d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

vfs: fix vn_poll performance with either MAC or AUDIT

Browse Source 
The code would unconditionally lock the vnode to audit or call the
mac hoook, even if neither want to do anything. Pre-check the state
to avoid locking in the common case of nothing to do.

Note this code should not be normally executed anyway as vnodes are
always return ready. However, poll1/2 from will-it-scale use regular
files for benchmarking, presumably to focus on the interface itself
as the vnode handler is not supposed to do almost anything.

This in particular fixes poll2 which passes 128 fds.

$ ./poll2_processes -s 10
before: 134411
after:  271572
This commit is contained in:
Mateusz Guzik 2020-07-16 14:09:18 +00:00
parent f2ed697e73
commit 3ea3fbe685
3 changed files with 24 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/kern/vfs_vnops.c
View File

@ -1636,12 +1636,14 @@ vn_poll(struct file *fp, int events, struct ucred *active_cred,
vp = fp->f_vnode;
#if defined(MAC) || defined(AUDIT)
vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
AUDIT_ARG_VNODE1(vp);
error = mac_vnode_check_poll(active_cred, fp->f_cred, vp);
VOP_UNLOCK(vp);
if (error != 0)
return (error);
if (AUDITING_TD(td) || mac_vnode_check_poll_enabled()) {
vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
AUDIT_ARG_VNODE1(vp);
error = mac_vnode_check_poll(active_cred, fp->f_cred, vp);
VOP_UNLOCK(vp);
if (error != 0)
return (error);
}
#endif
error = VOP_POLL(vp, events, fp->f_cred, td);
return (error);

13
sys/security/mac/mac_framework.c
View File

@ -118,11 +118,18 @@ SYSCTL_UINT(_security_mac, OID_AUTO, version, CTLFLAG_RD, &mac_version, 0,
"");
/*
* Flags for inlined checks.
* Flags for inlined checks. Note this would be best hotpatched at runtime.
* The following is a band-aid.
*
* Use FPFLAG for hooks running in commonly executed paths and FPFLAG_RARE
* for the rest.
*/
#define FPFLAG(f) \
bool __read_frequently mac_##f##_fp_flag
#define FPFLAG_RARE(f) \
bool __read_mostly mac_##f##_fp_flag
FPFLAG(priv_check);
FPFLAG(priv_grant);
FPFLAG(vnode_check_lookup);
@ -131,8 +138,10 @@ FPFLAG(vnode_check_stat);
FPFLAG(vnode_check_read);
FPFLAG(vnode_check_write);
FPFLAG(vnode_check_mmap);
FPFLAG_RARE(vnode_check_poll);
#undef FPFLAG
#undef FPFLAG_RARE
/*
* Labels consist of a indexed set of "slots", which are allocated policies
@ -416,6 +425,8 @@ struct mac_policy_fastpath_elem mac_policy_fastpath_array[] = {
.flag = &mac_vnode_check_write_fp_flag },
{ .offset = FPO(vnode_check_mmap),
.flag = &mac_vnode_check_mmap_fp_flag },
{ .offset = FPO(vnode_check_poll),
.flag = &mac_vnode_check_poll_fp_flag },
};
static void

4
sys/security/mac/mac_framework.h
View File

@ -463,10 +463,14 @@ mac_vnode_check_open(struct ucred *cred, struct vnode *vp,
int mac_vnode_check_mprotect(struct ucred *cred, struct vnode *vp,
int prot);
#define mac_vnode_check_poll_enabled() __predict_false(mac_vnode_check_poll_fp_flag)
#ifdef MAC
extern bool mac_vnode_check_poll_fp_flag;
int mac_vnode_check_poll(struct ucred *active_cred,
struct ucred *file_cred, struct vnode *vp);
#else
#define mac_vnode_check_poll_fp_flag 0
static inline int
mac_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred,
struct vnode *vp)