- Kernel - mailweb.openeuler.org

[PATCH v3 openEuler-23.09 00/46] ima: Add IMA digest lists extension
by Zhou Shuiqing 31 Aug '23

31 Aug '23

This patchset supports IMA digest lists for the kernel. v2: -remove unused variable in ima_main.c v3: -modify patch header information David Howells (4): PGPLIB: PGP definitions (RFC 4880) PGPLIB: Basic packet parser KEYS: Provide PGP key description autogeneration KEYS: Provide a function to load keys from a PGP keyring blob Mimi Zohar (1): initramfs: add file metadata Roberto Sassu (32): initramfs: read metadata from special file METADATA!!! gen_init_cpio: add support for file metadata init: Add kernel option to force usage of tmpfs for rootfs ima: Add enforce-evm and log-evm modes to strictly check EVM status ima: Generalize ima_read_policy() ima: Generalize ima_write_policy() and raise uploaded data size limit ima: Generalize policy file operations ima: Use ima_show_htable_value to show violations and hash table data ima: Add parser of compact digest list ima: Prevent usage of digest lists not measured or appraised ima: Introduce new securityfs files ima: Introduce new hook DIGEST_LIST_CHECK ima: Load all digest lists from a directory at boot time ima: Add support for measurement with digest lists ima: Add support for appraisal with digest lists evm: Add support for digest lists of metadata ima: Introduce exec_tcb policy ima: Introduce appraise_exec_tcb policy ima: Introduce appraise_exec_immutable policy ima: Add Documentation/security/IMA-digest-lists.txt mpi: introduce mpi_key_length() rsa: add parser of raw format KEYS: PGP data parser KEYS: Introduce load_pgp_public_keyring() certs: Introduce search_trusted_key() ima: Search key in the built-in keyrings ima: Allow direct upload of digest lists to securityfs ima: Add parser keyword to the policy evm: Extend evm= with x509. allow_metadata_writes and complete values ima: Execute parser to upload digest lists not recognizable by the kernel evm: Propagate choice of HMAC algorithm in evm_crypto.c config: add digest list options for arm64 and x86 Zhang Tianxing (5): ima: fix a memory leak in ima_del_digest_data_entry ima: Add max size for IMA digest database ima: don't allow control characters in policy path ima: fix CONFIG_IMA_DIGEST_DB_MEGABYTES in openeuler_defconfig ima: fix db size overflow and Kconfig issues Zheng Zengkai (1): Revert "evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded" Zhou Shuiqing (2): ima: Allow choice of file hash algorithm for measurement and audit ima: Add meta_immutable appraisal type shenxiangwei (1): ima: bugfix for digest lists importing Documentation/ABI/testing/evm | 4 +- .../admin-guide/kernel-parameters.txt | 49 +- Documentation/security/IMA-digest-lists.txt | 259 ++++++++++ arch/arm64/configs/openeuler_defconfig | 11 + arch/x86/configs/openeuler_defconfig | 31 +- certs/Kconfig | 7 + certs/Makefile | 7 + certs/system_certificates.S | 18 + certs/system_keyring.c | 44 ++ crypto/asymmetric_keys/Kconfig | 25 + crypto/asymmetric_keys/Makefile | 10 + crypto/asymmetric_keys/pgp_library.c | 281 +++++++++++ crypto/asymmetric_keys/pgp_parser.h | 23 + crypto/asymmetric_keys/pgp_preload.c | 119 +++++ crypto/asymmetric_keys/pgp_public_key.c | 383 +++++++++++++++ crypto/rsa.c | 14 +- crypto/rsa_helper.c | 69 +++ include/crypto/internal/rsa.h | 6 + include/linux/initramfs.h | 21 + include/linux/kernel_read_file.h | 1 + include/linux/mpi.h | 2 + include/linux/pgp.h | 220 +++++++++ include/linux/pgplib.h | 48 ++ include/linux/verification.h | 4 + init/do_mounts.c | 11 +- init/initramfs.c | 138 +++++- lib/mpi/mpicoder.c | 33 +- security/integrity/digsig_asymmetric.c | 10 + security/integrity/evm/Kconfig | 32 ++ security/integrity/evm/evm.h | 1 + security/integrity/evm/evm_crypto.c | 24 +- security/integrity/evm/evm_main.c | 103 +++- security/integrity/evm/evm_secfs.c | 2 +- security/integrity/iint.c | 2 + security/integrity/ima/Kconfig | 49 ++ security/integrity/ima/Makefile | 1 + security/integrity/ima/ima.h | 39 +- security/integrity/ima/ima_api.c | 42 +- security/integrity/ima/ima_appraise.c | 117 ++++- security/integrity/ima/ima_digest_list.c | 465 ++++++++++++++++++ security/integrity/ima/ima_digest_list.h | 54 ++ security/integrity/ima/ima_fs.c | 294 ++++++++--- security/integrity/ima/ima_init.c | 2 +- security/integrity/ima/ima_main.c | 125 ++++- security/integrity/ima/ima_policy.c | 117 ++++- security/integrity/integrity.h | 47 +- usr/Kconfig | 8 + usr/Makefile | 4 +- usr/gen_init_cpio.c | 136 ++++- usr/gen_initramfs.sh | 7 +- 50 files changed, 3300 insertions(+), 219 deletions(-) create mode 100644 Documentation/security/IMA-digest-lists.txt create mode 100644 crypto/asymmetric_keys/pgp_library.c create mode 100644 crypto/asymmetric_keys/pgp_parser.h create mode 100644 crypto/asymmetric_keys/pgp_preload.c create mode 100644 crypto/asymmetric_keys/pgp_public_key.c create mode 100644 include/linux/initramfs.h create mode 100644 include/linux/pgp.h create mode 100644 include/linux/pgplib.h create mode 100644 security/integrity/ima/ima_digest_list.c create mode 100644 security/integrity/ima/ima_digest_list.h -- 2.33.0

