From f1f3900c6324b152cbec88cbd1489ee91370692c Mon Sep 17 00:00:00 2001
From: Andrei Vagin <avagin@google.com>
Date: Tue, 2 May 2023 18:02:28 -0700
Subject: [PATCH] systrap: decrease priority of stub threads

We suppose that gvisor containers are running in a separate CPU cgroups,
so task priorities affect only tasks in one group.

Effectively, we increase priority of the sentry and gofers, because they
are doing functions of the kernel, so should have full controls over guest
processes. If the sentry runs with a higher priority, it can handle stub
thread events faster so it should reduce chances of triggering slow paths.

PiperOrigin-RevId: 528939329
---
 pkg/sentry/platform/systrap/filters.go    |  7 +++++++
 pkg/sentry/platform/systrap/subprocess.go | 15 +++++++++++++++
 pkg/sentry/platform/systrap/systrap.go    |  2 ++
 3 files changed, 24 insertions(+)

diff --git a/pkg/sentry/platform/systrap/filters.go b/pkg/sentry/platform/systrap/filters.go
index 0b3c620bc..fc8222cfb 100644
--- a/pkg/sentry/platform/systrap/filters.go
+++ b/pkg/sentry/platform/systrap/filters.go
@@ -72,6 +72,13 @@ func (p *Systrap) SyscallFilters() seccomp.SyscallRules {
 		},
 		unix.SYS_TGKILL: {},
 		unix.SYS_WAIT4:  {},
+		unix.SYS_SETPRIORITY: {
+			{
+				seccomp.EqualTo(unix.PRIO_PROCESS),
+				seccomp.MatchAny{},
+				seccomp.EqualTo(sysmsgThreadPriority),
+			},
+		},
 	}
 	r.Merge(p.archSyscallFilters())
 	return r
diff --git a/pkg/sentry/platform/systrap/subprocess.go b/pkg/sentry/platform/systrap/subprocess.go
index 8fdc5021c..439ca3649 100644
--- a/pkg/sentry/platform/systrap/subprocess.go
+++ b/pkg/sentry/platform/systrap/subprocess.go
@@ -1005,6 +1005,17 @@ func (s *subprocess) getSysmsgThread(tregs *arch.Registers, c *context, ac *arch
 	return s.createSysmsgThread(tregs, c, ac)
 }
 
+var sysmsgThreadPriority int
+
+func initSysmsgThreadPriority() {
+	prio, err := unix.Getpriority(unix.PRIO_PROCESS, 0)
+	if err != nil {
+		panic("unable to get current scheduling priority")
+	}
+	// Sysmsg threads are executed with a priority one lower than the Sentry.
+	sysmsgThreadPriority = 20 - prio + 1
+}
+
 // createSysmsgThread creates a new sysmsg thread.
 // If contextDecouplingExp=false, the thread starts working on the given context.
 // Otherwise the given function parameters are not used, and the thread starts
@@ -1108,6 +1119,10 @@ func (s *subprocess) createSysmsgThread(tregs *arch.Registers, c *context, ac *a
 
 	sysThread.msg.State.Set(sysmsg.ThreadStateInitializing)
 
+	if err := unix.Setpriority(unix.PRIO_PROCESS, int(p.tid), sysmsgThreadPriority); err != nil {
+		log.Warningf("Unable to change priority of a stub thread: %s", err)
+	}
+
 	// Install a pre-compiled seccomp rules for the BPF process.
 	_, err = p.syscallIgnoreInterrupt(&p.initRegs, unix.SYS_PRCTL,
 		arch.SyscallArgument{Value: uintptr(linux.PR_SET_NO_NEW_PRIVS)},
diff --git a/pkg/sentry/platform/systrap/systrap.go b/pkg/sentry/platform/systrap/systrap.go
index 4c4a9018a..e1416ae80 100644
--- a/pkg/sentry/platform/systrap/systrap.go
+++ b/pkg/sentry/platform/systrap/systrap.go
@@ -337,6 +337,8 @@ func New() (*Systrap, error) {
 		source.DecRef(nil)
 
 		globalPool.source = source
+
+		initSysmsgThreadPriority()
 	})
 
 	return &Systrap{memoryFile: mf}, nil