Skip to content

Commit 1f22144

Browse files
authored
Merge pull request #1002 from intel/push-2026-02-20
Push 2026 02 20
2 parents 448e026 + 786225b commit 1f22144

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+2003
-161
lines changed
Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: Security Scanning (dockerfile)
2+
3+
on:
4+
schedule:
5+
# Every 2 months on 1st at midnight UTC
6+
- cron: '0 0 1 */2 *'
7+
# Manual trigger for testing
8+
workflow_dispatch:
9+
10+
jobs:
11+
security:
12+
runs-on: ["innersource.prod.amr.dind"]
13+
if: ${{ github.repository != 'intel/pcm' }}
14+
15+
permissions:
16+
contents: read
17+
pull-requests: write
18+
steps:
19+
- uses: actions/checkout@v4
20+
with:
21+
fetch-depth: 0
22+
submodules: false
23+
24+
- uses: actions/setup-python@v5
25+
with:
26+
python-version: '3.11'
27+
28+
- name: CAS Security Orchestrator (Source Only)
29+
uses: intel-innersource/applications.security.monitoring.cas@v2
30+
with:
31+
sdl-api-key: ${{ secrets.SDL_API_KEY }}
32+
sdl-project-id: ${{ secrets.SDL_PROJECT_ID }}
33+
sdl-idsid-value: ${{ secrets.SDL_IDSID_VALUE }}
34+
# Scan for SDL419 only (workaround), SDL441 has separate scan
35+
sdl-tasks: "SDL419"
36+
# Set branch type to 'release' for scheduled runs and manual trigger on main branch.
37+
# Required for automatic evidence submit. Excludes push events.
38+
branch-type: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') && 'release' || 'dev' }}
Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: Security Scanning (Source Code)
2+
3+
on:
4+
schedule:
5+
# Every 2 months on 1st at midnight UTC
6+
- cron: '0 0 1 */2 *'
7+
# Manual trigger for testing
8+
workflow_dispatch:
9+
10+
jobs:
11+
security:
12+
runs-on: ["innersource.prod.amr.dind"]
13+
if: ${{ github.repository != 'intel/pcm' }}
14+
15+
permissions:
16+
contents: read
17+
pull-requests: write
18+
steps:
19+
- uses: actions/checkout@v4
20+
with:
21+
fetch-depth: 0
22+
submodules: recursive
23+
24+
- uses: actions/setup-python@v5
25+
with:
26+
python-version: '3.11'
27+
28+
- name: Install Python dependencies for SCA scanning
29+
run: |
30+
pip install -r perfmon/requirements.txt || true
31+
pip install -r perfmon/scripts/ci/verify_mapfile/requirements.txt || true
32+
pip install -r Intel-PMT/tools/docker/requirements.txt || true
33+
34+
- name: CAS Security Orchestrator (Source Only)
35+
uses: intel-innersource/applications.security.monitoring.cas@v2
36+
with:
37+
sdl-api-key: ${{ secrets.SDL_API_KEY }}
38+
sdl-project-id: ${{ secrets.SDL_PROJECT_ID }}
39+
sdl-idsid-value: ${{ secrets.SDL_IDSID_VALUE }}
40+
sdl-tasks: "SDL441" # scan for SDL441 only, SDL419 has separate scan (workaround)
41+
# Set branch type to 'release' for scheduled runs and manual trigger on main branch.
42+
# Required for automatic evidence submit. Excludes push events.
43+
branch-type: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') && 'release' || 'dev' }}

.github/workflows/ci-fuzz-micro.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,9 @@ jobs:
4141
- name: upload-artifact
4242
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
4343
with:
44-
name: fuzz-log-${{ github.sha }}
45-
path: "build/fuzz-log.txt"
44+
name: fuzz-evidence-${{ github.sha }}
45+
path: |
46+
build/fuzz-log.txt
47+
build/report.txt
4648
4749

.github/workflows/ci-fuzz.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,9 @@ jobs:
4343
- name: upload-artifact
4444
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
4545
with:
46-
name: fuzz-log-${{ github.sha }}
47-
path: "build/fuzz-log.txt"
46+
name: fuzz-evidence-${{ github.sha }}
47+
path: |
48+
build/fuzz-log.txt
49+
build/report.txt
4850
4951

.github/workflows/ci-windows.yml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ on:
88

99
env:
1010
BUILD_TYPE: Release
11+
OPENSSL_ROOT_DIR: "C:\\Program Files\\OpenSSL-Win64"
1112