1 46

[PATCH openEuler-1.0-LTS] sched: Add 'affinity_preferred_nodes' for smart grid
by Hui Tang 31 Aug '23

31 Aug '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7G6SW CVE: NA ------------------------------- Add sysctl 'affinity_preferred_nodes' to set preferred nodes. For example: echo 0,3 > /proc/sys/kernel/affinity_preferred_nodes The preferred nodes is preferentially selected to init affinity domain if util is lower than 85%. If the util is higher than 85% and less than 15% higher than the non-preferred node, the node is also preferentially selected. Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- include/linux/sched/sysctl.h | 4 + kernel/sched/fair.c | 177 +++++++++++++++++------------------ kernel/sched/sched.h | 1 + kernel/sysctl.c | 7 ++ 4 files changed, 98 insertions(+), 91 deletions(-) diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h index ad472760e97d7..8475ee46727ac 100644 --- a/include/linux/sched/sysctl.h +++ b/include/linux/sched/sysctl.h @@ -38,6 +38,10 @@ extern int sysctl_sched_util_low_pct; #ifdef CONFIG_QOS_SCHED_SMART_GRID extern int sysctl_affinity_adjust_delay_ms; +extern unsigned long *smart_grid_preferred_nodemask_bits; +extern int proc_cpu_affinity_domain_nodemask(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, + loff_t *ppos); #endif enum sched_tunable_scaling { diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index e9afb1e6ca4ca..571123e2a23a6 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -5296,6 +5296,9 @@ static unsigned long weighted_cpuload(struct rq *rq); static inline bool prefer_cpus_valid(struct task_struct *p); int sysctl_affinity_adjust_delay_ms = 5000; +nodemask_t smart_grid_preferred_nodemask; +unsigned long *smart_grid_preferred_nodemask_bits = + nodes_addr(smart_grid_preferred_nodemask); struct static_key __smart_grid_used; @@ -5494,90 +5497,6 @@ void stop_auto_affinity(struct auto_affinity *auto_affi) mutex_unlock(&smart_grid_used_mutex); } -static struct sched_group *sd_find_idlest_group(struct sched_domain *sd) -{ - struct sched_group *idlest = NULL, *group = sd->groups; - unsigned long min_runnable_load = ULONG_MAX; - unsigned long min_avg_load = ULONG_MAX; - int imbalance_scale = 100 + (sd->imbalance_pct-100)/2; - unsigned long imbalance = scale_load_down(NICE_0_LOAD) * - (sd->imbalance_pct-100) / 100; - - do { - unsigned long load, avg_load, runnable_load; - int i; - - avg_load = 0; - runnable_load = 0; - - for_each_cpu(i, sched_group_span(group)) { - load = target_load(i, 0); - runnable_load += load; - avg_load += cfs_rq_load_avg(&cpu_rq(i)->cfs); - } - - avg_load = (avg_load * SCHED_CAPACITY_SCALE) / - group->sgc->capacity; - runnable_load = (runnable_load * SCHED_CAPACITY_SCALE) / - group->sgc->capacity; - - if (min_runnable_load > (runnable_load + imbalance)) { - min_runnable_load = runnable_load; - min_avg_load = avg_load; - idlest = group; - } else if ((runnable_load < (min_runnable_load + imbalance)) && - (100*min_avg_load > imbalance_scale*avg_load)) { - min_avg_load = avg_load; - idlest = group; - } - } while (group = group->next, group != sd->groups); - - return idlest ? idlest : group; -} - -static int group_find_idlest_cpu(struct sched_group *group) -{ - int least_loaded_cpu = cpumask_first(sched_group_span(group)); - unsigned long load, min_load = ULONG_MAX; - unsigned int min_exit_latency = UINT_MAX; - u64 latest_idle_timestamp = 0; - int shallowest_idle_cpu = -1; - int i; - - if (group->group_weight == 1) - return least_loaded_cpu; - - for_each_cpu(i, sched_group_span(group)) { - if (sched_idle_cpu(i)) - return i; - - if (available_idle_cpu(i)) { - struct rq *rq = cpu_rq(i); - struct cpuidle_state *idle = idle_get_state(rq); - - if (idle && idle->exit_latency < min_exit_latency) { - min_exit_latency = idle->exit_latency; - latest_idle_timestamp = rq->idle_stamp; - shallowest_idle_cpu = i; - } else if ((!idle || - idle->exit_latency == min_exit_latency) && - rq->idle_stamp > latest_idle_timestamp) { - latest_idle_timestamp = rq->idle_stamp; - shallowest_idle_cpu = i; - } - } else if (shallowest_idle_cpu == -1) { - load = weighted_cpuload(cpu_rq(i)); - if (load < min_load) { - min_load = load; - least_loaded_cpu = i; - } - } - } - - return shallowest_idle_cpu != -1 ? shallowest_idle_cpu : - least_loaded_cpu; -} - void free_affinity_domains(struct affinity_domain *ad) { int i; @@ -5612,14 +5531,72 @@ static int init_affinity_domains_orig(struct affinity_domain *ad) return -ENOMEM; } +struct nid_stats { + unsigned long util; + unsigned long compute_capacity; +}; + +static inline void update_nid_stats(struct nid_stats *ns, int nid) +{ + int cpu; + + memset(ns, 0, sizeof(*ns)); + for_each_cpu(cpu, cpumask_of_node(nid)) { + ns->compute_capacity += capacity_of(cpu); + ns->util += cpu_util(cpu); + } +} + +static int find_idlest_nid(void) +{ + int nid, imbalance_pct, is_prefer; + unsigned long long util_min = UINT_MAX; + int idlest_is_prefer = 0; + struct nid_stats ns; + int idlest_nid = 0; + + for_each_online_node(nid) { + if (!cpumask_intersects(cpumask_of_node(nid), + housekeeping_cpumask(HK_FLAG_DOMAIN))) + continue; + + update_nid_stats(&ns, nid); + + if (node_isset(nid, smart_grid_preferred_nodemask)) { + if (ns.util * 100 < + ns.compute_capacity * sysctl_sched_util_low_pct) { + idlest_nid = nid; + break; + } + is_prefer = 1; + } else { + is_prefer = 0; + } + + if (is_prefer && !idlest_is_prefer) + imbalance_pct = 117; // higher 15% + else if (!is_prefer && idlest_is_prefer) + imbalance_pct = 85; // lower 15% + else + imbalance_pct = 100; + + if (ns.util * 100 < util_min * imbalance_pct) { + util_min = ns.util * 100 / imbalance_pct; + idlest_nid = nid; + idlest_is_prefer = is_prefer; + } + } + + return idlest_nid; +} + static int init_affinity_domains(struct affinity_domain *ad) { - struct sched_domain *sd = NULL, *tmp; - struct sched_group *idlest = NULL; + struct sched_domain *tmp; + int cpu, idlest_nid; int ret = -ENOMEM; int dcount = 0; int i = 0; - int cpu; for (i = 0; i < AD_LEVEL_MAX; i++) { ad->domains[i] = kmalloc(sizeof(cpumask_t), GFP_KERNEL); @@ -5631,18 +5608,18 @@ static int init_affinity_domains(struct affinity_domain *ad) cpu = cpumask_first_and(cpu_active_mask, housekeeping_cpumask(HK_FLAG_DOMAIN)); for_each_domain(cpu, tmp) { - sd = tmp; dcount++; } - if (!sd || dcount > AD_LEVEL_MAX) { + if (dcount > AD_LEVEL_MAX) { rcu_read_unlock(); ret = -EINVAL; goto err; } - idlest = sd_find_idlest_group(sd); - cpu = group_find_idlest_cpu(idlest); + idlest_nid = find_idlest_nid(); + cpu = cpumask_first_and(cpumask_of_node(idlest_nid), + housekeeping_cpumask(HK_FLAG_DOMAIN)); i = 0; for_each_domain(cpu, tmp) { cpumask_copy(ad->domains[i], sched_domain_span(tmp)); @@ -5711,6 +5688,24 @@ static void destroy_auto_affinity(struct task_group *tg) kfree(tg->auto_affinity); tg->auto_affinity = NULL; } + +int proc_cpu_affinity_domain_nodemask(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, + loff_t *ppos) +{ + int err; + + mutex_lock(&smart_grid_used_mutex); + + err = proc_do_large_bitmap(table, write, buffer, lenp, ppos); + if (!err && write) + nodes_and(smart_grid_preferred_nodemask, + smart_grid_preferred_nodemask, + node_online_map); + + mutex_unlock(&smart_grid_used_mutex); + return err; +} #else static void destroy_auto_affinity(struct task_group *tg) {} diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 1d882a2b8d5fe..ef3f5c84e8b95 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -509,6 +509,7 @@ extern void sched_offline_group(struct task_group *tg); extern void sched_move_task(struct task_struct *tsk); #ifdef CONFIG_QOS_SCHED_SMART_GRID +extern nodemask_t smart_grid_preferred_nodemask; extern void start_auto_affinity(struct auto_affinity *auto_affi); extern void stop_auto_affinity(struct auto_affinity *auto_affi); extern int init_auto_affinity(struct task_group *tg); diff --git a/kernel/sysctl.c b/kernel/sysctl.c index c7064f67f4a53..b0656ef92a2df 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1347,6 +1347,13 @@ static struct ctl_table kern_table[] = { .extra1 = &zero, .extra2 = &hundred_thousand, }, + { + .procname = "affinity_preferred_nodes", + .data = &smart_grid_preferred_nodemask_bits, + .maxlen = MAX_NUMNODES, + .mode = 0644, + .proc_handler = proc_cpu_affinity_domain_nodemask, + }, #endif { } }; -- 2.17.1

