SELinux: improve performance when AVC misses.

* We add ebitmap_for_each_positive_bit() which enables to walk on
  any positive bit on the given ebitmap, to improve its performance
  using common bit-operations defined in linux/bitops.h.
  In the previous version, this logic was implemented using a combination
  of ebitmap_for_each_bit() and ebitmap_node_get_bit(), but is was worse
  in performance aspect.
  This logic is most frequestly used to compute a new AVC entry,
  so this patch can improve SELinux performance when AVC misses are happen.
* struct ebitmap_node is redefined as an array of "unsigned long", to get
  suitable for using find_next_bit() which is fasted than iteration of
  shift and logical operation, and to maximize memory usage allocated
  from general purpose slab.
* Any ebitmap_for_each_bit() are repleced by the new implementation
  in ss/service.c and ss/mls.c. Some of related implementation are
  changed, however, there is no incompatibility with the previous
  version.
* The width of any new line are less or equal than 80-chars.

The following benchmark shows the effect of this patch, when we
access many files which have different security context one after
another. The number is more than /selinux/avc/cache_threshold, so
any access always causes AVC misses.

      selinux-2.6      selinux-2.6-ebitmap
AVG:   22.763 [s]          8.750 [s]
STD:    0.265              0.019
------------------------------------------
1st:   22.558 [s]          8.786 [s]
2nd:   22.458 [s]          8.750 [s]
3rd:   22.478 [s]          8.754 [s]
4th:   22.724 [s]          8.745 [s]
5th:   22.918 [s]          8.748 [s]
6th:   22.905 [s]          8.764 [s]
7th:   23.238 [s]          8.726 [s]
8th:   22.822 [s]          8.729 [s]

Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>

1 files changed, 75 insertions, 81 deletions

diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index 4a8bab2f3c71..9a11deaaa9e7 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -34,7 +34,9 @@
  */
 int mls_compute_context_len(struct context * context)
 {
-        int i, l, len, range;
+        int i, l, len, head, prev;
+        char *nm;
+        struct ebitmap *e;
         struct ebitmap_node *node;
 
         if (!selinux_mls_enabled)
@@ -42,31 +44,33 @@ int mls_compute_context_len(struct context * context)
 
         len = 1; /* for the beginning ":" */
         for (l = 0; l < 2; l++) {
-                range = 0;
-                len += strlen(policydb.p_sens_val_to_name[context->range.level[l].sens - 1]);
-
-                ebitmap_for_each_bit(&context->range.level[l].cat, node, i) {
-                        if (ebitmap_node_get_bit(node, i)) {
-                                if (range) {
-                                        range++;
-                                        continue;
-                                }
+                int index_sens = context->range.level[l].sens;
+                len += strlen(policydb.p_sens_val_to_name[index_sens - 1]);
 
-                                len += strlen(policydb.p_cat_val_to_name[i]) + 1;
-                                range++;
-                        } else {
-                                if (range > 1)
-                                        len += strlen(policydb.p_cat_val_to_name[i - 1]) + 1;
-                                range = 0;
+                /* categories */
+                head = -2;
+                prev = -2;
+                e = &context->range.level[l].cat;
+                ebitmap_for_each_positive_bit(e, node, i) {
+                        if (i - prev > 1) {
+                                /* one or more negative bits are skipped */
+                                if (head != prev) {
+                                        nm = policydb.p_cat_val_to_name[prev];
+                                        len += strlen(nm) + 1;
+                                }
+                                nm = policydb.p_cat_val_to_name[i];
+                                len += strlen(nm) + 1;
+                                head = i;
                         }
+                        prev = i;
+                }
+                if (prev != head) {
+                        nm = policydb.p_cat_val_to_name[prev];
+                        len += strlen(nm) + 1;
                 }
-                /* Handle case where last category is the end of range */
-                if (range > 1)
-                        len += strlen(policydb.p_cat_val_to_name[i - 1]) + 1;
-
                 if (l == 0) {
                         if (mls_level_eq(&context->range.level[0],
-                                         &context->range.level[1]))
+                                         &context->range.level[1]))
                                 break;
                         else
                                 len++;
@@ -84,8 +88,9 @@ int mls_compute_context_len(struct context * context)
 void mls_sid_to_context(struct context *context,
                         char **scontext)
 {
-        char *scontextp;
-        int i, l, range, wrote_sep;
+        char *scontextp, *nm;
+        int i, l, head, prev;
+        struct ebitmap *e;
         struct ebitmap_node *node;
 
         if (!selinux_mls_enabled)
@@ -97,61 +102,54 @@ void mls_sid_to_context(struct context *context,
         scontextp++;
 
         for (l = 0; l < 2; l++) {
-                range = 0;
-                wrote_sep = 0;
                 strcpy(scontextp,
                        policydb.p_sens_val_to_name[context->range.level[l].sens - 1]);
-                scontextp += strlen(policydb.p_sens_val_to_name[context->range.level[l].sens - 1]);
+                scontextp += strlen(scontextp);
 
