OpenVZ Forum - RDF feed
type: channel
items: [PATCH 00/10] Task Containers(V11): Introduction
items: [PATCH 01/10] Task Containers(V11): Basic task container framework
items: [PATCH 02/10] Task Containers(V11): Add tasks file interface
items: [PATCH 04/10] Task Containers(V11): Add container_clone() interface.
items: [PATCH 05/10] Task Containers(V11): Add procfs interface
items: [PATCH 06/10] Task Containers(V11): Shared container subsystem group arrays
items: [PATCH 07/10] Task Containers(V11): Automatic userspace notification of idle containers
items: [PATCH 10/10] Task Containers(V11): Simple task container debug info subsystem
items: Re: [PATCH 02/10] Task Containers(V11): Add tasks file interface
items: Re: [PATCH 07/10] Task Containers(V11): Automatic userspace notification of idle containers
items: Re: [PATCH 01/10] Task Containers(V11): Basic task container framework

[PATCH 00/10] Task Containers(V11): Introduction
type: item
description: This is an update to the task containers patchset. Changes since V10 (May 30th) include: - Based on 2.6.22-rc6-mm1 (minus existing container patches, see below) - Rolled in various fix/tidy patches contributed by akpm and others - Reorganisation of the mount/unmount code to use sget(); the new approach is modelled on the NFS superblock code. This fixes some potential lock inversions pointed out by lockdep. - Fix various lockdep warnings - Changed the create() subsystem callback to return a pointer to the new state object rather than updating the subsystem pointer in the container directly. - Changed container_add_file() to automatically prefix the subsystem name (and a period) on to all container files unless the filesystem is mounted with the "noprefix" option (intended for use by the legacy cpuset filesystem emulation). - Added a release_agent= mount option to allow the release agent path to be specified at mount time. - css_put() is now completely non-blocking - css_get()/css_put() avoid taking/dropping reference counts on the root state since this can't be freed anyway; this saves some atomic ops API changes (for subsystem writers): 1) return your new css object from create() callback 2) remove the subsystem name prefix from your cftype structures 3) pass your subsystem pointer as an additional new parameter to container_add_file() and container_add_files() Still TODO: - finalize the naming - add a hash-table based lookup for css_group objects. - use seq_file properly in container tasks files to avoid having to allocate a big array for all the container's task pointers. - add virtualization support to allow delegation to virtual servers - fix a lockdep false-positive - container_mutex nests inside inode->i_mutex, but there's a point in the mount code where we need to lock a newly-created (and hence guaranteed unlocked) directory from within container_mutex. - more subsystems Generic Process Containers -------------------------- There have recently been various p…
creator: Paul Menage
date: 2007-07-20T18:31:52-00:00

[PATCH 01/10] Task Containers(V11): Basic task container framework
type: item
description: This patch adds the main task containers framework - the container filesystem, and the basic structures for tracking membership and associating subsystem state objects to tasks. Signed-off-by: Paul Menage <menage@google.com> --- Documentation/containers.txt | 526 +++++++++++++++++ include/linux/container.h | 214 ++++++ include/linux/container_subsys.h | 10 include/linux/magic.h | 1 include/linux/sched.h | 34 + init/Kconfig | 8 init/main.c | 3 kernel/Makefile | 1 kernel/container.c | 1199 +++++++++++++++++++++++++++++++++++++++ 9 files changed, 1995 insertions(+), 1 deletion(-) Index: container-2.6.22-rc6-mm1/Documentation/containers.txt ============================================================ ======= --- /dev/null +++ container-2.6.22-rc6-mm1/Documentation/containers.txt @@ -0,0 +1,526 @@ + CONTAINERS + ------- + +Written by Paul Menage <menage@google.com> based on Documentation/cpusets.txt + +Original copyright statements from cpusets.txt: +Portions Copyright (C) 2004 BULL SA. +Portions Copyright (c) 2004-2006 Silicon Graphics, Inc. +Modified by Paul Jackson <pj@sgi.com> +Modified by Christoph Lameter <clameter@sgi.com> + +CONTENTS: +========= + +1. Containers + 1.1 What are containers ? + 1.2 Why are containers needed ? + 1.3 How are containers implemented ? + 1.4 What does notify_on_release do ? + 1.5 How do I use containers ? +2. Usage Examples and Syntax + 2.1 Basic Usage + 2.2 Attaching processes +3. Kernel API + 3.1 Overview + 3.2 Synchronization + 3.3 Subsystem API +4. Questions + +1. Containers +========== + +1.1 What are containers ? +---------------------- + +Containers provide a mechanism for aggregating/partitioning sets of +tasks, and all their future children, into hierarchical groups with +specialized behaviour. + +Definitions: + +A *container* associates a set of tasks with a set of parameters for one +or more subsystems. + +A *subsystem* is a module that makes use of the task grouping +facilities provided by containers to treat groups of tasks …
creator: Paul Menage
date: 2007-07-20T18:31:53-00:00

