| 
									
										
										
										
											2005-04-16 15:20:36 -07:00
										 |  |  | /*
 | 
					
						
							|  |  |  |  * An extensible bitmap is a bitmap that supports an | 
					
						
							|  |  |  |  * arbitrary number of bits.  Extensible bitmaps are | 
					
						
							|  |  |  |  * used to represent sets of values, such as types, | 
					
						
							|  |  |  |  * roles, categories, and classes. | 
					
						
							|  |  |  |  * | 
					
						
							|  |  |  |  * Each extensible bitmap is implemented as a linked | 
					
						
							|  |  |  |  * list of bitmap nodes, where each bitmap node has | 
					
						
							|  |  |  |  * an explicitly specified starting bit position within | 
					
						
							|  |  |  |  * the total bitmap. | 
					
						
							|  |  |  |  * | 
					
						
							|  |  |  |  * Author : Stephen Smalley, <sds@epoch.ncsc.mil> | 
					
						
							|  |  |  |  */ | 
					
						
							|  |  |  | #ifndef _SS_EBITMAP_H_
 | 
					
						
							|  |  |  | #define _SS_EBITMAP_H_
 | 
					
						
							|  |  |  | 
 | 
					
						
							| 
									
										
										
										
											2006-11-29 13:18:18 -05:00
										 |  |  | #include <net/netlabel.h>
 | 
					
						
							|  |  |  | 
 | 
					
						
							| 
									
										
										
										
											2013-07-23 17:38:41 -04:00
										 |  |  | #ifdef CONFIG_64BIT
 | 
					
						
							|  |  |  | #define	EBITMAP_NODE_SIZE	64
 | 
					
						
							|  |  |  | #else
 | 
					
						
							|  |  |  | #define	EBITMAP_NODE_SIZE	32
 | 
					
						
							|  |  |  | #endif
 | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | #define EBITMAP_UNIT_NUMS	((EBITMAP_NODE_SIZE-sizeof(void *)-sizeof(u32))\
 | 
					
						
							| 
									
										
											  
											
												SELinux: improve performance when AVC misses.
* We add ebitmap_for_each_positive_bit() which enables to walk on
  any positive bit on the given ebitmap, to improve its performance
  using common bit-operations defined in linux/bitops.h.
  In the previous version, this logic was implemented using a combination
  of ebitmap_for_each_bit() and ebitmap_node_get_bit(), but is was worse
  in performance aspect.
  This logic is most frequestly used to compute a new AVC entry,
  so this patch can improve SELinux performance when AVC misses are happen.
* struct ebitmap_node is redefined as an array of "unsigned long", to get
  suitable for using find_next_bit() which is fasted than iteration of
  shift and logical operation, and to maximize memory usage allocated
  from general purpose slab.
* Any ebitmap_for_each_bit() are repleced by the new implementation
  in ss/service.c and ss/mls.c. Some of related implementation are
  changed, however, there is no incompatibility with the previous
  version.
* The width of any new line are less or equal than 80-chars.
The following benchmark shows the effect of this patch, when we
access many files which have different security context one after
another. The number is more than /selinux/avc/cache_threshold, so
any access always causes AVC misses.
      selinux-2.6      selinux-2.6-ebitmap
AVG:   22.763 [s]          8.750 [s]
STD:    0.265              0.019
------------------------------------------
1st:   22.558 [s]          8.786 [s]
2nd:   22.458 [s]          8.750 [s]
3rd:   22.478 [s]          8.754 [s]
4th:   22.724 [s]          8.745 [s]
5th:   22.918 [s]          8.748 [s]
6th:   22.905 [s]          8.764 [s]
7th:   23.238 [s]          8.726 [s]
8th:   22.822 [s]          8.729 [s]
Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
											
