mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-28 20:02:17 +00:00
![Tejun Heo](/assets/img/avatar_default.png)
This patch implements cgroup v2 thread support. The goal of the thread mode is supporting hierarchical accounting and control at thread granularity while staying inside the resource domain model which allows coordination across different resource controllers and handling of anonymous resource consumptions. A cgroup is always created as a domain and can be made threaded by writing to the "cgroup.type" file. When a cgroup becomes threaded, it becomes a member of a threaded subtree which is anchored at the closest ancestor which isn't threaded. The threads of the processes which are in a threaded subtree can be placed anywhere without being restricted by process granularity or no-internal-process constraint. Note that the threads aren't allowed to escape to a different threaded subtree. To be used inside a threaded subtree, a controller should explicitly support threaded mode and be able to handle internal competition in the way which is appropriate for the resource. The root of a threaded subtree, the nearest ancestor which isn't threaded, is called the threaded domain and serves as the resource domain for the whole subtree. This is the last cgroup where domain controllers are operational and where all the domain-level resource consumptions in the subtree are accounted. This allows threaded controllers to operate at thread granularity when requested while staying inside the scope of system-level resource distribution. As the root cgroup is exempt from the no-internal-process constraint, it can serve as both a threaded domain and a parent to normal cgroups, so, unlike non-root cgroups, the root cgroup can have both domain and threaded children. Internally, in a threaded subtree, each css_set has its ->dom_cset pointing to a matching css_set which belongs to the threaded domain. This ensures that thread root level cgroup_subsys_state for all threaded controllers are readily accessible for domain-level operations. This patch enables threaded mode for the pids and perf_events controllers. Neither has to worry about domain-level resource consumptions and it's enough to simply set the flag. For more details on the interface and behavior of the thread mode, please refer to the section 2-2-2 in Documentation/cgroup-v2.txt added by this patch. v5: - Dropped silly no-op ->dom_cgrp init from cgroup_create(). Spotted by Waiman. - Documentation updated as suggested by Waiman. - cgroup.type content slightly reformatted. - Mark the debug controller threaded. v4: - Updated to the general idea of marking specific cgroups domain/threaded as suggested by PeterZ. v3: - Dropped "join" and always make mixed children join the parent's threaded subtree. v2: - After discussions with Waiman, support for mixed thread mode is added. This should address the issue that Peter pointed out where any nesting should be avoided for thread subtrees while coexisting with other domain cgroups. - Enabling / disabling thread mode now piggy backs on the existing control mask update mechanism. - Bug fixes and cleanup. Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Waiman Long <longman@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org>
349 lines
8.9 KiB
C
349 lines
8.9 KiB
C
/*
|
|
* Process number limiting controller for cgroups.
|
|
*
|
|
* Used to allow a cgroup hierarchy to stop any new processes from fork()ing
|
|
* after a certain limit is reached.
|
|
*
|
|
* Since it is trivial to hit the task limit without hitting any kmemcg limits
|
|
* in place, PIDs are a fundamental resource. As such, PID exhaustion must be
|
|
* preventable in the scope of a cgroup hierarchy by allowing resource limiting
|
|
* of the number of tasks in a cgroup.
|
|
*
|
|
* In order to use the `pids` controller, set the maximum number of tasks in
|
|
* pids.max (this is not available in the root cgroup for obvious reasons). The
|
|
* number of processes currently in the cgroup is given by pids.current.
|
|
* Organisational operations are not blocked by cgroup policies, so it is
|
|
* possible to have pids.current > pids.max. However, it is not possible to
|
|
* violate a cgroup policy through fork(). fork() will return -EAGAIN if forking
|
|
* would cause a cgroup policy to be violated.
|
|
*
|
|
* To set a cgroup to have no limit, set pids.max to "max". This is the default
|
|
* for all new cgroups (N.B. that PID limits are hierarchical, so the most
|
|
* stringent limit in the hierarchy is followed).
|
|
*
|
|
* pids.current tracks all child cgroup hierarchies, so parent/pids.current is
|
|
* a superset of parent/child/pids.current.
