Messages in this thread | | | Date | Thu, 7 Jun 2007 21:51:51 +0200 | From | Ingo Molnar <> | Subject | Re: [bug] very high non-preempt latency in context_struct_compute_av() |
| |
* Stephen Smalley <sds@tycho.nsa.gov> wrote:
> Can you try the patch below to see whether it helps? > > In security_get_user_sids, move the transition permission checks > outside of the section holding the policy rdlock, and use the AVC to > perform the checks, calling cond_resched after each one. These > changes should allow preemption between the individual checks and > enable caching of the results. It may however increase the overall > time spent in the function in some cases, particularly in the cache > miss case. > > The long term fix will be to take much of this logic to userspace by > exporting additional state via selinuxfs, and ultimately deprecating > and eliminating this interface from the kernel. > > Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
i have just tried your patch and it completely solves the issue! Without the patch, a simple script that keeps logging in on a box:
while :; do ssh testbox true; done
would cause glxgears to get into a very jerky motion due to the latencies. With the patch it's 100%, totally smooth! Thanks!
Tested-by: Ingo Molnar <mingo@elte.hu>
Ingo - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |