Re: [PATCH 1/3] cgroup, binfmt_elf: Add hwcap masks to the misc controller

On Fri, Dec 5, 2025 at 2:11 AM Chen Ridong <[email protected]> wrote:
>
>
>
> On 2025/12/5 8:58, Andrei Vagin wrote:
> > Add an interface to the misc cgroup controller that allows masking out
> > hardware capabilities (AT_HWCAP) reported to user-space processes. This
> > provides a mechanism to restrict the features a containerized
> > application can see.
> >
> > The new "misc.mask" cgroup file allows users to specify masks for
> > AT_HWCAP, AT_HWCAP2, AT_HWCAP3, and AT_HWCAP4.
> >
> > The output of "misc.mask" is extended to display the effective mask,
> > which is a combination of the masks from the current cgroup and all its
> > ancestors.
> >
> > Signed-off-by: Andrei Vagin <[email protected]>
> > ---
> >  fs/binfmt_elf.c             |  24 +++++--
> >  include/linux/misc_cgroup.h |  25 +++++++
> >  kernel/cgroup/misc.c        | 126 ++++++++++++++++++++++++++++++++++++
> >  3 files changed, 171 insertions(+), 4 deletions(-)
> >
> > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> > index 3eb734c192e9..59137784e81d 100644
> > --- a/fs/binfmt_elf.c
> > +++ b/fs/binfmt_elf.c
> > @@ -47,6 +47,7 @@
> >  #include <linux/dax.h>
> >  #include <linux/uaccess.h>
> >  #include <uapi/linux/rseq.h>
> > +#include <linux/misc_cgroup.h>
> >  #include <asm/param.h>
> >  #include <asm/page.h>
> >
> > @@ -182,6 +183,21 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
> >       int ei_index;
> >       const struct cred *cred = current_cred();
> >       struct vm_area_struct *vma;
> > +     struct misc_cg *misc_cg;
> > +     u64 hwcap_mask[4] = {0, 0, 0, 0};
> > +
> > +     misc_cg = get_current_misc_cg();
> > +     misc_cg_get_mask(MISC_CG_MASK_HWCAP, misc_cg, &hwcap_mask[0]);
> > +#ifdef ELF_HWCAP2
> > +     misc_cg_get_mask(MISC_CG_MASK_HWCAP2, misc_cg, &hwcap_mask[1]);
> > +#endif
> > +#ifdef ELF_HWCAP3
> > +     misc_cg_get_mask(MISC_CG_MASK_HWCAP3, misc_cg, &hwcap_mask[2]);
> > +#endif
> > +#ifdef ELF_HWCAP4
> > +     misc_cg_get_mask(MISC_CG_MASK_HWCAP4, misc_cg, &hwcap_mask[3]);
> > +#endif
> > +     put_misc_cg(misc_cg);
> >
> >       /*
> >        * In some cases (e.g. Hyper-Threading), we want to avoid L1
> > @@ -246,7 +262,7 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
> >        */
> >       ARCH_DLINFO;
> >  #endif
> > -     NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
> > +     NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP & ~hwcap_mask[0]);
> >       NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
> >       NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
> >       NEW_AUX_ENT(AT_PHDR, phdr_addr);
> > @@ -264,13 +280,13 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
> >       NEW_AUX_ENT(AT_SECURE, bprm->secureexec);
> >       NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
> >  #ifdef ELF_HWCAP2
> > -     NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2);
> > +     NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2 & ~hwcap_mask[1]);
> >  #endif
> >  #ifdef ELF_HWCAP3
> > -     NEW_AUX_ENT(AT_HWCAP3, ELF_HWCAP3);
> > +     NEW_AUX_ENT(AT_HWCAP3, ELF_HWCAP3 & ~hwcap_mask[2]);
> >  #endif
> >  #ifdef ELF_HWCAP4
> > -     NEW_AUX_ENT(AT_HWCAP4, ELF_HWCAP4);
> > +     NEW_AUX_ENT(AT_HWCAP4, ELF_HWCAP4 & ~hwcap_mask[3]);
> >  #endif
> >       NEW_AUX_ENT(AT_EXECFN, bprm->exec);
> >       if (k_platform) {
> > diff --git a/include/linux/misc_cgroup.h b/include/linux/misc_cgroup.h
> > index 0cb36a3ffc47..cff830c238fb 100644
> > --- a/include/linux/misc_cgroup.h
> > +++ b/include/linux/misc_cgroup.h
> > @@ -8,6 +8,8 @@
> >  #ifndef _MISC_CGROUP_H_
> >  #define _MISC_CGROUP_H_
> >
> > +#include <linux/elf.h>
> > +
> >  /**
> >   * enum misc_res_type - Types of misc cgroup entries supported by the host.
> >   */
> > @@ -26,6 +28,20 @@ enum misc_res_type {
> >       MISC_CG_RES_TYPES
> >  };
> >
> > +enum misc_mask_type {
> > +     MISC_CG_MASK_HWCAP,
> > +#ifdef ELF_HWCAP2
> > +     MISC_CG_MASK_HWCAP2,
> > +#endif
> > +#ifdef ELF_HWCAP3
> > +     MISC_CG_MASK_HWCAP3,