|
|
*
|
|
* Copyright (C) 2015 Aleksa Sarai <cyphar@cyphar.com>
|
|
*
|
|
* This file is subject to the terms and conditions of version 2 of the GNU
|
|
* General Public License. See the file COPYING in the main directory of the
|
|
* Linux distribution for more details.
|
|
*/
|
|
|
|
#include <linux/kernel.h>
|
|
#include <linux/threads.h>
|
|
#include <linux/atomic.h>
|
|
#include <linux/cgroup.h>
|
|
#include <linux/slab.h>
|
|
|
|
#define PIDS_MAX (PID_MAX_LIMIT + 1ULL)
|
|
#define PIDS_MAX_STR "max"
|
|
|
|
struct pids_cgroup {
|
|
struct cgroup_subsys_state css;
|
|
|
|
/*
|
|
* Use 64-bit types so that we can safely represent "max" as
|
|
* %PIDS_MAX = (%PID_MAX_LIMIT + 1).
|
|
*/
|
|
atomic64_t counter;
|
|
int64_t limit;
|
|
|
|
/* Handle for "pids.events" */
|
|
struct cgroup_file events_file;
|
|
|
|
/* Number of times fork failed because limit was hit. */
|
|
atomic64_t events_limit;
|
|
};
|
|
|
|
static struct pids_cgroup *css_pids(struct cgroup_subsys_state *css)
|
|
{
|
|
return container_of(css, struct pids_cgroup, css);
|
|
}
|
|
|
|
static struct pids_cgroup *parent_pids(struct pids_cgroup *pids)
|
|
{
|
|
return css_pids(pids->css.parent);
|
|
}
|
|
|
|
static struct cgroup_subsys_state *
|
|
pids_css_alloc(struct cgroup_subsys_state *parent)
|
|
{
|
|
struct pids_cgroup *pids;
|
|
|
|
pids = kzalloc(sizeof(struct pids_cgroup), GFP_KERNEL);
|
|
if (!pids)
|
|
return ERR_PTR(-ENOMEM);
|
|
|
|
pids->limit = PIDS_MAX;
|
|
atomic64_set(&pids->counter, 0);
|
|
atomic64_set(&pids->events_limit, 0);
|
|
return &pids->css;
|
|
}
|
|
|
|
static void pids_css_free(struct cgroup_subsys_state *css)
|
|
{
|
|
kfree(css_pids(css));
|
|
}
|
|
|
|
/**
|
|
* pids_cancel - uncharge the local pid count
|
|
* @pids: the pid cgroup state
|
|
* @num: the number of pids to cancel
|
|
*
|
|
* This function will WARN if the pid count goes under 0, because such a case is
|
|
* a bug in the pids controller proper.
|
|
*/
|
|
static void pids_cancel(struct pids_cgroup *pids, int num)
|
|
{
|
|
/*
|
|
* A negative count (or overflow for that matter) is invalid,
|
|
* and indicates a bug in the `pids` controller proper.
|
|
*/
|
|
WARN_ON_ONCE(atomic64_add_negative(-num, &pids->counter));
|
|
}
|
|
|
|
/**
|
|
* pids_uncharge - hierarchically uncharge the pid count
|
|
* @pids: the pid cgroup state
|
|
* @num: the number of pids to uncharge
|
|
*/
|
|
static void pids_uncharge(struct pids_cgroup *pids, int num)
|
|
{
|
|
struct pids_cgroup *p;
|
|
|
|
for (p = pids; parent_pids(p); p = parent_pids(p))
|
|
pids_cancel(p, num);
|
|
}
|
|
|
|
/**
|
|
* pids_charge - hierarchically charge the pid count
|
|
* @pids: the pid cgroup state
|
|
* @num: the number of pids to charge
|
|
*
|
|
* This function does *not* follow the pid limit set. It cannot fail and the new
|
|
* pid count may exceed the limit. This is only used for reverting failed
|
|
* attaches, where there is no other way out than violating the limit.
