From nobody Wed Dec 17 08:52:28 2025 Received: from mail-pj1-f66.google.com (mail-pj1-f66.google.com [209.85.216.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 43E5E30BB82 for ; Thu, 23 Oct 2025 11:29:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.66 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761218970; cv=none; b=AZHWwQkylABWTs89VWWkwQthusejunl325fAnLEfjupA5c+M/IZuS1WP2oqnIKsVpSth40FFdPElqN5vBewymPHFTq6VJ8QztH+1DY3nO3ILKk7oNgMzb8GMr2Lq98y2GISBX89O/pkZTM8d9DGr9HDFdtZnaDmwcKp9o3vaGkQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761218970; c=relaxed/simple; bh=FzKKP+qi1TzhAHy7hRHyyiW9VgAJXjaR72cYrrVJ5mc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kDQIom0XtwP1D0aM9wjqF3SqaLMcmduWhogv9veFQNALkIEi1hX4HlsCcYNq7032TeMZeOH95sQnpjzpuW68pph33VbCiGYMIIEGhstuyHrPaZtvodD8gClyXKDkjq8EfuyPd/pTaZse9unzfQgTbmPYDtMoWw16+JRWqVh/q8g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bYtkqRJO; arc=none smtp.client-ip=209.85.216.66 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bYtkqRJO" Received: by mail-pj1-f66.google.com with SMTP id 98e67ed59e1d1-33d463e79ddso900195a91.0 for ; Thu, 23 Oct 2025 04:29:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1761218967; x=1761823767; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=pI8fyvV9NpEDh37BJB0AeNnznBi5OzA64bjGckGCQw4=; b=bYtkqRJO3m2MRd84Vh8P8CENFYgXShP7hPZayPRpzHltTEjMRbDEG2gAJblVt3iU1C pyh/BdGcXrPx5MUCWFx7es6Yd718xgvasR3ibASOPdIQoFI7P6MiNjtYH+fHgykZV8ru /edtBNnv2xnc1RJVW+J50tCiqndrpvTEa9A7gZ1VJF0rLjcQinNuUJ9j+ZJuZ8L8TorP hY9z1if0M4y7d9yiqe2oYkfZDcn9aWqUEIUS08K+83t//sIrBlnOsCvA9aFsjc5ncT3h 5lU1FDhHLubrPipc2uhC2OVL8rjVTR6GRMJak5JONyU8SoSrYEU9dgkyfotxCbLeS47l c9Pw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1761218967; x=1761823767; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=pI8fyvV9NpEDh37BJB0AeNnznBi5OzA64bjGckGCQw4=; b=ehAevmqLN1O2OR3nmywPN90XXM482oEvWhLILrzoJ9Oct/vlHEYWJU5YTpa7NRwcdk yupyV88arUuWxsbjPBHHwmjRpRZIobfMNiwAl/lETbNheBGYETLscC9cagNimlEesRuj 0GF2H9UzD7PvxOaNBwdo98K/Vurv6J66PMMCoXqheEysvHviWfAPAfQMeawnFZ2J4ugG oUL73JVWlblDpIxmxYtqboOT1gZXgTjL3ePZ+iWjPvas2LtQk6s6NM1iuHtvjR9ldj++ 6S8TpEBHHH7EU4GMbU4vj3apXHCiUCFQVv7W9XJdA1pA/BaHIujJpELP+0hmoiolZxvD vF6w== X-Gm-Message-State: AOJu0YwihCT80smiGuk/4FJt8zgol+ojxBrA0ZaeZMQ2iZ8ffM8Jpw2K TC03t5lrpsHkF8nSGsD9K/HVH0nzVVA2XbOfEXsDZWjPbqLQ7aKkWWaQ X-Gm-Gg: ASbGncveWo+EhrYfj2Vqh/F+z7fQ+56h2ITENI4PZejWFwLlSGe/J5uTkl+5aiemjDI e62Rbrp/U1abF+T5Q28/P88mspqnm238+MCTHuXjTtYbmeS4lBwF0KBcMajuw9I7SXkqZI8aimI WKlhdFWxHAPVdGpmr+Mz1vqsVS+4yYCxzWq1Mj77EFbsRMMyuTRA/wnxsPsLdVtq1+3DdmYwxPn DX/Um5KS6/YL3AneHGn5SDo9MBDgGQcTlRFsdcsuLGUV0/b27a77fQ6sfhj3zvJ13pq/QiefncI fnYEBKPPYuVYg2pYrjeEJXTVbj1I7Om6u40d5r9Rffuji1B1c0Bh5QhTThXJeEAtLRfygT3S+LI wqOAhL5c0YkJWn4mgw/xhbvr19v/1Ild+ogD+7xwdG/kcW8JcNghAm3ZY9YPB21DFW05OP3bu04 WsJsAmV+Mz1H2idFvm0kqIG0EHZh29rax8MVebv2Y= X-Google-Smtp-Source: AGHT+IHMYmeE18WGGDWshrdmjaUibaI2DHVfeSDnI9qvk7s92Hc90Yy/ULdLnI50ohpLA3HpbFF6uw== X-Received: by 2002:a17:903:b0e:b0:290:c76f:d2ac with SMTP id d9443c01a7336-290cb65c5dbmr299615075ad.43.1761218967442; Thu, 23 Oct 2025 04:29:27 -0700 (PDT) Received: from zhr-ThinkStation-K.mioffice.cn ([43.224.245.231]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2946de02cb7sm20942165ad.40.2025.10.23.04.29.