This commit share host Real Time Clock device (rtc) into LXC containers to support hardware clock. This should be available setting up a `rtc` timer under clock section. Since this option is not emulated, it should be available only for `localtime` clock. This option should be readonly due to security reasons. Before: root# hwclock --verbose hwclock from util-linux 2.32.1 System Time: 1581877557.598365 Trying to open: /dev/rtc0 Trying to open: /dev/rtc Trying to open: /dev/misc/rtc No usable clock interface found. hwclock: Cannot access the Hardware Clock via any known method. Now: root# hwclock 2020-02-16 18:23:55.374134+00:00 root# hwclock -w hwclock: ioctl(RTC_SET_TIME) to /dev/rtc to set the time failed: Permission denied Signed-off-by: Julio Faracco <jcfaracco(a)gmail.com&gt; --- docs/formatdomain.html.in | 2 +- src/lxc/lxc_cgroup.c | 36 +++++++++++++++++++++ src/lxc/lxc_controller.c | 68 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 105 insertions(+), 1 deletion(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 4fef2a0a97..5598bf41b4 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -2465,7 +2465,7 @@ being modified, and can be one of "platform" (currently unsupported), "hpet" (libxl, xen, qemu), "kvmclock" (qemu), - "pit" (qemu), "rtc" (qemu), "tsc" (libxl, qemu - + "pit" (qemu), "rtc" (qemu, lxc), "tsc" (libxl, qemu - <span class="since">since 3.2.0</span>), "hypervclock" (qemu - <span class="since">since 1.2.2</span>) or "armvtimer" (qemu - <span class="since">since 6.1.0</span>). diff --git a/src/lxc/lxc_cgroup.c b/src/lxc/lxc_cgroup.c index 4ebe5ef467..6a103055a4 100644 --- a/src/lxc/lxc_cgroup.c +++ b/src/lxc/lxc_cgroup.c @@ -337,6 +337,42 @@ static int virLXCCgroupSetupDeviceACL(virDomainDefPtr def, VIR_CGROUP_DEVICE_RWM) < 0) return -1; + VIR_DEBUG("Allowing timers char devices"); + + /* Sync'ed with Host clock */ + if (def->clock.offset == VIR_DOMAIN_CLOCK_OFFSET_LOCALTIME) { + for (i = 0; i < def->clock.ntimers; i++) { + virDomainTimerDefPtr timer = def->clock.timers[i]; + + switch ((virDomainTimerNameType)timer->name) { + case VIR_DOMAIN_TIMER_NAME_PLATFORM: + case VIR_DOMAIN_TIMER_NAME_TSC: + case VIR_DOMAIN_TIMER_NAME_KVMCLOCK: + case VIR_DOMAIN_TIMER_NAME_HYPERVCLOCK: + case VIR_DOMAIN_TIMER_NAME_PIT: + case VIR_DOMAIN_TIMER_NAME_HPET: + case VIR_DOMAIN_TIMER_NAME_ARMVTIMER: + case VIR_DOMAIN_TIMER_NAME_LAST: + break; + case VIR_DOMAIN_TIMER_NAME_RTC: + if (!timer->present) + break; + + if (virFileExists("/dev/rtc")) { + if (virCgroupAllowDevicePath(cgroup, "/dev/rtc", + VIR_CGROUP_DEVICE_READ, + false) < 0) + return -1; + } else { + VIR_DEBUG("Ignoring non-existent device /dev/rtc"); + } + break; + } + } + } else { + VIR_DEBUG("Ignoring non-localtime clock"); + } + VIR_DEBUG("Device whitelist complete"); return 0; diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c index c3dec0859c..eba6bfe0bf 100644 --- a/src/lxc/lxc_controller.c +++ b/src/lxc/lxc_controller.c @@ -1550,6 +1550,71 @@ static int virLXCControllerPopulateDevices(virLXCControllerPtr ctrl) } +static int +virLXCControllerSetupTimers(virLXCControllerPtr ctrl) +{ + g_autofree char *path = NULL; + size_t i; + struct stat sb; + virDomainDefPtr def = ctrl->def; + + /* Not sync'ed with Host clock */ + if (def->clock.offset != VIR_DOMAIN_CLOCK_OFFSET_LOCALTIME) + return 0; + + for (i = 0; i < def->clock.ntimers; i++) { + dev_t dev; + virDomainTimerDefPtr timer = def->clock.timers[i]; + + switch ((virDomainTimerNameType)timer->name) { + case VIR_DOMAIN_TIMER_NAME_PLATFORM: + case VIR_DOMAIN_TIMER_NAME_TSC: + case VIR_DOMAIN_TIMER_NAME_KVMCLOCK: + case VIR_DOMAIN_TIMER_NAME_HYPERVCLOCK: + case VIR_DOMAIN_TIMER_NAME_PIT: + case VIR_DOMAIN_TIMER_NAME_HPET: + case VIR_DOMAIN_TIMER_NAME_ARMVTIMER: + case VIR_DOMAIN_TIMER_NAME_LAST: + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("unsupported timer type (name) '%s'"), + virDomainTimerNameTypeToString(timer->name)); + return -1; + case VIR_DOMAIN_TIMER_NAME_RTC: + if (!timer->present) + break; + + if (stat("/dev/rtc", &sb) < 0) { + if (errno == EACCES) + return -1; + + virReportSystemError(errno, + _("Path '%s' is not accessible"), + path); + return -1; + } + + path = g_strdup_printf("/%s/%s.dev/%s", LXC_STATE_DIR, + ctrl->def->name, "/rtc"); + + dev = makedev(major(sb.st_rdev), minor(sb.st_rdev)); + if (mknod(path, S_IFCHR, dev) < 0 || + chmod(path, sb.st_mode)) { + virReportSystemError(errno, + _("Failed to make device %s"), + path); + return -1; + } + + if (lxcContainerChown(ctrl->def, path) < 0) + return -1; + break; + } + } + + return 0; +} + + static int virLXCControllerSetupHostdevSubsysUSB(virDomainDefPtr vmDef, virDomainHostdevDefPtr def, @@ -2352,6 +2417,9 @@ virLXCControllerRun(virLXCControllerPtr ctrl) if (virLXCControllerPopulateDevices(ctrl) < 0) goto cleanup; + if (virLXCControllerSetupTimers(ctrl) < 0) + goto cleanup; + if (virLXCControllerSetupAllDisks(ctrl) < 0) goto cleanup; -- 2.20.1

There are a lots of strings being handled inside some LXC functions. They can be moved to g_autofree to avoid declaring a return value to get proper code cleanups. This commit is changing functions from lxc_{controller,cgroup,fuse} only. Signed-off-by: Julio Faracco <jcfaracco(a)gmail.com&gt; --- src/lxc/lxc_cgroup.c | 15 +++---- src/lxc/lxc_controller.c | 96 ++++++++++++++-------------------------- src/lxc/lxc_fuse.c | 23 +++------- 3 files changed, 44 insertions(+), 90 deletions(-) diff --git a/src/lxc/lxc_cgroup.c b/src/lxc/lxc_cgroup.c index 997a5c3dfa..d29b65092a 100644 --- a/src/lxc/lxc_cgroup.c +++ b/src/lxc/lxc_cgroup.c @@ -54,8 +54,7 @@ static int virLXCCgroupSetupCpusetTune(virDomainDefPtr def, virCgroupPtr cgroup, virBitmapPtr nodemask) { - int ret = -1; - char *mask = NULL; + g_autofree char *mask = NULL; virDomainNumatuneMemMode mode; if (def->placement_mode != VIR_DOMAIN_CPU_PLACEMENT_MODE_AUTO && @@ -66,21 +65,17 @@ static int virLXCCgroupSetupCpusetTune(virDomainDefPtr def, if (virDomainNumatuneGetMode(def->numa, -1, &mode) < 0 || mode == VIR_DOMAIN_NUMATUNE_MEM_STRICT) { - ret = 0; - goto cleanup; + return 0; } if (virDomainNumatuneMaybeFormatNodeset(def->numa, nodemask, &mask, -1) < 0) - goto cleanup; + return -1; if (mask && virCgroupSetCpusetMems(cgroup, mask) < 0) - goto cleanup; + return -1; - ret = 0; - cleanup: - VIR_FREE(mask); - return ret; + return 0; } diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c index 518967ee83..c580b17f5f 100644 --- a/src/lxc/lxc_controller.c +++ b/src/lxc/lxc_controller.c @@ -802,8 +802,7 @@ static int virLXCControllerGetNumadAdvice(virLXCControllerPtr ctrl, virBitmapPtr *mask) { virBitmapPtr nodemask = NULL; - char *nodeset = NULL; - int ret = -1; + g_autofree char *nodeset = NULL; /* Get the advisory nodeset from numad if 'placement' of * either <vcpu> or <numatune> is 'auto'. @@ -812,20 +811,17 @@ static int virLXCControllerGetNumadAdvice(virLXCControllerPtr ctrl, nodeset = virNumaGetAutoPlacementAdvice(virDomainDefGetVcpus(ctrl->def), ctrl->def->mem.cur_balloon); if (!nodeset) - goto cleanup; + return -1; VIR_DEBUG("Nodeset returned from numad: %s", nodeset); if (virBitmapParse(nodeset, &nodemask, VIR_DOMAIN_CPUMASK_LEN) < 0) - goto cleanup; + return -1; } - ret = 0; *mask = nodemask; - cleanup: - VIR_FREE(nodeset); - return ret; + return 0; } @@ -1434,9 +1430,8 @@ virLXCControllerSetupUsernsMap(virDomainIdMapEntryPtr map, */ static int virLXCControllerSetupUserns(virLXCControllerPtr ctrl) { - char *uid_map = NULL; - char *gid_map = NULL; - int ret = -1; + g_autofree char *uid_map = NULL; + g_autofree char *gid_map = NULL; /* User namespace is disabled for container */ if (ctrl->def->idmap.nuidmap == 0) { @@ -1450,28 +1445,23 @@ static int virLXCControllerSetupUserns(virLXCControllerPtr ctrl) if (virLXCControllerSetupUsernsMap(ctrl->def->idmap.uidmap, ctrl->def->idmap.nuidmap, uid_map) < 0) - goto cleanup; + return -1; gid_map = g_strdup_printf("/proc/%d/gid_map", ctrl->initpid); if (virLXCControllerSetupUsernsMap(ctrl->def->idmap.gidmap, ctrl->def->idmap.ngidmap, gid_map) < 0) - goto cleanup; + return -1; - ret = 0; - cleanup: - VIR_FREE(uid_map); - VIR_FREE(gid_map); - return ret; + return 0; } static int virLXCControllerSetupDev(virLXCControllerPtr ctrl) { - char *mount_options = NULL; - char *opts = NULL; - char *dev = NULL; - int ret = -1; + g_autofree char *mount_options = NULL; + g_autofree char *opts = NULL; + g_autofree char *dev = NULL; VIR_DEBUG("Setting up /dev/ for container"); @@ -1488,24 +1478,18 @@ static int virLXCControllerSetupDev(virLXCControllerPtr ctrl) opts = g_strdup_printf("mode=755,size=65536%s", mount_options); if (virFileSetupDev(dev, opts) < 0) - goto cleanup; + return -1; if (lxcContainerChown(ctrl->def, dev) < 0) - goto cleanup; + return -1; - ret = 0; - cleanup: - VIR_FREE(opts); - VIR_FREE(mount_options); - VIR_FREE(dev); - return ret; + return 0; } static int virLXCControllerPopulateDevices(virLXCControllerPtr ctrl) { size_t