Add the max_map_count isolation switch kernel.isolate_max_map_count;
The isolation of max_map_count is turned on by default. If you want
to turn it off, set kernel.isolate_max_map_count to 0;
Signed-off-by: Zhiguang Peng <zgpeng@tencent.com>
Kernel now supports cgroup bps and iops hard limit by io-throttling.
But that's not a scalable way, because block devices' bandwith is
always changing over time.
This patch dynamically adjusts bps limit of each blkio cgroup according
to its pre-set weight. Additionally, if a process has not issued any io
request during a time window, its weight will be shared by other processes
until its next io request.
Signed-off-by: Lei Chen <lennychen@tencent.com>
The offline scheduler named BT sched is based on the CFS scheduler. We
also use the rb-tree as the run queue to save the runnable tasks. And the
vruntime concept is also used in the offline scheduler. And the priority
of offline scheduler is from 140 to 179. So now the schedulers in the
kernel are as follows: stop, RT, CFS, BT and idle.
Signed-off-by: Xiaoming Gao <newtongao@tencent.com>
Signed-off-by: Hua Liu <shookliu@tencent.com>
Signed-off-by: Xiaogguang Chen <xiaoggchen@tencent.com>
Signed-off-by: Zhiguang Peng <zgpeng@tencent.com>
Signed-off-by: Bin Fan <tombinfan@tencent.com>
Signed-off-by: He Chen <heddchen@tencent.com>
This patch adds the infrastructure required to support cephfs quotas as it
is currently implemented in the ceph fuse client. Cephfs quotas can be
set on any directory, and can restrict the number of bytes or the number
of files stored beneath that point in the directory hierarchy.
Quotas are set using the extended attributes 'ceph.quota.max_files' and
'ceph.quota.max_bytes', and can be removed by setting these attributes to
'0'.
Link: http://tracker.ceph.com/issues/22372
Signed-off-by: Luis Henriques <lhenriques@suse.com>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Which control whether to resend requests if timeout. Further more,
the patch adds a debugfs file which can change this option during mount.
Signed-off-by: Liu Yu <allanyuliu@tencent.com>
When osd requests timeout, the defaut action is discarding all timeout
requests and reseting the connection. It then returns IO errors to
userspace.
The patch re-send all timeout requests instead of discarding,
so that make the timeout transparent to userspace.
Signed-off-by: Liu Yu <allanyuliu@tencent.com>
Based on upstream commit:
d63bae0 KVM: X86: Add kvm hypervisor init time platform setup callback
aaffcfd KVM: X86: Implement PV IPIs in linux guest
Implement paravirtual apic hooks to enable PV IPIs for KVM if the "send IPI"
hypercall is available. The hypercall lets a guest send IPIs, with
at most 128 destinations per hypercall in 64-bit mode and 64 vCPUs per
hypercall in 32-bit mode.
Signed-off-by: loobinliu <loobinliu@tencent.com>
The value of the cpuset.stat process field will be abnormal in
some scenarios. The reason for this problem is that the sum of
process_counts may be negative for several cpus.
Signed-off-by: brookxu <brookxu@tencent.com>
tcp_rto_min,tcp_rto_max control the parameters of them.
remember that the min value of tcp_rto_min is 4ms which
be used to be div by RTO_MAX.
Signed-off-by: Shan Wei <davidshan@tencent.com>
Signed-off-by: Fuhai Wang <fuhaiwang@tencent.com>
Signed-off-by: Xiaoming Gao <newtongao@tencent.com>
In order to facilitate each container to obtain its own IO statistics,
we implement per blkcg diskstats and expose some data from the host
into the container such as io_ticks.
Signed-off-by: Chunguang Xu <brookxu@tencent.com>
[upstream commit 5f3e2bf008c2221478101ee72f5cb4654b9fc363]
Some TCP peers announce a very small MSS option in their SYN and/or
SYN/ACK messages.
This forces the stack to send packets with a very high network/cpu
overhead.
Linux has enforced a minimal value of 48. Since this value includes
the size of TCP options, and that the options can consume up to 40
bytes, this means that each segment can include only 8 bytes of payload.
In some cases, it can be useful to increase the minimal value
to a saner value.
We still let the default to 48 (TCP_MIN_SND_MSS), for compatibility
reasons.
Note that TCP_MAXSEG socket option enforces a minimal value
of (TCP_MIN_MSS). David Miller increased this minimal value
in commit c39508d6f118 ("tcp: Make TCP_MAXSEG minimum more correct.")
from 64 to 88.
We might in the future merge TCP_MIN_SND_MSS and TCP_MIN_MSS.
CVE-2019-11479 -- tcp mss hardcoded to 48
[upstream commit: 967c05aee439e6e5d7d805e195b3a20ef5c433d6]
tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()
If mtu probing is enabled tcp_mtu_probing() could very well end up
with a too small MSS.
Use the new sysctl tcp_min_snd_mss to make sure MSS search
is performed in an acceptable range.
Signed-off-by: Zhiping Du <zhipingdu@tencent.com>
[upstream commit f070ef2ac66716357066b683fb0baf55f8191a2e]
Jonathan Looney reported that a malicious peer can force a sender
to fragment its retransmit queue into tiny skbs, inflating memory
usage and/or overflow 32bit counters.