> > +#endif
> > +#ifdef ELF_HWCAP4
> > +     MISC_CG_MASK_HWCAP4,
> > +#endif
> > +     MISC_CG_MASK_TYPES
> > +};
> > +
> >  struct misc_cg;
> >
> >  #ifdef CONFIG_CGROUP_MISC
> > @@ -62,12 +78,15 @@ struct misc_cg {
> >       struct cgroup_file events_local_file;
> >
> >       struct misc_res res[MISC_CG_RES_TYPES];
> > +     u64 mask[MISC_CG_MASK_TYPES];
> >  };
> >
> >  int misc_cg_set_capacity(enum misc_res_type type, u64 capacity);
> >  int misc_cg_try_charge(enum misc_res_type type, struct misc_cg *cg, u64 amount);
> >  void misc_cg_uncharge(enum misc_res_type type, struct misc_cg *cg, u64 amount);
> >
> > +int misc_cg_get_mask(enum misc_mask_type type, struct misc_cg *cg, u64 *pmask);
> > +
> >  /**
> >   * css_misc() - Get misc cgroup from the css.
> >   * @css: cgroup subsys state object.
> > @@ -134,5 +153,11 @@ static inline void put_misc_cg(struct misc_cg *cg)
> >  {
> >  }
> >
> > +static inline int misc_cg_get_mask(enum misc_mask_type type, struct misc_cg *cg, u64 *pmask)
> > +{
> > +     *pmask = 0;
> > +     return 0;
> > +}
> > +
> >  #endif /* CONFIG_CGROUP_MISC */
> >  #endif /* _MISC_CGROUP_H_ */
> > diff --git a/kernel/cgroup/misc.c b/kernel/cgroup/misc.c
> > index 6a01d91ea4cb..d1386d86060f 100644
> > --- a/kernel/cgroup/misc.c
> > +++ b/kernel/cgroup/misc.c
> > @@ -30,6 +30,19 @@ static const char *const misc_res_name[] = {
> >  #endif
> >  };
> >
> > +static const char *const misc_mask_name[] = {
> > +     "AT_HWCAP",
> > +#ifdef ELF_HWCAP2
> > +     "AT_HWCAP2",
> > +#endif
> > +#ifdef ELF_HWCAP3
> > +     "AT_HWCAP3",
> > +#endif
> > +#ifdef ELF_HWCAP4
> > +     "AT_HWCAP4",
> > +#endif
> > +};
> > +
> >  /* Root misc cgroup */
> >  static struct misc_cg root_cg;
> >
> > @@ -71,6 +84,11 @@ static inline bool valid_type(enum misc_res_type type)
> >       return type >= 0 && type < MISC_CG_RES_TYPES;
> >  }
> >
> > +static inline bool valid_mask_type(enum misc_mask_type type)
> > +{
> > +     return type >= 0 && type < MISC_CG_MASK_TYPES;
> > +}
> > +
> >  /**
> >   * misc_cg_set_capacity() - Set the capacity of the misc cgroup res.
> >   * @type: Type of the misc res.
> > @@ -391,6 +409,109 @@ static int misc_events_local_show(struct seq_file *sf, void *v)
> >       return __misc_events_show(sf, true);
> >  }
> >
> > +/**
> > + * misc_cg_get_mask() - Get the mask of the specified type.
> > + * @type: The misc mask type.
> > + * @cg: The misc cgroup.
> > + * @pmask: Pointer to the resulting mask.
> > + *
> > + * This function calculates the effective mask for a given cgroup by walking up
> > + * the hierarchy and ORing the masks from all parent cgroupfs. The final result
> > + * is stored in the location pointed to by @pmask.
> > + *
> > + * Context: Any context.
> > + * Return: 0 on success, -EINVAL if @type is invalid.
> > + */
> > +int misc_cg_get_mask(enum misc_mask_type type, struct misc_cg *cg, u64 *pmask)
> > +{
> > +     struct misc_cg *i;
> > +     u64 mask = 0;
> > +
> > +     if (!(valid_mask_type(type)))
> > +             return -EINVAL;
> > +
> > +     for (i = cg; i; i = parent_misc(i))
> > +             mask |= READ_ONCE(i->mask[type]);
> > +
> > +     *pmask = mask;
> > +     return 0;
> > +}
> > +
> > +/**
> > + * misc_cg_mask_show() - Show the misc cgroup masks.
> > + * @sf: Interface file
> > + * @v: Arguments passed
> > + *
> > + * Context: Any context.
> > + * Return: 0 to denote successful print.
> > + */
> > +static int misc_cg_mask_show(struct seq_file *sf, void *v)
> > +{
> > +     struct misc_cg *cg = css_misc(seq_css(sf));
> > +     int i;
> > +
> > +     for (i = 0; i < MISC_CG_MASK_TYPES; i++) {
> > +             u64 rval, val = READ_ONCE(cg->mask[i]);
> > +
> > +             misc_cg_get_mask(i, cg, &rval);
> > +             seq_printf(sf, "%s\t%#016llx\t%#016llx\n", misc_mask_name[i], val, rval);
> > +     }
> > +
> > +     return 0;
> > +}
> > +
>
> I'm concerned about the performance impact of the bottom-up traversal in deeply nested cgroup
> hierarchies. Could this approach introduce noticeable latency in such scenarios?
>