										 
											2007-09-29 02:20:55 +09:00
										 |  |  | 					/ sizeof(unsigned long)) | 
					
						
							|  |  |  | #define EBITMAP_UNIT_SIZE	BITS_PER_LONG
 | 
					
						
							|  |  |  | #define EBITMAP_SIZE		(EBITMAP_UNIT_NUMS * EBITMAP_UNIT_SIZE)
 | 
					
						
							|  |  |  | #define EBITMAP_BIT		1ULL
 | 
					
						
							| 
									
										
										
										
											2007-10-03 23:42:56 +09:00
										 |  |  | #define EBITMAP_SHIFT_UNIT_SIZE(x)					\
 | 
					
						
							|  |  |  | 	(((x) >> EBITMAP_UNIT_SIZE / 2) >> EBITMAP_UNIT_SIZE / 2) | 
					
						
							| 
									
										
										
										
											2005-04-16 15:20:36 -07:00
										 |  |  | 
 | 
					
						
							|  |  |  | struct ebitmap_node { | 
					
						
							|  |  |  | 	struct ebitmap_node *next; | 
					
						
							| 
									
										
											  
											
												SELinux: improve performance when AVC misses.
* We add ebitmap_for_each_positive_bit() which enables to walk on
  any positive bit on the given ebitmap, to improve its performance
  using common bit-operations defined in linux/bitops.h.
  In the previous version, this logic was implemented using a combination
  of ebitmap_for_each_bit() and ebitmap_node_get_bit(), but is was worse
  in performance aspect.
  This logic is most frequestly used to compute a new AVC entry,
  so this patch can improve SELinux performance when AVC misses are happen.
* struct ebitmap_node is redefined as an array of "unsigned long", to get
  suitable for using find_next_bit() which is fasted than iteration of
  shift and logical operation, and to maximize memory usage allocated
  from general purpose slab.
* Any ebitmap_for_each_bit() are repleced by the new implementation
  in ss/service.c and ss/mls.c. Some of related implementation are
  changed, however, there is no incompatibility with the previous
  version.
* The width of any new line are less or equal than 80-chars.
The following benchmark shows the effect of this patch, when we
access many files which have different security context one after
another. The number is more than /selinux/avc/cache_threshold, so
any access always causes AVC misses.
      selinux-2.6      selinux-2.6-ebitmap
AVG:   22.763 [s]          8.750 [s]
STD:    0.265              0.019
------------------------------------------
1st:   22.558 [s]          8.786 [s]
2nd:   22.458 [s]          8.750 [s]
3rd:   22.478 [s]          8.754 [s]
4th:   22.724 [s]          8.745 [s]
5th:   22.918 [s]          8.748 [s]
6th:   22.905 [s]          8.764 [s]
7th:   23.238 [s]          8.726 [s]
8th:   22.822 [s]          8.729 [s]
Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
											
										 
											2007-09-29 02:20:55 +09:00
										 |  |  | 	unsigned long maps[EBITMAP_UNIT_NUMS]; | 
					
						
							|  |  |  | 	u32 startbit; | 
					
						
							| 
									
										
										
										
											2005-04-16 15:20:36 -07:00
										 |  |  | }; | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | struct ebitmap { | 
					
						
							|  |  |  | 	struct ebitmap_node *node;	/* first node in the bitmap */ | 
					
						
							|  |  |  | 	u32 highbit;	/* highest position in the total bitmap */ | 
					
						
							|  |  |  | }; | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | #define ebitmap_length(e) ((e)->highbit)
 | 
					
						
							|  |  |  | 
 | 
					
						
							| 
									
										
											  