i; - int ret = -1; - char *path = NULL; + g_autofree char *path = NULL; const struct { int maj; int min; @@ -1521,7 +1505,7 @@ static int virLXCControllerPopulateDevices(virLXCControllerPtr ctrl) }; if (virLXCControllerSetupDev(ctrl) < 0) - goto cleanup; + return -1; /* Populate /dev/ with a few important bits */ for (i = 0; i < G_N_ELEMENTS(devs); i++) { @@ -1534,19 +1518,14 @@ static int virLXCControllerPopulateDevices(virLXCControllerPtr ctrl) virReportSystemError(errno, _("Failed to make device %s"), path); - goto cleanup; + return -1; } if (lxcContainerChown(ctrl->def, path) < 0) - goto cleanup; - - VIR_FREE(path); + return -1; } - ret = 0; - cleanup: - VIR_FREE(path); - return ret; + return 0; } @@ -2202,10 +2181,9 @@ virLXCControllerSetupPrivateNS(void) static int virLXCControllerSetupDevPTS(virLXCControllerPtr ctrl) { - char *mount_options = NULL; - char *opts = NULL; - char *devpts = NULL; - int ret = -1; + g_autofree char *mount_options = NULL; + g_autofree char *opts = NULL; + g_autofree char *devpts = NULL; gid_t ptsgid = 5; VIR_DEBUG("Setting up private /dev/pts"); @@ -2220,7 +2198,7 @@ virLXCControllerSetupDevPTS(virLXCControllerPtr ctrl) virReportSystemError(errno, _("Failed to make path %s"), devpts); - goto cleanup; + return -1; } if (ctrl->def->idmap.ngidmap) @@ -2239,26 +2217,20 @@ virLXCControllerSetupDevPTS(virLXCControllerPtr ctrl) virReportSystemError(errno, _("Failed to mount devpts on %s"), devpts); - goto cleanup; + return -1; } if (access(ctrl->devptmx, R_OK) < 0) { virReportSystemError(ENOSYS, "%s", _("Kernel does not support private devpts")); - goto cleanup; + return -1; } if ((lxcContainerChown(ctrl->def, ctrl->devptmx) < 0) || (lxcContainerChown(ctrl->def, devpts) < 0)) - goto cleanup; - - ret = 0; + return -1; - cleanup: - VIR_FREE(opts); - VIR_FREE(devpts); - VIR_FREE(mount_options); - return ret; + return 0; } @@ -2279,8 +2251,7 @@ virLXCControllerSetupConsoles(virLXCControllerPtr ctrl, char **containerTTYPaths) { size_t i; - int ret = -1; - char *ttyHostPath = NULL; + g_autofree char *ttyHostPath = NULL; for (i = 0; i < ctrl->nconsoles; i++) { VIR_DEBUG("Opening tty on private %s", ctrl->devptmx); @@ -2289,20 +2260,17 @@ virLXCControllerSetupConsoles(virLXCControllerPtr ctrl, &containerTTYPaths[i], &ttyHostPath) < 0) { virReportSystemError(errno, "%s", _("Failed to allocate tty")); - goto cleanup; + return -1; } /* Change the owner of tty device to the root user of container */ if (lxcContainerChown(ctrl->def, ttyHostPath) < 0) - goto cleanup; + return -1; VIR_FREE(ttyHostPath); } - ret = 0; - cleanup: - VIR_FREE(ttyHostPath); - return ret; + return 0; } diff --git a/src/lxc/lxc_fuse.c b/src/lxc/lxc_fuse.c index 44f240a0b5..8cfccdd7e0 100644 --- a/src/lxc/lxc_fuse.c +++ b/src/lxc/lxc_fuse.c @@ -40,8 +40,7 @@ static const char *fuse_meminfo_path = "/meminfo"; static int lxcProcGetattr(const char *path, struct stat *stbuf) { - int res; - char *mempath = NULL; + g_autofree char *mempath = NULL; struct stat sb; struct fuse_context *context = fuse_get_context(); virDomainDefPtr def = (virDomainDefPtr)context->private_data; @@ -49,16 +48,12 @@ static int lxcProcGetattr(const char *path, struct stat *stbuf) memset(stbuf, 0, sizeof(struct stat)); mempath = g_strdup_printf("/proc/%s", path); - res = 0; - if (STREQ(path, "/")) { stbuf->st_mode = S_IFDIR | 0755; stbuf->st_nlink = 2; } else if (STREQ(path, fuse_meminfo_path)) { - if (stat(mempath, &sb) < 0) { - res = -errno; - goto cleanup; - } + if (stat(mempath, &sb) < 0) + return -errno; stbuf->st_uid = def->idmap.uidmap ? def->idmap.uidmap[0].target : 0; stbuf->st_gid = def->idmap.gidmap ? def->idmap.gidmap[0].target : 0; @@ -71,12 +66,10 @@ static int lxcProcGetattr(const char *path, struct stat *stbuf) stbuf->st_ctime = sb.st_ctime; stbuf->st_mtime = sb.st_mtime; } else { - res = -ENOENT; + return -ENOENT; } - cleanup: - VIR_FREE(mempath); - return res; + return 0; } static int lxcProcReaddir(const char *path, void *buf, @@ -127,7 +120,7 @@ static int lxcProcReadMeminfo(char *hostpath, virDomainDefPtr def, { int res; FILE *fd = NULL; - char *line = NULL; + g_autofree char *line = NULL; size_t n; struct virLXCMeminfo meminfo; virBuffer buffer = VIR_BUFFER_INITIALIZER; @@ -229,7 +222,6 @@ static int lxcProcReadMeminfo(char *hostpath, virDomainDefPtr def, memcpy(buf, virBufferCurrentContent(new_meminfo), res); cleanup: - VIR_FREE(line); virBufferFreeAndReset(new_meminfo); VIR_FORCE_FCLOSE(fd); return res; @@ -242,7 +234,7 @@ static int lxcProcRead(const char *path G_GNUC_UNUSED, struct fuse_file_info *fi G_GNUC_UNUSED) { int res = -ENOENT; - char *hostpath = NULL; + g_autofree char *hostpath = NULL; struct fuse_context *context = NULL; virDomainDefPtr def = NULL; @@ -256,7 +248,6 @@ static int lxcProcRead(const char *path G_GNUC_UNUSED, res = lxcProcHostRead(hostpath, buf, size, offset); } - VIR_FREE(hostpath); return res; } -- 2.20.1

Native config files sometimes can setup cpuset.cpus to pin some CPUs. Before this, LXC was using a fixed number of 1 VCPU. After this commit, XML definition will generate a dynamic number of VCPUs based on that cgroup attribute. Signed-off-by: Julio Faracco <jcfaracco(a)gmail.com&gt; --- src/lxc/lxc_container.c | 23 ++++++++++++++++++ src/lxc/lxc_container.h | 2 ++ src/lxc/lxc_fuse.c | 4 ++-- src/lxc/lxc_native.c | 24 +++++++++++++++++-- .../lxcconf2xml-cpusettune.xml | 2 +- 5 files changed, 50 insertions(+), 5 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 3b1ac881ba..63b55c397d 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -2487,3 +2487,26 @@ int lxcContainerChown(virDomainDefPtr def, const char *path) return 0; } + + +int lxcContainerGetMaxCpusInCpuset(const char *cpuset) +{ + const char *c = cpuset; + int max_cpu = 0; + + while (c) { + int a, b, ret; + + ret = sscanf(c, "%d-%d", &a, &b); + if (ret == 1) + max_cpu++; + else if (ret == 2) + max_cpu += a > b ? a - b + 1 : b - a + 1; + + if (!