diff --git a/pkg/sentry/platform/kvm/filters_amd64.go b/pkg/sentry/platform/kvm/filters_amd64.go index 2bcdde655..2ff3d6ea3 100644 --- a/pkg/sentry/platform/kvm/filters_amd64.go +++ b/pkg/sentry/platform/kvm/filters_amd64.go @@ -49,3 +49,12 @@ func (k *KVM) archSyscallFilters() seccomp.SyscallRules { }, }) } + +// HottestSyscalls implements Platform.HottestSyscalls. +func (*KVM) HottestSyscalls() []uintptr { + return []uintptr{ + unix.SYS_FUTEX, + unix.SYS_IOCTL, + unix.SYS_RT_SIGRETURN, + } +} diff --git a/pkg/sentry/platform/kvm/filters_arm64.go b/pkg/sentry/platform/kvm/filters_arm64.go index 20884f2dc..2fa875446 100644 --- a/pkg/sentry/platform/kvm/filters_arm64.go +++ b/pkg/sentry/platform/kvm/filters_arm64.go @@ -33,3 +33,8 @@ func (*KVM) archSyscallFilters() seccomp.SyscallRules { }, }) } + +// HottestSyscalls implements Platform.HottestSyscalls. +func (*KVM) HottestSyscalls() []uintptr { + return nil +} diff --git a/pkg/sentry/platform/kvm/kvm.go b/pkg/sentry/platform/kvm/kvm.go index e1d0218e9..d7dec72b1 100644 --- a/pkg/sentry/platform/kvm/kvm.go +++ b/pkg/sentry/platform/kvm/kvm.go @@ -69,8 +69,6 @@ type KVM struct { platform.DoesOwnPageTables - platform.HottestSyscallsNotSpecified - // machine is the backing VM. machine *machine } diff --git a/pkg/sentry/platform/systrap/filters_amd64.go b/pkg/sentry/platform/systrap/filters_amd64.go index 5a8366439..90a72aa9f 100644 --- a/pkg/sentry/platform/systrap/filters_amd64.go +++ b/pkg/sentry/platform/systrap/filters_amd64.go @@ -18,6 +18,7 @@ package systrap import ( + "golang.org/x/sys/unix" "gvisor.dev/gvisor/pkg/seccomp" ) @@ -25,3 +26,11 @@ import ( func (*Systrap) archSyscallFilters() seccomp.SyscallRules { return seccomp.SyscallRules{} } + +// HottestSyscalls implements Platform.HottestSyscalls. +func (*Systrap) HottestSyscalls() []uintptr { + return []uintptr{ + unix.SYS_FUTEX, + unix.SYS_NANOSLEEP, + } +} diff --git a/pkg/sentry/platform/systrap/filters_arm64.go b/pkg/sentry/platform/systrap/filters_arm64.go index a379d0fcb..64c80aa3f 100644 --- a/pkg/sentry/platform/systrap/filters_arm64.go +++ b/pkg/sentry/platform/systrap/filters_arm64.go @@ -40,3 +40,8 @@ func (*Systrap) archSyscallFilters() seccomp.SyscallRules { }, }) } + +// HottestSyscalls implements Platform.HottestSyscalls. +func (*Systrap) HottestSyscalls() []uintptr { + return nil +} diff --git a/pkg/sentry/platform/systrap/systrap.go b/pkg/sentry/platform/systrap/systrap.go index f1217602d..e5869845c 100644 --- a/pkg/sentry/platform/systrap/systrap.go +++ b/pkg/sentry/platform/systrap/systrap.go @@ -301,7 +301,6 @@ type Systrap struct { platform.NoCPUPreemptionDetection platform.UseHostGlobalMemoryBarrier platform.DoesNotOwnPageTables - platform.HottestSyscallsNotSpecified // memoryFile is used to create a stub sysmsg stack // which is shared with the Sentry. diff --git a/runsc/boot/filter/config_amd64.go b/runsc/boot/filter/config_amd64.go index 447542ec1..963da5552 100644 --- a/runsc/boot/filter/config_amd64.go +++ b/runsc/boot/filter/config_amd64.go @@ -46,5 +46,11 @@ func archFstatAtSysNo() uintptr { } func archSpecificHotSyscalls() []uintptr { - return nil // TODO(b/298726675): Populate. + return []uintptr{ + unix.SYS_NANOSLEEP, // Used a bunch + unix.SYS_SENDMMSG, // Used by network workloads + unix.SYS_FSTAT, // Used for file I/O + unix.SYS_PPOLL, // Used in general for I/O + unix.SYS_EPOLL_WAIT, // Same + } }