// Recursively render the bytecode for the left node value here...
@right_node:
// Recursively render the bytecode for the right node value here...
@rules_for_this_syscall:
// Render bytecode for this syscall's filters here...
// Filtering code:
@rules_for_this_syscall:
// Render bytecode for this syscall's filters here
// Recursively render only the filtering code for the left node here
// Recursively render only the filtering code for the right node here
```
This effectively separates the per-syscall rules from the traversal of the BST.