[PATCH 02/10] Task Containers(V11): Add tasks file interface
type: item
description: This patch adds the per-directory "tasks" file for containerfs mounts; this allows the user to determine which tasks are members of a container by reading a container's "tasks", and to move a task into a container by writing its pid to its "tasks". Signed-off-by: Paul Menage <menage@google.com> --- include/linux/container.h | 10 + kernel/container.c | 359 +++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 368 insertions(+), 1 deletion(-) Index: container-2.6.22-rc6-mm1/include/linux/container.h ============================================================ ======= --- container-2.6.22-rc6-mm1.orig/include/linux/container.h +++ container-2.6.22-rc6-mm1/include/linux/container.h @@ -144,6 +144,16 @@ int container_is_removed(const struct co int container_path(const struct container *cont, char *buf, int buflen); +int __container_task_count(const struct container *cont); +static inline int container_task_count(const struct container *cont) +{ + int task_count; + rcu_read_lock(); + task_count = __container_task_count(cont); + rcu_read_unlock(); + return task_count; +} + /* Return true if the container is a descendant of the current container */ int container_is_descendant(const struct container *cont); Index: container-2.6.22-rc6-mm1/kernel/container.c ============================================================ ======= --- container-2.6.22-rc6-mm1.orig/kernel/container.c +++ container-2.6.22-rc6-mm1/kernel/container.c @@ -40,7 +40,7 @@ #include <linux/magic.h> #include <linux/spinlock.h> #include <linux/string.h> - +#include <linux/sort.h> #include <asm/atomic.h> /* Generate an array of container subsystem pointers */ @@ -704,6 +704,127 @@ int container_path(const struct containe return 0; } +/* + * Return the first subsystem attached to a container's hierarchy, and + * its subsystem id. + */ + +static void get_first_subsys(const struct container *cont, + struct container_subsys_state **css, int *subsys_id) +{ + const struct containerfs_root *root = cont->roo…
creator: Paul Menage
date: 2007-07-20T18:31:54-00:00