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Oct 2025 04:29:26 -0700 (PDT) From: Hongru Zhang X-Google-Original-From: Hongru Zhang To: paul@paul-moore.com, stephen.smalley.work@gmail.com, omosnace@redhat.com Cc: linux-kernel@vger.kernel.org, selinux@vger.kernel.org, zhanghongru@xiaomi.com Subject: [PATCH v4 1/3] selinux: Introduce a new config to make avc cache slot size adjustable Date: Thu, 23 Oct 2025 19:29:19 +0800 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Hongru Zhang On mobile device high-load situations, permission check can happen more than 90,000/s (8 core system). With default 512 cache nodes configuration, avc cache miss happens more often and occasionally leads to long time (>2ms) irqs off on both big and little cores, which decreases system real-time capability. An actual call stack is as follows: =3D> avc_compute_av =3D> avc_perm_nonode =3D> avc_has_perm_noaudit =3D> selinux_capable =3D> security_capable =3D> capable =3D> __sched_setscheduler =3D> do_sched_setscheduler =3D> __arm64_sys_sched_setscheduler =3D> invoke_syscall =3D> el0_svc_common =3D> do_el0_svc =3D> el0_svc =3D> el0t_64_sync_handler =3D> el0t_64_sync Although we can expand avc nodes through /sys/fs/selinux/cache_threshold to mitigate long time irqs off, hash conflicts make the bucket average length longer because of the fixed size of cache slots, leading to avc_search_node() latency increase. So introduce a new config to make avc cache slot size also configurable, and with fine tuning, we can mitigate long time irqs off with slightly avc_search_node() performance regression. Theoretically, the main overhead is memory consumption. Signed-off-by: Hongru Zhang --- security/selinux/Kconfig | 11 +++++++++++ security/selinux/avc.c | 6 +++--- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig index 61abc1e094a8..5588c4d573f6 100644 --- a/security/selinux/Kconfig +++ b/security/selinux/Kconfig @@ -69,6 +69,17 @@ config SECURITY_SELINUX_SID2STR_CACHE_SIZE =20 If unsure, keep the default value. =20 +config SECURITY_SELINUX_AVC_HASH_BITS + int "SELinux avc hashtable size" + depends on SECURITY_SELINUX + range 9 14 + default 9 + help + This option sets the number of buckets used in the AVC hash table + to 2^SECURITY_SELINUX_AVC_HASH_BITS. A higher value helps maintain + shorter chain lengths especially when expanding AVC nodes via + /sys/fs/selinux/avc/cache_threshold. + config SECURITY_SELINUX_DEBUG bool "SELinux kernel debugging support" depends on SECURITY_SELINUX diff --git a/security/selinux/avc.c b/security/selinux/avc.c index 430b0e23ee00..c12d45e46db6 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c @@ -34,9 +34,9 @@ #define CREATE_TRACE_POINTS #include =20 -#define AVC_CACHE_SLOTS 512 -#define AVC_DEF_CACHE_THRESHOLD 512 -#define AVC_CACHE_RECLAIM 16 +#define AVC_CACHE_SLOTS (1 << CONFIG_SECURITY_SELINUX_AVC_HASH_BITS) +#define AVC_DEF_CACHE_THRESHOLD AVC_CACHE_SLOTS +#define AVC_CACHE_RECLAIM 16 =20 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS #define avc_cache_stats_incr(field) this_cpu_inc(avc_cache_stats.field) --=20 2.43.0 From nobody Wed Dec 17 08:52:28 2025 Received: from mail-pg1-f193.google.com (mail-pg1-f193.google.com [209.85.215.193]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7885830E0CB for ; Thu, 23 Oct 2025 11:30:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.193 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761219004; cv=none; b=rk0gChGGdknMjKSINnGAqCADqiuMuINZdc4Y1WRz04hnHOh9Sb7MqGZ9pikYcJMqOFH5o+HH3VZSyonoKaQEV7H91ls1q7pDsxVBGEsGZ1QOZknJFSB9wYJV8v6nDy5x3KB06STTzKCk6zn0GMNqI38yUeEB2SgMkLaeUY9lC3k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761219004; c=relaxed/simple; bh=3cmcw6O1JT0q/DZK1ZW/J4/7wvV5/ihiGwU0wWyX6Sk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gWsNs8zUXdFCHgqrlu81uTes1W7Dq3of77H66WcEXj8POlmAdOtqJe7XMtsuDl6I1wxPEcP1FkRXmJzS3kU6giKmMv5fxXU5lnrb0T0dRhTM0hP06ojzPTTElb70RPmjuLYzsM0PgPsQYqW5jp1uHHHnsO4JtMGoDTrQpXA1H8A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=R2bUaFvL; arc=none smtp.client-ip=209.85.215.193 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="R2bUaFvL" Received: by mail-pg1-f193.google.com with SMTP id 41be03b00d2f7-b6a225b7e9eso510313a12.0 for ; Thu, 23 Oct 2025 04:30:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1761219002; x=1761823802; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=pSSwZBbOhzicOHkC0jzyAmVpir4bL5Qo+D6Q4ZcG14k=; b=R2bUaFvLpFNhPZwz42gjuqlGRXbFYIhh/po0QtjkHUSvtjaUOiTz1YCh/2OK2LSDKT CnnO6PVPnVG1RYVQJDHn7quJx0m3uAlxjPJC4tbDI3RnyCqPwn7G9P8bV0pCOnLwSCyt PdIsPogjtou4RytBBqPdKEUhDHnRdo6U/AGcmJQXs14I3xycS0vZUyZruWwWv1fYWACf vAKFOSa6HVaHIt55vpx47F2To06igH5XE/kbBzyAWpCPnbcpln127SXd2NW8sEVrJUQ0 geK90wKxCBRxV6CA6J9D6Mv2WvnB+JpwhOBl14RiQTlh9zkr2SuCh/RXRX5JdYjVmm7U PcdQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1761219002; x=1761823802; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=pSSwZBbOhzicOHkC0jzyAmVpir4bL5Qo+D6Q4ZcG14k=; b=n5NmTVC1f666PLwECJyWa/ne9s+EgWG2QpYq626szLi//hGGhRDpgO4qdD5cU54BRo 1KYYjBqYZNT81dPrvKgH0kGXFOaPqkSh7oFir/QpJ9XOllMSuPSAiYa+ZKevCijQnVkM lkCkWVV2kB6NRcEyGhsn1kIfeZNIx7IgweCHyixqZlyNYqCRJNoiPVoPMHHq7F7c5G9R ksrJ13E3/saiNOqMSiZaHhRRRxaKn8/M7pr/ftJa21iTRkvrDr/W5ajKBYRPw9qMcby3 3rww9ivFMwEAHbNz249IKVvMGF7sJIkDOu5kWudFmUu3gkrimXVf2rkudRZCgLe02wRM rQsg== X-Gm-Message-State: AOJu0YxK7ua5QLvyS6WrY1ZQTn+718KHAcUjBxdqt4YPkZlxX6TuOleN pi87vxdPkZfg/TLfbdLtq3dS0eid05hMr9s9FNbpkyVbLQJq6IrnVZAD X-Gm-Gg: ASbGncvXqW8tCF2DyJOjU3ssJmqpR0PRQM94/+oJEYHIC2MPVpLbYZlfiPix2xmqZar SWDDVB7FrrAV5vsodnB/JqmMJn916TOiFXeRaYcKBLDoFc4XUMylF48kp4MkhSf+aZgb+covdFP rw/MtmXH7oZITJ57NyaoqS5szJBnl1n9Rr3PpDNwuMeww5GTw7Gd5RyPMNnbnN8ezE2nfs1utnK QsbQpKhMq+Bolva0q9fVH1p0AOJVSwJfBLPumAQdVd2arvlvSZKGPbsTbmHAa+w1Dmh+fIW7S9d 6SE8KBzobHug+GaB19zMP1I0fOMlWknF0GqwDOwzVa/PLXsUYqula3/iUqstWzGNoBSy6+nG157 pCeTcAzjAYuZb7mHponEanGSLb8GeI3S9UsphaRv7RnayrCsMFC1LYuDX6k5bl9i75chzCqWZle