From owner-svn-src-head@FreeBSD.ORG Mon Mar 9 10:45:59 2009 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 38C0E106564A; Mon, 9 Mar 2009 10:45:59 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 260B88FC14; Mon, 9 Mar 2009 10:45:59 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id n29Ajxwi020383; Mon, 9 Mar 2009 10:45:59 GMT (envelope-from rwatson@svn.freebsd.org) Received: (from rwatson@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id n29AjwEC020379; Mon, 9 Mar 2009 10:45:58 GMT (envelope-from rwatson@svn.freebsd.org) Message-Id: <200903091045.n29AjwEC020379@svn.freebsd.org> From: Robert Watson Date: Mon, 9 Mar 2009 10:45:58 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r189570 - in head/sys: security/audit sys X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Mar 2009 10:45:59 -0000 Author: rwatson Date: Mon Mar 9 10:45:58 2009 New Revision: 189570 URL: http://svn.freebsd.org/changeset/base/189570 Log: Add a new thread-private flag, TDP_AUDITREC, to indicate whether or not there is an audit record hung off of td_ar on the current thread. Test this flag instead of td_ar when auditing syscall arguments or checking for an audit record to commit on syscall return. Under these circumstances, td_pflags is much more likely to be in the cache (especially if there is no auditing of the current system call), so this should help reduce cache misses in the system call return path. MFC after: 1 week Reported by: kris Obtained from: TrustedBSD Project Modified: head/sys/security/audit/audit.c head/sys/security/audit/audit.h head/sys/security/audit/audit_syscalls.c head/sys/sys/proc.h Modified: head/sys/security/audit/audit.c ============================================================================== --- head/sys/security/audit/audit.c Mon Mar 9 08:25:05 2009 (r189569) +++ head/sys/security/audit/audit.c Mon Mar 9 10:45:58 2009 (r189570) @@ -492,6 +492,8 @@ audit_syscall_enter(unsigned short code, au_id_t auid; KASSERT(td->td_ar == NULL, ("audit_syscall_enter: td->td_ar != NULL")); + KASSERT((td->td_pflags & TDP_AUDITREC) == 0, + ("audit_syscall_enter: TDP_AUDITREC set")); /* * In FreeBSD, each ABI has its own system call table, and hence @@ -542,9 +544,13 @@ audit_syscall_enter(unsigned short code, panic("audit_failing_stop: thread continued"); } td->td_ar = audit_new(event, td); - } else if (audit_pipe_preselect(auid, event, class, AU_PRS_BOTH, 0)) + if (td->td_ar != NULL) + td->td_pflags |= TDP_AUDITREC; + } else if (audit_pipe_preselect(auid, event, class, AU_PRS_BOTH, 0)) { td->td_ar = audit_new(event, td); - else + if (td->td_ar != NULL) + td->td_pflags |= TDP_AUDITREC; + } else td->td_ar = NULL; } @@ -572,6 +578,7 @@ audit_syscall_exit(int error, struct thr audit_commit(td->td_ar, error, retval); td->td_ar = NULL; + td->td_pflags &= ~TDP_AUDITREC; } void @@ -626,6 +633,8 @@ audit_thread_free(struct thread *td) { KASSERT(td->td_ar == NULL, ("audit_thread_free: td_ar != NULL")); + KASSERT((td->td_pflags & TDP_AUDITREC) == 0, + ("audit_thread_free: TDP_AUDITREC set")); } void Modified: head/sys/security/audit/audit.h ============================================================================== --- head/sys/security/audit/audit.h Mon Mar 9 08:25:05 2009 (r189569) +++ head/sys/security/audit/audit.h Mon Mar 9 10:45:58 2009 (r189570) @@ -186,7 +186,7 @@ void audit_thread_free(struct thread *t * audit_enabled flag before performing the actual call. */ #define AUDIT_ARG(op, args...) do { \ - if (td->td_ar != NULL) \ + if (td->td_pflags & TDP_AUDITREC) \ audit_arg_ ## op (args); \ } while (0) @@ -202,7 +202,7 @@ void audit_thread_free(struct thread *t * auditing is disabled, so we don't just check audit_enabled here. */ #define AUDIT_SYSCALL_EXIT(error, td) do { \ - if (td->td_ar != NULL) \ + if (td->td_pflags & TDP_AUDITREC) \ audit_syscall_exit(error, td); \ } while (0) @@ -210,7 +210,7 @@ void audit_thread_free(struct thread *t * A Macro to wrap the audit_sysclose() function. */ #define AUDIT_SYSCLOSE(td, fd) do { \ - if (audit_enabled) \ + if (td->td_pflags & TDP_AUDITREC) \ audit_sysclose(td, fd); \ } while (0) Modified: head/sys/security/audit/audit_syscalls.c ============================================================================== --- head/sys/security/audit/audit_syscalls.c Mon Mar 9 08:25:05 2009 (r189569) +++ head/sys/security/audit/audit_syscalls.c Mon Mar 9 10:45:58 2009 (r189570) @@ -96,6 +96,7 @@ audit(struct thread *td, struct audit_ar td->td_ar = audit_new(AUE_NULL, td); if (td->td_ar == NULL) return (ENOTSUP); + td->td_pflags |= TDP_AUDITREC; ar = td->td_ar; } Modified: head/sys/sys/proc.h ============================================================================== --- head/sys/sys/proc.h Mon Mar 9 08:25:05 2009 (r189569) +++ head/sys/sys/proc.h Mon Mar 9 10:45:58 2009 (r189570) @@ -368,6 +368,7 @@ do { \ #define TDP_KTHREAD 0x00200000 /* This is an official kernel thread */ #define TDP_CALLCHAIN 0x00400000 /* Capture thread's callchain */ #define TDP_IGNSUSP 0x00800000 /* Permission to ignore the MNTK_SUSPEND* */ +#define TDP_AUDITREC 0x01000000 /* Audit record pending on thread */ /* * Reasons that the current thread can not be run yet.