From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Neuling Subject: Re: [PATCH] audit: speedup for syscalls when auditing is disabled Date: Tue, 24 Aug 2010 15:56:07 +1000 Message-ID: <5994.1282629367@neuling.org> References: <29151.1282270393@neuling.org> <1282586177.2681.43.camel@localhost.localdomain> <20887.1282615880@neuling.org> <1282621410.26616.406.camel@localhost.localdomain> Return-path: In-reply-to: <1282621410.26616.406.camel@localhost.localdomain> Sender: linux-kernel-owner@vger.kernel.org To: Eric Paris Cc: linux-audit@redhat.com, linux-kernel@vger.kernel.org, Al Viro , anton@samba.org, sgrubb@redhat.com List-Id: linux-audit@redhat.com > > > I wonder if you could get much back, in terms of performance, by moving > > > the > > > context->dummy = !audit_n_rules; > > > line to the top and just returning if context->dummy == 1; > > > > We get 668.09 cycles with this optimisation, so it comes down a bit, but > > no where near if the auditing is disabled altogether. > > Clean that patch up and send it. Sounds like a win no matter what else > we do. ok... audit: speedup audit_syscall_entry when there are zero rules This creates a check at the start of audit_syscall_entry to see if there are zero rules in the audit filter list. If there are zero rules return immediately. This buys about ~10% on a null syscall on powerpc. Signed-off-by: Michael Neuling diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 1b31c13..bc0872b 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1579,6 +1579,9 @@ void audit_syscall_entry(int arch, int major, if (unlikely(!context)) return; + context->dummy = !audit_n_rules; + if (context->dummy == 1) + return; /* * This happens only on certain architectures that make system * calls in kernel_thread via the entry.S interface, instead of @@ -1628,7 +1631,6 @@ void audit_syscall_entry(int arch, int major, context->argv[3] = a4; state = context->state; - context->dummy = !audit_n_rules; if (!context->dummy && state == AUDIT_BUILD_CONTEXT) { context->prio = 0; state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);