TCP allows an application to queue up to sk_sndbuf bytes,
so we need to give some allowance for non malicious splitting
of retransmit queue.
A new SNMP counter is added to monitor how many times TCP
did not allow to split an skb if the allowance was exceeded.
Note that this counter might increase in the case applications
use SO_SNDBUF socket option to lower sk_sndbuf.
CVE-2019-11478 : tcp_fragment, prevent fragmenting a packet when the
socket is already using more than half the allowed space
Signed-off-by: Zhiping Du <zhipingdu@tencent.com>
[upstream commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff]
Jonathan Looney reported that TCP can trigger the following crash
in tcp_shifted_skb() :
BUG_ON(tcp_skb_pcount(skb) < pcount);
This can happen if the remote peer has advertized the smallest
MSS that linux TCP accepts : 48
An skb can hold 17 fragments, and each fragment can hold 32KB
on x86, or 64KB on PowerPC.
This means that the 16bit witdh of TCP_SKB_CB(skb)->tcp_gso_segs
can overflow.
Note that tcp_sendmsg() builds skbs with less than 64KB
of payload, so this problem needs SACK to be enabled.
SACK blocks allow TCP to coalesce multiple skbs in the retransmit
queue, thus filling the 17 fragments to maximal capacity.
CVE-2019-11477 -- u16 overflow of TCP_SKB_CB(skb)->tcp_gso_segs
[upstream commit cd4ffa93f16efea290bb70537f98f518e1927e63]
tcp: fix fack_count accounting on
tcp_shift_skb_data()
v4.15 or since commit 737ff314563 ("tcp: use sequence distance to
detect reordering") had switched from the packet-based FACK tracking
to sequence-based.
v4.14 and older still have the old logic and hence on
tcp_skb_shift_data() needs to retain its original logic and have
@fack_count in sync. In other words, we keep the increment of pcount
with
tcp_skb_pcount(skb) to later used that to update fack_count. To make it
more explicit we track the new skb that gets incremented to pcount in
@next_pcount, and we get to avoid the constant invocation of
tcp_skb_pcount(skb) all together.
Fixes: a5f1faa40101 ("tcp: limit payload size of sacked skbs")
Fixes: 832d11c5cd07 ("tcp: Try to restore large SKBs while SACK processing")
Signed-off-by: Zhiping Du <zhipingdu@tencent.com>
When use-gss-proxy is set to 1, write_gssp will lead to 2 get_net calls
in gssp_rpc_create, the paired put_net calls are supposed to be made
in rpcsec_gss_net_ops->exit i.e. rpcsec_gss_exit_net, but this will
never happen because rpcsec_gss_exit_net (via ops_exit_list) is called
by cleanup_net and cleanup_net will never run unless net->count becomes
0, since the paired put_net calls of gssp_rpc_create are not made yet,
net->count cannot drop to 0. This is dead lock situation.
This fix introduced a new method i.e. evict in struct proc_ns_operations,
which is called in nsfs_evict, moving rpcsec_gss_exit_net into the code
path of nsfs_evict gives it a chance to run.
Signed-off-by: Wenbin Zeng <wenbinzeng@tencent.com>
add /proc/sys/vm/vm_pagecache_limit_async interface which
allow page caches reclaimed in kpclimitd, it will not consume
work threads runtime, but oom may be occured. it's closed default.
Signed-off-by: Zhiping Du <zhipingdu@tencent.com>
Signed-off-by: Chunguang Xu <brookxu@tencent.com>
We add cpuinfo and stat for each container which
used for docker to get cpu stat just for current
container.
Signed-off-by: Xiaoming Gao <newtongao@tencent.com>
Signed-off-by: Weiwei Li <nuonuoli@tencent.com>
Signed-off-by: Liu Hua <shookliu@tencent.com>
the print_fatal_signals sysctl can only dump fatal signals from receiver's side,
cannot find who and why send these fatal signals, so add a new sysctl
print_fatal_signals_src_dst to switch dump fatal signals from sender side.
Signed-off-by: Xiaoming Gao <newtongao@tencent.com>
create a pid mapping data to parent processes in file /proc/$PID/status
create a proc file (/proc/$PID/hostinfo), mapping pid data to host pid
Signed-off-by: Lorin Liu <lorinliu@tencent.com>
upstream commit: 356d1833b638bd465672aefeb71def3ab93fc17d
Note that when a new netns is created, it inherits its
sysctl_tcp_rmem and sysctl_tcp_wmem from initial netns.
This change is needed so that we can refine TCP rcvbuf autotuning,
to take RTT into consideration.
Signed-off-by: Hongbo Li <herberthbli@tencent.com>
upstream commit: a3dcaf17ee54f1d01d22cc2b22cab0b4f60d78cf
As we want to gradually implement per netns sysctl_rmem and sysctl_wmem
on per protocol basis, add two new fields in struct proto,
and two new helpers : sk_get_wmem0() and sk_get_rmem0()
First user will be TCP. Then UDP and SCTP can be easily converted,
while DECNET probably wont get this support.
Signed-off-by: Hongbo Li <herberthbli@tencent.com>
zgpeng