											
												SELinux: improve performance when AVC misses.
* We add ebitmap_for_each_positive_bit() which enables to walk on
  any positive bit on the given ebitmap, to improve its performance
  using common bit-operations defined in linux/bitops.h.
  In the previous version, this logic was implemented using a combination
  of ebitmap_for_each_bit() and ebitmap_node_get_bit(), but is was worse
  in performance aspect.
  This logic is most frequestly used to compute a new AVC entry,
  so this patch can improve SELinux performance when AVC misses are happen.
* struct ebitmap_node is redefined as an array of "unsigned long", to get
  suitable for using find_next_bit() which is fasted than iteration of
  shift and logical operation, and to maximize memory usage allocated
  from general purpose slab.
* Any ebitmap_for_each_bit() are repleced by the new implementation
  in ss/service.c and ss/mls.c. Some of related implementation are
  changed, however, there is no incompatibility with the previous
  version.
* The width of any new line are less or equal than 80-chars.
The following benchmark shows the effect of this patch, when we
access many files which have different security context one after
another. The number is more than /selinux/avc/cache_threshold, so
any access always causes AVC misses.
      selinux-2.6      selinux-2.6-ebitmap
AVG:   22.763 [s]          8.750 [s]
STD:    0.265              0.019
------------------------------------------
1st:   22.558 [s]          8.786 [s]
2nd:   22.458 [s]          8.750 [s]
3rd:   22.478 [s]          8.754 [s]
4th:   22.724 [s]          8.745 [s]
5th:   22.918 [s]          8.748 [s]
6th:   22.905 [s]          8.764 [s]
7th:   23.238 [s]          8.726 [s]
8th:   22.822 [s]          8.729 [s]
Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
											
										 
											2007-09-29 02:20:55 +09:00
										 |  |  | static inline unsigned int ebitmap_start_positive(struct ebitmap *e, | 
					
						
							|  |  |  | 						  struct ebitmap_node **n) | 
					
						
							| 
									
										
										
										
											2005-09-03 15:55:16 -07:00
										 |  |  | { | 
					
						
							| 
									
										
											  
											
												SELinux: improve performance when AVC misses.
* We add ebitmap_for_each_positive_bit() which enables to walk on
  any positive bit on the given ebitmap, to improve its performance
  using common bit-operations defined in linux/bitops.h.
  In the previous version, this logic was implemented using a combination
  of ebitmap_for_each_bit() and ebitmap_node_get_bit(), but is was worse
  in performance aspect.
  This logic is most frequestly used to compute a new AVC entry,
  so this patch can improve SELinux performance when AVC misses are happen.
* struct ebitmap_node is redefined as an array of "unsigned long", to get
  suitable for using find_next_bit() which is fasted than iteration of
  shift and logical operation, and to maximize memory usage allocated
  from general purpose slab.
* Any ebitmap_for_each_bit() are repleced by the new implementation
  in ss/service.c and ss/mls.c. Some of related implementation are
  changed, however, there is no incompatibility with the previous
  version.
* The width of any new line are less or equal than 80-chars.
The following benchmark shows the effect of this patch, when we
access many files which have different security context one after
another. The number is more than /selinux/avc/cache_threshold, so
any access always causes AVC misses.
      selinux-2.6      selinux-2.6-ebitmap
AVG:   22.763 [s]          8.750 [s]
STD:    0.265              0.019
------------------------------------------
1st:   22.558 [s]          8.786 [s]
2nd:   22.458 [s]          8.750 [s]
3rd:   22.478 [s]          8.754 [s]
4th:   22.724 [s]          8.745 [s]
5th:   22.918 [s]          8.748 [s]
6th:   22.905 [s]          8.764 [s]
7th:   23.238 [s]          8.726 [s]
8th:   22.822 [s]          8.729 [s]
Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
											
										 
											2007-09-29 02:20:55 +09:00
										 |  |  | 	unsigned int ofs; | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | 	for (*n = e->node; *n; *n = (*n)->next) { | 
					
						
							|  |  |  | 		ofs = find_first_bit((*n)->maps, EBITMAP_SIZE); | 
					
						
							|  |  |  | 		if (ofs < EBITMAP_SIZE) | 
					
						
							|  |  |  | 			return (*n)->startbit + ofs; | 
					
						
							|  |  |  | 	} | 
					
						
							|  |  |  | 	return ebitmap_length(e); | 
					
						
							| 
									
										
										
