src-test/sys/security/mac, branch mainFreeBSD source treehttps://cgit-dev.freebsd.org/src-test/atom?h=main2020-11-19T06:30:25Zpipe: allow for lockless pipe_stat2020-11-19T06:30:25ZMateusz Guzikmjg@FreeBSD.org2020-11-19T06:30:25Zurn:sha1:89744405e64b2116fbdd7d0e866a34731c96e4d5
pipes get stated all thet time and this avoidably contributed to contention.
The pipe lock is only held to accomodate MAC and to check the type.
Since normally there is no probe for pipe stat depessimize this by having the
flag.
The pipe_state field gets modified with locks held all the time and it's not
feasible to convert them to use atomic store. Move the type flag away to a
separate variable as a simple cleanup and to provide stable field to read.
Use short for both fields to avoid growing the struct.
While here short-circuit MAC for pipe_poll as well.
mac_framework.h: fix build with DEBUG_VFS_LOCKS and !MAC2020-09-03T20:30:52ZAndriy Gaponavg@FreeBSD.org2020-09-03T20:30:52Zurn:sha1:137d26e8a378c50b439f3bc3f26ea5d7660c5607
I have such a custom kernel configuration and its build failed with:
linking kernel.full
ld: error: undefined symbol: mac_vnode_assert_locked
>>> referenced by mac_framework.h:556 (/usr/devel/git/apu2c4/sys/security/mac/mac_framework.h:556)
>>> tmpfs_vnops.o:(mac_vnode_check_stat)
>>> referenced by mac_framework.h:556 (/usr/devel/git/apu2c4/sys/security/mac/mac_framework.h:556)
>>> vfs_default.o:(mac_vnode_check_stat)
>>> referenced by mac_framework.h:556 (/usr/devel/git/apu2c4/sys/security/mac/mac_framework.h:556)
>>> ufs_vnops.o:(mac_vnode_check_stat)
security: clean up empty lines in .c and .h files2020-09-01T21:26:00ZMateusz Guzikmjg@FreeBSD.org2020-09-01T21:26:00Zurn:sha1:e5ecee7440496904939e936501d0db93bed15415mac: even up all entry points to the same scheme2020-08-06T00:23:06ZMateusz Guzikmjg@FreeBSD.org2020-08-06T00:23:06Zurn:sha1:4ec34a908bb2caf1967fd6e26e152e0bf2e4534e
- use a macro for checking whether the site is enabled
- expand it to 0 if mac is not compiled in to begin with
vfs: add a cheaper entry for mac_vnode_check_access2020-08-05T07:34:45ZMateusz Guzikmjg@FreeBSD.org2020-08-05T07:34:45Zurn:sha1:18f67bc413e8a4e6b313c023e8612603f1ea17c0Fix tinderbox build after r3637142020-07-30T22:56:57ZMateusz Guzikmjg@FreeBSD.org2020-07-30T22:56:57Zurn:sha1:5b0acaf75ff8d416a51c820b1c062dada0edaf66vfs: elide MAC-induced locking on rename if there are no relevant hoooks2020-07-29T17:05:31ZMateusz Guzikmjg@FreeBSD.org2020-07-29T17:05:31Zurn:sha1:fad6dd772d15214036aeea34a1c280dc8390fdfbvfs: add the infrastructure for lockless lookup2020-07-25T10:32:45ZMateusz Guzikmjg@FreeBSD.org2020-07-25T10:32:45Zurn:sha1:07d2145a17178e9df663c90cc45d249502f7f768
Reviewed by: kib
Tested by: pho (in a patchset)
Differential Revision: https://reviews.freebsd.org/D25577
vfs: fix vn_poll performance with either MAC or AUDIT2020-07-16T14:09:18ZMateusz Guzikmjg@FreeBSD.org2020-07-16T14:09:18Zurn:sha1:3ea3fbe685e0c7858c0bf5f4d29714b8fbbe69a1
The code would unconditionally lock the vnode to audit or call the
mac hoook, even if neither want to do anything. Pre-check the state
to avoid locking in the common case of nothing to do.
Note this code should not be normally executed anyway as vnodes are
always return ready. However, poll1/2 from will-it-scale use regular
files for benchmarking, presumably to focus on the interface itself
as the vnode handler is not supposed to do almost anything.
This in particular fixes poll2 which passes 128 fds.
$ ./poll2_processes -s 10
before: 134411
after: 271572
vfs: fix MAC/AUDIT mismatch in vn_poll2020-07-16T14:04:28ZMateusz Guzikmjg@FreeBSD.org2020-07-16T14:04:28Zurn:sha1:ab06a3051743a8347fb2bb7cbf47525bdec4946a
Auditing would not be performed without MAC compiled in.