2 1

[PATCH OLK-5.10 00/12] Some misc changes
by Yihang Li 31 Aug '23

31 Aug '23

From: xiabing <xiabing12(a)h-partners.com> Update the Openeuler community patch information to ensure that it is consistent with the Linux mainline community patch information. John Garry (1): scsi: hisi_sas: Revert change to limit max hw sectors for v3 HW Luo Jiaxing (3): scsi: hisi_sas: Increase debugfs_dump_index after dump is completed scsi: libsas: Export sas_phy_enable() scsi: hisi_sas: Disable SATA disk phy for severe I_T nexus reset failure Yihang Li (2): scsi: hisi_sas: Revert "scsi: hisi_sas: Disable SATA disk phy for severe I_T nexus reset failure" scsi: hisi_sas: Configure initial value of some registers according to HBA model xiabing (6): scsi: hisi_sas: Revert "Increase-debugfs_dump_index-after-dump" scsi: libsas: Revert "Export-sas_phy_enable" scsi: hisi_sas: Revert "Revert "scsi: hisi_sas: Disable SATA disk phy for severe I_T nexus reset failure"" scsi: hisi_sas: Revert "Disable-SATA-disk-phy-for-severe-I_T-nexus reset failure" scsi: hisi_sas: Revert "scsi: hisi_sas: Revert "scsi: hisi_sas: Limit max hw sectors for v3 HW"" scsi: hisi_sas: Revert "scsi: hisi_sas: Configure the initialization registers according to HBA model" drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.30.0