										
											2005-09-03 15:55:16 -07:00
										 |  |  | } | 
					
						
							|  |  |  | 
 | 
					
						
							| 
									
										
										
										
											2005-04-16 15:20:36 -07:00
										 |  |  | static inline void ebitmap_init(struct ebitmap *e) | 
					
						
							|  |  |  | { | 
					
						
							|  |  |  | 	memset(e, 0, sizeof(*e)); | 
					
						
							|  |  |  | } | 
					
						
							|  |  |  | 
 | 
					
						
							| 
									
										
											  
											
												SELinux: improve performance when AVC misses.
* We add ebitmap_for_each_positive_bit() which enables to walk on
  any positive bit on the given ebitmap, to improve its performance
  using common bit-operations defined in linux/bitops.h.
  In the previous version, this logic was implemented using a combination
  of ebitmap_for_each_bit() and ebitmap_node_get_bit(), but is was worse
  in performance aspect.
  This logic is most frequestly used to compute a new AVC entry,
  so this patch can improve SELinux performance when AVC misses are happen.
* struct ebitmap_node is redefined as an array of "unsigned long", to get
  suitable for using find_next_bit() which is fasted than iteration of
  shift and logical operation, and to maximize memory usage allocated
  from general purpose slab.
* Any ebitmap_for_each_bit() are repleced by the new implementation
  in ss/service.c and ss/mls.c. Some of related implementation are
  changed, however, there is no incompatibility with the previous
  version.
* The width of any new line are less or equal than 80-chars.
The following benchmark shows the effect of this patch, when we
access many files which have different security context one after
another. The number is more than /selinux/avc/cache_threshold, so
any access always causes AVC misses.
      selinux-2.6      selinux-2.6-ebitmap
AVG:   22.763 [s]          8.750 [s]
STD:    0.265              0.019
------------------------------------------
1st:   22.558 [s]          8.786 [s]
2nd:   22.458 [s]          8.750 [s]
3rd:   22.478 [s]          8.754 [s]
4th:   22.724 [s]          8.745 [s]
5th:   22.918 [s]          8.748 [s]
6th:   22.905 [s]          8.764 [s]
7th:   23.238 [s]          8.726 [s]
8th:   22.822 [s]          8.729 [s]
Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
											
										 
											2007-09-29 02:20:55 +09:00
										 |  |  | static inline unsigned int ebitmap_next_positive(struct ebitmap *e, | 
					
						
							|  |  |  | 						 struct ebitmap_node **n, | 
					
						
							|  |  |  | 						 unsigned int bit) | 
					
						
							| 
									
										
										
										
											2005-09-03 15:55:16 -07:00
										 |  |  | { | 
					
						
							| 
									
										
											  
											
												SELinux: improve performance when AVC misses.
* We add ebitmap_for_each_positive_bit() which enables to walk on
  any positive bit on the given ebitmap, to improve its performance
  using common bit-operations defined in linux/bitops.h.
  In the previous version, this logic was implemented using a combination
  of ebitmap_for_each_bit() and ebitmap_node_get_bit(), but is was worse
  in performance aspect.
  This logic is most frequestly used to compute a new AVC entry,
  so this patch can improve SELinux performance when AVC misses are happen.
* struct ebitmap_node is redefined as an array of "unsigned long", to get
  suitable for using find_next_bit() which is fasted than iteration of
  shift and logical operation, and to maximize memory usage allocated
  from general purpose slab.
* Any ebitmap_for_each_bit() are repleced by the new implementation
  in ss/service.c and ss/mls.c. Some of related implementation are
  changed, however, there is no incompatibility with the previous
  version.
* The width of any new line are less or equal than 80-chars.
The following benchmark shows the effect of this patch, when we
access many files which have different security context one after
another. The number is more than /selinux/avc/cache_threshold, so
any access always causes AVC misses.
      selinux-2.6      selinux-2.6-ebitmap
AVG:   22.763 [s]          8.750 [s]
STD:    0.265              0.019
------------------------------------------
1st:   22.558 [s]          8.786 [s]
2nd:   22.458 [s]          8.750 [s]
3rd:   22.478 [s]          8.754 [s]
4th:   22.724 [s]          8.745 [s]
5th:   22.918 [s]          8.748 [s]
6th:   22.905 [s]          8.764 [s]
7th:   23.238 [s]          8.726 [s]
8th:   22.822 [s]          8.729 [s]
Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
											
										 
											2007-09-29 02:20:55 +09:00
										 |  |  | 	unsigned int ofs; | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | 	ofs = find_next_bit((*n)->maps, EBITMAP_SIZE, bit - (*n)->startbit + 1); | 
					
						
							|  |  |  | 	if (ofs < EBITMAP_SIZE) | 
					
						
							|  |  |  | 		return ofs + (*n)->startbit; | 
					
						
							| 
									
										
										
										
											2005-09-03 15:55:16 -07:00
										 |  |  | 
 | 
					
						
							| 
									
										
											  
											
												SELinux: improve performance when AVC misses.
* We add ebitmap_for_each_positive_bit() which enables to walk on
  any positive bit on the given ebitmap, to improve its performance
  using common bit-operations defined in linux/bitops.h.
  In the previous version, this logic was implemented using a combination
  of ebitmap_for_each_bit() and ebitmap_node_get_bit(), but is was worse
  in performance aspect.
  This logic is most frequestly used to compute a new AVC entry,
  so this patch can improve SELinux performance when AVC misses are happen.
* struct ebitmap_node is redefined as an array of "unsigned long", to get
  suitable for using find_next_bit() which is fasted than iteration of
  shift and logical operation, and to maximize memory usage allocated
  from general purpose slab.
* Any ebitmap_for_each_bit() are repleced by the new implementation
  in ss/service.c and ss/mls.c. Some of related implementation are
  changed, however, there is no incompatibility with the previous
  version.
* The width of any new line are less or equal than 80-chars.
The following benchmark shows the effect of this patch, when we
access many files which have different security context one after
another. The number is more than /selinux/avc/cache_threshold, so
any access always causes AVC misses.
      selinux-2.6      selinux-2.6-ebitmap
AVG:   22.763 [s]          8.750 [s]
STD:    0.265              0.019
------------------------------------------
1st:   22.558 [s]          8.786 [s]
2nd:   22.458 [s]          8.750 [s]
3rd:   22.478 [s]          8.754 [s]
4th:   22.724 [s]          8.745 [s]
5th:   22.918 [s]          8.748 [s]
6th:   22.905 [s]          8.764 [s]
7th:   23.238 [s]          8.726 [s]
8th:   22.822 [s]          8.729 [s]
Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
											
										 
											2007-09-29 02:20:55 +09:00
										 |  |  | 	for (*n = (*n)->next; *n; *n = (*n)->next) { | 
					
						
							|  |  |  | 		ofs = find_first_bit((*n)->maps, EBITMAP_SIZE); | 
					
						
							|  |  |  | 		if (ofs < EBITMAP_SIZE) | 
					
						
							|  |  |  | 			return ofs + (*n)->startbit; | 
					
						
							|  |  |  | 	} | 
					
						
							|  |  |  | 	return ebitmap_length(e); | 
					
						
							| 
									
										
										
										
											2005-09-03 15:55:16 -07:00
										 |  |  | } | 
					
						
							|  |  |  | 
 | 
					
						
							| 
									
										
											  