|
|
*/
|
|
static void pids_charge(struct pids_cgroup *pids, int num)
|
|
{
|
|
struct pids_cgroup *p;
|
|
|
|
for (p = pids; parent_pids(p); p = parent_pids(p))
|
|
atomic64_add(num, &p->counter);
|
|
}
|
|
|
|
/**
|
|
* pids_try_charge - hierarchically try to charge the pid count
|
|
* @pids: the pid cgroup state
|
|
* @num: the number of pids to charge
|
|
*
|
|
* This function follows the set limit. It will fail if the charge would cause
|
|
* the new value to exceed the hierarchical limit. Returns 0 if the charge
|
|
* succeeded, otherwise -EAGAIN.
|
|
*/
|
|
static int pids_try_charge(struct pids_cgroup *pids, int num)
|
|
{
|
|
struct pids_cgroup *p, *q;
|
|
|
|
for (p = pids; parent_pids(p); p = parent_pids(p)) {
|
|
int64_t new = atomic64_add_return(num, &p->counter);
|
|
|
|
/*
|
|
* Since new is capped to the maximum number of pid_t, if
|
|
* p->limit is %PIDS_MAX then we know that this test will never
|
|
* fail.
|
|
*/
|
|
if (new > p->limit)
|
|
goto revert;
|
|
}
|
|
|
|
return 0;
|
|
|
|
revert:
|
|
for (q = pids; q != p; q = parent_pids(q))
|
|
pids_cancel(q, num);
|
|
pids_cancel(p, num);
|
|
|
|
return -EAGAIN;
|
|
}
|
|
|
|
static int pids_can_attach(struct cgroup_taskset *tset)
|
|
{
|
|
struct task_struct *task;
|
|
struct cgroup_subsys_state *dst_css;
|
|
|
|
cgroup_taskset_for_each(task, dst_css, tset) {
|
|
struct pids_cgroup *pids = css_pids(dst_css);
|
|
struct cgroup_subsys_state *old_css;
|
|
struct pids_cgroup *old_pids;
|
|
|
|
/*
|
|
* No need to pin @old_css between here and cancel_attach()
|
|
* because cgroup core protects it from being freed before
|
|
* the migration completes or fails.
|
|
*/
|
|
old_css = task_css(task, pids_cgrp_id);
|
|
old_pids = css_pids(old_css);
|
|
|
|
pids_charge(pids, 1);
|
|
pids_uncharge(old_pids, 1);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void pids_cancel_attach(struct cgroup_taskset *tset)
|
|
{
|
|
struct task_struct *task;
|
|
struct cgroup_subsys_state *dst_css;
|
|
|
|
cgroup_taskset_for_each(task, dst_css, tset) {
|
|
struct pids_cgroup *pids = css_pids(dst_css);
|
|
struct cgroup_subsys_state *old_css;
|
|
struct pids_cgroup *old_pids;
|
|
|
|
old_css = task_css(task, pids_cgrp_id);
|
|
old_pids = css_pids(old_css);
|
|
|
|
pids_charge(old_pids, 1);
|
|
pids_uncharge(pids, 1);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* task_css_check(true) in pids_can_fork() and pids_cancel_fork() relies
|
|
* on cgroup_threadgroup_change_begin() held by the copy_process().