S1c5dNHmpqqbBXkSbtaQ9edilp/0ZTF4ObLv1SYc0= X-Google-Smtp-Source: AGHT+IHq/+kXGc2/fBqgPUCYCUQAWCMlK3uONwZTn9qBtZxs7snqnVTZyF//ylvAIdgH0uG3mnHE3w== X-Received: by 2002:a17:902:e743:b0:290:ad79:c613 with SMTP id d9443c01a7336-290cb27c76cmr298740505ad.47.1761219001668; Thu, 23 Oct 2025 04:30:01 -0700 (PDT) Received: from zhr-ThinkStation-K.mioffice.cn ([43.224.245.231]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2946dded613sm20473685ad.37.2025.10.23.04.29.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Oct 2025 04:30:00 -0700 (PDT) From: Hongru Zhang X-Google-Original-From: Hongru Zhang To: paul@paul-moore.com, stephen.smalley.work@gmail.com, omosnace@redhat.com Cc: linux-kernel@vger.kernel.org, selinux@vger.kernel.org, zhanghongru@xiaomi.com Subject: [PATCH v4 2/3] selinux: Move avtab_hash() to a shared location for future reuse Date: Thu, 23 Oct 2025 19:29:54 +0800 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Hongru Zhang This is a preparation patch, no functional change. Signed-off-by: Hongru Zhang --- security/selinux/include/hash.h | 46 +++++++++++++++++++++++++++++++++ security/selinux/ss/avtab.c | 41 +---------------------------- 2 files changed, 47 insertions(+), 40 deletions(-) create mode 100644 security/selinux/include/hash.h diff --git a/security/selinux/include/hash.h b/security/selinux/include/has= h.h new file mode 100644 index 000000000000..5b429a873eb6 --- /dev/null +++ b/security/selinux/include/hash.h @@ -0,0 +1,46 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef _SELINUX_HASH_H_ +#define _SELINUX_HASH_H_ + +/* Based on MurmurHash3, written by Austin Appleby and placed in the + * public domain. + */ +static inline u32 avtab_hash(const struct avtab_key *keyp, u32 mask) +{ + static const u32 c1 =3D 0xcc9e2d51; + static const u32 c2 =3D 0x1b873593; + static const u32 r1 =3D 15; + static const u32 r2 =3D 13; + static const u32 m =3D 5; + static const u32 n =3D 0xe6546b64; + + u32 hash =3D 0; + +#define mix(input) \ + do { \ + u32 v =3D input; \ + v *=3D c1; \ + v =3D (v << r1) | (v >> (32 - r1)); \ + v *=3D c2; \ + hash ^=3D v; \ + hash =3D (hash << r2) | (hash >> (32 - r2)); \ + hash =3D hash * m + n; \ + } while (0) + + mix(keyp->target_class); + mix(keyp->target_type); + mix(keyp->source_type); + +#undef mix + + hash ^=3D hash >> 16; + hash *=3D 0x85ebca6b; + hash ^=3D hash >> 13; + hash *=3D 0xc2b2ae35; + hash ^=3D hash >> 16; + + return hash & mask; +} + +#endif /* _SELINUX_HASH_H_ */ diff --git a/security/selinux/ss/avtab.c b/security/selinux/ss/avtab.c index c2c31521cace..15e89d9b5d72 100644 --- a/security/selinux/ss/avtab.c +++ b/security/selinux/ss/avtab.c @@ -20,50 +20,11 @@ #include #include "avtab.h" #include "policydb.h" +#include "hash.h" =20 static struct kmem_cache *avtab_node_cachep __ro_after_init; static struct kmem_cache *avtab_xperms_cachep __ro_after_init; =20 -/* Based on MurmurHash3, written by Austin Appleby and placed in the - * public domain. - */ -static inline u32 avtab_hash(const struct