2 13

[PATCH v1 openEuler-23.09 00/21] Introduce programmable base on bpf for scheduler
by Guan Jing 31 Aug '23

31 Aug '23

Chen Hui (8): sched: programmable: Add user interface of task tag sched: programmable: add bpf_sched_task_tag_of helper function bpf: sched: Add helper functions to get cpu statistics sched: programmable: Add helper function for cpu topology. sched: programmable: Add convenient helper functions to convert sched entity bpf:programmable: Add cpumask ops collection sched: programmable: Add three hooks in select_task_rq_fair() sched: programmable: Add lib for sched programmable Guan Jing (10): bpf: sched: basic infrastructure for scheduler bpf bpf: sched: introduce bpf_sched_enable() libbpf: add support for scheduler bpf programs bpftool: recognize scheduler programs sched: programmable: Add a tag for the task sched: programmable: Add a tag for the task group sched: programmable: Add user interface of task group tag sched: programmable: add bpf_sched_tg_tag_of helper function sched: cfs: add bpf hooks to control wakeup and tick preemption sched: programmable: Add hook for pick next task Hui Tang (1): bpf:programmable: Add helper func to check cpu share cache Ren Zhijie (2): sched: programmable: Add helpers to set tag of task or task_group sched: programmable: add bpf hooks to update rq and task state in enqueue_task/deqeue_task of CFS fs/proc/base.c | 65 ++++ include/linux/bpf_sched.h | 50 ++++ include/linux/bpf_topology.h | 46 +++ include/linux/bpf_types.h | 4 + include/linux/sched.h | 83 ++++++ include/linux/sched_hook_defs.h | 12 + include/uapi/linux/bpf.h | 125 ++++++++ init/init_task.c | 3 + kernel/bpf/Kconfig | 11 + kernel/bpf/btf.c | 1 + kernel/bpf/helpers.c | 12 + kernel/bpf/syscall.c | 24 ++ kernel/bpf/trampoline.c | 1 + kernel/bpf/verifier.c | 11 +- kernel/sched/bpf_sched.c | 395 +++++++++++++++++++++++++ kernel/sched/bpf_topology.c | 87 ++++++ kernel/sched/build_utility.c | 5 + kernel/sched/core.c | 114 +++++++ kernel/sched/fair.c | 121 ++++++++ kernel/sched/sched.h | 6 + scripts/bpf_doc.py | 18 ++ tools/include/uapi/linux/bpf.h | 125 ++++++++ tools/lib/bpf/Makefile | 2 +- tools/lib/bpf/bpf.c | 1 + tools/lib/bpf/libbpf.c | 23 +- tools/lib/bpf/libbpf.h | 2 + tools/lib/bpf/libbpf.map | 1 + tools/lib/bpf/libbpf_sched.h | 507 ++++++++++++++++++++++++++++++++ 28 files changed, 1852 insertions(+), 3 deletions(-) create mode 100644 include/linux/bpf_sched.h create mode 100644 include/linux/bpf_topology.h create mode 100644 include/linux/sched_hook_defs.h create mode 100644 kernel/sched/bpf_sched.c create mode 100644 kernel/sched/bpf_topology.c create mode 100644 tools/lib/bpf/libbpf_sched.h -- 2.17.1

2 22

[PATCH v3 openEuler-23.09 00/46] ima: Add IMA digest lists extension
by Zhou Shuiqing 31 Aug '23