1213
permissions:
1314
contents: read
@@ -30,7 +31,11 @@ jobs:
3031
- name: Configure CMake
3132
run: |
3233
if (Test-Path ${{github.workspace}}\build){ Remove-Item ${{github.workspace}}\build -Recurse }
33-
cmake -B ${{github.workspace}}\build
34+
$cryptoLib = "$env:OPENSSL_ROOT_DIR\lib\VC\x64\MT\libcrypto_static.lib"
35+
$sslLib = "$env:OPENSSL_ROOT_DIR\lib\VC\x64\MT\libssl_static.lib"
36+
cmake -B ${{github.workspace}}\build `
37+
-DLIB_EAY_RELEASE:FILEPATH="$cryptoLib" `
38+
-DSSL_EAY_RELEASE:FILEPATH="$sslLib"
3439
- name: Build
3540
run: |
3641
cmake --build ${{github.workspace}}\build --config ${{env.BUILD_TYPE}} --parallel

.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,4 @@ build
3535
src/simdjson
3636
.vscode/
3737
_codeql_build_dir/
38+
tests/numa_test

Dockerfile

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,26 @@ FROM fedora:43@sha256:6cd815d862109208adf6040ea13391fe6aeb87a9dc80735c2ab07083fd
44
# Copyright (c) 2020-2024 Intel Corporation
55

66
RUN dnf -y install gcc-c++ git findutils make cmake openssl openssl-devel libasan libasan-static hwdata
7+
78
COPY . /tmp/pcm
8-
RUN cd /tmp/pcm && mkdir build && cd build && cmake -DPCM_NO_STATIC_LIBASAN=OFF .. && make -j
9+
WORKDIR /tmp/pcm/build
10+
RUN cmake -DPCM_NO_STATIC_LIBASAN=OFF .. && make -j
911

1012
FROM fedora:43@sha256:6cd815d862109208adf6040ea13391fe6aeb87a9dc80735c2ab07083fdf5e03a
13+
1114
COPY --from=builder /tmp/pcm/build/bin/* /usr/local/bin/
1215
COPY --from=builder /tmp/pcm/build/bin/opCode*.txt /usr/local/share/pcm/
1316
COPY --from=builder /usr/share/hwdata/pci.ids /usr/share/hwdata/pci.ids
1417
ENV PCM_NO_PERF=1
1518

16-
ENTRYPOINT [ "/usr/local/bin/pcm-sensor-server", "-p", "9738", "-r" ]
19+
RUN useradd -m pcm-user
20+
21+
# Allow pcm-user to run the server via sudo without a password
22+
RUN echo "pcm-user ALL=(root) NOPASSWD: /usr/local/bin/pcm-sensor-server" >> /etc/sudoers
23+
24+
USER pcm-user
25+
26+
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
27+
CMD sudo /usr/local/bin/pcm-sensor-server --help > /dev/null 2>&1 || exit 1
28+
29+
ENTRYPOINT [ "sudo", "/usr/local/bin/pcm-sensor-server", "-p", "9738", "-r" ]

doc/ENVVAR_README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,6 @@
1414

1515
`PCM_ENFORCE_MBM=1` : force-enable Memory Bandwidth Monitoring (MBM) metrics (LocalMemoryBW = LMB) and (RemoteMemoryBW = RMB) on processors with RDT/MBM errata
1616

17+
`PCM_QUIET=1` : enable quiet mode for PCM initialization. In quiet mode, only error messages are output during PCM initialization, suppressing informational output such as processor information and topology details
18+
1719
`PCM_DEBUG_LEVEL=x` : x is an integer defining debug output level. level = 0 (default): minimal or no debug info, > 0 increases verbosity

