From 59b41a150e8249a4ae77dbde126a2ca9100d0a29 Mon Sep 17 00:00:00 2001
From: Etienne Perot <eperot@google.com>
Date: Mon, 5 Feb 2024 19:16:19 -0800
Subject: [PATCH] `seccomp` blog post: Account for further BST optimization.

The BST structure was further optimized in
https://github.com/google/gvisor/commit/1e61310ce61e1c3d9272fbdbccd9d02dd27388f9

PiperOrigin-RevId: 604503481
---
 website/blog/2024-02-01-seccomp.md | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/website/blog/2024-02-01-seccomp.md b/website/blog/2024-02-01-seccomp.md
index 6c0bd824a..c8d164e53 100644
--- a/website/blog/2024-02-01-seccomp.md
+++ b/website/blog/2024-02-01-seccomp.md
@@ -367,20 +367,22 @@ traversal.
 Consider this structure instead:
 
 ```javascript
-if syscall number < current node value
-    jump @left_node
-if syscall_number > current node value
-    jump @right_node
-jump @rules_for_this_syscall
+// Traversal code:
+  if syscall number < current node value
+      jump @left_node
+  if syscall_number > current node value
+      jump @right_node
+  jump @rules_for_this_syscall
+  @left_node:
+    // Recursively render only the traversal code for the left node here
+  @right_node:
+    // Recursively render only the traversal code for the right node here
 
-@left_node:
-  // Recursively render the bytecode for the left node value here...
-
-@right_node:
-  // Recursively render the bytecode for the right node value here...
-
-@rules_for_this_syscall:
-  // Render bytecode for this syscall's filters here...
+// Filtering code:
+  @rules_for_this_syscall:
+    // Render bytecode for this syscall's filters here
+  // Recursively render only the filtering code for the left node here
+  // Recursively render only the filtering code for the right node here
 ```
 
 This effectively separates the per-syscall rules from the traversal of the BST.