[PATCH 04/10] Task Containers(V11): Add container_clone() interface.
type: item
description: This patch adds support for container_clone(), a way to create new containers intended to be used for systems such as namespace unsharing. A new subsystem callback, post_clone(), is added to allow subsystems to automatically configure cloned containers. Signed-off-by: Paul Menage <menage@google.com> --- Documentation/containers.txt | 7 ++ include/linux/container.h | 3 kernel/container.c | 135 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 145 insertions(+) Index: container-2.6.22-rc6-mm1/include/linux/container.h ============================================================ ======= --- container-2.6.22-rc6-mm1.orig/include/linux/container.h +++ container-2.6.22-rc6-mm1/include/linux/container.h @@ -174,6 +174,7 @@ struct container_subsys { void (*exit)(struct container_subsys *ss, struct task_struct *task); int (*populate)(struct container_subsys *ss, struct container *cont); + void (*post_clone)(struct container_subsys *ss, struct container *cont); void (*bind)(struct container_subsys *ss, struct container *root); int subsys_id; int active; @@ -213,6 +214,8 @@ static inline struct container* task_con int container_path(const struct container *cont, char *buf, int buflen); +int container_clone(struct task_struct *tsk, struct container_subsys *ss); + #else /* !CONFIG_CONTAINERS */ static inline int container_init_early(void) { return 0; } Index: container-2.6.22-rc6-mm1/kernel/container.c ============================================================ ======= --- container-2.6.22-rc6-mm1.orig/kernel/container.c +++ container-2.6.22-rc6-mm1/kernel/container.c @@ -1675,3 +1675,138 @@ void container_exit(struct task_struct * tsk->containers = init_task.containers; task_unlock(tsk); } + +/** + * container_clone - duplicate the current container in the hierarchy + * that the given subsystem is attached to, and move this task into + * the new child + */ +int container_clone(struct task_struct *tsk, struct container_subsys *subsys) +{ + struct dentry *dentry; + in…
creator: Paul Menage
date: 2007-07-20T18:31:56-00:00

[PATCH 05/10] Task Containers(V11): Add procfs interface
type: item
description: This patch adds: /proc/containers - general system info /proc/*/container - per-task container membership info Signed-off-by: Paul Menage <menage@google.com> --- fs/proc/base.c | 7 ++ include/linux/container.h | 2 kernel/container.c | 132 ++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 141 insertions(+) Index: container-2.6.22-rc6-mm1/fs/proc/base.c ============================================================ ======= --- container-2.6.22-rc6-mm1.orig/fs/proc/base.c +++ container-2.6.22-rc6-mm1/fs/proc/base.c @@ -67,6 +67,7 @@ #include <linux/mount.h> #include <linux/security.h> #include <linux/ptrace.h> +#include <linux/container.h> #include <linux/cpuset.h> #include <linux/audit.h> #include <linux/poll.h> @@ -2050,6 +2051,9 @@ static const struct pid_entry tgid_base_ #ifdef CONFIG_CPUSETS REG("cpuset", S_IRUGO, cpuset), #endif +#ifdef CONFIG_CONTAINERS + REG("container", S_IRUGO, container), +#endif INF("oom_score", S_IRUGO, oom_score), REG("oom_adj", S_IRUGO|S_IWUSR, oom_adjust), #ifdef CONFIG_AUDITSYSCALL @@ -2341,6 +2345,9 @@ static const struct pid_entry tid_base_s #ifdef CONFIG_CPUSETS REG("cpuset", S_IRUGO, cpuset), #endif +#ifdef CONFIG_CONTAINERS + REG("container", S_IRUGO, container), +#endif INF("oom_score", S_IRUGO, oom_score), REG("oom_adj", S_IRUGO|S_IWUSR, oom_adjust), #ifdef CONFIG_AUDITSYSCALL Index: container-2.6.22-rc6-mm1/kernel/container.c ============================================================ ======= --- container-2.6.22-rc6-mm1.orig/kernel/container.c +++ container-2.6.22-rc6-mm1/kernel/container.c @@ -33,6 +33,7 @@ #include <linux/mutex.h> #include <linux/mount.h> #include <linux/pagemap.h> +#include <linux/proc_fs.h> #include <linux/rcupdate.h> #include <linux/sched.h> #include <linux/seq_file.h> @@ -247,6 +248,7 @@ static int container_mkdir(struct inode static int container_rmdir(struct inode *unused_dir, struct dentry *dentry); static int container_populate_dir(struct container *cont); static struct inode_operations …
creator: Paul Menage
date: 2007-07-20T18:31:57-00:00

