From: Steven Rostedt <[email protected]>
Impact: clean up
Accounding to the annotated branch profiler, the unlikelys used by
ptrace is incorrect every time.
correct incorrect % Function File Line
------- --------- - -------- ---- ----
0 24176 100 syscall_trace_leave ptrace.c 1444
0 21478 100 syscall_trace_enter ptrace.c 1424
Signed-off-by: Steven Rostedt <[email protected]>
---
arch/x86/kernel/ptrace.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 06ca07f..74a16db 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -1421,7 +1421,7 @@ asmregparm long syscall_trace_enter(struct pt_regs *regs)
tracehook_report_syscall_entry(regs))
ret = -1L;
- if (unlikely(current->audit_context)) {
+ if (current->audit_context) {
if (IS_IA32)
audit_syscall_entry(AUDIT_ARCH_I386,
regs->orig_ax,
@@ -1441,7 +1441,7 @@ asmregparm long syscall_trace_enter(struct pt_regs *regs)
asmregparm void syscall_trace_leave(struct pt_regs *regs)
{
- if (unlikely(current->audit_context))
+ if (current->audit_context)
audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
if (test_thread_flag(TIF_SYSCALL_TRACE))
--
1.6.2
--
* Steven Rostedt <[email protected]> wrote:
> From: Steven Rostedt <[email protected]>
>
> Impact: clean up
>
> Accounding to the annotated branch profiler, the unlikelys used by
> ptrace is incorrect every time.
>
> correct incorrect % Function File Line
> ------- --------- - -------- ---- ----
>
> 0 24176 100 syscall_trace_leave ptrace.c 1444
> 0 21478 100 syscall_trace_enter ptrace.c 1424
>
> Signed-off-by: Steven Rostedt <[email protected]>
> ---
> arch/x86/kernel/ptrace.c | 4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
> index 06ca07f..74a16db 100644
> --- a/arch/x86/kernel/ptrace.c
> +++ b/arch/x86/kernel/ptrace.c
> @@ -1421,7 +1421,7 @@ asmregparm long syscall_trace_enter(struct pt_regs *regs)
> tracehook_report_syscall_entry(regs))
> ret = -1L;
>
> - if (unlikely(current->audit_context)) {
> + if (current->audit_context) {
i suspect you got this result because you are running Fedora with
auditd enabled and running, right? Does SuSE and Ubuntu run with
auditing enabled as well? If yes then removing this annotation would
be right - otherwise the auditing-enabled case is considered the
less likely variant. (despite it being 100% wrong for your
particular configuration)
Ingo
This is mislabeled, really. This is "x86: syscall-audit", not ptrace.
I think this one also warrants moving the if inside a generic (non-arch)
inline. The choice about unlikely() is not arch-specific, nor (AFIAK) is
the logic of the if.
Thanks,
Roland
Am Wednesday 25 March 2009 08:21:29 schrieb Ingo Molnar:
> > @@ -1421,7 +1421,7 @@ asmregparm long syscall_trace_enter(struct pt_regs *regs)
> > tracehook_report_syscall_entry(regs))
> > ret = -1L;
> >
> > - if (unlikely(current->audit_context)) {
> > + if (current->audit_context) {
>
> i suspect you got this result because you are running Fedora with
> auditd enabled and running, right? Does SuSE and Ubuntu run with
> auditing enabled as well? If yes then removing this annotation would
> be right - otherwise the auditing-enabled case is considered the
> less likely variant. (despite it being 100% wrong for your
> particular configuration)
Auditd can be enabled/disabled via kernel command line, no? In that case
there should be no unlikely and no likely. We should not optimize for a specific
value at compile time if the value can be changed at runtime.
This patch makes a lot of sense to me.
On Wed, 25 Mar 2009, Ingo Molnar wrote:
> > diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
> > index 06ca07f..74a16db 100644
> > --- a/arch/x86/kernel/ptrace.c
> > +++ b/arch/x86/kernel/ptrace.c
> > @@ -1421,7 +1421,7 @@ asmregparm long syscall_trace_enter(struct pt_regs *regs)
> > tracehook_report_syscall_entry(regs))
> > ret = -1L;
> >
> > - if (unlikely(current->audit_context)) {
> > + if (current->audit_context) {
>
> i suspect you got this result because you are running Fedora with
> auditd enabled and running, right? Does SuSE and Ubuntu run with
> auditing enabled as well? If yes then removing this annotation would
> be right - otherwise the auditing-enabled case is considered the
> less likely variant. (despite it being 100% wrong for your
> particular configuration)
I'm running an old RHEL 5.1 box. I guess we can look at what the other
distros run.
-- Steve