SECCOMP Filters Get A Very Nice Speed-Up With Linux 5.11

Written by Michael Larabel in Linux Security on 15 December 2020 at 04:51 PM EST. Add A Comment
The Linux 5.11 kernel cycle continues to prove to be very exciting. The latest are SECCOMP filters for this secure computing mode yielding a nice speed-up.

The SECCOMP updates for Linux 5.11 include the addition of constant-action bitmaps to reduce the overhead for many real-world syscall filters from O(N) to O(1). The filters benefiting the most are for allow/reject-only system call handling. This constant action bitmaps is also faster than BPF call optimization.

This constant-action bitmaps implementation has been in the works for several months and is yielding significantly faster performance for SECCOMP filters. This cover letter for one of the earlier patch series goes into more details about the implementation. The necessary architecture tracking has been implemented for all major Linux CPU architectures.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via

Popular News This Week