I wrote an execve benchmark to measure the impact of this change
(https://github.com/avagin/execve_vs_misccg).

The benchmark results are as follows:

depth | before (ops/sec)| after (ops/sec)| ratio %| perf
------------------------------------------------------
0     | 4813.06 ± 11.01 | 4826.78 ± 19.33| 100.28 |
2     | 4752.75 ± 11.28 | 4754.38 ± 21.93| 100.03 |
4     | 4767.41 ± 8.35  | 4729.81 ± 29.56|  99.21 |
8     | 4768.01 ± 10.42 | 4745.23 ± 27.68|  99.52 |
16    | 4749.34 ± 21.03 | 4723.63 ± 23.57|  99.45 |
32    | 4758.67 ± 10.94 | 4728.49 ± 13.9 |  99.36 |
64    | 4749.85 ± 12.33 | 4686.3  ± 13.06|  98.66 | 0.11%
128   | 4707.22 ± 12.01 | 4668.22 ± 16.9 |  99.17 | 0.33%
256   | 4725.75 ± 6.07  | 4629.09 ± 27.02|  97.95 | 1.61%

Columns:
* depth: The nesting level of the cgroup.
* before: without this patch.
* after: with this patch applied.
* ratio: performance of after relative to before.
* perf: profiling data from perf showing execution time spent in the
        misc_cg_get_mask function.

The performance impact is almost negligible for cgroup depths up to 64.
Even at a depth of 128, the overhead is less than 1%.

Thanks,
Andrei