avtab_key *keyp, u32 mask) -{ - static const u32 c1 =3D 0xcc9e2d51; - static const u32 c2 =3D 0x1b873593; - static const u32 r1 =3D 15; - static const u32 r2 =3D 13; - static const u32 m =3D 5; - static const u32 n =3D 0xe6546b64; - - u32 hash =3D 0; - -#define mix(input) \ - do { \ - u32 v =3D input; \ - v *=3D c1; \ - v =3D (v << r1) | (v >> (32 - r1)); \ - v *=3D c2; \ - hash ^=3D v; \ - hash =3D (hash << r2) | (hash >> (32 - r2)); \ - hash =3D hash * m + n; \ - } while (0) - - mix(keyp->target_class); - mix(keyp->target_type); - mix(keyp->source_type); - -#undef mix - - hash ^=3D hash >> 16; - hash *=3D 0x85ebca6b; - hash ^=3D hash >> 13; - hash *=3D 0xc2b2ae35; - hash ^=3D hash >> 16; - - return hash & mask; -} - static struct avtab_node *avtab_insert_node(struct avtab *h, struct avtab_node **dst, const struct avtab_key *key, --=20 2.43.0 From nobody Wed Dec 17 08:52:28 2025 Received: from mail-pf1-f194.google.com (mail-pf1-f194.google.com [209.85.210.194]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E3833093C7 for ; Thu, 23 Oct 2025 11:30:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.194 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761219028; cv=none; b=rZU+ARdbkzxToHFKKkd+sC08sKf3dHCyuW35rDJJCoGQgbGgi+nbFX5MVlwbynrFqQJf0iXIRYsOAdQz7CvGa5/8B0+PdFsucui+5aGrbzr8He++iro5GgksXi7OJIlpkvMqPIuSkdJ7n1jMHlg1TnQ6WDFJ7eQuHtpoWYpVA/w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761219028; c=relaxed/simple; bh=g1DU7d94xMAyLBEjLrv5eEgZmKZsihsLzGHxYVkc4e4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qIs/QJTq34q02RIuya4q/4SeNYpaOBGYX5sIhA9ZFrNSLYVVyqqyZaLZ4iIb1HQpFGSlHtP3ktKv0s0aJwhA/uGDwIoxcd1M3edQ9n4XBARjLlHzbVlxCMEBp/x1GWDQTZJZnw28lyEcINcjO92nWq6/eS7YuKL5nN9MGUmTIFM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NZCJ0Wo3; arc=none smtp.client-ip=209.85.210.194 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NZCJ0Wo3" Received: by mail-pf1-f194.google.com with SMTP id d2e1a72fcca58-7811a02316bso521356b3a.3 for ; Thu, 23 Oct 2025 04:30:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1761219026; x=1761823826; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=aLppwfFWUo1tq7Snl3tWff6m26kvcM/wx2BRdiKXXcI=; b=NZCJ0Wo3XD3NZYME7JarAHy4BMt82k0z1eTVAia4CSl6v+/S6h8DQvSOn1yvgU6o3i 6pUDP6vNTi6+ALik5WlQ+owfhSdIjqmvHePAyH0Y96x78Y2nMdalySQgzQAnfuZnnQeB tWeJD8Us5vix9ztiyEswKI6qWlA72XJ8pveluDxqFkIJ6oTXJgD1xY9r+R0RoV73moR7 qJKQtB/4IqRc4EPxBpd1bFP9rFrJFNu3Dhne3Wz6D4BIV4Z2N7bUyQUzWgn5oJG/hT/N DejBD/eDoPb5k3Fo4PU9qgVRlI1aDX8WbNrNxvCz4aWzbu7Lnl6/aHs46EHSn5OuriZO TcAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1761219026; x=1761823826; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=aLppwfFWUo1tq7Snl3tWff6m26kvcM/wx2BRdiKXXcI=; b=ud0KZYodpGmmH0Yp7/DGoDQtMtXmgeROZfmED62WqaG/Fzk1HnTXua/2fVzVq5EvRm qCkj+R8woAPZPUWErJniJ+wN3VblKjSVgbYp86IhF+V70YSaJUiQhZ9DoOIdaZxjnGQs J3mofJSEIPRkiDxTE+PhA7Lj8pl25piPMKkYcHzRde60eh/uPeMFPaBCCaVsjNrIiBpP ikoVVls8D37oEYV7/I59A4k1m+mLv57Yzjz1mRWqeqzyJLPKtBajfI4vzoxzVD9a6qrY ejHKQusJHhg259ileKkzdVyBWHDliDdKmi3k7OdzeIWP6Kw47poVxzrvA/owfryybjVC