(c = strchr(c+1, ','))) + break; + c++; + } + + return max_cpu; +} diff --git a/src/lxc/lxc_container.h b/src/lxc/lxc_container.h index 94a6c5309c..6f112e0667 100644 --- a/src/lxc/lxc_container.h +++ b/src/lxc/lxc_container.h @@ -63,3 +63,5 @@ virArch lxcContainerGetAlt32bitArch(virArch arch); int lxcContainerChown(virDomainDefPtr def, const char *path); bool lxcIsBasicMountLocation(const char *path); + +int lxcContainerGetMaxCpusInCpuset(const char *cpuset); diff --git a/src/lxc/lxc_fuse.c b/src/lxc/lxc_fuse.c index 70dc68ec85..dc888749bc 100644 --- a/src/lxc/lxc_fuse.c +++ b/src/lxc/lxc_fuse.c @@ -252,7 +252,7 @@ lxcProcReadCpuinfoParse(virDomainDefPtr def, char *base, break; if (curcpu > 0) - virBufferAddLit(new_cpuinfo, "\n", -1); + virBufferAddLit(new_cpuinfo, "\n"); virBufferAsprintf(new_cpuinfo, "processor\t: %zu\n", curcpu); @@ -268,7 +268,7 @@ lxcProcReadCpuinfoParse(virDomainDefPtr def, char *base, } } - virBufferAddLit(new_cpuinfo, "\n", -1); + virBufferAddLit(new_cpuinfo, "\n"); return strlen(virBufferCurrentContent(new_cpuinfo)); } diff --git a/src/lxc/lxc_native.c b/src/lxc/lxc_native.c index 02d2bf33e4..409bf00bd2 100644 --- a/src/lxc/lxc_native.c +++ b/src/lxc/lxc_native.c @@ -993,6 +993,24 @@ lxcSetCpusetTune(virDomainDefPtr def, virConfPtr properties) return 0; } + +static int +lxcGetVCpuMax(virConfPtr properties) +{ + g_autofree char *value = NULL; + int vcpumax = 1; + + if (virConfGetValueString(properties, "lxc.cgroup.cpuset.cpus", + &value) > 0) { + vcpumax = lxcContainerGetMaxCpusInCpuset(value); + if (vcpumax > 0) + return vcpumax; + } + + return vcpumax; +} + + static int lxcBlkioDeviceWalkCallback(const char *name, virConfValuePtr value, void *data) { @@ -1132,6 +1150,7 @@ lxcParseConfigString(const char *config, virDomainDefPtr vmdef = NULL; g_autoptr(virConf) properties = NULL; g_autofree char *value = NULL; + int vcpumax; if (!(properties = virConfReadString(config, VIR_CONF_FLAG_LXC_FORMAT))) return NULL; @@ -1155,10 +1174,11 @@ lxcParseConfigString(const char *config, /* Value not handled by the LXC driver, setting to * minimum required to make XML parsing pass */ - if (virDomainDefSetVcpusMax(vmdef, 1, xmlopt) < 0) + vcpumax = lxcGetVCpuMax(properties); + if (virDomainDefSetVcpusMax(vmdef, vcpumax, xmlopt) < 0) goto error; - if (virDomainDefSetVcpus(vmdef, 1) < 0) + if (virDomainDefSetVcpus(vmdef, vcpumax) < 0) goto error; vmdef->nfss = 0; diff --git a/tests/lxcconf2xmldata/lxcconf2xml-cpusettune.xml b/tests/lxcconf2xmldata/lxcconf2xml-cpusettune.xml index 6df089d00f..a1fec12d9b 100644 --- a/tests/lxcconf2xmldata/lxcconf2xml-cpusettune.xml +++ b/tests/lxcconf2xmldata/lxcconf2xml-cpusettune.xml @@ -3,7 +3,7 @@ <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> <memory unit='KiB'>65536</memory> <currentMemory unit='KiB'>65536</currentMemory> - <vcpu placement='static' cpuset='1-2,5-7'>1</vcpu> + <vcpu placement='static' cpuset='1-2,5-7'>5</vcpu> <numatune> <memory mode='strict' nodeset='1-4'/> </numatune> -- 2.20.1