[PATCH 06/10] Task Containers(V11): Shared container subsystem group arrays
type: item
description: This patch replaces the struct css_group embedded in task_struct with a pointer; all tasks that have the same set of memberships across all hierarchies will share a css_group object, and will be linked via their css_groups field to the "tasks" list_head in the css_group. Assuming that many tasks share the same container assignments, this reduces overall space usage and keeps the size of the task_struct down (three pointers added to task_struct compared to a non-containers kernel, no matter how many subsystems are registered). Signed-off-by: Paul Menage <menage@google.com> --- Documentation/containers.txt | 14 include/linux/container.h | 89 +++++- include/linux/sched.h | 33 -- kernel/container.c | 606 +++++++++++++++++++++++++++++++++++++------ kernel/fork.c | 1 5 files changed, 620 insertions(+), 123 deletions(-) Index: container-2.6.22-rc6-mm1/Documentation/containers.txt ============================================================ ======= --- container-2.6.22-rc6-mm1.orig/Documentation/containers.txt +++ container-2.6.22-rc6-mm1/Documentation/containers.txt @@ -176,7 +176,9 @@ Containers extends the kernel as follows subsystem state is something that's expected to happen frequently and in performance-critical code, whereas operations that require a task's actual container assignments (in particular, moving between - containers) are less common. + containers) are less common. A linked list runs through the cg_list + field of each task_struct using the css_group, anchored at + css_group->tasks. - A container hierarchy filesystem can be mounted for browsing and manipulation from user space. @@ -252,6 +254,16 @@ linear search to locate an appropriate e very efficient. A future version will use a hash table for better performance. +To allow access from a container to the css_groups (and hence tasks) +that comprise it, a set of cg_container_link objects form a lattice; +each cg_container_link is linked into a list of cg_container_links for +a single container on its con…
creator: Paul Menage
date: 2007-07-20T18:31:58-00:00

[PATCH 07/10] Task Containers(V11): Automatic userspace notification of idle containers
type: item
description: This patch adds the following files to the container filesystem: notify_on_release - configures/reports whether the container subsystem should attempt to run a release script when this container becomes unused release_agent - configures/reports the release agent to be used for this hierarchy (top level in each hierarchy only) releasable - reports whether this container would have been auto-released if notify_on_release was true and a release agent was configured (mainly useful for debugging) To avoid locking issues, invoking the userspace release agent is done via a workqueue task; containers that need to have their release agents invoked by the workqueue task are linked on to a list. Signed-off-by: Paul Menage <menage@google.com> --- include/linux/container.h | 11 - kernel/container.c | 425 +++++++++++++++++++++++++++++++++++++++++----- 2 files changed, 393 insertions(+), 43 deletions(-) Index: container-2.6.22-rc6-mm1/include/linux/container.h ============================================================ ======= --- container-2.6.22-rc6-mm1.orig/include/linux/container.h +++ container-2.6.22-rc6-mm1/include/linux/container.h @@ -77,10 +77,11 @@ static inline void css_get(struct contai * css_get() */ +extern void __css_put(struct container_subsys_state *css); static inline void css_put(struct container_subsys_state *css) { if (!test_bit(CSS_ROOT, &css->flags)) - atomic_dec(&css->refcnt); + __css_put(css); } struct container { @@ -112,6 +113,13 @@ struct container { * tasks in this container. Protected by css_group_lock */ struct list_head css_groups; + + /* + * Linked list running through all containers that can + * potentially be reaped by the release agent. Protected by + * release_list_lock + */ + struct list_head release_list; }; /* A css_group is a structure holding pointers to a set of @@ -285,7 +293,6 @@ struct task_struct *container_iter_next( struct container_iter *it); void container_iter_end(struct container *cont, struct container_iter *it); - #else /* !…
creator: Paul Menage
date: 2007-07-20T18:31:59-00:00

