Re: [PATCH] audit: speedup for syscalls when auditing is disabled
> > I wonder if you could get much back, in terms of
performance, by moving
> > the
> > context->dummy = !audit_n_rules;
> > line to the top and just returning if context->dummy == 1;
>
> We get 668.09 cycles with this optimisation, so it comes down a bit, but
> no where near if the auditing is disabled altogether.
Clean that patch up and send it. Sounds like a win no matter what else
we do.
ok...
audit: speedup audit_syscall_entry when there are zero rules
This creates a check at the start of audit_syscall_entry to see if there
are zero rules in the audit filter list. If there are zero rules return
immediately.
This buys about ~10% on a null syscall on powerpc.
Signed-off-by: Michael Neuling <mikey(a)neuling.org>
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 1b31c13..bc0872b 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1579,6 +1579,9 @@ void audit_syscall_entry(int arch, int major,
if (unlikely(!context))
return;
+ context->dummy = !audit_n_rules;
+ if (context->dummy == 1)
+ return;
/*
* This happens only on certain architectures that make system
* calls in kernel_thread via the entry.S interface, instead of
@@ -1628,7 +1631,6 @@ void audit_syscall_entry(int arch, int major,
context->argv[3] = a4;
state = context->state;
- context->dummy = !audit_n_rules;
if (!context->dummy && state == AUDIT_BUILD_CONTEXT) {
context->prio = 0;
state = audit_filter_syscall(tsk, context,
&audit_filter_list[AUDIT_FILTER_ENTRY]);