FiQw== X-Gm-Message-State: AOJu0YyX4mPSvFdKgSfdUtV5Mq0UupL/XVDKKgKLvnniGor/vpc+c2sv M5vv9az60+3DFW/6b9H1scbFlrxyaTBmxaX2rknH66G0BDg5duf1J5yraXIZXFH+ X-Gm-Gg: ASbGnct2auKcH5GVgiPVT+Aghvh+9URCryWBB61na5GfFzPvg/xHmybN/itl8L0GChJ ePfo+U01RHjw8Ab0/stiet3heiHM1pTlsKVCqE/qvZnFLWtuO/RS4yFEyplDtjHH0o4ppPr5ARO K+HkTeXAnW5VQNK3bOpsavEIu64dO+R5a4wQdLip6Jftu4sobUUAzgQEzSodK6AKcDZGaiV36EA 47N0fjguP4SXrSNFrITLtKVSsZy7uyaCoyyuMBwe/H4oQSNg8VC+9lkl9Uc32hpsRCJ8qCcl+59 0OIyjnISbB6H8CC89U2t0tDbgS2j5iSBl+Bz+Bve9ipYwbwWFuYKwXEThTf8L6O5mXfvpXantkZ DWojL7RBD4Lc0w+XgoM3m65HJn6wDp5MUdxffeEGJe21IAB6mqV0h+qq7UBk0DIG8ag8iYyXKKs OOkLlVIUeiL83vuips89nGQ2whyPVdqhbudxnp74w= X-Google-Smtp-Source: AGHT+IGVxKcixynlh26jYNQh04/DlYMvYZG4vx+TykiwHkcLG3w5tzvnhnluh27LHDoEaKYdepQqUw== X-Received: by 2002:a05:6a21:3289:b0:2f3:b278:eaa5 with SMTP id adf61e73a8af0-334a862dffcmr29150670637.60.1761219026204; Thu, 23 Oct 2025 04:30:26 -0700 (PDT) Received: from zhr-ThinkStation-K.mioffice.cn ([43.224.245.231]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-b6cf4e0a42fsm1834429a12.25.2025.10.23.04.30.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Oct 2025 04:30:25 -0700 (PDT) From: Hongru Zhang X-Google-Original-From: Hongru Zhang To: paul@paul-moore.com, stephen.smalley.work@gmail.com, omosnace@redhat.com Cc: linux-kernel@vger.kernel.org, selinux@vger.kernel.org, zhanghongru@xiaomi.com Subject: [PATCH v4 3/3] selinux: improve bucket distribution uniformity of avc_hash() Date: Thu, 23 Oct 2025 19:30:18 +0800 Message-ID: <4bf4246da1ad44670093e006bffd3c9e07f089ea.1761217900.git.zhanghongru@xiaomi.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Hongru Zhang Reuse the already implemented MurmurHash3 algorithm. Under heavy stress testing (on an 8-core system sustaining over 50,000 authentication events per second), sample once per second and take the mean of 1800 samples: 1. Bucket utilization rate and length of longest chain +--------------------------+-----------------------------------------+ | | bucket utilization rate / longest chain | | +--------------------+--------------------+ | | no-patch | with-patch | +--------------------------+--------------------+--------------------+ | 512 nodes, 512 buckets | 52.5%/7.5 | 60.2%/5.7 | +--------------------------+--------------------+--------------------+ | 1024 nodes, 512 buckets | 68.9%/12.1 | 80.2%/9.7 | +--------------------------+--------------------+--------------------+ | 2048 nodes, 512 buckets | 83.7%/19.4 | 93.4%/16.3 | +--------------------------+--------------------+--------------------+ | 8192 nodes, 8192 buckets | 49.5%/11.4 | 60.3%/7.4 | +--------------------------+--------------------+--------------------+ 2. avc_search_node latency (total latency of hash operation and table lookup) +--------------------------+-----------------------------------------+ | | latency of function avc_search_node | | +--------------------+--------------------+ | | no-patch | with-patch | +--------------------------+--------------------+--------------------+ | 512 nodes, 