											
												SELinux: improve performance when AVC misses.
* We add ebitmap_for_each_positive_bit() which enables to walk on
  any positive bit on the given ebitmap, to improve its performance
  using common bit-operations defined in linux/bitops.h.
  In the previous version, this logic was implemented using a combination
  of ebitmap_for_each_bit() and ebitmap_node_get_bit(), but is was worse
  in performance aspect.
  This logic is most frequestly used to compute a new AVC entry,
  so this patch can improve SELinux performance when AVC misses are happen.
* struct ebitmap_node is redefined as an array of "unsigned long", to get
  suitable for using find_next_bit() which is fasted than iteration of
  shift and logical operation, and to maximize memory usage allocated
  from general purpose slab.
* Any ebitmap_for_each_bit() are repleced by the new implementation
  in ss/service.c and ss/mls.c. Some of related implementation are
  changed, however, there is no incompatibility with the previous
  version.
* The width of any new line are less or equal than 80-chars.
The following benchmark shows the effect of this patch, when we
access many files which have different security context one after
another. The number is more than /selinux/avc/cache_threshold, so
any access always causes AVC misses.
      selinux-2.6      selinux-2.6-ebitmap
AVG:   22.763 [s]          8.750 [s]
STD:    0.265              0.019
------------------------------------------
1st:   22.558 [s]          8.786 [s]
2nd:   22.458 [s]          8.750 [s]
3rd:   22.478 [s]          8.754 [s]
4th:   22.724 [s]          8.745 [s]
5th:   22.918 [s]          8.748 [s]
6th:   22.905 [s]          8.764 [s]
7th:   23.238 [s]          8.726 [s]
8th:   22.822 [s]          8.729 [s]
Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
											
										 
											2007-09-29 02:20:55 +09:00
										 |  |  | #define EBITMAP_NODE_INDEX(node, bit)	\
 | 
					
						
							|  |  |  | 	(((bit) - (node)->startbit) / EBITMAP_UNIT_SIZE) | 
					
						
							|  |  |  | #define EBITMAP_NODE_OFFSET(node, bit)	\
 | 
					
						
							|  |  |  | 	(((bit) - (node)->startbit) % EBITMAP_UNIT_SIZE) | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | static inline int ebitmap_node_get_bit(struct ebitmap_node *n, | 
					
						
							| 
									
										
										
										
											2005-09-03 15:55:16 -07:00
										 |  |  | 				       unsigned int bit) | 
					
						
							|  |  |  | { | 
					
						
							| 
									
										
											  
											
												SELinux: improve performance when AVC misses.
* We add ebitmap_for_each_positive_bit() which enables to walk on
  any positive bit on the given ebitmap, to improve its performance
  using common bit-operations defined in linux/bitops.h.
  In the previous version, this logic was implemented using a combination
  of ebitmap_for_each_bit() and ebitmap_node_get_bit(), but is was worse
  in performance aspect.
  This logic is most frequestly used to compute a new AVC entry,
  so this patch can improve SELinux performance when AVC misses are happen.
* struct ebitmap_node is redefined as an array of "unsigned long", to get
  suitable for using find_next_bit() which is fasted than iteration of
  shift and logical operation, and to maximize memory usage allocated
  from general purpose slab.
* Any ebitmap_for_each_bit() are repleced by the new implementation
  in ss/service.c and ss/mls.c. Some of related implementation are
  changed, however, there is no incompatibility with the previous
  version.
* The width of any new line are less or equal than 80-chars.
The following benchmark shows the effect of this patch, when we
access many files which have different security context one after
another. The number is more than /selinux/avc/cache_threshold, so
any access always causes AVC misses.
      selinux-2.6      selinux-2.6-ebitmap
AVG:   22.763 [s]          8.750 [s]
STD:    0.265              0.019
------------------------------------------
1st:   22.558 [s]          8.786 [s]
2nd:   22.458 [s]          8.750 [s]
3rd:   22.478 [s]          8.754 [s]
4th:   22.724 [s]          8.745 [s]
5th:   22.918 [s]          8.748 [s]
6th:   22.905 [s]          8.764 [s]
7th:   23.238 [s]          8.726 [s]
8th:   22.822 [s]          8.729 [s]
Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
											
