* Steve Grubb (sgrubb(a)redhat.com) wrote:
 +++ linux-2.6.9~pre75/fs/attr.c
 @@ -68,6 +69,8 @@
         unsigned int ia_valid = attr->ia_valid;
         int error = 0;
 
 +       audit_notify_watch(inode, MAY_WRITE);
 +
         if (ia_valid & ATTR_SIZE) {
                 if (attr->ia_size != i_size_read(inode)) {
                         error = vmtruncate(inode, attr->ia_size);
 
 +void audit_notify_watch(struct inode *inode, int mask)
 +{
 +       struct audit_inode_data *data;
 +
 +       if (likely(!audit_enabled))
 +               return;
 
 This means that the variables have to be pushed onto the stack, a call 
 performed, the enabled test, do a return instruction, and then pop the stack. 
 Its probably faster to do:
 
 +       if (unlikely(audit_enabled))
 +              audit_notify_watch(inode, MAY_WRITE);
 + 
Any micro optimisation needs to be benchmarked to show whether it's really
useful (I'd expect this one to be in the noise even though assembly
inspection should show improvement).  IMO, a better choice would be
a static inline stub to keep from cluttering call sites.  Smth. like:
static inline void audit_notify_watch(struct inode *inode, int mask)
{
	if (likely(!audit_enabled))
		return;
	__audit_notify_watch(inode, mask);
}
thanks,
-chris