[PATCH 10/10] Task Containers(V11): Simple task container debug info subsystem
type: item
description: This example subsystem exports debugging information as an aid to diagnosing refcount leaks, etc, in the container framework. Signed-off-by: Paul Menage <menage@google.com> --- include/linux/container_subsys.h | 4 + init/Kconfig | 10 ++++ kernel/Makefile | 1 kernel/container_debug.c | 97 +++++++++++++++++++++++++++++++++++++++ 4 files changed, 112 insertions(+) Index: container-2.6.22-rc6-mm1/include/linux/container_subsys.h ============================================================ ======= --- container-2.6.22-rc6-mm1.orig/include/linux/container_subsys .h +++ container-2.6.22-rc6-mm1/include/linux/container_subsys.h @@ -19,4 +19,8 @@ SUBSYS(cpuacct) /* */ +#ifdef CONFIG_CONTAINER_DEBUG +SUBSYS(debug) +#endif + /* */ Index: container-2.6.22-rc6-mm1/init/Kconfig ============================================================ ======= --- container-2.6.22-rc6-mm1.orig/init/Kconfig +++ container-2.6.22-rc6-mm1/init/Kconfig @@ -303,6 +303,16 @@ config CONTAINERS Say N if unsure. +config CONTAINER_DEBUG + bool "Example debug container subsystem" + depends on CONTAINERS + help + This option enables a simple container subsystem that + exports useful debugging information about the containers + framework + + Say N if unsure + config CPUSETS bool "Cpuset support" depends on SMP && CONTAINERS Index: container-2.6.22-rc6-mm1/kernel/Makefile ============================================================ ======= --- container-2.6.22-rc6-mm1.orig/kernel/Makefile +++ container-2.6.22-rc6-mm1/kernel/Makefile @@ -38,6 +38,7 @@ obj-$(CONFIG_BSD_PROCESS_ACCT) += acct.o obj-$(CONFIG_KEXEC) += kexec.o obj-$(CONFIG_COMPAT) += compat.o obj-$(CONFIG_CONTAINERS) += container.o +obj-$(CONFIG_CONTAINER_DEBUG) += container_debug.o obj-$(CONFIG_CPUSETS) += cpuset.o obj-$(CONFIG_CONTAINER_CPUACCT) += cpu_acct.o obj-$(CONFIG_IKCONFIG) += configs.o Index: container-2.6.22-rc6-mm1/kernel/container_debug.c ============================================================ ======= --- /dev/null +++ container-…
creator: Paul Menage
date: 2007-07-20T18:32:02-00:00

Re: [PATCH 02/10] Task Containers(V11): Add tasks file interface
type: item
description: On Fri, 20 Jul 2007, menage@google.com wrote: > +/* > + * Attach task with pid 'pid' to container 'cont'. Call with > + * container_mutex, may take task_lock of task > + */ > +static int attach_task_by_pid(struct container *cont, char *pidbuf) > +{ > + pid_t pid; > + struct task_struct *tsk; > + int ret; > + > + if (sscanf(pidbuf, "%d", &pid) != 1) > + return -EIO; > + > + if (pid) { > + rcu_read_lock(); > + tsk = find_task_by_pid(pid); > + if (!tsk || tsk->flags & PF_EXITING) { > + rcu_read_unlock(); > + return -ESRCH; > + } > + get_task_struct(tsk); > + rcu_read_unlock(); > + > + if ((current->euid) && (current->euid != tsk->uid) > + && (current->euid != tsk->suid)) { > + put_task_struct(tsk); > + return -EACCES; I wonder if we should allow CAP_SYS_ADMIN to do this, too. -- James Morris <jmorris@namei.org>
creator: James Morris
date: 2007-07-20T20:20:10-00:00

Re: [PATCH 02/10] Task Containers(V11): Add tasks file interface
type: item
description: On 7/20/07, James Morris <jmorris@namei.org> wrote: > > + if ((current->euid) && (current->euid != tsk->uid) > > + && (current->euid != tsk->suid)) { > > + put_task_struct(tsk); > > + return -EACCES; > > I wonder if we should allow CAP_SYS_ADMIN to do this, too. > Yes, I ought to replace "current->euid" with "capable(CAP_SYS_ADMIN)". Thanks, Paul
creator: Paul Menage
date: 2007-07-20T21:25:41-00:00