										 
											2007-09-29 02:20:55 +09:00
										 |  |  | 	unsigned int index = EBITMAP_NODE_INDEX(n, bit); | 
					
						
							|  |  |  | 	unsigned int ofs = EBITMAP_NODE_OFFSET(n, bit); | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | 	BUG_ON(index >= EBITMAP_UNIT_NUMS); | 
					
						
							|  |  |  | 	if ((n->maps[index] & (EBITMAP_BIT << ofs))) | 
					
						
							| 
									
										
										
										
											2005-09-03 15:55:16 -07:00
										 |  |  | 		return 1; | 
					
						
							|  |  |  | 	return 0; | 
					
						
							|  |  |  | } | 
					
						
							|  |  |  | 
 | 
					
						
							| 
									
										
											  
											
												SELinux: improve performance when AVC misses.
* We add ebitmap_for_each_positive_bit() which enables to walk on
  any positive bit on the given ebitmap, to improve its performance
  using common bit-operations defined in linux/bitops.h.
  In the previous version, this logic was implemented using a combination
  of ebitmap_for_each_bit() and ebitmap_node_get_bit(), but is was worse
  in performance aspect.
  This logic is most frequestly used to compute a new AVC entry,
  so this patch can improve SELinux performance when AVC misses are happen.
* struct ebitmap_node is redefined as an array of "unsigned long", to get
  suitable for using find_next_bit() which is fasted than iteration of
  shift and logical operation, and to maximize memory usage allocated
  from general purpose slab.
* Any ebitmap_for_each_bit() are repleced by the new implementation
  in ss/service.c and ss/mls.c. Some of related implementation are
  changed, however, there is no incompatibility with the previous
  version.
* The width of any new line are less or equal than 80-chars.
The following benchmark shows the effect of this patch, when we
access many files which have different security context one after
another. The number is more than /selinux/avc/cache_threshold, so
any access always causes AVC misses.
      selinux-2.6      selinux-2.6-ebitmap
AVG:   22.763 [s]          8.750 [s]
STD:    0.265              0.019
------------------------------------------
1st:   22.558 [s]          8.786 [s]
2nd:   22.458 [s]          8.750 [s]
3rd:   22.478 [s]          8.754 [s]
4th:   22.724 [s]          8.745 [s]
5th:   22.918 [s]          8.748 [s]
6th:   22.905 [s]          8.764 [s]
7th:   23.238 [s]          8.726 [s]
8th:   22.822 [s]          8.729 [s]
Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
											
										 
											2007-09-29 02:20:55 +09:00
										 |  |  | static inline void ebitmap_node_set_bit(struct ebitmap_node *n, | 
					
						
							|  |  |  | 					unsigned int bit) | 
					
						
							|  |  |  | { | 
					
						
							|  |  |  | 	unsigned int index = EBITMAP_NODE_INDEX(n, bit); | 
					
						
							|  |  |  | 	unsigned int ofs = EBITMAP_NODE_OFFSET(n, bit); | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | 	BUG_ON(index >= EBITMAP_UNIT_NUMS); | 
					
						
							|  |  |  | 	n->maps[index] |= (EBITMAP_BIT << ofs); | 
					
						
							|  |  |  | } | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | static inline void ebitmap_node_clr_bit(struct ebitmap_node *n, | 
					
						
							|  |  |  | 					unsigned int bit) | 
					
						
							|  |  |  | { | 
					
						
							|  |  |  | 	unsigned int index = EBITMAP_NODE_INDEX(n, bit); | 
					
						
							|  |  |  | 	unsigned int ofs = EBITMAP_NODE_OFFSET(n, bit); | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | 	BUG_ON(index >= EBITMAP_UNIT_NUMS); | 
					
						
							|  |  |  | 	n->maps[index] &= ~(EBITMAP_BIT << ofs); | 
					
						
							|  |  |  | } | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  | #define ebitmap_for_each_positive_bit(e, n, bit)	\
 | 
					
						
							|  |  |  | 	for (bit = ebitmap_start_positive(e, &n);	\ | 
					
						
							|  |  |  | 	     bit < ebitmap_length(e);			\ | 
					
						
							|  |  |  | 	     bit = ebitmap_next_positive(e, &n, bit))	\ | 
					
						
							| 
									
										
										