31 Aug '23

This patchset supports IMA digest lists for the kernel. v2: -remove unused variable in ima_main.c v3: -modify patch header information David Howells (4): PGPLIB: PGP definitions (RFC 4880) PGPLIB: Basic packet parser KEYS: Provide PGP key description autogeneration KEYS: Provide a function to load keys from a PGP keyring blob Mimi Zohar (1): initramfs: add file metadata Roberto Sassu (32): initramfs: read metadata from special file METADATA!!! gen_init_cpio: add support for file metadata init: Add kernel option to force usage of tmpfs for rootfs ima: Add enforce-evm and log-evm modes to strictly check EVM status ima: Generalize ima_read_policy() ima: Generalize ima_write_policy() and raise uploaded data size limit ima: Generalize policy file operations ima: Use ima_show_htable_value to show violations and hash table data ima: Add parser of compact digest list ima: Prevent usage of digest lists not measured or appraised ima: Introduce new securityfs files ima: Introduce new hook DIGEST_LIST_CHECK ima: Load all digest lists from a directory at boot time ima: Add support for measurement with digest lists ima: Add support for appraisal with digest lists evm: Add support for digest lists of metadata ima: Introduce exec_tcb policy ima: Introduce appraise_exec_tcb policy ima: Introduce appraise_exec_immutable policy ima: Add Documentation/security/IMA-digest-lists.txt mpi: introduce mpi_key_length() rsa: add parser of raw format KEYS: PGP data parser KEYS: Introduce load_pgp_public_keyring() certs: Introduce search_trusted_key() ima: Search key in the built-in keyrings ima: Allow direct upload of digest lists to securityfs ima: Add parser keyword to the policy evm: Extend evm= with x509. allow_metadata_writes and complete values ima: Execute parser to upload digest lists not recognizable by the kernel evm: Propagate choice of HMAC algorithm in evm_crypto.c config: add digest list options for arm64 and x86 Zhang Tianxing (5): ima: fix a memory leak in ima_del_digest_data_entry ima: Add max size for IMA digest database ima: don't allow control characters in policy path ima: fix CONFIG_IMA_DIGEST_DB_MEGABYTES in openeuler_defconfig ima: fix db size overflow and Kconfig issues Zheng Zengkai (1): Revert "evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded" Zhou Shuiqing (2): ima: Allow choice of file hash algorithm for measurement and audit ima: Add meta_immutable appraisal type shenxiangwei (1): ima: bugfix for digest lists importing Documentation/ABI/testing/evm | 4 +- .../admin-guide/kernel-parameters.txt | 49 +- Documentation/security/IMA-digest-lists.txt | 259 ++++++++++ arch/arm64/configs/openeuler_defconfig | 11 + arch/x86/configs/openeuler_defconfig | 31 +- certs/Kconfig | 7 + certs/Makefile | 7 + certs/system_certificates.S | 18 + certs/system_keyring.c | 44 ++ crypto/asymmetric_keys/Kconfig | 25 + crypto/asymmetric_keys/Makefile | 10 + crypto/asymmetric_keys/pgp_library.c | 281 +++++++++++ crypto/asymmetric_keys/pgp_parser.h | 23 + crypto/asymmetric_keys/pgp_preload.c | 119 +++++ crypto/asymmetric_keys/pgp_public_key.c | 383 +++++++++++++++ crypto/rsa.c | 14 +- crypto/rsa_helper.c | 69 +++ include/crypto/internal/rsa.h | 6 + include/linux/initramfs.h | 21 + include/linux/kernel_read_file.h | 1 + include/linux/mpi.h | 2 + include/linux/pgp.h | 220 +++++++++ include/linux/pgplib.h | 48 ++ include/linux/verification.h | 4 + init/do_mounts.c | 11 +- init/initramfs.c | 138 +++++- lib/mpi/mpicoder.c | 33 +- security/integrity/digsig_asymmetric.c | 10 + security/integrity/evm/Kconfig | 32 ++ security/integrity/evm/evm.h | 1 + security/integrity/evm/evm_crypto.c | 24 +- security/integrity/evm/evm_main.c | 103 +++- security/integrity/evm/evm_secfs.c | 2 +- security/integrity/iint.c | 2 + security/integrity/ima/Kconfig | 49 ++ security/integrity/ima/Makefile | 1 + security/integrity/ima/ima.h | 39 +- security/integrity/ima/ima_api.c | 42 +- security/integrity/ima/ima_appraise.c | 117 ++++- security/integrity/ima/ima_digest_list.c | 465 ++++++++++++++++++ security/integrity/ima/ima_digest_list.h | 54 ++ security/integrity/ima/ima_fs.c | 294 ++++++++--- security/integrity/ima/ima_init.c | 2 +- security/integrity/ima/ima_main.c | 125 ++++- security/integrity/ima/ima_policy.c | 117 ++++- security/integrity/integrity.h | 47 +- usr/Kconfig | 8 + usr/Makefile | 4 +- usr/gen_init_cpio.c | 136 ++++- usr/gen_initramfs.sh | 7 +- 50 files changed, 3300 insertions(+), 219 deletions(-) create mode 100644 Documentation/security/IMA-digest-lists.txt create mode 100644 crypto/asymmetric_keys/pgp_library.c create mode 100644 crypto/asymmetric_keys/pgp_parser.h create mode 100644 crypto/asymmetric_keys/pgp_preload.c create mode 100644 crypto/asymmetric_keys/pgp_public_key.c create mode 100644 include/linux/initramfs.h create mode 100644 include/linux/pgp.h create mode 100644 include/linux/pgplib.h create mode 100644 security/integrity/ima/ima_digest_list.c create mode 100644 security/integrity/ima/ima_digest_list.h -- 2.33.0

1 46

[PATCH openEuler-23.09 v1 00/15] Support Qos scheduler
by Hui Tang 30 Aug '23

30 Aug '23

From: Zhang Qiao <zhangqiao22(a)huawei.com> Zhang Qiao (15): sched: Introduce qos scheduler for co-location sched: Throttle qos cfs_rq when current cpu is running online task sched: Fix offline task can't be killed in a timely sched: Unthrottle the throttled cfs rq when offline rq sched: Unthrottle qos cfs rq when free a task group sched: bugfix setscheduler unlock cpuset_rwsem sched: Introduce handle priority reversion mechanism sched: enable CONFIG_QOS_SCHED on arm64 sched: Fix sleeping in atomic context at cpu_qos_write() sched/fair: Add qos_throttle_list node in struct cfs_rq sched: Throttle offline task at tracehook_notify_resume() sched/qos: Add qos_tg_{throttle,unthrottle}_{up,down} sched/fair: Update rq clock before unthrottle a qos cfs_rq sched/qos: Don't unthrottle cfs_rq when cfs_rq is throttled by qos sched: Enable qos scheduler config arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/cgroup.h | 4 + include/linux/resume_user_mode.h | 5 + include/linux/sched.h | 11 + include/linux/sched/sysctl.h | 5 + init/Kconfig | 12 + kernel/cgroup/cgroup.c | 22 ++ kernel/sched/core.c | 155 ++++++++++++ kernel/sched/fair.c | 336 +++++++++++++++++++++++++ kernel/sched/sched.h | 12 + kernel/signal.c | 3 + kernel/sysctl.c | 24 ++ 13 files changed, 591 insertions(+) -- 2.25.1

