systrap: decrease priority of stub threads

We suppose that gvisor containers are running in a separate CPU cgroups,
so task priorities affect only tasks in one group.

Effectively, we increase priority of the sentry and gofers, because they
are doing functions of the kernel, so should have full controls over guest
processes. If the sentry runs with a higher priority, it can handle stub
thread events faster so it should reduce chances of triggering slow paths.

PiperOrigin-RevId: 528939329

pkg/sentry/platform/systrap/filters.go

@@ -72,6 +72,13 @@ func (p *Systrap) SyscallFilters() seccomp.SyscallRules {
 		},
 		unix.SYS_TGKILL: {},
 		unix.SYS_WAIT4:  {},
+		unix.SYS_SETPRIORITY: {
+			{
+				seccomp.EqualTo(unix.PRIO_PROCESS),
+				seccomp.MatchAny{},
+				seccomp.EqualTo(sysmsgThreadPriority),
+			},
+		},
 	}
 	r.Merge(p.archSyscallFilters())
 	return r

pkg/sentry/platform/systrap/subprocess.go

@@ -1005,6 +1005,17 @@ func (s *subprocess) getSysmsgThread(tregs *arch.Registers, c *context, ac *arch
 	return s.createSysmsgThread(tregs, c, ac)
 }
 
+var sysmsgThreadPriority int
+
+func initSysmsgThreadPriority() {
+	prio, err := unix.Getpriority(unix.PRIO_PROCESS, 0)
+	if err != nil {
+		panic("unable to get current scheduling priority")
+	}
+	// Sysmsg threads are executed with a priority one lower than the Sentry.
+	sysmsgThreadPriority = 20 - prio + 1
+}
+
 // createSysmsgThread creates a new sysmsg thread.
 // If contextDecouplingExp=false, the thread starts working on the given context.
 // Otherwise the given function parameters are not used, and the thread starts
@@ -1108,6 +1119,10 @@ func (s *subprocess) createSysmsgThread(tregs *arch.Registers, c *context, ac *a
 
 	sysThread.msg.State.Set(sysmsg.ThreadStateInitializing)
 
+	if err := unix.Setpriority(unix.PRIO_PROCESS, int(p.tid), sysmsgThreadPriority); err != nil {
+		log.Warningf("Unable to change priority of a stub thread: %s", err)
+	}
+
 	// Install a pre-compiled seccomp rules for the BPF process.
 	_, err = p.syscallIgnoreInterrupt(&p.initRegs, unix.SYS_PRCTL,
 		arch.SyscallArgument{Value: uintptr(linux.PR_SET_NO_NEW_PRIVS)},

pkg/sentry/platform/systrap/systrap.go

@@ -337,6 +337,8 @@ func New() (*Systrap, error) {
 		source.DecRef(nil)
 
 		globalPool.source = source
+
+		initSysmsgThreadPriority()
 	})
 
 	return &Systrap{memoryFile: mf}, nil