                 /* categories */
-                ebitmap_for_each_bit(&context->range.level[l].cat, node, i) {
-                        if (ebitmap_node_get_bit(node, i)) {
-                                if (range) {
-                                        range++;
-                                        continue;
-                                }
-
-                                if (!wrote_sep) {
-                                        *scontextp++ = ':';
-                                        wrote_sep = 1;
-                                } else
-                                        *scontextp++ = ',';
-                                strcpy(scontextp, policydb.p_cat_val_to_name[i]);
-                                scontextp += strlen(policydb.p_cat_val_to_name[i]);
-                                range++;
-                        } else {
-                                if (range > 1) {
-                                        if (range > 2)
+                head = -2;
+                prev = -2;
+                e = &context->range.level[l].cat;
+                ebitmap_for_each_positive_bit(e, node, i) {
+                        if (i - prev > 1) {
+                                /* one or more negative bits are skipped */
+                                if (prev != head) {
+                                        if (prev - head > 1)
                                                 *scontextp++ = '.';
                                         else
                                                 *scontextp++ = ',';
-
-                                        strcpy(scontextp, policydb.p_cat_val_to_name[i - 1]);
-                                        scontextp += strlen(policydb.p_cat_val_to_name[i - 1]);
+                                        nm = policydb.p_cat_val_to_name[prev];
+                                        strcpy(scontextp, nm);
+                                        scontextp += strlen(nm);
                                 }
-                                range = 0;
+                                if (prev < 0)
+                                        *scontextp++ = ':';
+                                else
+                                        *scontextp++ = ',';
+                                nm = policydb.p_cat_val_to_name[i];
+                                strcpy(scontextp, nm);
+                                scontextp += strlen(nm);
+                                head = i;
                         }
+                        prev = i;
                 }
 
-                /* Handle case where last category is the end of range */
-                if (range > 1) {
-                        if (range > 2)
+                if (prev != head) {
+                        if (prev - head > 1)
                                 *scontextp++ = '.';
                         else
                                 *scontextp++ = ',';
-
-                        strcpy(scontextp, policydb.p_cat_val_to_name[i - 1]);
-                        scontextp += strlen(policydb.p_cat_val_to_name[i - 1]);
+                        nm = policydb.p_cat_val_to_name[prev];
+                        strcpy(scontextp, nm);
+                        scontextp += strlen(nm);
                 }
 
                 if (l == 0) {
                         if (mls_level_eq(&context->range.level[0],
                                          &context->range.level[1]))
                                 break;
-                        else {
-                                *scontextp = '-';
-                                scontextp++;
-                        }
+                        else
+                                *scontextp++ = '-';
                 }
         }
 
@@ -190,17 +188,15 @@ int mls_context_isvalid(struct policydb *p, struct context *c)
                 if (!levdatum)
                         return 0;
 
-                ebitmap_for_each_bit(&c->range.level[l].cat, node, i) {
-                        if (ebitmap_node_get_bit(node, i)) {
-                                if (i > p->p_cats.nprim)
-                                        return 0;
-                                if (!ebitmap_get_bit(&levdatum->level->cat, i))
-                                        /*
-                                         * Category may not be associated with
-                                         * sensitivity in low level.
-                                         */
-                                        return 0;
-                        }
+                ebitmap_for_each_positive_bit(&c->range.level[l].cat, node, i) {
+                        if (i > p->p_cats.nprim)
+                                return 0;
+                        if (!ebitmap_get_bit(&levdatum->level->cat, i))
+                                /*
+                                 * Category may not be associated with
+                                 * sensitivity in low level.
+                                 */
+                                return 0;
                 }
         }
 
@@ -485,18 +481,16 @@ int mls_convert_context(struct policydb *oldp,
                 c->range.level[l].sens = levdatum->level->sens;
 
                 ebitmap_init(&bitmap);
-                ebitmap_for_each_bit(&c->range.level[l].cat, node, i) {
-                        if (ebitmap_node_get_bit(node, i)) {
-                                int rc;
-
-                                catdatum = hashtab_search(newp->p_cats.table,
-                                                oldp->p_cat_val_to_name[i]);
-                                if (!catdatum)
-                                        return -EINVAL;
-                                rc = ebitmap_set_bit(&bitmap, catdatum->value - 1, 1);
-                                if (rc)
-                                        return rc;
-                        }
+                ebitmap_for_each_positive_bit(&c->range.level[l].cat, node, i) {
+                        int rc;
+
+                        catdatum = hashtab_search(newp->p_cats.table,
+                                                  oldp->p_cat_val_to_name[i]);
+                        if (!catdatum)
+                                return -EINVAL;
+                        rc = ebitmap_set_bit(&bitmap, catdatum->value - 1, 1);
+                        if (rc)
+                                return rc;
                 }
                 ebitmap_destroy(&c->range.level[l].cat);
                 c->range.level[l].cat = bitmap;