2 16

[PATCH openEuler-23.09 v1 01/15] sched: Introduce qos scheduler for co-location
by Hui Tang 30 Aug '23

30 Aug '23

From: Zhang Qiao <zhangqiao22(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7WWMX CVE: NA -------------------------------- In cloud-native hybrid deployment scenarios, online tasks must preempt offline tasks in a timely and offline tasks can't affect the QoS of online tasks, so we introduce the idea of qos level to scheduler, which now is supported with different scheduler policies. The qos scheduler will change the policy of correlative tasks when the qos level of a task group is modified with cpu.qos_level cpu cgroup file. In this way we are able to satisfy different needs of tasks in different qos levels. The value of qos_level can be 0 or -1, default value is 0. If qos_level is 0, the group is an online group. otherwise it is an offline group. Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> --- init/Kconfig | 12 +++++ kernel/sched/core.c | 116 +++++++++++++++++++++++++++++++++++++++++++ kernel/sched/sched.h | 4 ++ 3 files changed, 132 insertions(+) diff --git a/init/Kconfig b/init/Kconfig index 7a3299a632e0..d96c76143610 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -984,6 +984,18 @@ menuconfig CGROUP_SCHED tasks. if CGROUP_SCHED +config QOS_SCHED + bool "Qos task scheduling" + depends on CGROUP_SCHED + depends on CFS_BANDWIDTH + default n + help + This option enable qos scheduler, and support co-location online + services (Latency Sensitive) and offline tasks. colocation can + effectively improve the resource utilization. + + If in doubt, say N. + config FAIR_GROUP_SCHED bool "Group scheduling for SCHED_OTHER" depends on CGROUP_SCHED diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 89ac3c89e39e..ac7abb6c5c64 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -7680,6 +7680,18 @@ static int __sched_setscheduler(struct task_struct *p, } change: +#ifdef CONFIG_QOS_SCHED + /* + * If the scheduling policy of an offline task is set to a policy + * other than SCHED_IDLE, the online task preemption and cpu resource + * isolation will be invalid, so return -EINVAL in this case. + */ + if (unlikely(task_group(p)->qos_level == -1 && !idle_policy(policy))) { + task_rq_unlock(rq, p, &rf); + return -EINVAL; + } +#endif + if (user) { #ifdef CONFIG_RT_GROUP_SCHED /* @@ -10308,6 +10320,35 @@ void ia64_set_curr_task(int cpu, struct task_struct *p) /* task_group_lock serializes the addition/removal of task groups */ static DEFINE_SPINLOCK(task_group_lock); +#ifdef CONFIG_QOS_SCHED +static inline int alloc_qos_sched_group(struct task_group *tg, + struct task_group *parent) +{ + tg->qos_level = parent->qos_level; + + return 1; +} + +static void sched_change_qos_group(struct task_struct *tsk, struct task_group *tg) +{ + struct sched_attr attr = {0}; + + /* + * No need to re-setcheduler when a task is exiting or the task + * is in an autogroup. + */ + if (!(tsk->flags & PF_EXITING) && + !task_group_is_autogroup(tg) && + (tg->qos_level == -1)) { + attr.sched_priority = 0; + attr.sched_policy = SCHED_IDLE; + attr.sched_nice = PRIO_TO_NICE(tsk->static_prio); + __setscheduler_params(tsk, &attr); + __setscheduler_prio(tsk, normal_prio(tsk)); + } +} +#endif + static inline void alloc_uclamp_sched_group(struct task_group *tg, struct task_group *parent) { @@ -10358,6 +10399,11 @@ struct task_group *sched_create_group(struct task_group *parent) if (!alloc_fair_sched_group(tg, parent)) goto err; +#ifdef CONFIG_QOS_SCHED + if (!alloc_qos_sched_group(tg, parent)) + goto err; +#endif + if (!alloc_rt_sched_group(tg, parent)) goto err; @@ -10444,6 +10490,10 @@ static void sched_change_group(struct task_struct *tsk, struct task_group *group { tsk->sched_task_group = group; +#ifdef CONFIG_QOS_SCHED + sched_change_qos_group(tsk, group); +#endif + #ifdef CONFIG_FAIR_GROUP_SCHED if (tsk->sched_class->task_change_group) tsk->sched_class->task_change_group(tsk); @@ -11146,6 +11196,65 @@ static int cpu_idle_write_s64(struct cgroup_subsys_state *css, } #endif +#ifdef CONFIG_QOS_SCHED +static int tg_change_scheduler(struct task_group *tg, void *data) +{ + int policy; + struct css_task_iter it; + struct sched_param param; + struct task_struct *tsk; + s64 qos_level = *(s64 *)data; + struct cgroup_subsys_state *css = &tg->css; + + tg->qos_level = qos_level; + if (qos_level == -1) { + policy = SCHED_IDLE; + cfs_bandwidth_usage_inc(); + } else { + policy = SCHED_NORMAL; + cfs_bandwidth_usage_dec(); + } + + param.sched_priority = 0; + css_task_iter_start(css, 0, &it); + while ((tsk = css_task_iter_next(&it))) + sched_setscheduler(tsk, policy, &param); + css_task_iter_end(&it); + + return 0; +} + +static int cpu_qos_write(struct cgroup_subsys_state *css, + struct cftype *cftype, s64 qos_level) +{ + struct task_group *tg = css_tg(css); + + if (!tg->se[0]) + return -EINVAL; + + if (qos_level != -1 && qos_level != 0) + return -EINVAL; + + if (tg->qos_level == qos_level) + goto done; + + if (tg->qos_level == -1 && qos_level == 0) + return -EINVAL; + + rcu_read_lock(); + walk_tg_tree_from(tg, tg_change_scheduler, tg_nop, (void *)(&qos_level)); + rcu_read_unlock(); +done: + return 0; +} + +static inline s64 cpu_qos_read(struct cgroup_subsys_state *css, + struct cftype *cft) +{ + return css_tg(css)->qos_level; +} +#endif + static struct cftype cpu_legacy_files[] = { #ifdef CONFIG_FAIR_GROUP_SCHED { @@ -11205,6 +11314,13 @@ static struct cftype cpu_legacy_files[] = { .seq_show = cpu_uclamp_max_show, .write = cpu_uclamp_max_write, }, +#endif +#ifdef CONFIG_QOS_SCHED + { + .name = "qos_level", + .read_s64 = cpu_qos_read, + .write_s64 = cpu_qos_write, + }, #endif { } /* Terminate */ }; diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index ec7b3e0a2b20..5a8afed85a10 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -409,6 +409,10 @@ struct task_group { struct cfs_bandwidth cfs_bandwidth; +#ifdef CONFIG_QOS_SCHED + long qos_level; +#endif + #ifdef CONFIG_UCLAMP_TASK_GROUP /* The two decimal precision [%] value requested from user-space */ unsigned int uclamp_pct[UCLAMP_CNT]; -- 2.25.1

