• KaiGai Kohei's avatar
    SELinux: improve performance when AVC misses. · 9fe79ad1
    KaiGai Kohei authored
    * We add ebitmap_for_each_positive_bit() which enables to walk on
      any positive bit on the given ebitmap, to improve its performance
      using common bit-operations defined in linux/bitops.h.
      In the previous version, this logic was implemented using a combination
      of ebitmap_for_each_bit() and ebitmap_node_get_bit(), but is was worse
      in performance aspect.
      This logic is most frequestly used to compute a new AVC entry,
      so this patch can improve SELinux performance when AVC misses are happen.
    * struct ebitmap_node is redefined as an array of "unsigned long", to get
      suitable for using find_next_bit() which is fasted than iteration of
      shift and logical operation, and to maximize memory usage allocated
      from general purpose slab.
    * Any ebitmap_for_each_bit() are repleced by the new implementation
      in ss/service.c and ss/mls.c. Some of related implementation are
      changed, however, there is no incompatibility with the previous
      version.
    * The width of any new line are less or equal than 80-chars.
    
    The following benchmark shows the effect of this patch, when we
    access many files which have different security context one after
    another. The number is more than /selinux/avc/cache_threshold, so
    any access always causes AVC misses.
    
          selinux-2.6      selinux-2.6-ebitmap
    AVG:   22.763 [s]          8.750 [s]
    STD:    0.265              0.019
    ------------------------------------------
    1st:   22.558 [s]          8.786 [s]
    2nd:   22.458 [s]          8.750 [s]
    3rd:   22.478 [s]          8.754 [s]
    4th:   22.724 [s]          8.745 [s]
    5th:   22.918 [s]          8.748 [s]
    6th:   22.905 [s]          8.764 [s]
    7th:   23.238 [s]          8.726 [s]
    8th:   22.822 [s]          8.729 [s]
    Signed-off-by: default avatarKaiGai Kohei <kaigai@ak.jp.nec.com>
    Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
    Signed-off-by: default avatarJames Morris <jmorris@namei.org>
    9fe79ad1
mls.c 15.5 KB