[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH 00/19] implement cgroups v2 devices support



On Wed, Jan 02, 2019 at 03:08:32PM +0100, Pavel Hrdina wrote:
In cgroups v2 there is no devices controller, BPF should be used
instead.

Patches 3 - 12 will be squashed into single commit and they need to be
compiled together, I've separated them to make review easier.

Pavel Hrdina (19):
 util: introduce virbpf helpers
 vircgroup: introduce virCgroupV2DevicesAvailable
 vircgroup: introduce virCgroupV2DeviceLoadProg
 vircgroup: introduce virCgroupV2DeviceAttachProg
 vircgroup: introduce virCgroupV2DeviceDetectProg
 vircgroup: introduce virCgroupV2DeviceCreateProg
 vircgroup: introduce virCgroupV2DeviceReallocMap
 vircgroup: introduce virCgroupV2DevicePrepareProg
 vircgroup: introduce virCgroupV2DeviceRemoveProg
 vircgroup: introduce virCgroupV2DeviceGetPerms
 vircgroup: introduce virCgroupV2DeviceGetKey
 vircgroup: introduce virCgroupV2AllowDevice
 vircgroup: introduce virCgroupV2DenyDevice
 vircgroup: introduce virCgroupV2AllowAllDevices
 vircgroup: introduce virCgroupV2DenyAllDevices
 vircgroup: workaround devices in hybrid mode
 vircgroupv2: detech BPF program before removing cgroup
 vircgroupv2: use dummy process to workaround kernel bug with systemd
 vircgroupmock: mock virBPFQueryProg

include/libvirt/virterror.h       |   1 +
src/Makefile.am                   |   1 +
src/libvirt_private.syms          |  17 +
src/lxc/lxc_cgroup.c              |   1 +
src/qemu/qemu_cgroup.c            |   6 +-
src/util/Makefile.inc.am          |   2 +
src/util/virbpf.c                 | 263 ++++++++++++
src/util/virbpf.h                 | 249 ++++++++++++
src/util/vircgroup.c              |  18 +-
src/util/vircgroup.h              |   1 +
src/util/vircgroupbackend.h       |   3 +-
src/util/vircgrouppriv.h          |  12 +
src/util/vircgroupv1.c            |   9 +-
src/util/vircgroupv2.c            | 638 +++++++++++++++++++++++++++++-
src/util/virerror.c               |   1 +
src/util/virsystemd.c             |   2 +-
src/util/virsystemd.h             |   2 +
tests/vircgroupdata/hybrid.parsed |   2 +-
tests/vircgroupmock.c             |  11 +
tests/vircgrouptest.c             |   4 +-
20 files changed, 1233 insertions(+), 10 deletions(-)
create mode 100644 src/util/virbpf.c
create mode 100644 src/util/virbpf.h


I haven't had the time to look at this closely, but this fails to compile
on my Gentoo with sys-kernel/linux-headers-4.14-r1:

