From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Howells Subject: Re: PATCH [1/1]: audit: acquire creds selectively to reduce atomic op overhead Date: Tue, 08 Mar 2011 18:02:53 +0000 Message-ID: <18893.1299607373@redhat.com> References: <20110307210656.GA1750@suse.de> Return-path: In-Reply-To: <20110307210656.GA1750@suse.de> Sender: linux-kernel-owner@vger.kernel.org To: Tony Jones Cc: dhowells@redhat.com, linux-kernel@vger.kernel.org, linux-audit@redhat.com, Eric Paris , Al Viro List-Id: linux-audit@redhat.com Tony Jones wrote: > Commit c69e8d9c01db added calls to get_task_cred and put_cred in > audit_filter_rules. Profiling with a large number of audit rules active on > the exit chain shows that we are spending upto 48% in this routine for > syscall intensive tests, most of which is in the atomic ops. > > The following patch acquires the cred if a rule requires it. In our > particular case above, most rules had no cred requirement and this dropped > the time spent in audit_filter_rules down to ~12%. An alternative would be > for the caller to acquire the cred just once for the whole chain and pass > into audit_filter_rules. I can create an alternate patch doing this if > required. There's no actual need to get a ref on the named task's creds. If tsk == current, no locking is needed at all. If tsk != current, the RCU read lock is sufficient. See task_cred_xxx() in include/linux/cred.h. Hmmm... I wonder... The audit filter uses tsk->real_cred, but is that correct? Should it be using tsk->cred? And is tsk always going to be current? > + const struct cred *cred=NULL; Binary operators like '=' should have a space on each side. David