doc/NUMA_NODE_API.md

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
# NUMA Node Location API for PCI Devices
2+
3+
## Overview
4+
5+
The `getNUMANode()` API allows you to retrieve the NUMA (Non-Uniform Memory Access) node location of a PCI device identified by its segment:bus:device:function coordinates.
6+
7+
## Background
8+
9+
- **PciHandle** and **PciHandleMM** classes are abstractions of PCI configuration space registers
10+
- Each PCI device has a unique location: `segment:bus:device:function`
11+
- **segment** is also known as **group number** or **domain** (synonyms: groupnr, groupnr_)
12+
13+
## API Usage
14+
15+
### Method Signature
16+
17+
```cpp
18+
int32 PciHandle::getNUMANode() const;
19+
int32 PciHandleMM::getNUMANode() const;
20+
```
21+
22+
### Return Value
23+
24+
- **>= 0**: The NUMA node ID where the PCI device is located
25+
- **-1**: NUMA information not available or not applicable
26+
27+
### Example
28+
29+
```cpp
30+
#include "pci.h"
31+
32+
using namespace pcm;
33+
34+
// Open a PCI device at segment 0, bus 0, device 0, function 0
35+
PciHandleType handle(0, 0, 0, 0);
36+
37+
// Get the NUMA node
38+
int32 numa_node = handle.getNUMANode();
39+
40+
if (numa_node >= 0) {
41+
std::cout << "Device is on NUMA node: " << numa_node << "\n";
42+
} else {
43+
std::cout << "NUMA information not available\n";
44+
}
45+
```
46+
47+
## Platform-Specific Implementation
48+
49+
### Linux
50+
51+
- **Method**: Reads from `/sys/bus/pci/devices/<domain>:<bus>:<device>.<function>/numa_node`
52+
- **Fallback**: Also tries `/pcm/sys/bus/pci/devices/...` path
53+
- **Return**:
54+
- NUMA node ID (typically 0, 1, 2, ...) if available
55+
- -1 if the file doesn't exist or can't be read
56+
57+
### Windows
58+
59+
- **Method**: Reads SRAT (System Resource Affinity Table) from ACPI firmware using `GetSystemFirmwareTable` API
60+
- **Implementation**:
61+
- Parses SRAT table to extract PCI Device Affinity structures (type 2)
62+
- Builds a mapping from PCI device location (segment:bus:device:function) to NUMA node (proximity domain)
63+
- Caches the mapping on first call for performance
64+
- **Return**:
65+
- NUMA node ID (proximity domain) if device is found in SRAT table
66+
- -1 if SRAT table is not available or device is not listed
67+
- **Requirements**: Windows Vista or later (for `GetSystemFirmwareTable` API)
68+
69+
### FreeBSD / DragonFly
70+
71+
- **Method**: Queries system via `sysctlbyname()` for NUMA domain information
72+
- **Implementation**:
73+
- First checks if NUMA is enabled via `vm.ndomains` sysctl
74+
- Attempts to query PCI device-specific NUMA domain using multiple sysctl path formats
75+
- Tries: `hw.pci.X.Y.Z.W.numa_domain` and `hw.pci.X:Y:Z.W.numa_domain`
76+
- **Return**:
77+
- NUMA node ID if available and system has NUMA enabled
78+
- -1 if NUMA is disabled, not supported, or device affinity information unavailable
79+
- **Note**: FreeBSD doesn't have a standardized sysctl path for PCI device NUMA affinity across all versions
80+
81+
### macOS
82+
83+
- **Method**: Returns -1 (macOS typically doesn't expose NUMA for PCI devices)
84+
- **Return**: -1 (not applicable)
85+
86+
## Use Cases
87+
88+
1. **Performance Optimization**: Place processing threads on the same NUMA node as the device
89+
2. **Memory Allocation**: Allocate buffers on the same NUMA node for optimal DMA performance
90+
3. **System Topology Discovery**: Map out the relationship between PCI devices and NUMA nodes
91+
4. **Monitoring and Analytics**: Identify cross-NUMA traffic patterns
92+
93+
## Building the Example
94+
95+
```bash
96+
cd examples
97+
g++ -std=c++11 -I../src numa_node_example.cpp -o numa_node_example -L../build/lib -lpcm -lpthread
98+
LD_LIBRARY_PATH=../build/lib ./numa_node_example
99+
```
100+
101+
## Notes
102+
103+
- Requires appropriate permissions to access PCI configuration space
104+
- On Linux, run with `sudo` or ensure `/sys/bus/pci` is accessible
105+
- The NUMA node value is read at runtime and not cached
106+
- A return value of -1 doesn't indicate an error; it means NUMA information is not available
107+
108+
## Related APIs
109+
110+
- `PciHandle::read32()` - Read 32-bit value from PCI configuration space
111+
- `PciHandle::write32()` - Write 32-bit value to PCI configuration space
112+
- `PciHandle::read64()` - Read 64-bit value from PCI configuration space
113+
- `PciHandle::exists()` - Check if a PCI device exists
114+
115+
## See Also
116+
117+
- Linux kernel documentation: `Documentation/ABI/testing/sysfs-bus-pci`
118+
- ACPI SRAT (System Resource Affinity Table) specification
119+
- PCI Express Base Specification

0 commit comments

Comments
 (0)