2 16

[PATCH v3 openEuler-23.09 00/46] ima: Add IMA digest lists extension
by Zhou Shuiqing 30 Aug '23

30 Aug '23

This patchset supports IMA digest lists for the kernel. v2: -remove unused variable in ima_main.c v3: -modify patch header information David Howells (4): PGPLIB: PGP definitions (RFC 4880) PGPLIB: Basic packet parser KEYS: Provide PGP key description autogeneration KEYS: Provide a function to load keys from a PGP keyring blob Mimi Zohar (1): initramfs: add file metadata Roberto Sassu (32): initramfs: read metadata from special file METADATA!!! gen_init_cpio: add support for file metadata init: Add kernel option to force usage of tmpfs for rootfs ima: Add enforce-evm and log-evm modes to strictly check EVM status ima: Generalize ima_read_policy() ima: Generalize ima_write_policy() and raise uploaded data size limit ima: Generalize policy file operations ima: Use ima_show_htable_value to show violations and hash table data ima: Add parser of compact digest list ima: Prevent usage of digest lists not measured or appraised ima: Introduce new securityfs files ima: Introduce new hook DIGEST_LIST_CHECK ima: Load all digest lists from a directory at boot time ima: Add support for measurement with digest lists ima: Add support for appraisal with digest lists evm: Add support for digest lists of metadata ima: Introduce exec_tcb policy ima: Introduce appraise_exec_tcb policy ima: Introduce appraise_exec_immutable policy ima: Add Documentation/security/IMA-digest-lists.txt mpi: introduce mpi_key_length() rsa: add parser of raw format KEYS: PGP data parser KEYS: Introduce load_pgp_public_keyring() certs: Introduce search_trusted_key() ima: Search key in the built-in keyrings ima: Allow direct upload of digest lists to securityfs ima: Add parser keyword to the policy evm: Extend evm= with x509. allow_metadata_writes and complete values ima: Execute parser to upload digest lists not recognizable by the kernel evm: Propagate choice of HMAC algorithm in evm_crypto.c config: add digest list options for arm64 and x86 Zhang Tianxing (5): ima: fix a memory leak in ima_del_digest_data_entry ima: Add max size for IMA digest database ima: don't allow control characters in policy path ima: fix CONFIG_IMA_DIGEST_DB_MEGABYTES in openeuler_defconfig ima: fix db size overflow and Kconfig issues Zheng Zengkai (1): Revert "evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded" Zhou Shuiqing (2): ima: Allow choice of file hash algorithm for measurement and audit ima: Add meta_immutable appraisal type shenxiangwei (1): ima: bugfix for digest lists importing Documentation/ABI/testing/evm | 4 +- .../admin-guide/kernel-parameters.txt | 49 +- Documentation/security/IMA-digest-lists.txt | 259 ++++++++++ arch/arm64/configs/openeuler_defconfig | 11 + arch/x86/configs/openeuler_defconfig | 31 +- certs/Kconfig | 7 + certs/Makefile | 7 + certs/system_certificates.S | 18 + certs/system_keyring.c | 44 ++ crypto/asymmetric_keys/Kconfig | 25 + crypto/asymmetric_keys/Makefile | 10 + crypto/asymmetric_keys/pgp_library.c | 281 +++++++++++ crypto/asymmetric_keys/pgp_parser.h | 23 + crypto/asymmetric_keys/pgp_preload.c | 119 +++++ crypto/asymmetric_keys/pgp_public_key.c | 383 +++++++++++++++ crypto/rsa.c | 14 +- crypto/rsa_helper.c | 69 +++ include/crypto/internal/rsa.h | 6 + include/linux/initramfs.h | 21 + include/linux/kernel_read_file.h | 1 + include/linux/mpi.h | 2 + include/linux/pgp.h | 220 +++++++++ include/linux/pgplib.h | 48 ++ include/linux/verification.h | 4 + init/do_mounts.c | 11 +- init/initramfs.c | 138 +++++- lib/mpi/mpicoder.c | 33 +- security/integrity/digsig_asymmetric.c | 10 + security/integrity/evm/Kconfig | 32 ++ security/integrity/evm/evm.h | 1 + security/integrity/evm/evm_crypto.c | 24 +- security/integrity/evm/evm_main.c | 103 +++- security/integrity/evm/evm_secfs.c | 2 +- security/integrity/iint.c | 2 + security/integrity/ima/Kconfig | 49 ++ security/integrity/ima/Makefile | 1 + security/integrity/ima/ima.h | 39 +- security/integrity/ima/ima_api.c | 42 +- security/integrity/ima/ima_appraise.c | 117 ++++- security/integrity/ima/ima_digest_list.c | 465 ++++++++++++++++++ security/integrity/ima/ima_digest_list.h | 54 ++ security/integrity/ima/ima_fs.c | 294 ++++++++--- security/integrity/ima/ima_init.c | 2 +- security/integrity/ima/ima_main.c | 125 ++++- security/integrity/ima/ima_policy.c | 117 ++++- security/integrity/integrity.h | 47 +- usr/Kconfig | 8 + usr/Makefile | 4 +- usr/gen_init_cpio.c | 136 ++++- usr/gen_initramfs.sh | 7 +- 50 files changed, 3300 insertions(+), 219 deletions(-) create mode 100644 Documentation/security/IMA-digest-lists.txt create mode 100644 crypto/asymmetric_keys/pgp_library.c create mode 100644 crypto/asymmetric_keys/pgp_parser.h create mode 100644 crypto/asymmetric_keys/pgp_preload.c create mode 100644 crypto/asymmetric_keys/pgp_public_key.c create mode 100644 include/linux/initramfs.h create mode 100644 include/linux/pgp.h create mode 100644 include/linux/pgplib.h create mode 100644 security/integrity/ima/ima_digest_list.c create mode 100644 security/integrity/ima/ima_digest_list.h -- 2.33.0

