FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=releng%2F8.1 2009-06-03T19:41:12Z 2009-06-03T19:41:12Z Robert Watson rwatson@FreeBSD.org 2009-06-03T19:41:12Z urn:sha1:3ad3d9c5ef2ef66ac2a019662eaadcb30d7c9044 (limited to netatalk) to avoid MAC label lookup on both mbufs if no policies are registered. Obtained from: TrustedBSD Project 2009-06-03T18:46:28Z Robert Watson rwatson@FreeBSD.org 2009-06-03T18:46:28Z urn:sha1:3de4046939a04576ede9d97f48f6a02d1a2ccc8c modules are loaded by avoiding mbuf label lookups when policies aren't loaded, pushing further socket locking into MAC policy modules, and avoiding locking MAC ifnet locks when no policies are loaded: - Check mac_policies_count before looking for mbuf MAC label m_tags in MAC Framework entry points. We will still pay label lookup costs if MAC policies are present but don't require labels (typically a single mbuf header field read, but perhaps further indirection if IPSEC or other m_tag consumers are in use). - Further push socket locking for socket-related access control checks and events into MAC policies from the MAC Framework, so that sockets are only locked if a policy specifically requires a lock to protect a label. This resolves lock order issues during sonewconn() and also in local domain socket cross-connect where multiple socket locks could not be held at once for the purposes of propagatig MAC labels across multiple sockets. Eliminate mac_policy_count check in some entry points where it no longer avoids locking. - Add mac_policy_count checking in some entry points relating to network interfaces that otherwise lock a global MAC ifnet lock used to protect ifnet labels. Obtained from: TrustedBSD Project 2009-06-02T22:22:09Z Robert Watson rwatson@FreeBSD.org 2009-06-02T22:22:09Z urn:sha1:5f51fb4871e91c6e20622eef0c637b931f0c8aaa might arise from WITNESS not understanding its locking protocol, which should be deadlock-free. Currently these warnings generally don't occur, but as object locking is pushed into policies for some object types, they would otherwise occur more often. Obtained from: TrustedBSD Project 2009-06-02T18:26:17Z Robert Watson rwatson@FreeBSD.org 2009-06-02T18:26:17Z urn:sha1:f93bfb23dcb5b1d8a3aa13da522369974fcda39b count of the number of registered policies. Rather than unconditionally locking sockets before passing them into MAC, lock them in the MAC entry points only if mac_policy_count is non-zero. This avoids locking overhead for a number of socket system calls when no policies are registered, eliminating measurable overhead for the MAC Framework for the socket subsystem when there are no active policies. Possibly socket locks should be acquired by policies if they are required for socket labels, which would further avoid locking overhead when there are policies but they don't require labeling of sockets, or possibly don't even implement socket controls. Obtained from: TrustedBSD Project 2009-05-29T10:52:37Z Robert Watson rwatson@FreeBSD.org 2009-05-29T10:52:37Z urn:sha1:1a109c1cb0ef3176d2d32e11d8a51d48248bd2e5 - Add rm_init_flags() and accept extended options only for that variation. - Add a flags space specifically for rm_init_flags(), rather than borrowing the lock_init() flag space. - Define flag RM_RECURSE to use instead of LO_RECURSABLE. - Define flag RM_NOWITNESS to allow an rmlock to be exempt from WITNESS checking; this wasn't possible previously as rm_init() always passed LO_WITNESS when initializing an rmlock's struct lock. - Add RM_SYSINIT_FLAGS(). - Rename embedded mutex in rmlocks to make it more obvious what it is. - Update consumers. - Update man page. 2009-05-27T09:41:58Z Robert Watson rwatson@FreeBSD.org 2009-05-27T09:41:58Z urn:sha1:81fee06f9cc566345bb8a219542dc1b51698f2a2 framework registration for non-sleepable entry points. Obtained from: TrustedBSD Project 2009-05-01T21:05:40Z Robert Watson rwatson@FreeBSD.org 2009-05-01T21:05:40Z urn:sha1:fa76567150773e0aab5fdd883cf7652a27c7c25e MAC_BOOLEAN -> MAC_POLICY_BOOLEAN MAC_BOOLEAN_NOSLEEP -> MAC_POLICY_BOOLEANN_NOSLEEP MAC_CHECK -> MAC_POLICY_CHECK MAC_CHECK_NOSLEEP -> MAC_POLICY_CHECK_NOSLEEP MAC_EXTERNALIZE -> MAC_POLICY_EXTERNALIZE MAC_GRANT -> MAC_POLICY_GRANT MAC_GRANT_NOSLEEP -> MAC_POLICY_GRANT_NOSLEEP MAC_INTERNALIZE -> MAC_POLICY_INTERNALIZE MAC_PERFORM -> MAC_POLICY_PERFORM_CHECK MAC_PERFORM_NOSLEEP -> MAC_POLICY_PERFORM_NOSLEEP This frees up those macro names for use in wrapping calls into the MAC Framework from the remainder of the kernel. Obtained from: TrustedBSD Project 2009-03-14T16:06:06Z Robert Watson rwatson@FreeBSD.org 2009-03-14T16:06:06Z urn:sha1:4020272933cbe552f932d9642419f8becee04bd5 improve performance: - Eliminate custom reference count and condition variable to monitor threads entering the framework, as this had both significant overhead and behaved badly in the face of contention. - Replace reference count with two locks: an rwlock and an sx lock, which will be read-acquired by threads entering the framework depending on whether a give policy entry point is permitted to sleep or not. - Replace previous mutex locking of the reference count for exclusive access with write acquiring of both the policy list sx and rw locks, which occurs only when policies are attached or detached. - Do a lockless read of the dynamic policy list head before acquiring any locks in order to reduce overhead when no dynamic policies are loaded; this a race we can afford to lose. - For every policy entry point invocation, decide whether sleeping is permitted, and if not, use a _NOSLEEP() variant of the composition macros, which will use the rwlock instead of the sxlock. In some cases, we decide which to use based on allocation flags passed to the MAC Framework entry point. As with the move to rwlocks/rmlocks in pfil, this may trigger witness warnings, but these should (generally) be false positives as all acquisition of the locks is for read with two very narrow exceptions for policy load/unload, and those code blocks should never acquire other locks. Sponsored by: Google, Inc. Obtained from: TrustedBSD Project Discussed with: csjp (idea, not specific patch) 2009-03-08T12:32:06Z Robert Watson rwatson@FreeBSD.org 2009-03-08T12:32:06Z urn:sha1:fefd0ac8a911c1b3b63da1602bb13cee5ffe4311 extended attribute get/set; in the case of get an uninitialized user buffer was passed before the EA was retrieved, making it of relatively little use; the latter was simply unused by any policies. Obtained from: TrustedBSD Project Sponsored by: Google, Inc. 2009-03-08T12:22:00Z Robert Watson rwatson@FreeBSD.org 2009-03-08T12:22:00Z urn:sha1:c14172e3aeb860d8e071f75ac5698a6954fb69a8 other use of the same variable type. Obtained from: TrustedBSD Project Sponsored by: Google, Inc.