Re: [PATCH 07/10] Task Containers(V11): Automatic userspace notification of idle containers
type: item
description: Quoting menage@google.com (menage@google.com): > This patch adds the following files to the container filesystem: > > notify_on_release - configures/reports whether the container subsystem should > attempt to run a release script when this container becomes unused > > release_agent - configures/reports the release agent to be used for > this hierarchy (top level in each hierarchy only) > > releasable - reports whether this container would have been auto-released if > notify_on_release was true and a release agent was configured (mainly useful > for debugging) > > To avoid locking issues, invoking the userspace release agent is done via a > workqueue task; containers that need to have their release agents invoked by > the workqueue task are linked on to a list. Hi Paul, my tree may be a bit crufty, but I had to #include <linux/kmod.h> in order for this to compile on s390. thanks, -serge > Signed-off-by: Paul Menage <menage@google.com> > --- > > include/linux/container.h | 11 - > kernel/container.c | 425 +++++++++++++++++++++++++++++++++++++++++----- > 2 files changed, 393 insertions(+), 43 deletions(-) > > Index: container-2.6.22-rc6-mm1/include/linux/container.h > ============================================================ ======= > --- container-2.6.22-rc6-mm1.orig/include/linux/container.h > +++ container-2.6.22-rc6-mm1/include/linux/container.h > @@ -77,10 +77,11 @@ static inline void css_get(struct contai > * css_get() > */ > > +extern void __css_put(struct container_subsys_state *css); > static inline void css_put(struct container_subsys_state *css) > { > if (!test_bit(CSS_ROOT, &css->flags)) > - atomic_dec(&css->refcnt); > + __css_put(css); > } > > struct container { > @@ -112,6 +113,13 @@ struct container { > * tasks in this container. Protected by css_group_lock > */ > struct list_head css_groups; > + > + /* > + * Linked list running through all containers that can > + * potentially be reaped by the release agent. Protected by > + * release_list_lock > + */…
creator: serue
date: 2007-07-23T17:41:02-00:00

Re: [PATCH 01/10] Task Containers(V11): Basic task container framework
type: item
description: > +Other fields in the container_subsys object include: > +- hierarchy: an index indicating which hierarchy, if any, this > + subsystem is currently attached to. If this is -1, then the > + subsystem is not attached to any hierarchy, and all tasks should be > + considered to be members of the subsystem's top_container. It should > + be initialized to -1. stale info? > +struct container { > + struct containerfs_root *root; > + struct container *top_container; > +}; can cont->top_container be different from than &cont->root.top_container? YAMAMOTO Takashi _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: yamamoto
date: 2007-07-27T05:31:19-00:00

Re: [PATCH 01/10] Task Containers(V11): Basic task container framework
type: item
description: On 7/26/07, YAMAMOTO Takashi <yamamoto@valinux.co.jp> wrote: > > +Other fields in the container_subsys object include: > > > +- hierarchy: an index indicating which hierarchy, if any, this > > + subsystem is currently attached to. If this is -1, then the > > + subsystem is not attached to any hierarchy, and all tasks should be > > + considered to be members of the subsystem's top_container. It should > > + be initialized to -1. > > stale info? Yes, I think so. I really need to do a proper pass over Documentation/containers.txt one more time following a bunch of recent changes. > > > +struct container { > > > + struct containerfs_root *root; > > + struct container *top_container; > > +}; > > can cont->top_container be different from than &cont->root.top_container? No, I guess it can't. And there are only a couple of places using cont->top_container now, so I should probably remove it. Thanks, Paul _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Paul Menage
date: 2007-07-29T17:03:49-00:00

Re: [PATCH 01/10] Task Containers(V11): Basic task container framework
type: item
description: > +extern void container_init_smp(void); > +static inline void container_init_smp(void) {} stale prototypes? YAMAMOTO Takashi _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: yamamoto
date: 2007-07-30T04:00:00-00:00