1 46

[PATCH v3 openEuler-23.09 0/9] enable filescgroup
by Lu Jialin 30 Aug '23

30 Aug '23

v3->v2: remove unused members in struct cftype and struct cgroup_subsys v2->v1: enable CONFIG_CGROUP_FILES in openeuler_defconfig for x86 and arm64 Binder Makin (1): cgroups: Resource controller for open files Hou Tao (2): cgroup/files: use task_get_css() to get a valid css during dup_fd() cgroup: undo unnecessary updates to struct cgroup_subsys & cftype Lu Jialin (3): fs: fix files.usage bug when move tasks fs/filescontrol.c: fix warning:large integer implicitly truncated to unsigned type openeuler_defconfig: enable CONFIG_CGROUP_FILES in openeuler_defconfig for x86 and arm64 Yu Kuai (1): fs/filescontrol: add a switch to enable / disable accounting of open fds Zhang Xiaoxu (1): files_cgroup: fix error pointer when kvm_vm_worker_thread yangerkun (1): fs/dcache.c: avoid panic while lockref of dentry overflow arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/Makefile | 1 + fs/dcache.c | 32 ++- fs/file.c | 53 ++++- fs/filescontrol.c | 312 +++++++++++++++++++++++++ include/linux/cgroup_subsys.h | 6 + include/linux/fdtable.h | 1 + include/linux/filescontrol.h | 34 +++ include/linux/fs.h | 3 + init/Kconfig | 10 + 11 files changed, 446 insertions(+), 8 deletions(-) create mode 100644 fs/filescontrol.c create mode 100644 include/linux/filescontrol.h -- 2.34.1

2 10

[PATCH openEuler-23.09 v1 00/15] Support Qos scheduler
by Zhang Qiao 30 Aug '23

30 Aug '23

Zhang Qiao (15): sched: Introduce qos scheduler for co-location sched: Throttle qos cfs_rq when current cpu is running online task sched: Fix offline task can't be killed in a timely sched: Unthrottle the throttled cfs rq when offline rq sched: Unthrottle qos cfs rq when free a task group sched: bugfix setscheduler unlock cpuset_rwsem sched: Introduce handle priority reversion mechanism sched: enable CONFIG_QOS_SCHED on arm64 sched: Fix sleeping in atomic context at cpu_qos_write() sched/fair: Add qos_throttle_list node in struct cfs_rq sched: Throttle offline task at tracehook_notify_resume() sched/qos: Add qos_tg_{throttle,unthrottle}_{up,down} sched/fair: Update rq clock before unthrottle a qos cfs_rq sched/qos: Don't unthrottle cfs_rq when cfs_rq is throttled by qos sched: Enable qos scheduler config arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/cgroup.h | 4 + include/linux/resume_user_mode.h | 5 + include/linux/sched.h | 11 + include/linux/sched/sysctl.h | 5 + init/Kconfig | 12 + kernel/cgroup/cgroup.c | 22 ++ kernel/sched/core.c | 155 ++++++++++++ kernel/sched/fair.c | 336 +++++++++++++++++++++++++ kernel/sched/sched.h | 12 + kernel/signal.c | 3 + kernel/sysctl.c | 24 ++ 13 files changed, 591 insertions(+) -- 2.25.1

1 15