hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8424 ---------------------------------------- to do Signed-off-by: Liu Kai <liukai284@huawei.com> --- arch/arm64/configs/openeuler_defconfig | 3 +- arch/x86/configs/openeuler_defconfig | 3 +- include/linux/cgroup_subsys.h | 8 +- include/linux/device_cgroup.h | 28 +++++ include/linux/xsched.h | 2 + kernel/xsched/cgroup.c | 138 +++++++++++++++++++++++-- security/device_cgroup.c | 48 +++++++-- 7 files changed, 208 insertions(+), 22 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index fc581adb563b..622d44e6d9ff 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -101,7 +101,8 @@ CONFIG_XCU_SCHEDULER=y CONFIG_XCU_VSTREAM=y CONFIG_XSCHED_NR_CUS=128 CONFIG_XCU_SCHED_RT=y -# CONFIG_XCU_SCHED_CFS is not set +CONFIG_XCU_SCHED_CFS=y +CONFIG_CGROUP_XCU=y # # CPU/Task time and stats accounting diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index d493dbf6b8a1..e66724b15bb4 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -121,7 +121,8 @@ CONFIG_XCU_SCHEDULER=y CONFIG_XCU_VSTREAM=y CONFIG_XSCHED_NR_CUS=128 CONFIG_XCU_SCHED_RT=y -# CONFIG_XCU_SCHED_CFS is not set +CONFIG_XCU_SCHED_CFS=y +CONFIG_CGROUP_XCU=y # # CPU/Task time and stats accounting diff --git a/include/linux/cgroup_subsys.h b/include/linux/cgroup_subsys.h index e65ae90946c2..4130c924f47c 100644 --- a/include/linux/cgroup_subsys.h +++ b/include/linux/cgroup_subsys.h @@ -29,7 +29,9 @@ SUBSYS(io) SUBSYS(memory) #endif -#if IS_ENABLED(CONFIG_CGROUP_DEVICE) +#if IS_ENABLED(CONFIG_CGROUP_XCU) +SUBSYS(xcu) +#elif IS_ENABLED(CONFIG_CGROUP_DEVICE) SUBSYS(devices) #endif @@ -61,10 +63,6 @@ SUBSYS(pids) SUBSYS(rdma) #endif -#if IS_ENABLED(CONFIG_CGROUP_XCU) -SUBSYS(xcu) -#endif - #if IS_ENABLED(CONFIG_CGROUP_MISC) SUBSYS(misc) #endif diff --git a/include/linux/device_cgroup.h b/include/linux/device_cgroup.h index d02f32b7514e..ee84ce61546c 100644 --- a/include/linux/device_cgroup.h +++ b/include/linux/device_cgroup.h @@ -1,6 +1,10 @@ /* SPDX-License-Identifier: GPL-2.0 */ #include <linux/fs.h> +#ifdef CONFIG_CGROUP_XCU +#include <linux/cgroup-defs.h> +#endif + #define DEVCG_ACC_MKNOD 1 #define DEVCG_ACC_READ 2 #define DEVCG_ACC_WRITE 4 @@ -65,3 +69,27 @@ static inline int devcgroup_inode_permission(struct inode *inode, int mask) static inline int devcgroup_inode_mknod(int mode, dev_t dev) { return 0; } #endif + +#ifdef CONFIG_CGROUP_XCU +/* + * When CONFIG_CGROUP_XCU is enabled, devices_cgrp_subsys and xcu_cgrp_subsys + * share the same set of cgroup_subsys hook functions. Consequently, the hooks for + * devices_cgrp_subsys must be exposed externally to allow linkage with the XCU + * cgroup_subsys. + * + * The STATIC macro is used to handle this conditional visibility: + * - Enabled: interfaces are defined as non-static (exported). + * - Disabled: interfaces remain static (file-local). + */ +#define STATIC +#define devices_cgrp_id xcu_cgrp_id + +extern struct cftype dev_cgroup_files[]; +int devcgroup_online(struct cgroup_subsys_state *css); +void devcgroup_offline(struct cgroup_subsys_state *css); +struct cgroup_subsys_state * +devcgroup_css_alloc(struct cgroup_subsys_state *parent_css); +void devcgroup_css_free(struct cgroup_subsys_state *css); +#else +#define STATIC static +#endif diff --git a/include/linux/xsched.h b/include/linux/xsched.h index ff314f88169f..e9c580149d55 100644 --- a/include/linux/xsched.h +++ b/include/linux/xsched.h @@ -485,6 +485,8 @@ void xsched_quota_account(struct xsched_group *xg, s64 exec_time); void xsched_quota_check(struct xsched_group *xg, struct xsched_cu *xcu); void xsched_quota_refill(struct work_struct *work); +bool xcu_cgroup_enabled(void); + #define XCU_PERIOD_MIN_MS 1 #define XCU_QUOTA_RUNTIME_INF -1 #define XCU_SHARES_MIN 1 diff --git a/kernel/xsched/cgroup.c b/kernel/xsched/cgroup.c index 73f044475939..53f958f7b844 100644 --- a/kernel/xsched/cgroup.c +++ b/kernel/xsched/cgroup.c @@ -20,6 +20,7 @@ #include <linux/slab.h> #include <linux/xsched.h> #include <linux/delay.h> +#include <linux/device_cgroup.h> static struct xsched_group root_xsched_group; struct xsched_group *root_xcg = &root_xsched_group; @@ -39,6 +40,61 @@ static const char xcu_sched_name[XSCHED_TYPE_NUM][SCHED_CLASS_MAX_LENGTH] = { [XSCHED_TYPE_CFS] = "cfs" }; +/* + * xcu_mode: + * 0 = disable (devices cgroup) + * 1 = enable (xcu cgroup) + */ +static int xcu_mode; + +/** + * Parse the "xcu=" kernel command line parameter. + * + * Usage: + * xcu=enable → enable xcu_cgrp_subsys + * Otherwise → enable devices_cgrp_subsys + * + * Returns: + * 1 (handled), 0 (not handled) + */ +static int __init xcu_setup(char *str) +{ + if (!str) + return 0; + + if (strcmp(str, "enable") == 0) + xcu_mode = 1; + + return 1; +} +__setup("xcu=", xcu_setup); + +bool xcu_cgroup_enabled(void) +{ + return xcu_mode; +} + +/** + * xcu_cgroup_check_compat - Verify XCU mode matches the cgroup hierarchy version. + * + * Checks if the current xcu_mode aligns with the cgroup subsystem's default + * hierarchy status. + * + * IMPORTANT: cgroup_subsys_on_dfl() only returns a valid version indicator + * after the cgroup filesystem has been mounted at the root node. Calling + * this function prior to mount may yield incorrect results. + * + * Return: true if compatible, false otherwise (with a warning logged). + */ +bool xcu_cgroup_check_compat(void) +{ + if (xcu_mode != cgroup_subsys_on_dfl(xcu_cgrp_subsys)) { + XSCHED_WARN("XCU cgrp is incompatible with the cgroup version\n"); + return false; + } + return true; +} + static int xcu_cg_set_file_show(struct xsched_group *xg, int sched_class) { if (!xg) { @@ -742,6 +798,7 @@ static struct cftype xcu_cg_files[] = { }, { .name = "stat", + .flags = CFTYPE_NOT_ON_ROOT, .seq_show = xcu_stat, }, { @@ -753,17 +810,80 @@ static struct cftype xcu_cg_files[] = { {} /* terminate */ }; +static struct cgroup_subsys_state * +xcu_devices_compat_css_alloc(struct cgroup_subsys_state *parent_css) +{ + if (parent_css && xcu_cgroup_check_compat()) + return ERR_PTR(-EPERM); + + if (xcu_cgroup_enabled()) + return xcu_css_alloc(parent_css); + + return devcgroup_css_alloc(parent_css); +} + +static int xcu_devices_compat_css_online(struct cgroup_subsys_state *css) +{ + if (xcu_cgroup_enabled()) + return xcu_css_online(css); + + return devcgroup_online(css); +} + +static void xcu_devices_compat_css_offline(struct cgroup_subsys_state *css) +{ + if (xcu_cgroup_enabled()) + return xcu_css_offline(css); + + return devcgroup_offline(css); +} + +static void xcu_devices_compat_css_released(struct cgroup_subsys_state *css) +{ + if (xcu_cgroup_enabled()) + return xcu_css_released(css); +} + +static void xcu_devices_compat_css_free(struct cgroup_subsys_state *css) +{ + if (xcu_cgroup_enabled()) + return xcu_css_free(css); + + return devcgroup_css_free(css); +} + +static int xcu_devices_compat_can_attach(struct cgroup_taskset *tset) +{ + if (xcu_cgroup_enabled()) + return xcu_can_attach(tset); + + return 0; +} + +static void xcu_devices_compat_cancel_attach(struct cgroup_taskset *tset) +{ + if (xcu_cgroup_enabled()) + return xcu_cancel_attach(tset); +} + +static void xcu_devices_compat_attach(struct cgroup_taskset *tset) +{ + if (xcu_cgroup_enabled()) + return xcu_attach(tset); +} + struct cgroup_subsys xcu_cgrp_subsys = { - .css_alloc = xcu_css_alloc, - .css_online = xcu_css_online, - .css_offline = xcu_css_offline, - .css_released = xcu_css_released, - .css_free = xcu_css_free, - .can_attach = xcu_can_attach, - .cancel_attach = xcu_cancel_attach, - .attach = xcu_attach, + .css_alloc = xcu_devices_compat_css_alloc, + .css_online = xcu_devices_compat_css_online, + .css_offline = xcu_devices_compat_css_offline, + .css_released = xcu_devices_compat_css_released, + .css_free = xcu_devices_compat_css_free, + .can_attach = xcu_devices_compat_can_attach, + .cancel_attach = xcu_devices_compat_cancel_attach, + .attach = xcu_devices_compat_attach, .dfl_cftypes = xcu_cg_files, - .legacy_cftypes = xcu_cg_files, + .legacy_cftypes = dev_cgroup_files, + .legacy_name = "devices", .early_init = false, .threaded = true }; diff --git a/security/device_cgroup.c b/security/device_cgroup.c index dc4df7475081..72b471e0e0fd 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c @@ -16,6 +16,10 @@ #include <linux/rcupdate.h> #include <linux/mutex.h> +#ifdef CONFIG_CGROUP_XCU +#include <linux/xsched.h> +#endif + #ifdef CONFIG_CGROUP_DEVICE static DEFINE_MUTEX(devcgroup_mutex); @@ -185,7 +189,7 @@ static inline bool is_devcg_online(const struct dev_cgroup *devcg) * @css: css getting online * returns 0 in case of success, error code otherwise */ -static int devcgroup_online(struct cgroup_subsys_state *css) +STATIC int devcgroup_online(struct cgroup_subsys_state *css) { struct dev_cgroup *dev_cgroup = css_to_devcgroup(css); struct dev_cgroup *parent_dev_cgroup = css_to_devcgroup(css->parent); @@ -206,7 +210,7 @@ static int devcgroup_online(struct cgroup_subsys_state *css) return ret; } -static void devcgroup_offline(struct cgroup_subsys_state *css) +STATIC void devcgroup_offline(struct cgroup_subsys_state *css) { struct dev_cgroup *dev_cgroup = css_to_devcgroup(css); @@ -218,7 +222,7 @@ static void devcgroup_offline(struct cgroup_subsys_state *css) /* * called from kernel/cgroup/cgroup.c with cgroup_lock() held. */ -static struct cgroup_subsys_state * +STATIC struct cgroup_subsys_state * devcgroup_css_alloc(struct cgroup_subsys_state *parent_css) { struct dev_cgroup *dev_cgroup; @@ -232,7 +236,7 @@ devcgroup_css_alloc(struct cgroup_subsys_state *parent_css) return &dev_cgroup->css; } -static void devcgroup_css_free(struct cgroup_subsys_state *css) +STATIC void devcgroup_css_free(struct cgroup_subsys_state *css) { struct dev_cgroup *dev_cgroup = css_to_devcgroup(css); @@ -280,10 +284,20 @@ static void set_majmin(char *str, unsigned m) static int devcgroup_seq_show(struct seq_file *m, void *v) { - struct dev_cgroup *devcgroup = css_to_devcgroup(seq_css(m)); + struct dev_cgroup *devcgroup; struct dev_exception_item *ex; char maj[MAJMINLEN], min[MAJMINLEN], acc[ACCLEN]; +#ifdef CONFIG_CGROUP_XCU + /* + * When the XCU subsystem is enabled but cgroup v1 is mounted, + * operations on the devices subsystem interfaces are not permitted. + */ + if (xcu_cgroup_enabled()) + return -EPERM; +#endif /* CONFIG_CGROUP_XCU */ + + devcgroup = css_to_devcgroup(seq_css(m)); rcu_read_lock(); /* * To preserve the compatibility: @@ -786,6 +800,15 @@ static ssize_t devcgroup_access_write(struct kernfs_open_file *of, { int retval; +#ifdef CONFIG_CGROUP_XCU + /* + * When the XCU subsystem is enabled but cgroup v1 is mounted, + * operations on the devices subsystem interfaces are not permitted. + */ + if (xcu_cgroup_enabled()) + return -EPERM; +#endif /* CONFIG_CGROUP_XCU */ + mutex_lock(&devcgroup_mutex); retval = devcgroup_update_access(css_to_devcgroup(of_css(of)), of_cft(of)->private, strstrip(buf)); @@ -793,7 +816,7 @@ static ssize_t devcgroup_access_write(struct kernfs_open_file *of, return retval ?: nbytes; } -static struct cftype dev_cgroup_files[] = { +STATIC struct cftype dev_cgroup_files[] = { { .name = "allow", .write = devcgroup_access_write, @@ -835,6 +858,19 @@ static int devcgroup_legacy_check_permission(short type, u32 major, u32 minor, struct dev_cgroup *dev_cgroup; bool rc; +#ifdef CONFIG_CGROUP_XCU + /* + * When CONFIG_CGROUP_XCU is enabled and "xcu=enable" is set on the command line, + * xcu_cgrp_subsys is used instead of the standard devices_cgrp_subsys. + * In this case, task_devcgroup() returns an invalid dev_cgroup, which would + * trigger an exception if processed further. + * This scenario is effectively equivalent to having CONFIG_CGROUP_DEVICE disabled. + * Therefore, we can safely return 0 here without proceeding further. + */ + if (xcu_cgroup_enabled()) + return 0; +#endif /* CONFIG_CGROUP_XCU */ + rcu_read_lock(); dev_cgroup = task_devcgroup(current); if (dev_cgroup->behavior == DEVCG_DEFAULT_ALLOW) -- 2.34.1