On mobile device high-load situations, permission check can happen
more than 90,000/s (8 core system). With default 512 cache nodes
configuration, avc cache miss happens more often and occasionally
leads to long time (>2ms) irqs off on both big and little cores,
which decreases system real-time capability.

Although we can expand avc nodes through /sys/fs/selinux/cache_threshold
to mitigate long time irqs off, hash conflicts make the bucket average
length longer because of the fixed size of cache slots, leading to
avc_search_node() latency increase.

This patch series aims to expand AVC nodes without significantly increasing
avc_search_node() latency.

This is v4 of the patch series.
Changes since v3:
- use MurmurHash3 to improve avc_hash()
- add a config to adjust avc cache slot size instead of kernel parameter
Changes since v2:
- update changelog and fix warnings for commit ("000bce8f11d0
  selinux: improve bucket distribution uniformity of avc_hash()")
Changes since v1:
- improve hash algorithm in avc_hash()
- define avc_cache_slots as a static variable

v1 discussion:
https://lore.kernel.org/selinux/20250905100454.685866-1-zhanghongru@xiaomi.com/
v2 discussion:
https://lore.kernel.org/selinux/cover.1758633723.git.zhanghongru@xiaomi.com/
v3 discussion:
https://lore.kernel.org/selinux/cover.1758859391.git.zhanghongru@xiaomi.com/

Hongru Zhang (3):
  selinux: Introduce a new config to make avc cache slot size adjustable
  selinux: Move avtab_hash() to a shared location for future reuse
  selinux: improve bucket distribution uniformity of avc_hash()

 security/selinux/Kconfig        | 11 ++++++++
 security/selinux/avc.c          |  9 ++++---
 security/selinux/include/hash.h | 47 +++++++++++++++++++++++++++++++++
 security/selinux/ss/avtab.c     | 39 +++------------------------
 4 files changed, 66 insertions(+), 40 deletions(-)
 create mode 100644 security/selinux/include/hash.h


base-commit: c6f0a830ef4bffc8eedd7ddb307bfba4929cd3e1
-- 
2.43.0