> > > I wonder if you could get much back, in terms of performance, by moving > > > the > > > context->dummy = !audit_n_rules; > > > line to the top and just returning if context->dummy == 1; > > > > We get 668.09 cycles with this optimisation, so it comes down a bit, but > > no where near if the auditing is disabled altogether. > > Clean that patch up and send it. Sounds like a win no matter what else > we do.
ok... audit: speedup audit_syscall_entry when there are zero rules This creates a check at the start of audit_syscall_entry to see if there are zero rules in the audit filter list. If there are zero rules return immediately. This buys about ~10% on a null syscall on powerpc. Signed-off-by: Michael Neuling <[email protected]> diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 1b31c13..bc0872b 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1579,6 +1579,9 @@ void audit_syscall_entry(int arch, int major, if (unlikely(!context)) return; + context->dummy = !audit_n_rules; + if (context->dummy == 1) + return; /* * This happens only on certain architectures that make system * calls in kernel_thread via the entry.S interface, instead of @@ -1628,7 +1631,6 @@ void audit_syscall_entry(int arch, int major, context->argv[3] = a4; state = context->state; - context->dummy = !audit_n_rules; if (!context->dummy && state == AUDIT_BUILD_CONTEXT) { context->prio = 0; state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]); -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
