From: Kees Cook <keescook@chromium.org>
To: KP Singh <kpsingh@kernel.org>
Cc: linux-security-module@vger.kernel.org, bpf@vger.kernel.org,
paul@paul-moore.com, casey@schaufler-ca.com, song@kernel.org,
daniel@iogearbox.net, ast@kernel.org, renauld@google.com
Subject: Re: [PATCH v4 0/5] Reduce overhead of LSMs with static calls
Date: Fri, 22 Sep 2023 08:51:51 -0700 [thread overview]
Message-ID: <202309220851.620EFFCC7C@keescook> (raw)
In-Reply-To: <20230922145505.4044003-1-kpsingh@kernel.org>
On Fri, Sep 22, 2023 at 04:55:00PM +0200, KP Singh wrote:
> # Performance improvement
>
> With this patch-set some syscalls with lots of LSM hooks in their path
> benefitted at an average of ~3% and I/O and Pipe based system calls benefitting
> the most.
>
> Here are the results of the relevant Unixbench system benchmarks with BPF LSM
> and SELinux enabled with default policies enabled with and without these
> patches.
>
> Benchmark Delta(%): (+ is better)
> ===============================================================================
> Execl Throughput +1.9356
> File Write 1024 bufsize 2000 maxblocks +6.5953
> Pipe Throughput +9.5499
> Pipe-based Context Switching +3.0209
> Process Creation +2.3246
> Shell Scripts (1 concurrent) +1.4975
> System Call Overhead +2.7815
> System Benchmarks Index Score (Partial Only): +3.4859
>
> In the best case, some syscalls like eventfd_create benefitted to about ~10%.
> The full analysis can be viewed at https://kpsingh.ch/lsm-perf
Ship it! ;)
Thanks for continuing to work on this; this is a classic case for
static_call.
-Kees
--
Kees Cook
next prev parent reply other threads:[~2023-09-22 15:51 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-22 14:55 [PATCH v4 0/5] Reduce overhead of LSMs with static calls KP Singh
2023-09-22 14:55 ` [PATCH v4 1/5] kernel: Add helper macros for loop unrolling KP Singh
2023-09-22 14:55 ` [PATCH v4 2/5] security: Count the LSMs enabled at compile time KP Singh
2023-09-22 15:50 ` Kees Cook
2023-09-22 16:07 ` KP Singh
2023-09-27 22:37 ` KP Singh
2023-09-22 14:55 ` [PATCH v4 3/5] security: Replace indirect LSM hook calls with static calls KP Singh
2023-09-23 14:52 ` kernel test robot
2023-09-27 5:26 ` kernel test robot
2023-09-22 14:55 ` [PATCH v4 4/5] bpf: Only enable BPF LSM hooks when an LSM program is attached KP Singh
2023-09-22 14:55 ` [PATCH v4 5/5] security: Add CONFIG_SECURITY_HOOK_LIKELY KP Singh
2023-09-22 15:50 ` Kees Cook
2023-09-22 15:51 ` Kees Cook [this message]
2023-09-22 18:42 ` [PATCH v4 0/5] Reduce overhead of LSMs with static calls Mateusz Guzik
2023-09-23 16:16 ` KP Singh
2023-09-23 17:13 ` Mateusz Guzik
2023-09-23 17:15 ` Mateusz Guzik
2023-09-24 2:46 ` Kees Cook
2023-09-25 20:08 ` Mateusz Guzik
2023-09-25 22:02 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202309220851.620EFFCC7C@keescook \
--to=keescook@chromium.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=casey@schaufler-ca.com \
--cc=daniel@iogearbox.net \
--cc=kpsingh@kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=renauld@google.com \
--cc=song@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.