|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-changelog] [xen master] evtchn: optimize XSM ssid field
commit a3e12a091147a0804b55c73064beb7e11785ab04
Author: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
AuthorDate: Mon Mar 24 10:55:26 2014 +0100
Commit: Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Mar 24 10:55:26 2014 +0100
evtchn: optimize XSM ssid field
When FLASK is the only enabled implementation of the XSM hooks in Xen,
some of the abstractions required to handle multiple XSM providers are
redundant and only produce unneeded overhead. This patch reduces the
memory overhead of enabling XSM on event channels by replacing the
untyped ssid pointer from struct evtchn with a union containing the
contents of the structure. This avoids an additional heap allocation
for every event channel, and on 64-bit systems, reduces the size of
struct evtchn by 4 bytes. If an out-of-tree XSM module needs the full
flexibility of the generic evtcnn ssid pointer, defining the symbol
XSM_NEED_GENERIC_EVTCHN_SSID will include a suitable pointer field.
This also cleans up the unused selinux_checkreqprot declaration left
from the Linux port.
Signed-off-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
Acked-by: Keir Fraser <keir@xxxxxxx>
---
xen/include/xen/sched.h | 18 +++++++++++++++++-
xen/xsm/flask/hooks.c | 37 ++++++-------------------------------
xen/xsm/flask/include/objsec.h | 6 ------
3 files changed, 23 insertions(+), 38 deletions(-)
diff --git a/xen/include/xen/sched.h b/xen/include/xen/sched.h
index 00f0eba..b9ba379 100644
--- a/xen/include/xen/sched.h
+++ b/xen/include/xen/sched.h
@@ -100,8 +100,24 @@ struct evtchn
u8 pending:1;
u16 last_vcpu_id;
u8 last_priority;
+#ifdef XSM_ENABLE
+ union {
+#ifdef XSM_NEED_GENERIC_EVTCHN_SSID
+ /*
+ * If an XSM module needs more space for its event channel context,
+ * this pointer stores the necessary data for the security server.
+ */
+ void *generic;
+#endif
#ifdef FLASK_ENABLE
- void *ssid;
+ /*
+ * Inlining the contents of the structure for FLASK avoids unneeded
+ * allocations, and on 64-bit platforms with only FLASK enabled,
+ * reduces the size of struct evtchn.
+ */
+ u32 flask_sid;
+#endif
+ } ssid;
#endif
};
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index ba719de..4ce31c9 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -55,8 +55,7 @@ static u32 domain_target_sid(struct domain *src, struct
domain *dst)
static u32 evtchn_sid(const struct evtchn *chn)
{
- struct evtchn_security_struct *esec = chn->ssid;
- return esec->sid;
+ return chn->ssid.flask_sid;
}
static int domain_has_perm(struct domain *dom1, struct domain *dom2,
@@ -182,7 +181,6 @@ static int flask_evtchn_unbound(struct domain *d1, struct
evtchn *chn,
u32 sid1, sid2, newsid;
int rc;
struct domain *d2;
- struct evtchn_security_struct *esec;
d2 = rcu_lock_domain_by_any_id(id2);
if ( d2 == NULL )
@@ -190,7 +188,6 @@ static int flask_evtchn_unbound(struct domain *d1, struct
evtchn *chn,
sid1 = domain_sid(d1);
sid2 = domain_target_sid(d1, d2);
- esec = chn->ssid;
rc = security_transition_sid(sid1, sid2, SECCLASS_EVENT, &newsid);
if ( rc )
@@ -204,7 +201,7 @@ static int flask_evtchn_unbound(struct domain *d1, struct
evtchn *chn,
if ( rc )
goto out;
- esec->sid = newsid;
+ chn->ssid.flask_sid = newsid;
out:
rcu_unlock_domain(d2);
@@ -216,7 +213,6 @@ static int flask_evtchn_interdomain(struct domain *d1,
struct evtchn *chn1,
{
u32 sid1, sid2, newsid, reverse_sid;
int rc;
- struct evtchn_security_struct *esec1;
struct avc_audit_data ad;
AVC_AUDIT_DATA_INIT(&ad, NONE);
ad.sdom = d1;
@@ -225,8 +221,6 @@ static int flask_evtchn_interdomain(struct domain *d1,
struct evtchn *chn1,
sid1 = domain_sid(d1);
sid2 = domain_target_sid(d1, d2);
- esec1 = chn1->ssid;
-
rc = security_transition_sid(sid1, sid2, SECCLASS_EVENT, &newsid);
if ( rc )
{
@@ -252,17 +246,14 @@ static int flask_evtchn_interdomain(struct domain *d1,
struct evtchn *chn1,
if ( rc )
return rc;
- esec1->sid = newsid;
+ chn1->ssid.flask_sid = newsid;
return rc;
}
static void flask_evtchn_close_post(struct evtchn *chn)
{
- struct evtchn_security_struct *esec;
- esec = chn->ssid;
-
- esec->sid = SECINITSID_UNLABELED;
+ chn->ssid.flask_sid = SECINITSID_UNLABELED;
}
static int flask_evtchn_send(struct domain *d, struct evtchn *chn)
@@ -297,33 +288,17 @@ static int flask_evtchn_reset(struct domain *d1, struct
domain *d2)
static int flask_alloc_security_evtchn(struct evtchn *chn)
{
- struct evtchn_security_struct *esec;
-
- esec = xzalloc(struct evtchn_security_struct);
- if ( !esec )
- return -ENOMEM;
-
- esec->sid = SECINITSID_UNLABELED;
-
- chn->ssid = esec;
+ chn->ssid.flask_sid = SECINITSID_UNLABELED;
return 0;
}
static void flask_free_security_evtchn(struct evtchn *chn)
{
- struct evtchn_security_struct *esec;
-
if ( !chn )
return;
- esec = chn->ssid;
-
- if ( !esec )
- return;
-
- chn->ssid = NULL;
- xfree(esec);
+ chn->ssid.flask_sid = SECINITSID_UNLABELED;
}
static char *flask_show_security_evtchn(struct domain *d, const struct evtchn
*chn)
diff --git a/xen/xsm/flask/include/objsec.h b/xen/xsm/flask/include/objsec.h
index 6595dc3..b576a5d 100644
--- a/xen/xsm/flask/include/objsec.h
+++ b/xen/xsm/flask/include/objsec.h
@@ -23,10 +23,4 @@ struct domain_security_struct {
u32 target_sid; /* SID for device model target domain */
};
-struct evtchn_security_struct {
- u32 sid; /* current SID */
-};
-
-extern unsigned int selinux_checkreqprot;
-
#endif /* _FLASK_OBJSEC_H_ */
--
generated by git-patchbot for /home/xen/git/xen.git#master
_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog
|
 |
Lists.xenproject.org is hosted with RackSpace, monitoring our |