linux_dsm_epyc7002/security/apparmor/include
Sebastian Andrzej Siewior df323337e5 apparmor: Use a memory pool instead per-CPU caches
The get_buffers() macro may provide one or two buffers to the caller.
Those buffers are pre-allocated on init for each CPU. By default it
allocates
	2* 2 * MAX_PATH * POSSIBLE_CPU

which equals 64KiB on a system with 4 CPUs or 1MiB with 64 CPUs and so
on.

Replace the per-CPU buffers with a common memory pool which is shared
across all CPUs. The pool grows on demand and never shrinks. The pool
starts with two (UP) or four (SMP) elements. By using this pool it is
possible to request a buffer and keeping preemption enabled which avoids
the hack in profile_transition().

It has been pointed out by Tetsuo Handa that GFP_KERNEL allocations for
small amount of memory do not fail. In order not to have an endless
retry, __GFP_RETRY_MAYFAIL is passed (so the memory allocation is not
repeated until success) and retried once hoping that in the meantime a
buffer has been returned to the pool. Since now NULL is possible all
allocation paths check the buffer pointer and return -ENOMEM on failure.

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-06-20 10:33:31 -07:00
..
apparmor.h apparmor: Initial implementation of raw policy blob compression 2019-04-11 14:56:29 -07:00
apparmorfs.h apparmor: add policy revision file interface 2017-06-10 17:11:27 -07:00
audit.h audit: remove unused actx param from audit_rule_match 2019-01-31 23:00:15 -05:00
capability.h LSM: generalize flag passing to security_capable 2019-01-10 14:16:06 -08:00
cred.h Infrastructure management of the cred security blob 2019-01-08 13:18:44 -08:00
crypto.h apparmor: allow introspecting the loaded policy pre internal transform 2017-01-16 01:18:42 -08:00
domain.h + Features 2017-09-23 05:33:29 -10:00
file.h LSM: Infrastructure management of the file security 2019-01-08 13:18:44 -08:00
ipc.h apparmor: add the ability to mediate signals 2017-09-22 13:00:57 -07:00
label.h apparmor: add support for mapping secids and using secctxes 2018-05-02 00:48:55 -07:00
lib.h Infrastructure management of the cred security blob 2019-01-08 13:18:44 -08:00
match.h apparmor: improve overlapping domain attachment resolution 2018-02-09 11:30:02 -08:00
mount.h apparmor: add mount mediation 2017-09-22 13:00:57 -07:00
net.h apparmor: Parse secmark policy 2018-10-03 06:18:38 -07:00
path.h apparmor: Use a memory pool instead per-CPU caches 2019-06-20 10:33:31 -07:00
perms.h apparmor: Check buffer bounds when mapping permissions mask 2018-07-19 16:24:43 -07:00
policy_ns.h apparmor: switch from profiles to using labels on contexts 2017-06-10 17:11:38 -07:00
policy_unpack.h apparmor: Initial implementation of raw policy blob compression 2019-04-11 14:56:29 -07:00
policy.h apparmor: Parse secmark policy 2018-10-03 06:18:38 -07:00
procattr.h apparmor: switch getprocattr to using label_print fns() 2017-06-10 17:11:39 -07:00
resource.h apparmor: move resource checks to using labels 2017-06-10 17:11:40 -07:00
secid.h apparmor: Add a wildcard secid 2018-10-03 06:18:17 -07:00
sig_names.h apparmor: audit unknown signal numbers 2018-02-09 11:30:01 -08:00
task.h apparmor: Adjust offset when accessing task blob. 2019-01-22 14:38:59 -08:00