util/virbpf.c:121:10: error: field designator 'query' does not refer to any field in type 'union bpf_attr'
       .query.target_fd = targetfd,
        ^
util/virbpf.c:122:10: error: field designator 'query' does not refer to any field in type 'union bpf_attr'
       .query.attach_type = attachType,
        ^
util/virbpf.c:123:10: error: field designator 'query' does not refer to any field in type 'union bpf_attr'
       .query.prog_cnt = maxprogids,
        ^
util/virbpf.c:124:10: error: field designator 'query' does not refer to any field in type 'union bpf_attr'
       .query.prog_ids = (__u64)progids,
        ^
util/virbpf.c:127:27: error: use of undeclared identifier 'BPF_PROG_QUERY'; did you mean 'BPF_PROG_LOAD'?
   rc = syscall(SYS_bpf, BPF_PROG_QUERY, &attr, sizeof(attr));
                         ^~~~~~~~~~~~~~
                         BPF_PROG_LOAD
/usr/include/linux/bpf.h:85:2: note: 'BPF_PROG_LOAD' declared here
       BPF_PROG_LOAD,
       ^
util/virbpf.c:162:25: error: no member named 'nr_map_ids' in 'struct bpf_prog_info'
   if (mapIDs && info->nr_map_ids > 0) {
                 ~~~~  ^
util/virbpf.c:163:37: error: no member named 'nr_map_ids' in 'struct bpf_prog_info'
       unsigned int maplen = info->nr_map_ids;
                             ~~~~  ^
util/virbpf.c:170:15: error: no member named 'nr_map_ids' in 'struct bpf_prog_info'
       info->nr_map_ids = maplen;
       ~~~~  ^
util/virbpf.c:171:15: error: no member named 'map_ids' in 'struct bpf_prog_info'
       info->map_ids = (__u64)retmapIDs;
       ~~~~  ^
9 errors generated.
 CC       util/libvirt_util_la-viriptables.lo
 CC       util/libvirt_util_la-viriscsi.lo
make[3]: *** [Makefile:11083: util/libvirt_util_la-virbpf.lo] Error 1
make[3]: *** Waiting for unfinished jobs....
util/vircgroupv2.c:305:38: error: use of undeclared identifier 'BPF_CGROUP_DEVICE'; did you mean 'VIR_CGROUP_DEVICE_RW'?
   if (virBPFQueryProg(cgroupfd, 0, BPF_CGROUP_DEVICE, &progCnt, NULL) < 0) {
                                    ^~~~~~~~~~~~~~~~~
                                    VIR_CGROUP_DEVICE_RW
./util/vircgroup.h:200:5: note: 'VIR_CGROUP_DEVICE_RW' declared here
   VIR_CGROUP_DEVICE_RW    = VIR_CGROUP_DEVICE_READ | VIR_CGROUP_DEVICE_WRITE,
   ^
util/vircgroupv2.c:1686:33: error: use of undeclared identifier 'BPF_PROG_TYPE_CGROUP_DEVICE'; did you mean 'BPF_PROG_TYPE_CGROUP_SOCK'?
   return virBPFLoadProg(prog, BPF_PROG_TYPE_CGROUP_DEVICE, ARRAY_CARDINALITY(prog));
                               ^~~~~~~~~~~~~~~~~~~~~~~~~~~
                               BPF_PROG_TYPE_CGROUP_SOCK
/usr/include/linux/bpf.h:127:2: note: 'BPF_PROG_TYPE_CGROUP_SOCK' declared here
       BPF_PROG_TYPE_CGROUP_SOCK,
       ^
util/vircgroupv2.c:1717:44: error: use of undeclared identifier 'BPF_CGROUP_DEVICE'; did you mean 'VIR_CGROUP_DEVICE_RW'?
   if (virBPFAttachProg(progfd, cgroupfd, BPF_CGROUP_DEVICE) < 0) {
                                          ^~~~~~~~~~~~~~~~~
                                          VIR_CGROUP_DEVICE_RW
./util/vircgroup.h:200:5: note: 'VIR_CGROUP_DEVICE_RW' declared here
   VIR_CGROUP_DEVICE_RW    = VIR_CGROUP_DEVICE_READ | VIR_CGROUP_DEVICE_WRITE,
   ^
util/vircgroupv2.c:1787:49: error: use of undeclared identifier 'BPF_CGROUP_DEVICE'; did you mean 'VIR_CGROUP_DEVICE_RW'?
   if (virBPFQueryProg(cgroupfd, MAX_PROG_IDS, BPF_CGROUP_DEVICE,
                                               ^~~~~~~~~~~~~~~~~
                                               VIR_CGROUP_DEVICE_RW
./util/vircgroup.h:200:5: note: 'VIR_CGROUP_DEVICE_RW' declared here
   VIR_CGROUP_DEVICE_RW    = VIR_CGROUP_DEVICE_READ | VIR_CGROUP_DEVICE_WRITE,
   ^
util/vircgroupv2.c:1811:22: error: no member named 'nr_map_ids' in 'struct bpf_prog_info'
       if (progInfo.nr_map_ids == 0) {
           ~~~~~~~~ ^
util/vircgroupv2.c:2043:36: error: use of undeclared identifier 'BPF_CGROUP_DEVICE'; did you mean 'VIR_CGROUP_DEVICE_RW'?
                        cgroupfd, BPF_CGROUP_DEVICE) < 0) {
                                  ^~~~~~~~~~~~~~~~~
                                  VIR_CGROUP_DEVICE_RW
./util/vircgroup.h:200:5: note: 'VIR_CGROUP_DEVICE_RW' declared here
   VIR_CGROUP_DEVICE_RW    = VIR_CGROUP_DEVICE_READ | VIR_CGROUP_DEVICE_WRITE,
   ^
util/vircgroupv2.c:2069:16: error: use of undeclared identifier 'BPF_DEVCG_ACC_MKNOD'
       ret |= BPF_DEVCG_ACC_MKNOD << 16;
              ^
util/vircgroupv2.c:2072:16: error: use of undeclared identifier 'BPF_DEVCG_ACC_READ'
       ret |= BPF_DEVCG_ACC_READ << 16;
              ^
util/vircgroupv2.c:2075:16: error: use of undeclared identifier 'BPF_DEVCG_ACC_WRITE'
       ret |= BPF_DEVCG_ACC_WRITE << 16;
              ^
util/vircgroupv2.c:2078:16: error: use of undeclared identifier 'BPF_DEVCG_DEV_BLOCK'
       ret |= BPF_DEVCG_DEV_BLOCK;
              ^
util/vircgroupv2.c:2080:16: error: use of undeclared identifier 'BPF_DEVCG_DEV_CHAR'
       ret |= BPF_DEVCG_DEV_CHAR;
              ^
util/vircgroupv2.c:2082:16: error: use of undeclared identifier 'BPF_DEVCG_DEV_BLOCK'
       ret |= BPF_DEVCG_DEV_BLOCK | BPF_DEVCG_DEV_CHAR;
              ^
util/vircgroupv2.c:2082:38: error: use of undeclared identifier 'BPF_DEVCG_DEV_CHAR'
       ret |= BPF_DEVCG_DEV_BLOCK | BPF_DEVCG_DEV_CHAR;
                                    ^
13 errors generated.

Jano

Attachment: signature.asc
Description: PGP signature


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]