										
											2005-09-03 15:55:16 -07:00
										 |  |  | 
 | 
					
						
							| 
									
										
										
										
											2005-04-16 15:20:36 -07:00
										 |  |  | int ebitmap_cmp(struct ebitmap *e1, struct ebitmap *e2); | 
					
						
							|  |  |  | int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src); | 
					
						
							| 
									
										
										
										
											2013-07-23 17:38:41 -04:00
										 |  |  | int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit); | 
					
						
							| 
									
										
										
										
											2005-04-16 15:20:36 -07:00
										 |  |  | int ebitmap_get_bit(struct ebitmap *e, unsigned long bit); | 
					
						
							|  |  |  | int ebitmap_set_bit(struct ebitmap *e, unsigned long bit, int value); | 
					
						
							|  |  |  | void ebitmap_destroy(struct ebitmap *e); | 
					
						
							|  |  |  | int ebitmap_read(struct ebitmap *e, void *fp); | 
					
						
							| 
									
										
										
										
											2010-10-13 17:50:25 -04:00
										 |  |  | int ebitmap_write(struct ebitmap *e, void *fp); | 
					
						
							| 
									
										
										
										
											2005-04-16 15:20:36 -07:00
										 |  |  | 
 | 
					
						
							| 
									
										
										
										
											2006-11-29 13:18:18 -05:00
										 |  |  | #ifdef CONFIG_NETLABEL
 | 
					
						
							|  |  |  | int ebitmap_netlbl_export(struct ebitmap *ebmap, | 
					
						
							| 
									
										
										
										
											2014-08-01 11:17:37 -04:00
										 |  |  | 			  struct netlbl_lsm_catmap **catmap); | 
					
						
							| 
									
										
										
										
											2006-11-29 13:18:18 -05:00
										 |  |  | int ebitmap_netlbl_import(struct ebitmap *ebmap, | 
					
						
							| 
									
										
										
										
											2014-08-01 11:17:37 -04:00
										 |  |  | 			  struct netlbl_lsm_catmap *catmap); | 
					
						
							| 
									
										
										
										
											2006-11-29 13:18:18 -05:00
										 |  |  | #else
 | 
					
						
							|  |  |  | static inline int ebitmap_netlbl_export(struct ebitmap *ebmap, | 
					
						
							| 
									
										
										
										
											2014-08-01 11:17:37 -04:00
										 |  |  | 					struct netlbl_lsm_catmap **catmap) | 
					
						
							| 
									
										
										
										
											2006-11-29 13:18:18 -05:00
										 |  |  | { | 
					
						
							|  |  |  | 	return -ENOMEM; | 
					
						
							|  |  |  | } | 
					
						
							|  |  |  | static inline int ebitmap_netlbl_import(struct ebitmap *ebmap, | 
					
						
							| 
									
										
										
										
											2014-08-01 11:17:37 -04:00
										 |  |  | 					struct netlbl_lsm_catmap *catmap) | 
					
						
							| 
									
										
										
										
											2006-11-29 13:18:18 -05:00
										 |  |  | { | 
					
						
							|  |  |  | 	return -ENOMEM; | 
					
						
							|  |  |  | } | 
					
						
							|  |  |  | #endif
 | 
					
						
							|  |  |  | 
 | 
					
						
							| 
									
										
										
										
											2005-04-16 15:20:36 -07:00
										 |  |  | #endif	/* _SS_EBITMAP_H_ */
 |