|
|
*/
|
|
static int pids_can_fork(struct task_struct *task)
|
|
{
|
|
struct cgroup_subsys_state *css;
|
|
struct pids_cgroup *pids;
|
|
int err;
|
|
|
|
css = task_css_check(current, pids_cgrp_id, true);
|
|
pids = css_pids(css);
|
|
err = pids_try_charge(pids, 1);
|
|
if (err) {
|
|
/* Only log the first time events_limit is incremented. */
|
|
if (atomic64_inc_return(&pids->events_limit) == 1) {
|
|
pr_info("cgroup: fork rejected by pids controller in ");
|
|
pr_cont_cgroup_path(css->cgroup);
|
|
pr_cont("\n");
|
|
}
|
|
cgroup_file_notify(&pids->events_file);
|
|
}
|
|
return err;
|
|
}
|
|
|
|
static void pids_cancel_fork(struct task_struct *task)
|
|
{
|
|
struct cgroup_subsys_state *css;
|
|
struct pids_cgroup *pids;
|
|
|
|
css = task_css_check(current, pids_cgrp_id, true);
|
|
pids = css_pids(css);
|
|
pids_uncharge(pids, 1);
|
|
}
|
|
|
|
static void pids_free(struct task_struct *task)
|
|
{
|
|
struct pids_cgroup *pids = css_pids(task_css(task, pids_cgrp_id));
|
|
|
|
pids_uncharge(pids, 1);
|
|
}
|
|
|
|
static ssize_t pids_max_write(struct kernfs_open_file *of, char *buf,
|
|
size_t nbytes, loff_t off)
|
|
{
|
|
struct cgroup_subsys_state *css = of_css(of);
|
|
struct pids_cgroup *pids = css_pids(css);
|
|
int64_t limit;
|
|
int err;
|
|
|
|
buf = strstrip(buf);
|
|
if (!strcmp(buf, PIDS_MAX_STR)) {
|
|
limit = PIDS_MAX;
|
|
goto set_limit;
|
|
}
|
|
|
|
err = kstrtoll(buf, 0, &limit);
|
|
if (err)
|
|
return err;
|
|
|
|
if (limit < 0 || limit >= PIDS_MAX)
|
|
return -EINVAL;
|
|
|
|
set_limit:
|
|
/*
|
|
* Limit updates don't need to be mutex'd, since it isn't
|
|
* critical that any racing fork()s follow the new limit.
|
|
*/
|
|
pids->limit = limit;
|
|
return nbytes;
|
|
}
|
|
|
|
static int pids_max_show(struct seq_file *sf, void *v)
|
|
{
|
|
struct cgroup_subsys_state *css = seq_css(sf);
|
|
struct pids_cgroup *pids = css_pids(css);
|
|
int64_t limit = pids->limit;
|
|
|
|
if (limit >= PIDS_MAX)
|
|
seq_printf(sf, "%s\n", PIDS_MAX_STR);
|
|
else
|
|
seq_printf(sf, "%lld\n", limit);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static s64 pids_current_read(struct cgroup_subsys_state *css,
|
|
struct cftype *cft)
|
|
{
|
|
struct pids_cgroup *pids = css_pids(css);
|
|
|
|
return atomic64_read(&pids->counter);
|
|
}
|
|
|
|
static int pids_events_show(struct seq_file *sf, void *v)
|
|
{
|
|
struct pids_cgroup *pids = css_pids(seq_css(sf));
|
|
|
|
seq_printf(sf, "max %lld\n", (s64)atomic64_read(&pids->events_limit));
|
|
return 0;
|
|
}
|
|
|
|
static struct cftype pids_files[] = {
|
|
{
|
|
.name = "max",
|
|
.write = pids_max_write,
|
|
.seq_show = pids_max_show,
|
|
.flags = CFTYPE_NOT_ON_ROOT,
|
|
},
|
|
{
|
|
.name = "current",
|
|
.read_s64 = pids_current_read,
|
|
.flags = CFTYPE_NOT_ON_ROOT,
|
|
},
|
|
{
|
|
.name = "events",
|
|
.seq_show = pids_events_show,
|
|
.file_offset = offsetof(struct pids_cgroup, events_file),
|
|
.flags = CFTYPE_NOT_ON_ROOT,
|
|
},
|
|
{ } /* terminate */
|
|
};
|
|
|
|
struct cgroup_subsys pids_cgrp_subsys = {
|
|
.css_alloc = pids_css_alloc,
|
|
.css_free = pids_css_free,
|
|
.can_attach = pids_can_attach,
|
|
.cancel_attach = pids_cancel_attach,
|
|
.can_fork = pids_can_fork,
|
|
.cancel_fork = pids_cancel_fork,
|
|
.free = pids_free,
|
|
.legacy_cftypes = pids_files,
|
|
.dfl_cftypes = pids_files,
|
|
.threaded = true,
|
|
};
|