512 buckets | 87ns | 84ns | +--------------------------+--------------------+--------------------+ | 1024 nodes, 512 buckets | 97ns | 96ns | +--------------------------+--------------------+--------------------+ | 2048 nodes, 512 buckets | 118ns | 113ns | +--------------------------+--------------------+--------------------+ | 8192 nodes, 8192 buckets | 106ns | 99ns | +--------------------------+--------------------+--------------------+ Although MurmurHash3 has higher overhead than the bitwise operations in the original algorithm, the data shows that the MurmurHash3 achieves better distribution, reducing average lookup time. Consequently, the total latency of hashing and table lookup is lower than before. Signed-off-by: Hongru Zhang --- security/selinux/avc.c | 3 ++- security/selinux/include/hash.h | 11 ++++++----- security/selinux/ss/avtab.c | 6 ++++++ 3 files changed, 14 insertions(+), 6 deletions(-) diff --git a/security/selinux/avc.c b/security/selinux/avc.c index c12d45e46db6..8f77b9a732e1 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c @@ -30,6 +30,7 @@ #include "avc.h" #include "avc_ss.h" #include "classmap.h" +#include "hash.h" =20 #define CREATE_TRACE_POINTS #include @@ -124,7 +125,7 @@ static struct kmem_cache *avc_xperms_cachep __ro_after_= init; =20 static inline u32 avc_hash(u32 ssid, u32 tsid, u16 tclass) { - return (ssid ^ (tsid<<2) ^ (tclass<<4)) & (AVC_CACHE_SLOTS - 1); + return av_hash(ssid, tsid, (u32)tclass, (u32)(AVC_CACHE_SLOTS - 1)); } =20 /** diff --git a/security/selinux/include/hash.h b/security/selinux/include/has= h.h index 5b429a873eb6..18956dbef8ff 100644 --- a/security/selinux/include/hash.h +++ b/security/selinux/include/hash.h @@ -3,10 +3,11 @@ #ifndef _SELINUX_HASH_H_ #define _SELINUX_HASH_H_ =20 -/* Based on MurmurHash3, written by Austin Appleby and placed in the +/* + * Based on MurmurHash3, written by Austin Appleby and placed in the * public domain. */ -static inline u32 avtab_hash(const struct avtab_key *keyp, u32 mask) +static inline u32 av_hash(u32 key1, u32 key2, u32 key3, u32 mask) { static const u32 c1 =3D 0xcc9e2d51; static const u32 c2 =3D 0x1b873593; @@ -28,9 +29,9 @@ static inline u32 avtab_hash(const struct avtab_key *keyp= , u32 mask) hash =3D hash * m + n; \ } while (0) =20 - mix(keyp->target_class); - mix(keyp->target_type); - mix(keyp->source_type); + mix(key1); + mix(key2); + mix(key3); =20 #undef mix =20 diff --git a/security/selinux/ss/avtab.c b/security/selinux/ss/avtab.c index 15e89d9b5d72..7d44b546ab45 100644 --- a/security/selinux/ss/avtab.c +++ b/security/selinux/ss/avtab.c @@ -25,6 +25,12 @@ static struct kmem_cache *avtab_node_cachep __ro_after_init; static struct kmem_cache *avtab_xperms_cachep __ro_after_init; =20 +static inline u32 avtab_hash(const struct avtab_key *keyp, u32 mask) +{ + return av_hash((u32)keyp->target_class, (u32)keyp->target_type, + (u32)keyp->source_type, mask); +} + static struct avtab_node *avtab_insert_node(struct avtab *h, struct avtab_node **dst, const struct avtab_key *key, --=20 2.43.0