From: Eric Paris <eparis@redhat.com>
To: Dave Chinner <david@fromorbit.com>
Cc: linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-fsdevel@vger.kernel.org, hch@infradead.org,
zohar@us.ibm.com, warthog9@kernel.org, jmorris@namei.org,
kyle@mcmartin.ca, hpa@zytor.com, akpm@linux-foundation.org,
torvalds@linux-foundation.org, mingo@elte.hu,
viro@zeniv.linux.org.uk
Subject: Re: [PATCH 01/11] IMA: use rbtree instead of radix tree for inode information cache
Date: Mon, 25 Oct 2010 20:12:12 -0400 [thread overview]
Message-ID: <1288051932.2655.93.camel@localhost.localdomain> (raw)
In-Reply-To: <20101025232230.GW32255@dastard>
On Tue, 2010-10-26 at 10:22 +1100, Dave Chinner wrote:
> On Mon, Oct 25, 2010 at 02:41:18PM -0400, Eric Paris wrote:
> > The IMA code needs to store the number of tasks which have an open fd
> > granting permission to write a file even when IMA is not in use. It needs
> > this information in order to be enabled at a later point in time without
> > losing it's integrity garantees. At the moment that means we store a
> > little bit of data about every inode in a cache. We use a radix tree key'd
> > on the inode's memory address. Dave Chinner pointed out that a radix tree
> > is a terrible data structure for such a sparse key space. This patch
> > switches to using an rbtree which should be more efficient.
>
> I'm not sure this is the right fix, though.
>
> Realistically, there is a 1:1 relationship between the inode and the
> IMA information. I fail to see why an external index is needed here
> at all - just use a separate structure to store the IMA information
> that the inode points to. That makes the need for a new global index
> and global lock go away completely.
I guess I did a bad job explaining my 1:1 relationship comments. I only
need the i_readcount in a 1:1 manor. (I'm also using the already
existing i_writecount) So IMA needs some information in a 1:1
relationship, but everything else in the IMA structure is only needed
when 'a measurement policy is loaded.'
I believe that IBM is going to look into making i_readcount a first
class citizen which can be used by both IMA and generic_setlease().
Then people could say IMA had 0 per inode overhead :)
> You're already adding 8 bytes to the inode, so why not make it a
> pointer.
4 + 4 padding. Yes.
> We've got 4 conditions:
You're suggesting we go to 4 conditions? Today we have 3.
> 1. not configured - no overhead
> 2. configured, boot time disabled - 8 bytes per inode
> 3. configured, boot time enabled, runtime disabled - 8 bytes per
> inode + small IMA structure
2 and 3 are the same today, and both are 4+4. I believe your suggestion
would be for #3 would be 8 bytes in inode pointing to a 4+4 byte
structure. I don't really know if that gets us anything.
> 4. configured, boot time enabled, runtime enabled - 8 bytes per
> inode + large IMA structure
> Anyone who wants the option of runtime enablement can take the extra
> allocation overhead, but otherwise nobody is affected apart from 8
> bytes of additional memory per inode. I doubt that will change
> anything unless it increases the size of the inode enough to push it
> over slab boundaries. And if LSM stacking is introduced, then that 8
> bytes per inode overhead will go away, anyway.
At least it gets shifted so you don't see it. Can't say it goes
away....
> This approach doesn't introduce new global lock and lookup overhead
> into the main VFS paths, allows you to remove a bunch of code and
> has a path forward for removing the 8 byte per inode overhead as
> well. Seems like the best compromise to me....
End of my patch series there are no global locks in main VFS paths
(unless you load an ima measurement policy). I realize that this patch
switches an rcu_readlock() to a spin_lock() and maybe that's what you
means, but you'll find that I drop ALL locking on core paths when you
don't load a measurement policy in 10/11
http://marc.info/?l=linux-kernel&m=128803236419823&w=2
-Eric
prev parent reply other threads:[~2010-10-26 0:12 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-10-25 18:41 [PATCH 01/11] IMA: use rbtree instead of radix tree for inode information cache Eric Paris
2010-10-25 18:41 ` [PATCH 02/11] IMA: drop the inode opencount since it isn't needed for operation Eric Paris
2010-10-25 18:41 ` [PATCH 03/11] IMA: use unsigned int instead of long for counters Eric Paris
2010-10-25 18:41 ` [PATCH 04/11] IMA: convert internal flags from long to char Eric Paris
2010-10-25 18:41 ` [PATCH 05/11] IMA: use inode->i_lock to protect read and write counters Eric Paris
2010-10-25 18:41 ` [PATCH 06/11] IMA: use i_writecount rather than a private counter Eric Paris
2010-10-25 19:27 ` John Stoffel
2010-10-25 21:52 ` Eric Paris
2010-10-25 22:25 ` H. Peter Anvin
2010-10-25 22:29 ` Eric Paris
2010-10-26 13:57 ` John Stoffel
2010-10-26 13:53 ` John Stoffel
2010-10-26 22:08 ` H. Peter Anvin
2010-10-25 18:41 ` [PATCH 07/11] IMA: move read counter into struct inode Eric Paris
2010-10-25 18:42 ` [PATCH 08/11] IMA: only allocate iint when needed Eric Paris
2010-10-25 18:42 ` [PATCH 09/11] IMA: drop refcnt from ima_iint_cache since it isn't needed Eric Paris
2010-10-25 18:42 ` [PATCH 10/11] IMA: explicit IMA i_flag to remove global lock on inode_delete Eric Paris
2010-10-25 18:42 ` [PATCH 11/11] IMA: fix the ToMToU logic Eric Paris
2010-10-25 19:21 ` [PATCH 01/11] IMA: use rbtree instead of radix tree for inode information cache John Stoffel
2010-10-25 19:38 ` J.H.
2010-10-25 20:55 ` Linus Torvalds
2010-10-25 20:57 ` Christoph Hellwig
2010-10-25 21:11 ` Linus Torvalds
2010-10-26 14:01 ` John Stoffel
2010-10-26 15:22 ` Linus Torvalds
2010-10-26 15:30 ` Eric Paris
2010-10-26 15:53 ` John Stoffel
2010-10-26 18:13 ` Al Viro
2010-10-27 13:35 ` James Morris
2010-10-26 14:07 ` John Stoffel
2010-10-25 21:34 ` Eric Paris
2010-10-26 13:45 ` John Stoffel
2010-10-25 23:22 ` Dave Chinner
2010-10-26 0:12 ` Eric Paris [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1288051932.2655.93.camel@localhost.localdomain \
--to=eparis@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=david@fromorbit.com \
--cc=hch@infradead.org \
--cc=hpa@zytor.com \
--cc=jmorris@namei.org \
--cc=kyle@mcmartin.ca \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mingo@elte.hu \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
--cc=warthog9@kernel.org \
--cc=zohar@us.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).